From Pilot to Practice: How Internal Audit Functions Are Scaling GenAI

00:00:02 The IIA

The Institute of Internal Auditors presents All Things Internal Audit Tech.

00:00:06 The IIA

In this episode, we're moving past the hype and getting into what GenAI is actually doing inside internal audit functions right now.

00:00:13 The IIA

Not in theory, not in three years, but today.

00:00:17 The IIA

Doris Miles sits down with Neil White to talk through where the biggest efficiency gains are happening, how to pick the right use cases when everything feels urgent,

00:00:26 The IIA

and why most functions aren't failing at Gen.

00:00:28 The IIA

AI.

00:00:29 The IIA

They're just stuck.

00:00:30 The IIA

White shares the framework he uses to prioritize AI investments, why building a prompt library is the most underrated thing any function can do right now, and what he believes internal audit will look like in 10 years.

00:00:43 Doris Myles

Where are you seeing...

00:00:44 Doris Myles

Gen.

00:00:45 Doris Myles

AI create the biggest lift in internal audit today.

00:00:49 Doris Myles

And how do you advise leaders in deciding whether to bank those efficiency gains or reinvest them into broader assurance coverage?

00:00:58 Neil White

Doris, we're seeing so many areas where AI and Gen.

00:01:03 Neil White

AI can transform the internal audit process.

00:01:06 Neil White

wherever there is gravity and friction in this process, there is opportunity for us to deploy these capabilities against those areas which are drawing down on the attention of internal audit and taking us away from the things that I think we should be doing more of, which is greater levels of assurance, more interaction with our stakeholders.

00:01:26 Neil White

I am extremely excited and extremely positive on the impact that AI is going to have on internal audit.

00:01:34 Neil White

I have never seen in my career

00:01:36 Neil White

quite such a transformative capability put in the hands of auditors.

00:01:40 Neil White

And honestly, I will tell you, I say this a lot, it feels like this Gen.

00:01:44 Neil White

AI thing was purpose-built for internal audit.

00:01:47 Neil White

So I'm super excited to get into the topic today, and we can touch on lots of these areas.

00:01:50 Neil White

You asked a little bit about the gravity in the process.

00:01:52 Neil White

For me, around the risk assessment process, there's lots of opportunity.

00:01:56 Neil White

Around QAR, lots of opportunity.

00:01:59 Neil White

We already see many aspects around automation of documentation, announcement letters, reporting, audit committee

00:02:06 Neil White

be reporting where these capabilities are being applied at scale.

00:02:09 Neil White

I'm really excited actually to see where this goes as it relates to field work, as we're just starting to hit now on some of the applications and destruction data.

00:02:17 Neil White

But really, end-to-end across the internal audit lifecycle, we should be looking for these opportunities where we can apply that AI.

00:02:24 Neil White

And also, this is an opportunity for internal audit to rethink ways of working and reimagine how we audit today.

00:02:32 Neil White

So it's a very exciting place to be.

00:02:34 Doris Myles

I agree with you.

00:02:36 Doris Myles

You mentioned automation as it relates to reporting.

00:02:40 Doris Myles

So are we talking about report drafts or are we talking about something a little deeper?

00:02:47 Doris Myles

Is it a finished product?

00:02:49 Doris Myles

Are we closer to that?

00:02:50 Neil White

Yeah.

00:02:51 Neil White

Interestingly, we've been going through an evolution over the last two years.

00:02:54 Neil White

Obviously, greater, you know, more capable models have been coming into the marketplace every single day.

00:03:00 Neil White

A year ago, we were really focused on AI and prompting.

00:03:04 Neil White

engineering, now we're really talking about agentic.

00:03:07 Neil White

With the advent of these agentic capabilities, we have really exponentially increased our ability to get to very high quality outcomes in our work.

00:03:18 Neil White

So when you mention something like reporting, on the simplest end, I can have a very simple prompt that simply takes a finding and writes a report.

00:03:26 Neil White

But when you start to think about agentifying that, why wouldn't I also include in that an agent that can QA my report?

00:03:33 Neil White

Why wouldn't I also include in that an agent that reads in my audit methodology, my documentation expectations, perhaps old audit reports looking for prior similar issues.

00:03:44 Neil White

So not only are we creating simply an outcome, which is a report, but now we can start to bring the history back through there.

