Audits have anchored cybersecurity for decades, but their continued relevance will require enterprises to keep pace with emerging digital risk. Advances in audit technology promise efficiencies and insights—and go hand in hand with new challenges. Meanwhile, the sophistication of cybersecurity attacks is increasing, and systems are being developed and deployed without sufficient long-term planning and oversight, introducing technical debt. In addition, artificial intelligence (AI) systems can inadvertently expose or misuse personal data, and there is a hidden risk spanning data collection, storage, and model behavior. For example, bias, improper data handling, and poor integration in AI workflows can lead to costly, large-scale failures with real-world implications. These include chatbot conversations becoming unintentionally disclosed, fictitious AI-generated citations in court cases, and disparity within AI hiring tools.1
In such a turbulent environment, the audit function can no longer remain a point-in-time assessment; instead, it must be utilized continuously and iteratively to achieve success. It is only through the lens of the audit that enterprises can gain critical insights into risk and vulnerability, allowing them to develop the robust governance and control structures necessary to navigate uncertainty, embed resilience, and ensure readiness. To transform auditing from a cost center to a strategic advantage, today's auditors must employ—and evolve—new methodologies.
Reframing Audits to Address Evolving Risk
To operate in modern environments, enterprises must continuously reevaluate and evolve the audit function into a proactive, adaptive force for building digital trust and strengthening organizational resilience.2
From Retrospective to Real Time
Traditional auditing often operates on a retrospective model, providing a snapshot of compliance or control effectiveness from a specific point in the past. This periodic, backward-looking approach cannot keep up with today's rapidly changing digital environment, where cloud configurations, code deployments, and data flows are constantly evolving. The modern audit function must transition to continuous auditing and monitoring.3 Similarly, traditional monitoring, which is designed for predefined thresholds, static configurations, and periodic log reviews, is overwhelmed by today's mercurial environment. A control that is effective today might be bypassed or rendered irrelevant by the next software update or architectural change. This results in gaps where risk can go undetected until a major incident occurs.4
To retain agility, auditing must leverage automation, advanced analytics, and integrated data feeds from operational systems to provide a continuous assurance model that monitors systems, controls, and vulnerabilities in real time. For instance, machine learning (ML) algorithms can be used to identify anomalies, patterns, and outliers reflecting policy violations, breaches, or drifts in operations, and anomaly detection models trained on historical logs can easily flag abnormal activities such as unauthorized access or data theft.5 Natural language processing (NLP) is useful for processing emails, support tickets, and log data, focusing on early warning indicators of compliance issues or ethical hazards as they emerge. Last, AI-based robotic process automation (RPA) can automatically detect and extract evidence, reconcile data between systems, and generate audit reports.6
A periodic, backward-looking approach cannot keep up with today's rapidly changing digital environment.Ultimately, an AI-enabled audit approach meets the growing need for real-time validation of controls, leading to greater transparency and confidence. Particularly in industries laden with risk (e.g., finance, healthcare, power and energy), enterprises must validate the effectiveness of controls to prove that they are operating correctly. Gap assessments can provide a roadmap to help validate the implementation of controls and flag areas that need attention.
From Siloed to Integrated
Auditors must integrate their efforts across various domains, evaluating the entire life cycle of development, operations, and AI systems. Historically, audit functions often operated in silos, with separate audit teams handling specialized areas such as finances or operations. Although this approach may have been adequate in an era of static business processes, infrequent technology rollouts, and relatively constant regulatory expectations, it neglects crucial interdependencies and creates significant blind spots. In today’s hyperconnected digital ecosystems, such a siloed audit is both inefficient and risky. Thus, an audit must be fully integrated into organizational processes and teams. Organizations must ensure that diverse multistakeholder feedback is gathered from data scientists, IT, legal, and compliance teams, and executive leadership.7
From Reactive to Proactive
Early risk identification, robust threat modeling, and preimplementation audits are crucial for mitigating risk before it materializes. Although backward-looking assurance is still needed, it has become increasingly insufficient in the era of fast-paced AI innovations. Risk spreads rapidly, and consequences can multiply before a traditional audit review can take place.
