The IIA Related Content Interested in this topic? Visit the links below for more resources:
Visit The IIA's YouTube channel for related topics and more.
00:00:02 Speaker 1
The Institute of Internal Auditors presents all things internal audit tech. In this episode, Warren Stippich speaks with Ethan Rajani about the evolving role of Agentic artificial intelligence in internal auditing. They discuss how Agentic AI differs from traditional AI, its impact on risk assessment, and the skills internal auditors will need to adapt.
00:00:22 Speaker 1
They talk about the ethical considerations, automation of controls, testing, and the future of AI driven audit execution.
00:00:32 Speaker 2
Hey, so let's dive in here, Ethan.
00:00:35 Speaker 2
Glad to see you today and we'll have some fun with this conversation. So out of the gate, like to have a little discussion with you, Ethan and and some perspective. Can you give an explanation of what agentic AI is and how it differs from traditional AI systems?
00:00:52 Speaker 3
It's a great question, Warren. You know, it's it's a big topic in industry right now and you know, in short, agentic AI is kind of what we've all been thinking AI would be.
00:01:03 Speaker 3
You know, for many, many years it's it's that proactive artificial intelligence that has that ability to act. I mean, you know, let me give you my favorite analogy and then I'll go through some of the differences. You know, my favorite analogy is traditional AI is like a a good library. And, you know, you ask a question and it goes and it finds you the answer agentic AI is is more like an investigative journalist.
00:01:24 Speaker 3
Where it goes and seeks out information it binds, leads it makes decisions, and it comes back and it gives you that information that you know you could basically say, hey, go, go tell me what's going on.
00:01:34 Speaker 3
With Grant Thornton these days and you know it'll come in and we'll write a full article for you based on that rather than just kind of giving you an, you know, an answer, and it will make some decisions on your behalf as well. I think that's really something that differentiates it. But in looking at the differences between traditional AI and agentic AI, you know, there's there's several.
00:01:54 Speaker 3
Categories of differentiation. One of them is reactivity.
00:01:58 Speaker 3
Traditional AI tools like ChatGPT or Claude, which is, you know, tool that you can get on Amazon, which is, you know, part of anthropics.
00:02:07 Speaker 3
System. They're very reactive, right? You you ask a question, it comes back an answer and it could be a very good answer or it might not be totally correct. It will be, you know, like a human. It will make mistakes, but it's not very proactive versus agenta gay I.
00:02:20 Speaker 3
The other hand, they're very proactive, right? It might wake up in the morning and say, hey, Ethan, I know that you were looking at, you know, what's going on with Grant Thornton yesterday. I just want you to know, there's a NEWS UPDATE that I think you would find very interesting. Can I can I give that to you today because I know that that's something you were thinking about or, hey, Warren, I know that you're really interested, you know, in audit quality. I see that there's a new update for the audit.
00:02:42 Speaker 3
The innards board, or bias, updated its policies. Can we do a quick summary of those? So agentic AI is very proactive, just like a human being might be.
00:02:51 Speaker 3
And the other one is autonomy, and this is where it gets a little bit interesting, right? So, you know, again, traditional AIS like, ChatGPT, they're kind of, they're really limited to the questions that you post to it versus some of the new agentic AIS that are coming out. They have the ability to make decisions and actions on their own. It really gets a little bit scary and. And so we talked about the risks associated with that.
00:03:12 Speaker 3
Because there should always be a human in the loop at this point, but you know, we're starting to see AI is checking AI's. For example, we call those multi agent systems.
00:03:21 Speaker 3
But one of the areas where I think that there's a big difference, which really.
00:03:24 Speaker 3
He kind of gets me excited and interesting is that there's a goal orientation for agentic AI's, and this is something that I find to be super interesting. You can almost give the AI its own persona and say, you know, your goal is to be the best senior associate in internal audit possible, and you're going to review the work of.
00:03:46 Speaker 3
Some of the associates and we want you to understand how to lead walkthroughs, how to create flow charts, how to, you know do a.
00:03:52 Speaker 3
Investments and that AI is never going to give up that goal. It's going to be something that it continually works towards improving on its own versus a traditional AI. It doesn't have goals, it's just it's it's task oriented. It executes on tasks, but it doesn't really have a goal of where can I? Where can I take things in the future.
00:04:11 Speaker 3
They're both.
00:04:12 Speaker 3
Learning and adaptive, right? That's something that.
00:04:14 Speaker 3
Doesn't change. They both have reasoning right, they've they've been, they've built in some of the the reasoning responses, but again going back to that discussion around goal orientation and proactivity is that the agentic AI's have the ability to plan sequences of actions to achieve a goal on a short level. Going back to the analogy that I used.
