A Fresh Look at Internal Audit Framework at the Age of Artificial Intelligence (AI)

With the rise of Artificial Intelligence (AI), industries embraced or are preparing to embrace its potentials. Financial industries, banking industry in particular, are unleashing and harnessing AI powers in various business lines and functional departments. However, similar to other initiatives, AI brings its own opportunities and challenges including various legal and compliance risks. Banks are required to understand this technology clearly and mitigate potential risks associated with the applications of these tools. Introducing sound and transparent measures to mitigate the potential risks entails new initiatives from various lines of defense within banks. In this paper, our focus is devoted to the third line of defense also known as Internal Audit (IA) function. As a current industry practice, effective challenges for different stages of an AI model from data access, collection and compliance, model development and validation, to the deployment and integration of the model within the established IT systems are performed by different teams within Internal Audit function. These teams do not necessarily look at the end-to-end process in a joint effort but rather perform in solos. This approach has successfully been running until today, however, with AI in place this approach will not be as effective and efficient as used to be. The main rationale underlying this statement is that with AI tools one cannot effectively challenge the data part of the model (or the IT deployment) without knowing sufficient information about the model. In this paper, we introduce a unified model-centric framework for Internal Audit function to enable the third line of defense to perform effective challenge for AI tools and technology in a smooth and unified way. In this approach, model team is responsible (not only for the model audit part), in collaboration with other teams, for the end-to-end audit process of AI tools