Five key questions audit committees should be asking
Artificial intelligence rarely begins as a formal project. More often, it appears through software the organisation already uses, tools adopted by staff, or services provided by third parties. AI can therefore become embedded in business processes before policies, controls and oversight arrangements have caught up.
AI can reduce manual effort, analyse information and support decisions. It can also create privacy, cyber security, accuracy, bias, compliance and reputational risks.
Expectations are also rising. ASIC, the ANAO and the Australian Government have each called for greater transparency, accountability and oversight. Government policy now requires relevant Commonwealth entities to identify AI use cases, assess risks and impacts, and assign ownership.
What does this mean for organisations?
Privacy and cyber security risks are reasonably well understood. One of the less obvious risks is “control drift”. This occurs when AI changes how work is performed, however policies, procedures, delegations and controls remain unchanged.
A manager may use AI to summarise a board paper without checking whether context has been lost. Staff may use it in an assessment without documenting its contribution. The process may look unchanged, but the way work is performed, and decisions are made has shifted.
Regulators have identified similar concerns. ASIC’s Report 798: Beware the Gap: Governance Arrangements in the Face of AI Innovation reviewed 624 AI use cases across 23 banking, credit, insurance and advice licensees. It found that AI adoption was often moving faster than the risk and compliance frameworks intended to govern it. The ANAO reached a comparable conclusion in its review of AI governance at the Australian Taxation Office, identifying areas for improvement across governance, risk management, evaluation and information management.
Audit committees are responsible for overseeing risk management and the effectiveness of internal controls. For audit committees, the question is no longer whether the organisation uses AI. It is whether the organisation can provide assurance where AI is being used, remains accountable for the outcomes, understands the risks, opportunities and controls associated with that use.
The following five questions can help audit committees move the discussion from general awareness to practical oversight.
1. Do we have an AI governance framework or policy, and is it working in practice?
A policy is a starting point, not assurance. It should identify approved tools, permitted information, approval of higher risk uses, human review requirements, and incident and exception reporting. It should also set clear privacy and cyber security controls, including how sensitive information is handled, who can access AI tools and outputs, and how third-party providers store, use and protect the organisation’s information.
The committee should ask whether staff understand the framework and whether actual practices align with it. If the organisation has a policy but no training, monitoring or clear ownership, the policy may not be influencing behaviour.
2. Who is accountable, and can we demonstrate human oversight?
For significant uses, it should be clear who reviews the output, who can override it and who accepts the remaining risk. These roles may sit with one person, but they cannot be left undefined.
If a decision is later challenged through a complaint, freedom of information request or litigation, the organisation should be able to show what the AI tool contributed and what the human decision-maker contributed. A sign-off without a supporting record provides little evidence of accountability.
3. How do we know our AI tools remain fit for purpose?
Approval at implementation is not enough. Models may be retrained, vendors may change default settings, and the data or business environment may shift over time.
The audit committee should ask how management periodically tests significant AI outputs, monitors errors and bias, and responds to incidents, complaints and control failures. Reporting should focus on these matters and emerging risks, rather than simply providing usage statistics.
Internal audit can provide independent assurance on whether the governance framework is operating as intended and whether higher-risk uses are supported by effective controls.
4. What about our suppliers, is there a risk there?
Management should be able to provide a clear view of material AI use across centrally purchased tools, AI features within existing systems, publicly available tools used by staff, and services delivered by third parties.
Suppliers require particular attention. Supplier due diligence and contract management processes should also explicitly assess AI-related risks, including privacy, security, bias, transparency, regulatory compliance, and reliance on third-party AI models. Vendors may enable AI functionality in established products, sometimes by default, while contracted providers may use AI to deliver work for which the organisation remains responsible.
The Australian Government’s AI in Government Policy provides a useful benchmark. From 15 December 2025, relevant non-corporate Commonwealth entities must publish an AI transparency statement, designate accountable officials, assign an owner to each in-scope use case, and maintain an internal use case register. While these requirements do not apply to every organisation, they indicate the level of visibility and ownership audit committees may reasonably expect.
5. Which emerging regulatory requirements could impact our use of AI?
Some regulatory changes have a fixed date. Failure to identify and prepare for emerging AI-related regulatory obligations may expose organisations to compliance breaches, regulatory scrutiny, reputational damage, and increased legal risk. From 10 December 2026, new privacy law requirements will require organisations to be more transparent about automated and AI-assisted decision-making.
Where personal information is used in decisions that could significantly affect an individual’s rights or interests, organisations will need to include relevant information in their privacy policies. For many organisations, the larger task will not be rewriting the policy. It will be identifying and documenting where these decisions are already taking place.
How can we help?
As AI adoption accelerates, organisations need to ensure governance frameworks, controls and accountability arrangements keep pace with technological change and emerging regulatory expectations.
Our experienced team at HLB Mann Judd Melbourne can assist with AI governance reviews, maturity assessments, control and compliance assessments, independent assurance activities, and practical implementation roadmaps. We work with organisations to identify governance gaps, clarify accountability, strengthen oversight arrangements and support the responsible use of AI across the business.
Whether your organisation is establishing its AI governance framework or reviewing existing arrangements, we can help provide confidence that AI opportunities are being pursued with appropriate controls and oversight.
Co-authored by Jaideep Mor, Assistant Manager, Audit & Assurance