00:03:50 Neil White

We can start to bring quality up front.

00:03:52 Neil White

And this is where I think it begins to transform the process

00:03:56 Neil White

And we're aligning quality to every step of the internal audit process as opposed to waiting to the very end to go and do these things.

00:04:02 Neil White

So lots of opportunities around sort of reimagining.

00:04:05 Neil White

But for me, this is not about simply automating what we're doing today.

00:04:09 Neil White

This is about layering different GenAI capabilities onto these individual patterns, creating better outcomes for auditors, higher quality outcomes for auditors.

00:04:19 Neil White

So I will say in some cases, we get to very, very high quality outcomes with these agentic capabilities.

00:04:26 Neil White

Really excited.

00:04:26 Neil White

I mean, reporting is a great area, but I think there's many areas across the audit approach where this can be applied.

00:04:31 Doris Myles

That's fascinating.

00:04:32 Doris Myles

And I love that.

00:04:33 Doris Myles

And I'm looking forward to all of these capabilities being realized.

00:04:38 Doris Myles

But I know a lot of people are investing, but not a lot of people are in that transformation stage where what you've just discussed is actually what's happening in their department.

00:04:52 Doris Myles

Like what percentage would you say is fully leveraging

00:04:56 Doris Myles

those capabilities today.

00:04:59 Neil White

It depends a little bit by industry, I will say.

00:05:01 Neil White

So if you sort of split it by industry, you see financial services and the tech companies probably pushing ahead a little bit more quickly than other industries typically are.

00:05:10 Neil White

When you get into some of the more advanced functions in those tech and financial services industries,

00:05:15 Neil White

Maybe 30 to 40% have already realized the value from AI, meaning we're seeing where we've got five or more productionalized agentic capabilities already deployed within these functions, and so many have started to realize this tremendous sort of value out of the AI and have moved ahead very, very quickly.

00:05:35 Neil White

Others are a little slower on the uptake.

00:05:37 Neil White

And oftentimes, what we're really finding is it's not because internal audit doesn't have the desire or the vision or the capability, but we're perhaps being held back a little bit by the enterprise in many cases.

00:05:49 Neil White

And so deployment of the technologies that we need to build these capabilities are not where they need to be in order to get to some of these agentic structures.

00:05:58 Neil White

And so oftentimes, enterprise holds us back a little bit.

00:06:01 Neil White

But when I talk to internal audit functions about this,

00:06:04 Neil White

I feel that internal audit in particular has this opportunity to really lead on this issue of AI and automation and identification of process so that we can lead across the enterprise and become almost evangelical around these capabilities and begin to push the business.

00:06:20 Neil White

But at the same time...

00:06:22 Neil White

internal audit has this dual remit that you mentioned at the very beginning, which is, yes, we want to be able to use this effectively and we want to use this in a well-governed way.

00:06:31 Neil White

But at the same time, we're here to protect the business and make sure that the risks of AI do not impact the brand reputation or otherwise of the enterprises within which we're working.

00:06:40 Neil White

And so internal audit has a complicated role because of that.

00:06:43 Neil White

And it sort of behooves us to be even more on the front side of AI and its usage so that we understand the implications for the business.

00:06:51 Doris Myles

All right, thank you for that.

00:06:53 Doris Myles

Now, that paints the picture of like what's possible.

00:06:57 Doris Myles

So once you know what's possible, you still have to choose where you go first.

00:07:03 Doris Myles

So let's talk about prioritization decisions.

00:07:07 Doris Myles

And that's where a lot of internal audit functions are going to struggle and that's where they're going to get stuck.

00:07:12 Doris Myles

When you advise a client on picking Gen.

00:07:14 Doris Myles

AI use cases, what practical criteria do you use to balance business impact and speed to value with strategic alignment, scalability?

00:07:27 Doris Myles

Delivery complexity, data readiness, and ethical, legal, and reputational risk.

00:07:33 Doris Myles

I know that was like a multi-part, but I know you can handle it.

00:07:37 Neil White

I have to say, that is actually an excellent framework.

00:07:39 Neil White

I'd almost stick with exactly what you said there.

00:07:41 Neil White

That's a great prioritization framework.

00:07:43 Neil White

Part of this, yes, is about the prioritization framework.