Proactive auditing techniques allow auditors to expose possible failure points, ethical risk factors, or policy breaches before they become hardcoded into production systems. In the case of AI systems, proactive auditing might involve:
- Scrutinizing the origins and labeling of training sets to guard against bias
- Reviewing model design choices for consistency with the enterprise’s risk appetite and ethical principles
- Testing explainability and fairness benchmarks before deployment
- Introducing safeguards into the workflows of AI decision making
A catalyst for this transformation is predictive analytics and AI-driven auditing tools. ML models can be used to recognize risky system configurations, identify patterns of noncompliance based on previous audit findings, and suggest controls as new threat surfaces appear. Such tools can replicate attack vectors or data misuse cases and identify issues before they appear in the practical system. NLP techniques can help detect situations with a high probability of latent risk, misalignment, or regulatory discrepancies. Likewise, reinforcement models can stress-test decision outcomes across several scenarios in a variety of operational conditions, providing early feedback for developers and governance teams.8
Modern audits must include embedded audit practices that provide a seamless mechanism to review accountability frameworks, escalation protocols, and human interpretability of AI systems.Key Principles of Modern Auditing
Auditing has traditionally focused on financial accounting, regulatory compliance, and point-in-time checks to validate operational efficiency. As a result, it does little to account for the complex sociotechnical dynamics of data-driven technologies developed in the AI era. This is problematic in AI systems, where algorithmic decision making can potentially reinforce biased historical inequities and hinder transparency and accountability. Traditional audits have not historically employed tools to reveal or address these types of problems iteratively. Specifically, disparate impact, or the misrepresentation of populations, remains an underaudited threat in AI deployment. As AI becomes foundational to business processes, this raises concerns in areas such as hiring, healthcare, policing, and credit scoring, where algorithmic outputs can have a disparate impact on people’s lives.9
There is a need for re-imagined audit practices. In the age of AI, audits are both inadequate and underresourced. They do not pay sufficient attention to evolving risk profiles, and as a result, systemic problems are not identified until after damage has been done.10 Moreover, algorithmic bias caused by biased training data, inadequate model structures, or biased feature engineering is usually beyond the scope of traditional audit processes. Classic audits cannot evaluate the fairness or explainability of ML models without interdisciplinary know-how and AI-specific audit paradigms. Modern audits must include embedded audit practices that provide a seamless mechanism to review accountability frameworks, escalation protocols, and human interpretability of AI systems.
AI and Algorithmic Accountability
Auditors must address the complexity of AI systems by focusing on bias detection, transparency, and explainability. This means inspecting training sets for bias, understanding model logic, and verifying outcome consistency. This is especially critical in high-stakes domains such as hiring, lending, and healthcare.11 To help address these challenges, ISO/IEC 42001 provides a management system standard for responsible AI development and deployment, and NIST’s AI Risk Management Framework (AI RMF) offers a detailed methodology with concrete controls for managing risk throughout the AI life cycle.12 Organizations can also champion independent AI audits, pushing for verifiable ethical standards and accountability mechanisms to ensure that AI performs responsibly and equitably.13
Cybersecurity
Enterprises must develop and implement approaches to capture the changing risk associated with the modern cloud and data governance environment. This demands a new approach to iterative reviews of systems, code, and data. Red teaming, continuous integration/continuous deployment (CI/CD) pipeline reviews, and secrets management are all critical, and, with the rapid adoption of new technology driven by AI, they must be evaluated more than once a year. In cloud and DevSecOps environments, auditors must embed the monitoring of data lineage, provenance, and privacy in their assessments to understand their impact in real time and address exposure. Furthermore, automated governance, traceability, and privacy by design principles are important to understanding the evolving risk profile within an enterprise.14
Data Governance and Privacy Impact Assessments
