Auditing has at all times concerned a strict algorithm, requirements and controls. Whether or not a corporation is scrutinizing its funds, know-how or different property, the objective is to determine a predictable collection of occasions that results in a predictable set of conclusions.
In 2026, nonetheless, AI is rewriting the rulebook. Predictability is not a given: Ask an LLM the identical query a number of occasions, and it is more likely to produce a unique reply at every time. This is not a bug; it is a characteristic. But, for CIOs striving for protected and accountable AI, the shortage of regularity may be maddening.
At the moment, AI brokers rating mortgage purposes, assess stock and form the numbers that seem in monetary statements. In addition they work together with IT and operational methods. All of those AI use instances require consistency to be efficient and reliable, but present audit fashions do not account for AI’s inherent variability.
“There’s nonetheless a little bit of a disconnect on the right way to audit AI, as a result of AI is shifting sooner than frameworks are catching up — and auditors like repetition,” stated Lauren Kornutick, a senior director analyst within the analytics and AI group at Gartner.
The issue turns into clear when auditors ask how numerous AI choices happened and plenty of CIOs cannot clarify. Standard audit trails monitor an outlined set of actions and occasions, they usually presume a human signed off on every step. LLMs work in another way. Immediate logs and mannequin outputs reveal what went right into a system and what got here out, however not the method in between or whether or not the outcomes are dependable.
As auditors push for defensible AI decision-making, CIOs are within the crosshairs. There is a want for brand new instruments and new approaches. Organizations “ought to be fascinated about how they create and retain that report because the system operates — fairly than attempting to reconstruct it later,” stated Jennifer Kosar, AI assurance chief at PwC US.
Friction factors within the present auditing course of
Till lately, AI audits principally targeted on taming hallucinations and extracting correct outcomes from GenAI fashions. “At the moment, the main focus extends to understanding how AI is particularly getting used within the course of,” stated Mike Sawyer, audit companion and U.S. audit enterprise chief for AI and innovation at KPMG.
This contains understanding what info went into an AI mannequin, how AI output is generated and used, and what degree of reliance a corporation locations on the data. “Auditors are in search of a transparent report connecting the know-how’s particular use case and agent design to the method administration it has in place to validate the AI judgment,” Sawyer stated.
No less than, that is the objective. In lots of instances, auditing challenges do not originate with the mannequin; they floor when work strikes amongst groups. The know-how group might perceive how a system operates, whereas the finance workforce understands what a quantity means — however there is no report to attach the 2. The result’s a fuzzy idea of possession that undermines oversight and incident response. Monitoring instruments flag exceptions that go unresolved as a result of no workforce can declare full accountability.
The AI mannequin could also be working completely, however the audit will nonetheless fail if the group cannot show it.
The numbers paint a troubling image. Gartner’s 2026 AI Governance Survey of 697 AI leaders discovered that enterprise leaders rated AI bias and equity monitoring “very” or “reasonably” tough 67% of the time. Output accuracy mechanisms adopted proper behind at 66%, and accountable AI coverage landed at 64%.
Ranging from scratch
It is not a scarcity of effort on the a part of CIOs and auditors. The issue, Kornutick stated, is that there is no established playbook. Auditing frameworks and requirements, together with cybersecurity, have been constructed atop years of experience, however the controls particular to AI — drift, bias monitoring, output accuracy — do not have that benefit.
“There should not numerous precedents round to find out what beauty like,” she stated.
In lots of instances, auditors wind up attempting to force-fit AI right into a GRC course of, Kornutick stated. “It is nearly like utilizing waterfall improvement processes in a hyper agile world, as a result of AI even strikes sooner than an agile course of does.”
What’s extra, with generative AI, there is no approach to perceive precisely how the response was fashioned as a result of there is no step-by-step path to hint from immediate to output. “You possibly can’t describe how we get from level A to level Z,” Kornutick stated. “You possibly can solely interpret that the intention of the particular person writing the immediate is aligned to the output.”
Adopting a boutique method to AI fashions does not resolve the difficulty both. It is potential to manage each variable on the enter aspect and nonetheless find yourself with unpredictable output and unverifiable outcomes, which as soon as once more undermines confidence within the AI audit.
Understanding which inquiries to ask
An efficient AI auditing framework revolves round a primary query: how a lot info ought to the group accumulate and preserve? As a result of real-time inference logs are costly, many organizations use steady monitoring just for their highest-risk methods and depend on point-in-time audits for the remaining. Whereas this lowers prices, it ends in decrease visibility — and will even go away enterprises in violation of exterior laws.
The temptation to focus solely on technical points is misguided, Kornutick stated. AI traceability and knowledge retention are largely rooted in authorized elements. Even when a corporation optimizes thresholds for what’s defensible, regulatory penalties can observe. The extra complete method is to pursue a path of due diligence and have mitigating controls in place.
At that time, the query turns into: “May now we have prevented it? After which if we could not stop it, how rapidly may we detect and remediate it?” Kornutick stated.
Defensible AI hinges on 4 key questions, Sawyer stated. “What knowledge was used? How was the output evaluated? Who was accountable for reviewing it? And the way did it affect the ultimate resolution?” A CIO who can reply these questions clearly — and map solutions to recognized dangers — is healthier geared up to assist AI-enabled decision-making, he stated.
Constructing a framework round accountability
To deal with the problems that come up from unclear possession, enterprises ought to contemplate implementing a framework that addresses accountability.
Kosar defined {that a} profitable accountability framework revolves round three layers of safety:
-
The primary layer addresses the design of the AI system. This contains an evaluation of associated dangers and related controls, in addition to the dedication of whether or not sure dangers are acceptable.
-
The second layer periodically opinions these choices and raises challenges as dangers evolve.
-
The third layer independently assesses whether or not the primary two layers carried out accurately.
When carried out successfully, a framework of accountability minimizes time-consuming and dear forensic audits. With a transparent audit path of selections, exams, approvals, exceptions, and modifications logged, visibility improves.
A number of distributors have lately entered the area, suggesting that this can be a rising space of enterprise funding within the years to come back. These vary from audit administration platforms that ship normal governance frameworks, comparable to Optro (previously AuditBoard), TeamMate, Workiva and Archer, to instruments like Credo AI, IBM watsonx.governance and Holistic Ai, which monitor bias, accuracy and drift as they seem.
The bottom line is to not delay the AI audit technique. Too usually, Kosar stated, CIOs consider that AI does not but fall inside the scope of auditing as a result of their group hasn’t but rolled out a large-scale AI framework. But AI options more and more pop up in enterprise software program that enterprise groups already use, she famous. Consequently, present controls might not work — and with out an audit, there is no approach to detect an issue.
Proudly owning the chance
CIOs should cease treating auditing as a point-in-time train, Kosar stated. When organizations get the audit equation proper, they know the place AI is operating, acknowledge when utilization patterns change, and might constantly check and monitor methods that carry the best danger. At that time, they’re geared up to control AI proactively.
Based on Sawyer, it’s critical to view AI audit readiness as a enterprise functionality fairly than a compliance chore. Organizations that undertake this mindset are in a position to transfer sooner and innovate with better confidence, he stated.
For CIOs, that is the place the chance lies. Kornutick argues that CIOs are the important thing hyperlink within the AI auditing chain — and their involvement makes or breaks an initiative. “That is actually the CIO’s likelihood to step up and take possession of it,” she stated. “They need to lean into it.”