00:04:36 Speaker 3
You know, a journalist. It's close to go out and collect information about complex topics and then to synthesize those into.
00:04:43 Speaker 3
Report versus AI is just going to give you a dump of information based on what it was able to uncover. I think the last area that I'll share that I think is a big difference which I find to be very interesting, is interaction with the environment. Right now the traditional AI's and you know large language models like GPT or cloud.
00:05:03 Speaker 3
They really do process static inputs, so it's a, you know, give and react system. I give them a question, it reacts back. I give it an idea.
00:05:11 Speaker 3
Reacts back the new agentic AIS can actually engage with external systems and modify their approach and their behaviors dynamically, and we're starting to see that in some of the autonomous vehicles that are out there where they can learn from experiences that it has driving on the road and it will modify that going forward. So you're starting to see that.
00:05:31 Speaker 3
You know kind.
00:05:31 Speaker 3
Of implementing in the real world with systems that have you know that can take multiple inputs. So visual inputs as well as you know written inputs. Large language models tend to be just for the most part written with some pictures.
00:05:45 Speaker 3
Versus now you're starting to see videos you're starting to see understanding of the weather for some of the new systems that are being, you know, developed for, you know, flight and and aerospace systems. So you know, those agents can actually interact with the environment. So those are very long winded answer for you there, Warren and and sorry for that. It's something I'm very passionate about. So we want to make sure that.
00:06:05 Speaker 3
Definitely talk through some of the differences.
00:06:07 Speaker 2
Yeah.
00:06:08 Speaker 2
Well, I appreciate you setting the stage on on essentially this definitional explanation on these two. And my question, what I'd like you to do now is take your crystal ball out and take the cover off of it, set it on the on the table. I know our listeners love data-driven answers and and and data-driven perspectives. And so I'd like to bring in the internal audit.
00:06:31 Speaker 2
Foundations vision 2035 research and report that was put up last year. If our listeners don't have it, go to the internal audit foundations web page and download a free copy.
00:06:45 Speaker 2
It has a lot of good information as we look to 2035, right, we look at the profession and and what are things that we're going to need as we go forward. So for you Ethan and and kind of the crystal ball point of view in our analysis and our research and our data, we had a series of questions around technologies and emerging technologies.
00:07:06 Speaker 2
One in particular relevant to this topic around AI is at 48% of our responders in the research.
00:07:14 Speaker 2
Are involved in AI activities and it's varying degrees of activities, but in some way, shape or form involved in active. In looking at artificial intelligence now, 48% is probably low, which is a a startling revelation, but maybe in some would say it's not that low.
00:07:19
In the east.
00:07:35 Speaker 2
Given where we are at the time the research was done in 2024 and as we move into 2025, OK, so here's the crystal ball question.
00:07:42 Speaker 2
For.
00:07:43 Speaker 2
How do you?
00:07:43 Speaker 2
See agentic AI transforming internal audit functions in the next 5 and five to 10 years as we look towards 2035.
00:07:53 Speaker 3
00:08:11 Speaker 2
OK.
00:08:14 Speaker 3
I would imagine that that 48% that's using AI, it's probably some of the traditional alms.
00:08:18 Speaker 3
ChatGPT among them. Such great tools. Right. They help you think through critical examples, they help you learn, right? It's like having a buddy there next to you. That's great, right? But what we're seeing coming down the Pike is just astounding.
00:08:33 Speaker 3
So I'll start with my.
00:08:33 Speaker 3
Favorite.
00:08:34 Speaker 3
One yeah, at the beginning of the year, we do a risk assessment, right, enterprise risk assessment.
00:08:38 Speaker 3
Into a lot of risk assessment, you know, financial controls risk assess whatever risk assessment you're doing. You do that at the beginning of the year for internal audit.
00:08:45 Speaker 3
And it's usually a, you know, a periodic, you know, type activity, maybe a survey, maybe a conversation, an interview. You know, maybe it's we're looking at policies and data and we're consolidating that into some risk assessment to drive whatever. Sometimes, you know for for internal audits, often what audits, are we going to do throughout the year and you know, how are we aligning the risk with the audit and making sure that we're addressing that.
00:09:07 Speaker 3
Appropriately and getting feedback from.
00:09:08 Speaker 3
Management agentic AI may flip this model on its head for the simple reason that rather than having to do a periodic audit, imagine having an AI that could sit there and monitor communications, have conversations with the executive team, have conversations with the people and field, you know, consolidate that information. We all interact with these API's on a consistent basis.
00:09:29 Speaker 3
And it knows what the.
00:09:30 Speaker 3
Concerns are you can read the emails that are coming in and going out. It can look at the transaction information that's going it's it's really moving to that continuous real time monitoring that we've been talking about for many years. But because it's so easy for these AI's now to take a look at this unstructured information as it's flowing around organizations, it can now begin to get.