The proliferation of data necessitates a strong emphasis on data governance. Auditors must verify data provenance, lineage, and conduct thorough privacy impact assessments (PIAs) to ensure compliance with privacy regulations and ethical data handling practices. In traditional audits, tracking data provenance and lineage poses significant challenges due to the reliance on manual documentation and static records. Cloud and DevSecOps environments introduce dynamic, distributed systems that require real-time automated provenance tracking. Auditors must assess how data flows across microservices, application programming interfaces (APIs), and cloud platforms—something conventional audits were not designed to handle. Provenance and lineage are critical for demonstrating compliance, ensuring data integrity, and detecting unauthorized data manipulation. PIAs play a key role by helping identify risk early in the software development life cycle. ISACA®emphasizes the integration of automated governance, data traceability, and privacy by design principles into cloud and DevSecOps audits to ensure alignment with standards such as ISO 42001 and the EU General Data Protection Regulation (GDPR).15
Traditional audit methods also fall short when applied to CI/CD pipelines, where rapid code deployment and automated workflows demand continuous monitoring of data quality, security, and compliance. Data provenance must be captured at each step of the pipeline—from development to deployment—to verify data integrity and lineage.16 Similarly, auditing infrastructure as code (IaC) demands verification that the code used to provision cloud resources is compliant and does not introduce risk. Without automated controls and real-time audit trails, these components can become blind spots.
Transforming Audit Into a Strategic Advantage
In an era of rapid digital transformation and AI proliferation, auditing must evolve from a backward-looking, compliance-oriented function into a forward-looking, strategic enabler. For enterprises striving to lead responsibly, auditing must become embedded, intelligent, and anticipatory.
Embed Audits Early and Continuously in the Technology Life Cycle
Forward-looking enterprises should embed audit mechanisms at the earliest stages of system design and maintain an audit presence throughout the entire life cycle of digital technologies, including AI systems. This shift aligns with assurance by design principles and responsible innovation, where ethical, legal, and safety considerations are part of the product’s DNA rather than an afterthought. Embedding audits early allows risk detection during the ideation, preimplementation, and model training phases of AI, helping avoid downstream costs, reputational risk,
and compliance violations.17
Invest in Cross-Functional Auditor Training
The complexity of emerging technologies demands that auditors develop interdisciplinary fluency. This includes knowledge of cybersecurity and secure architecture, AI/ML model interpretability and fairness, legal and regulatory landscapes, and environmental, social, and governance (ESG) factors. Interdisciplinary audit teams more effectively identify nuanced risk in AI applications, particularly risk involving fairness, bias, and explainability.18 Thus, enterprises should fund auditor training programs and cultivate hybrid roles that can speak both technical and policy languages (e.g., AI compliance officer, ethical tech auditor).
Use Audits for Alignment, Not Just Compliance
Audit should move beyond checklists to function as a calibration mechanism that aligns technology development with organizational values, societal expectations, and stakeholder trust. For AI, this could mean validating that algorithmic outputs align with declared fairness objectives or that risk trade-offs are documented and transparent. Audit artifacts can serve as continuous feedback loops between development, governance, and the boardroom, helping fine-tune risk management, optimize controls, and enhance overall organizational performance. Instead of merely identifying deficiencies, audits should provide actionable insights that help management understand the effectiveness of their control environment, pinpointing areas for strategic investment in security or technology. This use of audits aligns with adaptive governance models that prioritize responsiveness over static compliance.19
Shift to Continuous, Data-Driven Assurance Models
To keep pace with AI-driven operations and cloud-native infrastructures, audit functions must evolve toward real-time, telemetry-informed, AI-augmented models. This includes automated control testing, anomaly detection via ML, and dynamic dashboards for oversight. Such systems offer a shift from episodic reviews to continuous assurance, drastically reducing audit lag and enabling near-instant escalation of critical issues.