00:07:46 Neil White

The other really important thing, not surprisingly, is what is that vision, mission, and North Star that's really driving this desire to use AI?

00:07:55 Neil White

Is it about efficiency, which I'll

00:07:57 Neil White

Tell you right now, many internal audit functions really are focused just on the efficiency side of things right now, but I'm actually more excited about what it means in terms of changing ways of working and how transformational it can be, but we've got to start small and achievable, so set that vision, set that mission.

00:08:14 Neil White

identify those use cases where the outcomes are relatively low risk and the data, we have confidence in the data that we're using in these models.

00:08:23 Neil White

And so something that is producing, say, an announcement letter or summarizing meeting notes for a walkthrough, things that the auditors can easily validate the outcomes, that's where we should be starting so that we can understand the overall accuracy and the quality and the impact of these things on a relatively small basis before we start stepping into more advanced

00:08:44 Neil White

techniques, retrieval, augmented generation, and the agentic capabilities.

00:08:49 Neil White

And oftentimes it does really help, and you articulated it particularly well, to have a decision framework so that we're prioritizing the right things.

00:08:57 Neil White

at the right time.

00:08:59 Neil White

And there's many of these frameworks out there today that people can leverage.

00:09:03 Neil White

We use a very simple one, which is desirability, viability, and feasibility.

00:09:08 Neil White

So we talk here about the, is it desirable?

00:09:11 Neil White

Is it going to have that impact and value to the group?

00:09:14 Neil White

Is it viable?

00:09:15 Neil White

Does it match to the company AI strategy?

00:09:19 Neil White

Are we aligned?

00:09:19 Neil White

Are we on strategy?

00:09:21 Neil White

Is it feasible?

00:09:22 Neil White

Is its complexity over and above what we're able to achieve?

00:09:25 Neil White

Or can we handle that level of complexity

00:09:27 Neil White

Effectively build and deploy something along with what's the reusability of some of these capabilities?

00:09:33 Neil White

How do we scale them out further?

00:09:35 Neil White

But starting simple, proving out the value, and I'll often say...

00:09:39 Neil White

that the no-regret project for any internal audit function to undertake is to build out that prompt library or that prompt registry that is incredibly cheap to build out, but can be incredibly powerful.

00:09:52 Neil White

And we've seen where internal audit functions with a well-situated prompt library can be saving anything up to 200 hours per audit.

00:10:00 Neil White

And I think that is just the tip of the iceberg on the savings.

00:10:03 Doris Myles

Yeah, I love that you brought up the prompt library.

00:10:07 Doris Myles

I know myself and my team

00:10:09 Doris Myles

That's one of the things that it seems like we're recreating the wheel every single time.

00:10:15 Doris Myles

It's like, oh, well, I had a prompt like that.

00:10:18 Doris Myles

And then it's like, we really need to organize this.

00:10:21 Doris Myles

So it sounds bad that, you know, we need to stick with the fundamentals.

00:10:27 Doris Myles

Let's start something.

00:10:28 Doris Myles

Let's maintain this library and let's leverage it across.

00:10:32 Doris Myles

So I love that you shared that.

00:10:35 Neil White

Yeah, look, I mean, not only because there's an efficiency play there,

00:10:39 Neil White

But think about those small prompts that you write eventually become the Lego building blocks of larger agentic structures.

00:10:47 Neil White

So once you prove the ROI of the basic individual prompt, so no regret, tons of value for doing the prompt library concept.

00:10:56 Neil White

I'm very, very supportive of that.

00:10:58 Doris Myles

So we have a sense of like how to pick the right use cases, but even when you pick the right use cases, you can still stall.

00:11:07 Doris Myles

And that's where we find

00:11:09 Doris Myles

Most people, it's not that they're failing, they're just kind of stuck.

00:11:14 Doris Myles

So let's talk about why that may happen.

00:11:18 Doris Myles

What are the most common reasons GenAI efforts in internal audit stall?

00:11:23 Doris Myles

Is it trust in outputs?

00:11:25 Doris Myles

Is it weak feedback loops or limited leadership alignment?

00:11:30 Doris Myles

There's also low adoption.

00:11:33 Doris Myles

And what change tactics have you found that actually work?

00:11:37 Neil White

Honestly, all very, very good points.

00:11:39 Neil White

Trust is going to be a major concern for senior leaders within the organization, audit committee board, especially given our reporting responsibilities there.

