How Audit Committees Can Get Involved with GenAI Adoption

Generative artificial intelligence (genAI) technology is evolving at a rapid pace; the capabilities today far outpace the capabilities of one year ago and an increasing number of companies are exploring ways genAI can be used to expand business offerings and improve efficiency. While some companies may be hesitant to embrace genAI given the new risks that can arise from the use of an emerging technology, the bigger risk for companies is not engaging with this new tool at all.

In a recent joint Center for Audit Quality (CAQ) and Deloitte survey, 33 percent of audit committee respondents indicated that finance transformation is a top-three priority for their audit committees in the next 12 months, and almost half of those respondents (15 percent of total survey respondents) selected finance transformation as the top issue. GenAI can play a pivotal role in this transformation, and, in turn, audit committees can play an important role in encouraging management to embrace and responsibly adopt genAI. The message is clear: now is the time to act.

For audit committees, it may be hard to know where to begin. In a webinar organized by the CAQ and NACD in October, Richard Jackson, global artificial intelligence assurance leader at EY; Cory Hrncirik, Modern Finance lead at Microsoft Corp.; and Tom Petro, managing partner of 1867 Capital Partners and an audit committee member discussed actionable steps that audit committees can take to champion responsible genAI adoption at the companies they oversee. Below are our top three takeaways for audit committees from the event.

1.  Governance: Oversee management’s approach to a responsible AI framework and use policies.

A fit-for-purpose AI governance strategy is foundational to effectively implement genAI throughout the company. It is management’s responsibility to develop a framework and policies to ensure the safe and responsible adoption of genAI and audit committees can play an important role in overseeing management’s approach. However, in our recent joint CAQ and Deloitte survey of audit committee members, 66 percent of respondents indicated that their audit committees have spent insufficient time in the past 12 months discussing AI governance. This is an area where audit committees can do more to oversee the safe and responsible use of genAI.

Responsible AI frameworks can help companies evaluate AI risk and develop controls to mitigate identified risks. Companies can develop their own frameworks or leverage existing published frameworks; for example, large public accounting firms have published their own responsible AI frameworks. Companies may also be able to leverage their existing enterprise risk management frameworks to develop guiding principles for identifying risks and responsibly engaging with genAI. The framework doesn’t need to be elaborate; what’s most important is that the framework establishes guidelines for robust governance and implementing reliable AI solutions. A responsible AI framework may be accompanied by specific policies regarding the acceptable use of AI throughout the organization. The policies make the framework actionable and guide employee behavior.

Audit committees can lean into genAI governance by asking management the following questions:

• What is the company’s approach to AI governance? Does the company have a responsible AI framework?
• How does the company identify and address potential risks associated with the use of AI? 

2.  Learning and training: Encourage management to create a culture of learning and experimentation with genAI in the company. 

One of the best, simplest ways to demystify genAI is to use it. Experimenting with genAI—while complying with policies for responsible use—teaches what the technology is and is not capable of, and how to best engage with it to achieve the desired outcome. Audit committees can use their influence to encourage management to enable employees to experiment with genAI in the company. This starts with the tone at the top from management, the audit committee, and the board by demonstrating that they are willing to learn, experiment, and engage with genAI. Encouraging this kind of environment will set the tone for innovation and embracing new and evolving technology.

In addition to allowing employees to informally experiment with genAI, companies should provide more formal training and resources for employees so that they can get the most out of the technology. For example, training employees in prompt engineering—the process of developing instructions, context, and personas to provide to genAI to produce the desired output—will enable employees to more effectively use the technology and maximize its benefits. 

Audit committees can lean into genAI learning and training by asking management the following questions:

• How has management set the tone around embracing genAI within the company?
• What training and other learning resources has management made available to employees to enable them to effectively use genAI?

3.  Use cases: Understand the genAI use cases within the company and monitor new technological developments.

As companies deploy new technologies, audit committees should understand the use cases for genAI within the company. For example, within the finance function, there are many potential use cases for genAI and AI, including:

• drafting financial statement footnote disclosures,
• reviewing the mathematical accuracy and internal consistency of financial statements and footnote disclosures,
• automated invoice processing,
• drafting code which can be used to perform data analysis on financial data, and
• analyzing transactions for indicators of potential fraud.

Potential use cases continue to evolve with the technology. Audit committees should stay up to date with new developments and understand how the evolution impacts management’s planned approach to implementing genAI solutions. One recent development is agentic AI, which refers to an AI system designed to act autonomously, make decisions, and pursue goals with minimal human intervention. AI agents can understand complex instructions, plan actions, and adapt their behavior based on changing circumstances. Agentic AI’s ability to break down and solve complex problems will enable more advanced use cases, potentially with less human intervention, in the near term.

Audit committees can engage with management on use cases by asking the following questions:

• How is genAI being used throughout the company?
• How does the company develop new use cases for genAI?

As the adoption of new AI technologies continues, it is important that audit committees stay abreast of developments to grasp the technology and its use, benefits, and potential risks. Doing so will enable their companies to maximize the benefits of new technologies while mitigating risks to operations and reputation.

CAQ is a NACD partner, providing directors with critical and timely information, and perspectives. CAQ is a financial supporter of the NACD.

Vanessa Teitelbaum, CPA, is senior director on the Professional Practice team at the Center for Audit Quality. She joined the CAQ in 2016 and advocates for stakeholders in the audits of public companies.