00:09:51 Speaker 3
A sense of.
00:09:52 Speaker 3
What are some of these real risks, right? It can autonomously adjust risk scores. We can give it a risk model and say, hey, here's what our model is. And I can say, you know what, based on what I'm seeing coming out of our operations, we need to adjust.
00:10:03 Speaker 3
Additionally, it can you know, monitor for global threats, emerging anomalies, macroeconomic conditions. I mean they can incorporate a spectrum of data that we haven't been able to fathom for many years into that risk assessment and really help us hone in on what is a big issue, you know, and and as we started to see this happen, it's actually uncovered things that, you know, the humans.
00:10:24 Speaker 3
Wait.
00:10:25 Speaker 3
On the flip side of that, it sometimes gives us information that it thinks is a big issue because people are working very hard on it, but it's really not that big an issue. So a good example is, you know, some of the early API's in the agentic world that we've seen, they tend to take an outsized focus on on some of the compliance related activities that are critical, right, that we need to go do socks.
00:10:45 Speaker 3
We need to make sure that those financial controls are in place.
00:10:48 Speaker 3
However, from a perspective from an executive, as long as there's no material weaknesses, there's no significant deficiencies. Those are just normal course of business, things that need to be addressed.
00:10:57 Speaker 3
And the real?
00:10:57 Speaker 3
Risks need to be more operationally focused and I know that that's something that, you know, the AI is kind of moving toward is how do we help internal audit be more of the consultative partner that helps address some of the organizational risks.
00:11:10 Speaker 3
And you know.
00:11:11 Speaker 3
Try to make sure that we're spending the right amount of time on our.
00:11:14 Speaker 3
Clients. So let me pause there that that was one example. I think you've got like four or five more if you want to run through them.
00:11:19 Speaker 2
Yeah.
00:11:20 Speaker 3
Why don't I start with the one that's in use right now? It's it's automated control testing and exception handling. We have a tool called comply AI. It's going to be a second revision, you know, instead of auditing samples of vendor payments, you know we're able to ingest that data and we're able to optimize our control testing procedures right away.
00:11:41 Speaker 3
The future of that is going to be testing of 100% of transactions. We're targeting the end of the summer for automatically ingesting information and applying those control tests on a continuous.
00:11:51 Speaker 3
Basis the firm, you know? Grant Thornton, along with some of our our tech partners and banking partners, we released a A report last summer that was, you know, how to take advantage of 100% controlled testing. And you know how to think about exceptions and issues and detecting anomalies. So I'm certainly happy to, you know, go further into that. But I think that's that's one.
00:12:10 Speaker 3
Of the key.
00:12:11 Speaker 3
Use cases that we're seeing right now and folks love it because it minimizes that compliance burden and enables folks to focus more on business operations and operational audits. I think the other area that we're forecasting in our world.
00:12:25 Speaker 3
Is looking at intelligent anomaly detection. You know in that predictive risk forecasting we've been talking about this for so many years and there's some very niche tools that can do it in IT space you know think about crowd strike for example, there's some smaller tools that can do it in like the accounts payable space. If you think about some of the AP tools that are out there for managing that.
00:12:45 Speaker 3
But there's nothing that kind of thinks about it globally or holistic.
00:12:48 Speaker 3
And so overtime we're going to see some of that predictive risk forecasting happen with some of these agentic AI tools. A great example. You know you might see minor expense reimbursements. You know I remember we discovered this with a client governmental client a few years ago where there were $4.
00:13:08 Speaker 3
Charges. So you just, you know, charges right around $4.00. And remember, we did a forensic analysis of that and we uncovered that those charges were all named after the Grateful Dead, like. Well, that's really odd. It turned out it was a massive scale fraud that.
00:13:20 Speaker 3
Was being done in the micro level.
00:13:22 Speaker 3
Right, a I could do that in real time rather than having to do a whole forensic assessment cost thousands of dollars and takes hours and hours of time to do that. AI's can detect that as they're moving through, right? Hey, why is why is one of the great full dead doing $4.00 transactions every Tuesday, right. It's it's something that they would pick up on that a human might not. Maybe that would say the other one that I think.
00:13:42 Speaker 3
Be very, very interesting. You know, we were talking earlier about some of the, you know, concerns for, you know, humans, jobs being replaced. I don't think it's going to happen. I think it's just going to.
00:13:51 Speaker 3
Elevate the.
00:13:52 Speaker 3
Role that we do, I can see it at the point where we have, you know, AI driven audit execution and reporting, right, so.
00:14:00 Speaker 3
Where the agentic AIS can actually autonomously perform certain audit steps for us like data extraction issue, follow up right, there's no longer need to send an e-mail to our our folks in inventory, for example, because the agenda I realizes that there's something missing and it just sends an e-mail says hey, we noticed that you were missing this large item in.