00:11:48 Neil White

So trust and quality is always going to be top of mind for internal audit.

00:11:53 Neil White

And if we can't get that consistently, that's going to cause challenges in terms of moving forward with the program.

00:11:59 Neil White

Adoption, again, that's a big challenge.

00:12:01 Neil White

Some people just

00:12:03 Neil White

haven't even prompted out, even in their personal lives, aren't even using ChatGPT.

00:12:09 Neil White

I'm not even sure how I get through a day without it, but I think that everybody needs to sort of push that.

00:12:14 Neil White

We can't be in a situation where people don't understand this.

00:12:17 Neil White

Again, think about that dual remit we talked about before.

00:12:20 Neil White

If I don't understand AI, how can I consult on risks around AI to the business?

00:12:24 Neil White

And so you've got to push through some of that.

00:12:26 Neil White

There is training.

00:12:27 Neil White

I think a lot of training is now coming on board.

00:12:30 Neil White

I think even things that are a little bit more informal

00:12:33 Neil White

in the training.

00:12:33 Neil White

And again, coming back to building your prompt library, we often talk about running promptathons, or some people call them hackathons.

00:12:40 Neil White

Yeah, promptathon's one of the newer ones we're talking about.

00:12:42 Neil White

Yeah, it's good, right?

00:12:44 Neil White

But think about the experience that the auditors get instead of going through and thinking about the architecture of a great prompt and thinking about their business and how can this disrupt and change and automate the things that they're doing.

00:12:56 Neil White

That is great training in and of itself going through that exercise.

00:12:59 Neil White

I keep going back to this no regret project to undertake because it has so many benefits at the end of the day in doing something like that.

00:13:06 Neil White

So certainly training is one of the ways to get over these adoption issues.

00:13:09 Neil White

That tone has to come from the top as well.

00:13:11 Neil White

Are we transforming?

00:13:12 Neil White

Are we driving forward on this initiative?

00:13:14 Neil White

But to be sure, for chief audit executives out there,

00:13:18 Neil White

We're not competing against AI one day.

00:13:21 Neil White

That is not the outcome that is going to happen here.

00:13:23 Neil White

We will be competing against other internal audit functions who have AI augmented auditors.

00:13:29 Neil White

That's what we're competing against in the marketplace today in this war for talent and capability.

00:13:34 Neil White

I don't see AI being this big sort of replacement of internal audit at any point in time.

00:13:39 Neil White

I see this being about performance and yield and capability and quality and extension of services.

00:13:45 Neil White

And I think if people can get behind that, you start to see it's just simply essential that we push the adoption issue, we move forward with the training, we upskill people, and you'll often hear me say, Whomever writes the best prompt wins, and fundamentally that means that we can...

00:14:00 Neil White

impress all of this experience into someone's iPhone or computer and their prompt, and they can garner the experience of pretty much any professional subject matter expert through those prompting of these large language models.

00:14:15 Neil White

So it's almost like it's also fun just doing this stuff.

00:14:19 Neil White

So get on board.

00:14:20 Neil White

Get on board.

00:14:21 Doris Myles

Yes.

00:14:22 Doris Myles

Now I want to talk about like the leadership alignment.

00:14:26 Doris Myles

So even though you may have a CAE

00:14:30 Doris Myles

that's really enthused about bringing Gen.

00:14:34 Doris Myles

AI in and embedding that into their team, they may be facing an executive that's very skeptical.

00:14:41 Doris Myles

So how do you balance that misalignment?

00:14:44 Doris Myles

How do you move past that when we know that this is where we are and where we need to be going as an audit function?

00:14:53 Neil White

It is a great question.

00:14:54 Neil White

We do see this very often where internal audit wants to move fast, but the enterprise is not willing to move at that pace.

00:15:02 Neil White

They're not willing to move with that agility.

00:15:05 Neil White

And that can be for a whole range of different reasons why enterprises aren't moving forward quickly.

00:15:10 Neil White

Some of it can be an issue of prioritization.

00:15:13 Neil White

Why would we focus as an enterprise on the risk function when we've got customers to serve and business to build?

00:15:19 Neil White

And so prioritization is often an issue.

00:15:22 Neil White

What I'm tending to recommend is that internal audit needs to have a seat at the table of those AI governance committees.