AI-driven audit analytics enhance precision and reduce human error in anomaly detection, particularly in identifying financial fraud, insider threats, or AI model drift.20
Make Audits an Enabler of Responsible Technology
Audits should be positioned not as a barrier but as a strategic enabler of ethical, resilient, and inclusive technology. When integrated into innovation pipelines, audits ensure that technologies align with enterprise ethics commitments, unbiased strategies, sustainability pledges, and governance and accountability standards. By ensuring that digital initiatives are trustworthy by design, audits help future-proof an enterprise against regulatory shocks, reputational damage, and public distrust. Thus, auditing AI systems for bias and transparency strengthens stakeholder confidence and is increasingly viewed as a fiduciary responsibility by boards.21 By providing assurance that new technologies are developed and deployed securely and ethically, auditing empowers enterprises to innovate with confidence, minimizing inherent risk and maximizing its positive impact.
Conclusion
Enterprises that cling to dated audit processes not only expose themselves to serious risk but also miss major opportunities. Those that embrace audit as an innovation partner can build systems that are durable, secure, and ethical. In the era of AI, cloud-based infrastructures, and continuous digital transformation, the audit can no longer be a retrospective checkpoint; it must become embedded, adaptive, and anticipatory. The evolving landscape demands a fundamental shift in audit approaches and expanded skills. By evolving into an integrated, real-time, and strategic process, auditing can become a cornerstone of resilient governance, empowering enterprises not only to comply with standards but also to lead toward future-ready, trustworthy innovation.
Endnotes
1 Responsible AI Collaborative, “AI Incident Database,” 2025, ; Mamgai, A.; “AI Security Risk and Best Practices,” ISACA®, 15 August 2024
2 Alles, M.G.; Brennan, G.; et al.; “Continuous Monitoring of Business Process Controls: A Pilot Implementation of a Continuous Auditing System at Siemens,” International Journal of Accounting Information Systems, vol. 7, iss. 2, 2006, p. 137–161
3 Alles, et al., “Continuous Monitoring”; Shilts, J.; “A Framework for Continuous Auditing: Why Companies Don’t Need to Spend Big Money,” Journal of Accountancy, March 2017
4 Raji, D.I.; Smart, A.; et al.; “Closing the AI Accountability Gap: Defining an End-to-End Framework for Internal Algorithmic Auditing,” Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency, January 2020, p. 33–44
5 TeamMate, “Artificial Intelligence in Auditing: Enhancing the Audit Life Cycle,” Wolters Kluwer, 17 April 2024
6 Abdalla, A.; “Impact of Artificial Intelligence Using the Robotic Process Automation System on the Efficiency of Internal Audit Operations at Jordanian Commercial Banks,” Banks and Bank Systems, vol. 20, iss. 1, 2025, p. 122–135
7 Appelbaum, D.; Kogan, A.; et al.; “Big Data and Analytics in the Modern Audit Engagement: Research Needs,” Auditing: A Journal of Practice & Theory, vol. 36, iss. 4, 2017, p. 1–27
8 Qatawneh, A.M.; “The Role of Artificial Intelligence in Auditing and Fraud Detection in Accounting Information Systems: Moderating Role of Natural Language Processing,” International Journal of Organizational Analysis, vol. 33, iss. 6, 2024, p. 1391–1409
9 Scarpino, J.P.; “An Exploratory Study: Implications of Machine Learning and Artificial Intelligence in Risk Management,” Marymount University, USA, 2022
10 Raji, et al., “Closing the AI”
11 Raji, et al., “Closing the AI”
12 International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC), Joint Technical Committee on Artificial Intelligence (ISO/IEC JTC 1/SC 42), ISO/IEC 42001:2023 Information technology—Artificial intelligence—Management system, Edition 1, 2023, National Institute of Standards and Technology, AI Risk Management Framework, USA, 2023
13 ForHumanity, “Independent Audit of AI Systems,” ForHumanity Projects, 2025
14 Kohnke, A.; “Auditing the Cloud Microsoft Azure,” ISACA® Journal, vol. 5, 2020