00:14:20 Speaker 3
Inventory. What happened with?
00:14:22 Speaker 3
Right. So, you know, it's kind of moving away from that one time periodic audit. So just kind of keeping an eye on things throughout the year and restructuring that audit is something that's happening throughout the year that the agenda is keeping tabs on and giving us a report and letting us know if it's seeing something that's consistent or or an issue. So I think that's.
00:14:40 Speaker 3
Kind of you.
00:14:41 Speaker 3
Know where where I would say is.
00:14:42 Speaker 3
Kind of the next frontier. That's really like the what I would say is five to 10 years out where you have these AI's actually performing these audits on a continuous basis.
00:14:51 Speaker 3
You know, with input from the humans and coming back and reporting on things moving away from that periodic that periodic audit type idea.
00:14:58 Speaker 2
What I'd like to do now is is move on in that looking at the talent component and really in our in our vision 2035 analysis, we did a lot of research around what the profession is going to need in terms of technical capabilities and what will the internal auditor's background of the future hold probably different than what the internal auditor of the past.
00:15:19 Speaker 2
Has had in his or her college education and toolkit of expert.
00:15:24 Speaker 2
So with that stage set and thinking about that the, the talent preparation of future internal.
00:15:31 Speaker 2
What do you think those that are working in the world of agentic AI are going to need to have in terms of skills and capabilities?
00:15:39 Speaker 3
So that's a that's a great question, right? It's kind of funny, I see this changing dramatically with.
00:15:44 Speaker 3
Staff, you know, and the students that are coming out of college, I think that, you know, as you think about how it's going to become core to our operations as an organization as it will for everybody, some of the key competencies that we're going to be needing to think about, I call it AI literacy, we used to call it data analytics, one which I know that you're very familiar with. But in this case it's, you know, rather than having to.
00:16:04 Speaker 3
To actually write the structured SQL and to build the visualizations ourselves, it's going to be how do you interact with an AI to actually generate the information.
00:16:13 Speaker 3
That you need.
00:16:14 Speaker 3
To understand that right. So if.
00:16:18 Speaker 3
Said there's 3 or 4 core competencies that you really need to think about. 1 is a I fund amounts, which is.
00:16:25 Speaker 3
Are you working with? Are you working with a machine learning model? Are you working with an agentic AI? Are you working with something that generates analytics? So it's really just understanding the model itself. Do you have to be a coder? No, absolutely not. You just have to understand how they operate so you know in what capacity do you actually use the right AI? It's the right tool for the right job situation.
00:16:46 Speaker 3
Right. You know, you don't bring a hammer when you need a screwdriver at the same time, you don't use a machine learning tool when what you really need to do is that's something that proactively generates your risk assessments, which would be an.
00:16:56 Speaker 2
Yeah. Where do you think we'll go for talent? Where do you think the professional have to recruit?
00:17:00 Speaker 3
You know, I I think that it's going to come from within, to be honest. I think it's going to be a learning exercise. The the metaphor or the analogy that I always use is think about the conversion from basic ledgers, handwritten ledgers, to spreadsheets. There were some folks that just never got.
00:17:16
On board with.
00:17:17 Speaker 3
How to use a personal laptop and a spreadsheet? There will probably be some folks that just never get on board with how to work with the AI. However the vast.
00:17:24 Speaker 3
Majority of folks that.
00:17:25 Speaker 3
Were bookkeepers. When spreadsheets came online learned? They're like, hey, I need to know how to learn how to use a spreadsheet's going to be the future of our industry from an accounting perspective. And they.
00:17:36 Speaker 3
Learning so I think it's going to be a training exercise. It's going to be a generational shift in many ways. So colleges for sure going to do the training. But I think other organizations like the IAEA are going to be very, very fundamental to training folks how to use it.
00:17:50 Speaker 2
That's that's a a great layout of how you're thinking about it, and I know many of our fellow internal auditors and chief fought executives are are having these dialogue conversations right now as we go through this. So very relevant response.
00:18:07 Speaker 2
As we continue down the path of being very, very compliant oriented and strategic advisors and finding the balance there right in our vision 2035 analysis and report, we did a lot of research around where we're at today.
00:18:23 Speaker 2
On assurance or compliance work and and where advisory sits in today's plan, if you will and where do we need to go? What would be the ideal future? And so today we're at 676% doing assurance or compliance work and 24 percent doing advisory work. The ideal future based on our research, the respondents.
00:18:43 Speaker 2
Felt that assurance would come down to 59%, so kind of the compliance work would fall and advisory needs to increase to 41%.