00:15:29 Neil White

They need to have a seat at the table where prioritization decisions are being made.

00:15:34 Neil White

And oftentimes, I will go and work with our clients and talk to their center of excellence for AI, and I'll educate them a little bit on what is risk and why does it matter to the enterprise.

00:15:45 Neil White

Because what you're dealing with is engineers who just want to build

00:15:49 Neil White

product.

00:15:49 Neil White

And so part of this might be education.

00:15:51 Neil White

Part of this might be helping them understand the value of what internal audit brings to the table and what that means in terms of brand and reputational protection for the organization.

00:16:01 Neil White

And then the other thing I tend to recommend is that don't go it alone.

00:16:05 Neil White

The internal audit function, other compliance and risk functions in the first and second line often have very, very similar outcomes they're trying to get to.

00:16:13 Neil White

So it's better to go as a party across the organization if you're happy to push things down through the COE

00:16:19 Neil White

you tend to find a lot more traction that way.

00:16:21 Neil White

But it's a little bit of hand-to-hand combat in terms of convincing people, bringing them along on the journey, and demonstrating our desire to move forward.

00:16:27 Neil White

And I'll go back and say one last thing.

00:16:29 Neil White

That's why I also think it's quite important to have that vision and North Star in your pocket so that you can articulate effectively to other senior executives in the organization.

00:16:38 Doris Myles

Yeah, I love that advice.

00:16:40 Doris Myles

But sometimes I think the pause, it has to do with trust in the outputs.

00:16:44 Doris Myles

So I know personally, I'm an auditor, so my credibility is my currency.

00:16:51 Doris Myles

And if GenAI produces something that's wrong or I can't rely on it, whatever the case may be, how do you help auditors build enough confidence in the output to actually use them without abandoning their professional skepticism?

00:17:08 Neil White

It starts with the ideation around what that use case desired outcome

00:17:14 Neil White

is and thinking about the what could go wrong up front and so that we're building those checks and balances and controls that we need into these agentic flows and into these models so that the outcome is more likely to be assured to align with what your expectations are.

00:17:33 Neil White

We also have to start to think about the development process as well.

00:17:37 Neil White

This is not just, once we start to get to these more complex reasoning models, your risk level does heighten, of course, at the end of the day.

00:17:46 Neil White

And so how do we ensure that we're monitoring model performance, we're monitoring model accuracy?

00:17:52 Neil White

How do we manage model drift as the underlying LLMs, the large language models, the brains underneath these capabilities, change every six to eight months as new models come into the marketplace?

00:18:03 Neil White

So there needs to be a little bit of an AI nuanced response to that to be able to deal with those trust issues.

00:18:09 Neil White

And there are ways I think internal audit should and could respond to that, not least of which is beginning to derive our own AI usage policy within internal audit.

00:18:19 Neil White

And I see today around 18, 20% of internal audit shops have already started to take the

00:18:25 Neil White

enterprise policy, derive their own AI usage policy, and are now starting to think, how does that impact my methodology and my QAR processes?

00:18:34 Neil White

And so going through a thoughtful process of how do we structure, how do we govern, how do we think about systems development life cycles and the AI nuances throughout that, for sure, it requires some new thinking.

00:18:46 Doris Myles

Yes, it does.

00:18:47 Doris Myles

I'm so excited about this.

00:18:49 Doris Myles

Like this time in our profession is so exciting to me.

00:18:53 Doris Myles

So let's say we've worked through the adoption challenges.

00:18:57 Doris Myles

You got leadership on board, your team is starting to trust the outputs.

00:19:02 Doris Myles

So the next frontier is really reliability, especially when the stakes are high.

00:19:08 Doris Myles

How do you design GenAI solutions so auditors can rely on them, especially for policy, contract, regulatory review, while keeping outputs grounded in the right evidence and

00:19:23 Doris Myles

And data sources.

00:19:24 Neil White

There are a range of complexities around this, but I'll break it down to the simplest 2 concepts that are absolutely essential to what you're talking about, and that is model explainability and model traceability.

00:19:37 Neil White

Those 2 components are going to be very important in any high reasoning models.

00:19:42 Neil White

Where an output is simply summarization of meeting notes or the preparation of an announcement letter from a set of risk categories, an internal auditor with the professional competency necessary can review that and know they're accurate.

