AI is no longer sitting at the edge of the business. It is being embedded into everyday processes, from journal entry review and expense approval to fraud monitoring, customer communications, vendor screening, and financial reporting workflows.
For audit and assurance teams, that creates a practical challenge: how do you evaluate a process when AI is part of how decisions are made, exceptions are flagged, or actions are taken?
The issue is not whether organizations will adopt AI. Many already have. The bigger question is whether governance, controls, documentation, and assurance practices are keeping pace.
That was one of the clearest themes from the recent Cherry Hill Advisory session, Auditing AI-Enabled Processes, sponsored by MindBridge. The conversation was not about AI hype. It was about what audit leaders need to do now: understand where AI exists, evaluate how it affects risk, and build confidence that AI-enabled processes are working as intended.
Here’s a short clip from the session where Mike Levy discusses why identifying where AI exists has become a foundational step in effective governance and assurance.
The new challenge is visibility
Before an AI-enabled process can be audited, teams need to know where AI is being used.
That sounds simple, but in practice, AI can be difficult to identify. It may be built into enterprise software, deployed through third-party tools, introduced through automation, or added to existing workflows without a clear inventory. In some cases, the organization may not have intentionally adopted AI, but vendors and systems inside the process are already using it.
That makes visibility foundational.
Audit teams need to ask:
- Where does AI sit in the process?
- What inputs does it rely on?
- What outputs does it produce?
- Does it recommend decisions, make decisions, or trigger automated actions?
- Is there a human in the loop, or only monitoring after the fact?
Without that understanding, teams risk auditing around the AI instead of auditing the process itself.
The methodology still matters
AI changes the risk profile, but it does not erase the fundamentals of audit.
A strong approach still starts with the business process. Teams need to map the process, understand the objective, identify where AI affects the flow of activity, and connect risks back to control objectives.
In many ways, the work becomes more important because AI can add complexity without adding transparency.
Core control objectives still apply:
- Authorization
- Accuracy
- Completeness
- Validity
- Access restrictions
The difference is that teams now need to evaluate how AI affects those objectives. If a tool approves a vendor, flags a journal entry, routes an exception, or auto-approves an expense report, auditors need to understand whether that activity is complete, accurate, authorized, explainable, and properly governed.
The risk is not just that AI produces a wrong answer. The risk is that the organization cannot explain, reproduce, or defend the process by which that answer was reached.
Evidence has to hold up
One of the biggest concerns with AI-enabled processes is defensibility.
Traditional audit evidence depends on clarity: objective, procedure, evidence, conclusion. With AI, that chain can become harder to document if teams do not understand how decisions are generated, what logic is being applied, or whether outputs can be independently validated.
That means audit teams need to look beyond AI’s own claim that it is accurate.
They need to evaluate:
- The configuration of the tool
- The quality and completeness of inputs
- The logic used to generate outputs
- Exceptions, false positives, and missed items
- Human review points
- Monitoring for bias, drift, and hallucination
- Whether workpapers can support independent review
This is especially important as organizations move from human-in-the-loop review models toward more autonomous human-on-the-loop monitoring approaches. As processes become more autonomous, expectations around documentation, testing, oversight, and defensibility become even more important.
Sampling alone is not enough
Sampling still has a place. But AI-enabled processes often require a broader view.
When a process is dynamic, automated, or operates across large transaction populations, a traditional sample may not capture the full risk picture. Audit teams need ways to stratify populations, identify outliers, test logic, and compare expected outcomes against actual behavior.
That is where full-population analysis and continuous monitoring become more important.
Rather than relying only on point-in-time testing, audit teams can use analytics to evaluate entire populations, prioritize higher-risk items, and focus human judgment where it matters most.
This does not replace the auditor. It strengthens the auditor’s ability to ask better questions, identify patterns earlier, and support more defensible conclusions.
From AI audit to continuous assurance
The bigger shift is not just auditing AI-enabled processes once. It is building an assurance model that can keep pace as those processes evolve.
AI models can drift. Use cases can expand. Third-party tools can change. Business processes can become more automated over time. A control environment that looked sufficient during implementation may no longer be sufficient six months later.
That is why audit and assurance teams are moving toward more connected, continuous models.
A modern data-driven audit approach should help teams:
- Detect anomalies across full populations
- Map risk to assertions and procedures
- Standardize analytics and narratives
- Produce evidence that is inspection-ready
- Reduce unnecessary sampling where risk-based analysis is stronger
- Gain visibility across the client or organization’s broader financial technology stack
The future is not about using AI for the sake of using AI. It is about creating a more consistent, scalable, and defensible assurance model.
What audit leaders should prioritize next
For teams still early in this journey, the path forward does not have to start with a complete transformation.
It can start with practical questions:
- Do we have an inventory of where AI is being used in key processes?
- Are AI-enabled activities mapped to clear control objectives?
- Can we explain and reproduce the basis for AI-driven outputs?
- Are we testing both configuration and outcomes?
- Are we using analytics to see more than a sample can show?
- Can our documentation stand up to review?
The organizations that move fastest will not be the ones that treat AI as a separate category of risk. They will be the ones that embed AI governance and assurance into the way they already evaluate business processes, financial controls, and operational risk.
AI-enabled processes are already here.
The next step is making sure audit and assurance teams have the visibility, structure, and evidence they need to keep up.
If you want to learn more about how firms are bringing greater visibility, consistency, and defensibility to AI-enabled processes, book a chat to see how these approaches are already being applied in practice.