00:18:52 Speaker 2
More so, that sets the stage for this question. As we look at the importance and and really the the request of stakeholders, management teams and even our own internal audit leaders for internal auditors to become strategic advisors in the future. How can agentic AI help auditors transition from compliance?
00:19:13 Speaker 2
Focus roles to more proactive advisory type positions.
00:19:18 Speaker 3
That's a good one. So a few ways, right. So obviously we talked about some of the automation of risk assessments, right. You know, one of the other areas that you know, there's there's a, there's 1000 use cases, right? And we're seeing this happen more and more consistently. So a lot of our major clients are looking at how to automate controls testing because it's compliance.
00:19:38 Speaker 3
Your.
00:19:39 Speaker 3
Because a lot of it is wrote in terms.
00:19:41 Speaker 3
Of it's it's.
00:19:42 Speaker 3
You know very consistent year to year, it does require some logic and some reasoning, but some of our tools like comply, I can automate a lot of that right now. There's other tools that are out there like and that can automate a lot of that work and.
00:19:54 Speaker 3
Start to bring that.
00:19:54 Speaker 3
Workload down and help managers, especially IA managers.
00:19:59 Speaker 3
Reorient their staff towards more business focused.
00:20:03 Speaker 3
So that's really, you know, the the big help is taking that workload down in the areas that they don't want. There was, there's been a very unusual side effect of that as we bring more AI to the table. One of the things that we've discovered is that it actually increases the satisfaction of employees with their jobs. They're happier to be doing the work that they're actually doing because they can use the AI.
00:20:24 Speaker 3
Tools to automate a large portion of the things that they don't like. We don't know about you more, but how many of us actually really enjoyed formatting our documents for grammar and consistency?
00:20:33 Speaker 3
It was one of those things that, you know, it was a former engineer.
00:20:35 Speaker 3
Myself, I really hated.
00:20:37 Speaker 3
That. Yeah. So you know now that AI can do that for me and it does it in seconds. And so, you know, that half hour of my day is now, you know, freed up for those things that I'm really interested in, which is going out and taking a look at what real risks are to the organization.
00:20:50 Speaker 2
So freeing up, freeing up the time of the assurance and compliance work by some of these tools is great. What's an example of where you think that identically I could plug into the strategic side of?
00:21:02 Speaker 2
What we do?
00:21:03 Speaker 3
Oh, that's a great one. How about I give you a good example of one that I actually you know.
00:21:07 Speaker 3
Know about Warren?
00:21:08 Speaker 3
So in this case, one of the big challenges for one of our retail clients was demand fluctuations, right? They they didn't understand, you know, where is the demand coming from? They're having hard time forecasting and they weren't sure.
00:21:24 Speaker 3
Exactly like how to correct for that issue, right? They need to be able to.
00:21:27 Speaker 3
Forecast budgets, but.
00:21:28 Speaker 3
Demand was kind of all over the place.
00:21:30 Speaker 3
And so, you know, internal audit stepped in and said why don't we do a an audit of the demand forecasting and we'll apply AI and see what happens. And you know what they discovered was that the AI tools were really good at not just helping with the compliance monitoring.
00:21:46 Speaker 3
Aspect but with.
00:21:47 Speaker 3
Also, you know helping to predict some of that.
00:21:49 Speaker 3
Customer demand fluctuation.
00:21:51 Speaker 3
Where was that inventory going to be needed? When was it going to be needed and it was an interesting side effect and it was really one of those things where like, wow, that's.
00:21:59 Speaker 3
A lot of just solved our biggest problem.
00:22:00 Speaker 3
Which was how do we actually help with demand forecasting? And it was a side effect of them coming in and doing an audit of something that had been a challenge for them many times. And you know, that's one of those areas where, you know, by being skilled in this space, that retail client was able to say into a lot of is truly business partner because they brought AI to a consistent problem that we've had for a long time.
00:22:20 Speaker 2
That that's a great a great example and I hope our listeners can can reflect on that a little bit and and apply it and broaden it to to other areas that might be relevant in their shops. I want to talk a bit about kind of the ethical and risk consideration aspect of this. So a little different perspective, a little different conversion.
00:22:38 Speaker 2
But auditors nonetheless, right? We're using these tools and we will use these tools. But how can auditors ensure that accountability and transparency and reliability is in place? Not necessarily, we're not lawyers, so I know we can qualify that and say now we're not going to get a legal response to this question.
00:22:57 Speaker 2
But let's get a practical answer for internal auditors. So Ethan?
00:23:01 Speaker 2
What do you?
00:23:02 Speaker 3
That's a great one. People always jump. There's there's three key risks that I'll talk about here. One of them is the one that everybody else thinks about, which is AI bias and data integrity. Right? AI learns from historical data. You can contaminate it. There can be biases in the data. There can be biases in the model. You know, if it's trained on flawed data it, you know, it can misinterpret risks or, you know.