15 Pearce, G.; “DevSecOps and Privacy by Design: How Far Have We Come?,” ISACA, 26 July 2021, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation [GDPR])
16 Bamidele S.A.; Ojika, U.; et al.; “Advances in Data Lineage, Auditing, and Governance in Distributed Cloud Data Ecosystems,” Shodhshauryam, International Scientific Refereed Research Journal, vol. 5, iss. 4, 2022, p. 245–273
17 Raji, et al., “Closing the AI”; Mökander, J.; Floridi, L.; “Ethics-Based Auditing to Develop Trustworthy AI,” Minds and Machines, vol. 31, 2021
18 Raji, et al., “Closing the AI”
19 Floridi, L.; Cowls, J.; et al.; “AI4People—An Ethical Framework for a Good AI Society: Opportunities, Risks, Principles, and Recommendations,” Minds and Machines, vol. 28, 2018, p. 689–707
20 Antwi, B.O.; Adelakun, B.O.; et al.; “Enhancing Audit Accuracy: The Role of AI in Detecting Financial Anomalies and Fraud,” Finance & Accounting Research Journal, vol. 6, iss. 6, 2024, p. 1049–1068
21 Rahwan, I.; Cebrian, M.; et al.; “Machine Behaviour,” Nature, vol. 568, 2019, p. 477–486
JOSHUA SCARPINO | D.SC., CISM
Is the vice president of information security at TrustEngine. He leads the IT operations, security, and compliance teams and is also responsible for developing and managing the responsible AI program. Scarpino is also the chief executive officer (CEO) and founder of Assessed Intelligence LLC, a security and AI research consultancy firm. He has more than two decades of experience working in various roles within the US Department of Defense (DOD), including leading security operations for Fortune 500 companies, enhancing critical controls at financial and manufacturing organizations, and leading, scaling, and auditing security and compliance programs. His continued research focuses on ethical technologies and responsible AI, and he is passionate about educating the next generation of security and AI professionals. He is currently partnering with ForHumanity to develop and teach frameworks for auditing AI systems, a member of the US National Institute of Technology’s (NIST’s) Generative AI Public Working Group, and a contributing member of the AI Risk and Vulnerability Database (ARVA).
KATIE GRILLAERT
Is an accomplished interdisciplinary scientist and entrepreneur with more than a decade of leadership experience at the intersection of science, technology, and business strategy. She has a unique ability to bridge technical innovation with strategic vision, ensuring that cutting-edge advancements are aligned with business growth and long-term value creation. As an AI governance and ethics fellow at ForHumanity and a responsible AI advisor on a United Nations initiative, she brings expertise in ethical frameworks, governance design, and regulatory compliance.
ESTHER CHUNG
Is an expert in law and risk strategy, both of which fuel her deep commitment to ethical tech. As a former public interest attorney and current ForHumanity fellow in ethics and governance, she has spent her career focused on protecting rights and building accountability into complex systems. In her role as chief privacy and risk officer (CPRO), Chung is instrumental in developing and executing Assessed Intelligence's privacy program and risk management framework, enhancing privacy, risk, and education initiatives.
NIA RICHARDS | ISO/IEC 27001:2022 LA
Is a results-driven IT leader with more than 20 years of experience supporting mission-critical initiatives across federal and commercial sectors. A US Navy veteran, he brings a deep background in IT infrastructure, governance, risk, and compliance (GRC), and third-party risk management, with a strong track record of aligning technology strategy with business objectives.
KEITH PARKMAN | CISA, CDPSE, ISO 27001 LA, ISO 42001
LA Is a seasoned IT and compliance professional with more than 20 years of experience in information security, audit, and risk management. At Assessed Intelligence, Parkman leads IT audit and AI compliance efforts, including the implementation of International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) 42001. His work focuses on aligning emerging technologies with regulatory frameworks, driving ethical AI adoption, and strengthening organizational readiness across sectors.