00:19:54 Neil White

But when we get these higher reasoning models that are perhaps giving us the exceptions only to look at in our field work, there's a different level of reliance that we need to get from those models.

00:20:04 Neil White

And so this idea of model explainability is this idea that you have the model itself explain its reasoning on how it chose the samples it did or how it chose not to sample certain things.

00:20:16 Neil White

And then the traceability is that citation that goes straight back into the original source documentation, effectively creating a re-performance standard.

00:20:25 Neil White

Now, we're talking about a probabilistic world now.

00:20:28 Neil White

So re-performance is more like

00:20:31 Neil White

not necessarily like black and white, it is now very much this idea of confidence.

00:20:36 Neil White

So we'll hear more and more often in the way that we talk about these models, you'll start to hear about confidence in model outcomes, not necessarily did it get it right, did it get it wrong, but what's the confidence that it was accurate in its response.

00:20:48 Neil White

But ultimately, traceability, explainability, that's how we're really focusing on getting reliance on these models.

00:20:54 Doris Myles

I love that.

00:20:55 Doris Myles

So you're describing what sounds like a significant

00:21:00 Doris Myles

design investment upfront, like you're going to curate those data sources, you got to build in the feedback loops, and you got to validate those outputs.

00:21:10 Doris Myles

So for an internal audit function that's trying to move quickly, how do you balance the setup rigor with the urgency to show results?

00:21:18 Doris Myles

Now, yesterday.

00:21:19 Neil White

Let me maybe reset this question and say there's three patterns that we build in today, right?

00:21:23 Neil White

We do prompt engineering, that's basically prompt response and query, follow up, etc.

00:21:28 Neil White

We have the retrieval augmented generation models.

00:21:31 Neil White

That's where we're using some level of infrastructure underlying data storage to enable these models that consume specific data and respond against that specific data.

00:21:41 Neil White

And then we have the agentic models that we're building in today.

00:21:44 Neil White

With the simple prompt-based models, there's a greater onus on the auditor to understand quality, to understand outcome versus expectation, because you're not able to build that human in the loop effectively in a simple prompt.

00:21:58 Neil White

When you start to stage these capabilities like RAG models, retrieval augmented generation, and agentic into applications, there you're able to build very specific workflow into those applications so that you can have human in the loop producing higher quality results or human over the loop reviewing the results of the models and being able to get comfortable with what's being pushed all the way through.

00:22:20 Neil White

When we build these capabilities today, we're literally building an agentic structure with an agent built into it, which is reading methodology, reading documentation guidance, and documentation expectation, and performing a level one review.

00:22:34 Neil White

And oftentimes, we'll split these between different models.

00:22:37 Neil White

We may use an advanced reasoning model to perform an evaluation of our controls or a testing outcome.

00:22:44 Neil White

And then we'll use a smaller flash model or a small language model to then go back and say, I understand what the testing strategy was.

00:22:51 Neil White

I understand what the document and data model was that you were going to use.

00:22:54 Neil White

Did you do all those things correctly?

00:22:55 Neil White

And can you conclude effectively on these results?

00:22:58 Neil White

And it will then conclude with a level of confidence again on how confident it is that you did the models, in this case, did everything correctly.

00:23:05 Neil White

So you've almost got this sort of models reviewing models world, which I think is where we're ultimately going to go eventually.

00:23:11 Neil White

And frankly, if I was in the business today, I would probably have an agent model called Internal Auditor that sat on my desk and I would run them against all the work papers before I handed

00:23:20 Neil White

anything over.

00:23:21 Neil White

So I think that's the world we're sort of heading into, all of these agents working to the betterment of risk and assurance across the enterprise.

00:23:28 Doris Myles

Yeah, thank you for making something that's technical, very simple.

00:23:33 Doris Myles

So for auditors that are early on in their journey, they can follow, they can understand, so they know what they need to push on from their leadership to get to where they need to be.

00:23:45 Doris Myles

So we've talked about where GenAI is working.

00:23:50 Doris Myles

We've talked about picking the right use cases, what makes adoption succeed, and how to build for reliability.

00:23:58 Doris Myles

So the final frontier is scale.

00:24:01 Doris Myles

But most internal audit functions are doing pilots.

00:24:05 Doris Myles

There are few internal audit departments that are truly in that transformation stage.