00:23:22 Speaker 3
Prioritize controls. You know the way that you mitigate that, really, that bias is, you know, just regularly going back and checking the data that you have underlying for accuracy, fairness. You know, making sure you're removing it.
00:23:35 Speaker 3
And really, the biggest thing, and Microsoft is a great job talking about this in their, you know, responsible AI framework. It's they call it the human in the loop. But it's really human oversight. You cannot take the human out of the equation. And even with the genetic AI where there's reasoning capability, you still have to have a human look at the result. If that, say, it doesn't make sense, you know.
00:23:55 Speaker 3
There always has to be that human. That's that's the risk. Everybody always jumps to.
00:23:59 Speaker 3
You know from from an internal audit perspective, the one that I always see is the biggest risk from my perspective is the lack of explain ability. We are really good at about explaining why a problem is a problem, but when an AI finds a problem, it has a really hard time explaining why it's a problem. And so there's some new tools that are coming out. You know that help.
00:24:20 Speaker 3
Explain reasoning right. You can use reasoning models that show the steps that the AI went through to to accomplish its goal. You can look at detailed audit logs. That's really the risk mitigation and you can flag things you know to make sure.
00:24:33 Speaker 3
For, I don't think we've really figured out how to mitigate that risk really, really well yet. That's one that's still evolving and that's one that we're going to have to work with the technology companies to really help us, you know, remove that black box type issue.
00:24:47 Speaker 3
I think the.
00:24:48 Speaker 3
Third, big risk as an internal audit that I worry about is weakening our auditors judgment.
00:24:55 Speaker 3
You know, really over reliance on AI that just you know that that that makes me nervous every day as a as a principle. And so, you know, we don't want people blindly trusting. We don't want them to forget that there's there's a nuance to the risks that require human judgment. Right. And and not fully, you know the AI's don't fully understand the business context.
00:25:15 Speaker 3
Or the ethics associated with a given situation, so you know again that.
00:25:18 Speaker 3
Goes back to that human and.
00:25:20 Speaker 3
Loop solution. You need to make sure that there is a human that is reviewing the results of the AI.
00:25:25 Speaker 3
'S work right and.
00:25:27 Speaker 3
You know a great example. We do a lot of vendor risk management, right? If a if a, you know vendor gets flagged as low risk for example you know a seasoned auditor might realize like hey you know just because you flagged that vendor is low risk.
00:25:40 Speaker 3
I know what's going on in the market and I've had problems with this, you know, client in the past before and it's using bad data. We need to change that flag and make sure that this is more of a medium or high risk type.
00:25:51 Speaker 3
Vendor because you just have that experience that's been in place for many, many years. Yeah, I might not be able to explain it, but the human knows intuitively based on past experience, this is not a vendor that.
00:26:00 Speaker 3
We need to just trust blindly.
00:26:02 Speaker 2
Let's stay on that track of the human. OK, so everybody's thinking about this. I know our listeners are are thinking about this and and really the the whole world is thinking about this with this continuation around artificial intelligence, intelligence and the the the growth of this.
00:26:20 Speaker 2
What do you think about the human internal auditor role? Right. That role, is that role going to go away? Is that role going to be reduced? Will there be less internal auditors, less human internal auditors? What do you think is going to? Is it going to look like in three 5-10 years?
00:26:37 Speaker 3
That's always the tough question, right? I think everybody's always said, you know, will new technology replacement, will there be something?
00:26:44 Speaker 2
Different.
00:26:45 Speaker 3
You know, I think the analogy I use on this one is the Internet, right? The Internet came along. There were people that were out there, you know, Manning, you know, phone lines and doing data transfers. I mean, you know, for anybody that is an auditor, we remember that, you know, people used to take these big tape libraries as backups, and they used to, like, run them out to, like, a storage site, right, big physical issue.
00:27:05 Speaker 3
With the advent of the Internet and then subsequently cloud systems, there's no longer a human being that has to run those big tape backups from 1 system to another any longer, right? It automatically gets backed up that controls.
00:27:16 Speaker 3
Change.
00:27:17 Speaker 3
Similarly, with AI you know and and then again to your point Warren, this is Ethan taking out his crystal ball right in, in human history. You know, have people been replaced? Sure. But you know, has something better come along to help them adapt to that change. The answer is yeah. New jobs came along. You know, there were no network engineers.
00:27:37 Speaker 3
In 1985, right? But you know today there's thousands of them or hundreds of thousands of them that help maintain the Internet for the same degree. Is there an AI enabled internal auditor today? Well, to a limited degree. But is that role going to evolve into something that we've never even thought of?
