Governance must be nimbler than ever
Executive summary
AI promises dramatically increased productivity, but the resulting compliance challenges can confound existing systems. Fortunately, AI can help solve the challenges it has created. A well-designed, AI-driven approach can provide real-time monitoring of even the most complex and dynamic systems.
Introduction
AI can evaluate transactions, make recommendations and generate documentation at an unprecedented speed. This can lead to transformative levels of productivity and enable real-time compliance monitoring of even the most robust systems.
But a fast-moving system poses its own challenges, especially for service firms.
“The prevalence of automation and the emergence of AI have changed the game,” said Fred Kohm, who leads Grant Thornton’s Services Industry practice. “A smaller player may move quickly but neglect governance. At a larger firm, one stumble could endanger reputational equity. For these reasons, all service firms need to be thinking about what governance means for them going forward.”
A traditional world undergoing rapid change
When reputation is essential, governance becomes crucial.
Reputation is especially important to service firms. Some have licensing, certification and reporting requirements. Some act as fiduciaries. Some have defined standards of care that inform definitions of malpractice. But all seek to cultivate trust.
Grant Thornton Risk Advisory Managing Director D. J. Rossini explains what this process looks like in the legal profession.
“There are model rules of ethics they must adhere to, which require lawyers to be responsible for everything they publish and everything that goes on under their supervision, responsibility and authority,” Rossini said. “So the question becomes: ‘Where is any particular piece of information coming from? Is it accurate?’”
AI and automation have a profound effect on how service firms do business. They enable far more transactions than any human — or even a reasonably sized team of humans — can oversee. If the associated risk is managed by responsible governance, there is an opportunity for elevated productivity and revised pricing structures.
Absent effective governance, the risks are profound. The inclusion into briefs of legal cases that did not exist — the cases were hallucinated by AI — dramatized these risks early on.
“While law firms face particular public scrutiny, similar issues arise with all service providers — consulting firms, engineering firms and staffing firms,” Kohm said. “If you’re going to use AI for a particular project for a client, but you aren’t double-checking the source of the information, you run into the same issue.”
The need for frameworks and expertise
Broadly speaking, service firms need both a durable framework that reflects the best practices for integrating new technologies and a reliable partner with experience in these processes.
Experience in AI engagements is especially valuable in an area that is quickly changing and where client expertise may be limited. Kohm explains what expertise looks like in this context: a broad knowledge of best practices, cutting-edge technology, and relevant regulations; and an ability to identify quick wins, define priorities, estimate ROI and sketch a roadmap to implementation.
Grant Thornton Risk Advisory Partner Ethan Rojhani suggests a third requirement — one that is unique to AI.
“The fundamental disconnect we’re seeing with governance is you have humans trying to govern an autonomous AI system,” Rojhani said. “Where you’re seeing things come off the rails is humans cannot respond as quickly. Even if you have 1,000 humans, they cannot respond quickly enough to regulate an AI system.”
He added: “Do you need an independent AI system to help govern the other AI systems? Do you give it the guardrails? Do you give it all of the things that you would give a human governance system so that it can regulate independently as well?”
Rojhani acknowledges that “there’s no magic bullet. However, the Microsoft Responsible AI framework is one of the more robust frameworks out there.” This human-in-the-loop approach proposes checkpoints where a decision-maker reviews regulated or high-impact recommendations before they are implemented. Examples of such inflection points include a suggested hiring decision or a proposed engineering design.
Unregulated decisions, on the other hand, such as what advertisements to run or what content to display are subject to minimal oversight. AI has considerable power here to autonomously implement and autonomously evolve a strategy.
And that raises the question of the role of auditing.
Automating the auditors, auditing the automation
Of course, auditing is at the core of governance. How does AI change that role?
Some new questions arise. “How do you audit an algorithm? If you can test everything all the time, what does that mean for audit? What does that infrastructure look like?” Rojhani asked. “What role do external and internal auditors play in such an environment?”
A June 2024 white paper, co-produced by Grant Thornton and by the AICPA Assurance Services Executive Committee, charted an approach to automated auditing. The paper weighs full-population control testing vs. sample-based testing and considers what may support “a well-designed CTA program that tests the full population in a given period.”
Relevant factors spelled out in “Control test automation: From manual testing to use of technology” include the presence of objective or clearly defined controls, the homogeneity of tested populations, the completeness of population and the accuracy of data. Parameters that must be addressed include the frequency of testing, acceptable deviations and failure rates, risk tolerances, definitions of materiality, choice of technologies and conformance to larger governance principles such as transparency and accountability.
Cultural implications also result from the 100% oversight AI enables. Rojhani asks, “Is that something you want? Maybe, it might be. If you have a culture that’s pretty lax and you need to drive some discipline, ramped-up oversight actually might not be a bad thing. But it’s one of those big questions that you have to ask.”
Note that this is fundamentally different from automating transactions. In the case of automation, technology performs an action — say data entry. In the case of AI, technology evaluates that action. In some cases, that means a machine evaluating a human action. Accepting this may require some cultural change.