00:24:13 Doris Myles

What does it take to scale GenAI for function-wide impact in internal audit, and what foundations should leaders prioritize first?

00:24:23 Neil White

We're still in the discovery phase right now of this journey, which I think is going to be a decade's long.

00:24:29 Neil White

In fact, I would say we're now on this infinite innovation loop that I never see stopping, to be perfectly honest with you.

00:24:36 Neil White

So we're in the very early stages.

00:24:38 Neil White

We're still trying to understand, is this about efficiency gain?

00:24:41 Neil White

Is this about scaling assurance services?

00:24:44 Neil White

Is this about quality outcomes?

00:24:45 Neil White

Is this about how we interact or how we change ways of working?

00:24:49 Neil White

Right now, everyone's focused on efficiency.

00:24:52 Neil White

Understandably, right?

00:24:54 Neil White

Because let's see if we can free up some time and we can focus.

00:24:58 Neil White

we used to have that saying, do more with less all the time in internal audit, which I find very annoying.

00:25:02 Neil White

It's like, now it's the first time when we have the capability to harvest hours and then reuse these hours in other areas of the audit.

00:25:09 Neil White

And that's how most people are responding.

00:25:11 Neil White

That is stage one.

00:25:12 Neil White

I think the next stage of this is transformation of our services through these agentic structures.

00:25:18 Neil White

And then beyond that, I think we completely reimagine audit.

00:25:22 Neil White

I will posit that in 10 years, audit looks almost unrecognizable to how it is today.

00:25:28 Doris Myles

Wow.

00:25:29 Doris Myles

Who would have thought after SOX came into our lives that we'd be where we are talking about all of these tools that can help us audit more efficiently and faster?

00:25:41 Doris Myles

I want to ask you one final question.

00:25:44 Doris Myles

For the internal audit leader who's listening right now, what is the one thing you would tell them to do first?

00:25:53 Neil White

To get on this path, we need to understand the vision, the mission, the North Star.

00:25:57 Neil White

That's really where to start.

00:25:58 Neil White

How do you want to deploy this?

00:26:00 Neil White

To what end are you deploying this?

00:26:02 Neil White

How does that align to the corporate strategy?

00:26:05 Neil White

Understanding where we are from a corporate strategy perspective.

00:26:08 Neil White

And then of course, we have that dual remit to help the organization navigate the risks as we go through here.

00:26:14 Neil White

And so to me, this is about sort of engaging at the enterprise level, getting that seat at the table, being part of the discussion, helping

00:26:23 Neil White

for the enterprise to understand the role and the importance of what internal audit can do in this whole transformational journey.

00:26:28 Neil White

I really see us being out there, you know, not to slow down the process, but to have the right sort of brakes on that process so that we can move as fast as we possibly can through this great AI journey so that we're taking full advantage of it.

00:26:39 Neil White

So I think it's about mission, vision, seat at the table, and being part of the dialogue on AI.

00:26:46 Doris Myles

I love all the nuggets that you have shared.

00:26:49 Doris Myles

I'm sure everybody's going to appreciate that.

00:26:51 Doris Myles

But Neil, you've spent two decades helping internal audit functions kind of see around the corner, first with analytics and now with AI.

00:27:01 Doris Myles

And to everyone listening, I hope this conversation gave you at least one thing you can act on, maybe two or three.

00:27:09 Doris Myles

But Gen.

00:27:10 Doris Myles

AI is not a future problem.

00:27:12 Doris Myles

It's a right now opportunity.

00:27:14 Doris Myles

And the leaders who treat it that way, they're going to redefine what their audit shops look like.

00:27:20 Doris Myles

Neil, I can't thank you enough for your time, your candor, and for making this so practical.

00:27:27 Doris Myles

We really appreciate you sharing those nuggets with us today.

00:27:31 Neil White

Oh, Doris, thank you.

00:27:31 Neil White

This has been a lot of fun for me too.

00:27:33 Neil White

Thanks very much.

00:27:35 The IIA

If you like this podcast, please subscribe and rate us.

00:27:38 The IIA

You can subscribe wherever you get your podcasts.

00:27:40 The IIA

You can also catch other episodes on YouTube or at the iia.org.

00:27:45 The IIA

That's T-H-E-I-I-A dot O-R-G.