00:27:53 Speaker 3
Probably, and I think it's going to be the AI. It's going to be the, you know organization like.
00:27:57 Speaker 3
The IRA, that's.
00:27:58 Speaker 3
Going to help folks kind of move into that new role, they're going to have to learn how to do something different, right? And adapt into that. You know, again, going back to that, we're going to train folks in AI fundamentals and.
00:28:09 Speaker 3
Have AI driven work.
00:28:10 Speaker 3
But I will say this for the early analysis that.
00:28:13 Speaker 3
We have done.
00:28:14 Speaker 3
And for folks taking, you know, adopting these tools, what we have found is that it is.
00:28:18 Speaker 3
Actually elevated their role to be more critical thinking and more problem solving, right? It's going to be a lot less of the documenting and defining and defending of our results and more of the how do we just move into the problem solving which is really where we want.
00:28:36 Speaker 3
To be anyway it's. It's where.
00:28:38 Speaker 3
Folks really want to spend their time. I think one thing that's also going to do Warren and this is going to be the most interesting piece as a discipline internal audit is going to have to become.
00:28:49 Speaker 2
Right.
00:28:50 Speaker 3
Right. No, we're no longer going to be just experts into audit, maybe financial and it we're going to have to know about operations. We have to know about, you know, FDA compliance, we're going to know about HIPAA. So it's going to be very interesting how we're going to have to evolve into a much.
00:29:04 Speaker 3
Broader knowledge base going forward.
00:29:06 Speaker 2
Probably have a little less optimism than you have in that in that response. That's probably the way to say it.
00:29:11 Speaker 2
And I'm an optimistic guy. You've worked with me for a long time.
00:29:14 Speaker 2
But the speed at with which this technology has advanced, when you look back over, you know the recent past, so 50 years, 70 years of history, even 100 years of technology, the speed of this technology advancement has been extremely fast. And so the other technology advancements I felt.
00:29:36 Speaker 2
Allowed and it just took a lot longer to perfect.
00:29:39 Speaker 2
And so there was a lot more gradually in the transition of automation to human and there was more time for for humans to to find meaningful roles and enhanced roles. My concern with this is that this.
00:29:52 Speaker 2
Is just so.
00:29:52 Speaker 2
Fast this agentic learning is so fast, this autonomous development is so fast.
00:29:57 Speaker 2
That the volume of work that that these tools may be able to take on, I worry that the gap that it's going to leave on the human side of the roles is going to be faster coming and large much larger to fill. So therefore, what where does that leave some of our internal auditors and and probably the answer is somewhere in the middle of me and you.
00:30:18 Speaker 2
But I certainly do think that everything you said around the skills and and and technical capabilities of of people looking to be in the profession needs to be wide and varied and has to have a very sharp eye to the advancement of all these technologies that you talked about.
00:30:34 Speaker 3
That's that's a great point. Yeah, maybe maybe I'm overly optimistic, but one thing to think about though, Warren and this is one of those things that I love about internal audit, the companies that have adopted the artificial intelligence tools wrap.
00:30:44 Speaker 3
Suddenly they're starting to see something interesting happen with their staff. Their staff are getting placed into executive or leadership roles within their organization because what the internal auditors end up learning isn't necessarily the core of how to do internal audits. It's the core of how to run the business and how to run it.
00:31:04 Speaker 3
Well, because they have to become those multidisciplinary experts where they're like, well, how do I do demand forecasting going back to the retail example, the internal auditor that ended up, you know, figuring that out, ended up going into the FP and a role to help with that demand forecasting and got placed into.
00:31:20 Speaker 3
A very high level role that normally would have taken four or five years in an MBA from a prestigious school and suddenly they were thrust into that role right away because they figured out how to do it very quickly. So I think, you know, there's there's some interesting learnings that are happening, which is now internal audit is no longer just a profession in and of itself. It's now a launching pad for.
00:31:40 Speaker 3
You know leadership, which is something that's really unique.
00:31:44 Speaker 2
And I do agree with that. I do agree with that, that comment and that sentiment. And I am seeing that as well in the.
00:31:49 Speaker 2
Market.
00:31:50 Speaker 2
What is the advice that you have for internal auditors who are skeptical about AI?
00:31:56
Well.
00:31:57 Speaker 3
You know, I think that.
00:31:58 Speaker 3
That's a very simple one.
00:32:00 Speaker 3
And that's just go play.
00:32:02 Speaker 3
There are lots and lots of avenues to play with AI tools for free.
00:32:07 Speaker 3
Every single vendor that's out there that's pushing.
00:32:09 Speaker 3
An AI tool will give.
00:32:10 Speaker 3
You pretty much a free instance of.
00:32:12 Speaker 3
It to work.