AI’s ability to evaluate transactions and make decisions is also useful in applications that are fast-moving, numerous, multi-lingual and decentralized. One example is managing compliance with standards for advertising that vary by jurisdiction or need to be applied on a case-by-case basis — such as a prohibition on displaying cigarette ads to people who have entered “smoking cessation” as a search term. But ultimately, there are as many business cases for using AI in governance as there are businesses.
Where to start?
Given these challenges, just getting started can be daunting. But the first step is often quite straightforward: taking inventory of your current state. AI has been incorporated so quickly and quietly into so many applications that many compliance executives may not have a firm understanding of how it is being used. Once they gain clarity about where they are, the possibilities for moving forward are exhilarating.
Key takeaways
- AI can act more quickly than human governance systems can respond. Absent effective governance, the risks are profound.
- The importance of reputation to service firms makes governance especially critical for them.
- Given the speed of change, firms are looking for partners with knowledge of best practices, cutting-edge technology and relevant regulations — and an ability to identify quick wins, define priorities, estimate ROI and sketch a roadmap to implementation.
- Fortunately, AI can enable real-time compliance monitoring that serves as a check for other AI-related risks.
- The frameworks for the use of real-time, AI-facilitated monitoring are just emerging. They need to consider the nature of controls, the population and the data. Designs should address frequency of testing, acceptable deviations and failure rates, risk tolerances, definitions of materiality, choice of technologies and conformance to larger governance principles.
Contacts:
Head of Services Industry
Partner, Risk Advisory Services
Grant Thornton Advisors LLC
Frederick Kohm, Jr. is the Head of the Services industry and a Risk Advisory Principal based in the Philadelphia office.
Philadelphia, Pennsylvania
Industries
- Insurance
- Energy
- Services
Service Experience
- Advisory Services
Partner, Risk Advisory Services
National Hospitality Industry Leader
Grant Thornton Advisors LLC
Joann is a partner in our Advisory Services practice, based in Arlington, VA and also leads Grant Thornton’s National Hospitality Industry, supporting all lines of service including audit, tax and advisory
Arlington, Virginia
Industries
- Construction & Real Estate
- Healthcare
- Technology, Media & Telecommunications
Service Experience
- Advisory Services
Partner, Risk Advisory Services
Grant Thornton Advisors LLC
Mr. Rojhani is a Partner in Grant Thornton’s Risk practice with experience leading the full lifecycle of risk management and consulting engagements.
Managing Director, Risk Advisory Services
Grant Thornton Advisors LLC
D.J. Rossini has more than 25 years of experience leading investigations and directing complex compliance projects.
Chicago, Illinois
Industries
- Financial Services
- Healthcare
- Life Sciences
- Construction & Real Estate
- Insurance
- Manufacturing, Transportation & Distribution
- Services
Service Experience
- Risk Advisory
- Regulatory compliance
- Forensics, investigations and disputes
- Anti-money Laundering & Economic Sanctions
- Cybersecurity & Privacy
Content disclaimer
This Grant Thornton Advisors LLC content provides information and comments on current issues and developments. It is not a comprehensive analysis of the subject matter covered. It is not, and should not be construed as, accounting, legal, tax, or professional advice provided by Grant Thornton Advisors LLC. All relevant facts and circumstances, including the pertinent authoritative literature, need to be considered to arrive at conclusions that comply with matters addressed in this content.
Grant Thornton Advisors LLC and its subsidiary entities are not licensed CPA firms.
For additional information on topics covered in this content, contact a Grant Thornton Advisors LLC professional.
Tax professional standards statement
This content supports Grant Thornton Advisors LLC’s marketing of professional services and is not written tax advice directed at the particular facts and circumstances of any person. It is not, and should not be construed as, accounting, legal, tax, or professional advice provided by Grant Thornton Advisors LLC. If you are interested in the topics presented herein, we encourage you to contact a Grant Thornton Advisors LLC tax professional. Nothing herein shall be construed as imposing a limitation on any person from disclosing the tax treatment or tax structure of any matter addressed herein.
The information contained herein is general in nature and is based on authorities that are subject to change. It is not, and should not be construed as, accounting, legal, tax, or professional advice provided by Grant Thornton Advisors LLC. This material may not be applicable to, or suitable for, the reader’s specific circumstances or needs and may require consideration of tax and nontax factors not described herein. Contact a Grant Thornton Advisors LLC tax professional prior to taking any action based upon this information.
Changes in tax laws or other factors could affect, on a prospective or retroactive basis, the information contained herein; Grant Thornton Advisors LLC assumes no obligation to inform the reader of any such changes. All references to “Section,” “Sec.,” or “§” refer to the Internal Revenue Code of 1986, as amended.
Grant Thornton Advisors LLC and its subsidiary entities are not licensed CPA firms.
Trending topics
No Results Found. Please search again using different keywords and/or filters.
Share with your network
Share