00:32:12 Speaker 3
With there's a few limited ones that won't, but you know the cheapest and easiest way to do it. If if you have not gone out and played with GPT.
00:32:21 Speaker 3
Or Claude or copilot, or any of the, you know, relatively inexpensive tools or free tools out there. Go out and play with it, see what it can do for you right at a very minimum. Try something different. Ask it to help you think about risks in the market relative to the organization that you're thinking about. You don't have to put any key data in there. I'm not saying go put organizational data. Don't put anything in the public models, right.
00:32:42 Speaker 3
We want to be sensitive to data, but start to think about how you can use these tools internally within your organization.
00:32:48 Speaker 3
I would say.
00:32:49 Speaker 3
That you know.
00:32:49 Speaker 3
You noted that 48% have already.
00:32:51 Speaker 3
Started working with.
00:32:52 Speaker 3
It I would be willing to bet that most organizations have opened up the ability to play with an AI tool somewhere within their organization that you can take advantage of.
00:33:02 Speaker 3
And you know within that model you should try it out and give it a shot and see what happens. You know, there's some great things out there that will make your life easier. One of my favorite ones, the tool that we use at Grant Thornton, called Slowdown.
00:33:14 Speaker 3
It will automatically build a flow chart in Visio based on a transcript from a walkthrough right? A very common thing that we as auditors do, we do walk through, we build a flow chart. We want to know what the process looks like. There's a lot of tools out there that will do that automatically now, and it will make your life so much better. I know about you, but I don't like drawing little boxes and arrows any longer.
00:33:34 Speaker 3
My old day ward.
00:33:36 Speaker 3
You know, I'm very happy to let a computer do that for me and.
00:33:39 Speaker 3
I can go make corrections on it so.
00:33:42 Speaker 2
Yeah, absolutely. And and and you know your your advice about go out and play with AI and get get exposed to it is spot on. I've been in the profession 35 years. So you know people can do math. The listeners can figure.
00:33:55 Speaker 2
Out that when.
00:33:56 Speaker 2
I went to.
00:33:56 Speaker 2
School.
00:33:57 Speaker 2
You know, I I grew up in my professional life very, very differently than the way.
00:34:02 Speaker 2
College graduates today are growing up, but I went out and and played with AI and and have done a number of different things in my personal life. Whether it's planning a trip.
00:34:11 Speaker 2
Yep, that used to take me, you know, a week on and off, back and forth to do a lot of research and loaded it into an AI engine. And you know, within 3 minutes spit out A7 day itinerary, very attuned to my my style. My approach must have searched where I like to Google and where I like to search.
00:34:32 Speaker 2
And hotels and restaurants and other things and certainly the IT it gives you that aha.
00:34:37 Speaker 2
When?
00:34:38 Speaker 2
When you see the speed at which this very accurate information comes back and it just saved an immense amount of time, I've also used it to help me with the slide preparation and getting ready for, for speeches and and preparing slides that normally would have taken a marketing department probably a week to create and and these slides are created in a matter of moments. So there's just a couple of examples.
00:34:59 Speaker 2
Where I've played around with it. To quote you, Ethan, and has given me certainly comfort and kind of that third dimensional feel.
00:35:06 Speaker 2
On what this can do, how this can help and when targeted and harnessed and deployed in the right way, identically, I can certainly help drive future success for all of us. So, you know, in closing, do you have any final remarks you'd like to leave the listeners with today, Ethan?
00:35:24 Speaker 3
Well, I think I think we kind of hit on that final remark. The one thing I will say is that you know it's an opportunity to learn. The one thing I would say about AI that I find the most fun.
00:35:33 Speaker 3
Is that it is like having your own personal professor right there with.
00:35:37 Speaker 3
You.
00:35:37 Speaker 2
It is, it really is.
00:35:39 Speaker 3
And so, you know, if anything, if you need to go play with it, set a goal for what you want to learn about. I never knew that I had an interest in molecular biology or physics, you know, especially as a career auditor myself. But it turns out that, you know, because I have clients that work in those spaces. It's it's a great learning tool and have some fun with it.
00:35:59 Speaker 3
Don't learn something fun. It will teach you and it will be like having a.
00:36:02 Speaker 3
Professor right there.
00:36:04 Speaker 2
Great conversation. Thanks, Ethan. Appreciate it.
00:36:06 Speaker 3
Thank you.
00:36:09 Speaker 1
Are you concerned about security in the age of AI joining the IAS 2025 analytics, automation and AI Virtual Conference on April 24th, you can hear from industry experts how cutting edge technologies transforming internal audit by securing your spot and registering today at thecia.org.
00:36:28 Speaker 1
If you like this podcast, please subscribe and rate US. You can subscribe wherever you get your podcasts. You can also catch other episodes on YouTube or at the iaa.org that's theia.org.
