Artificial intelligence is fundamentally changing internal business processes. As this technology becomes more accessible, organisations across a multitude of industries are evaluating its potential to streamline operations and deliver greater value.
Integrating new technology, however, involves far more than a simple copy-and-paste approach. Identifying exactly how AI adds value helps organisations understand what needs to adapt so they can maintain effective oversight as their operations change.
Muhammad Ali, Managing Director and Registered Lead Auditor at WWISE, shares his perspective on managing business continuity and governance during AI adoption.
One big concern around AI is employees putting confidential business information into public AI tools. From an information security perspective, how can organisations create policies that provide useful boundaries, and, subsequently, monitor this unconventional data breach?
The best method is to align with an internationally recognised standard, either the guidelines of NIST AI RMF 1.0 or ISO 42001. These standards provide the requirements and guidelines for having the correct information in a policy and the methods of effective implementation.
Creating a policy without awareness, training and controls to manage the policy is a huge change and can be ineffective if not effectively implemented.
Could you explain how businesses are running a risk by treating AI governance as a new separate compliance exercise instead of asking how it fits into the risk and management systems they already have?
The international standards such as ISO 42001 and ISO 27001 set out the minimum controls in Annexure A of the standard to be considered into a document noted as a Statement of Applicability.
If it is applicable, the risk associated with control is to be evaluated against current controls. If the control is ineffective or nonexistent, the method of mitigation and treatment is brought forward with SMART objectives aligned to key responsibilities, accountabilities and KPIs of Executive management to work correctly.
It generally is not a separate exercise — it should be embedded within the compliance and risk management prices of every business to function as one as opposed to a silo.
AI can make it easier for employees to perform tasks that previously required specialist knowledge. From an organisational risk perspective, how should businesses ensure that greater accessibility to these capabilities is matched by appropriate accountability?
Yes, using AI, developing AI or reselling AI is not frowned upon. It's understanding how to use the tools effectively and in the correct method.
Any tool can be misused and abused. It is important that the rules and boundaries are set forth and, thereafter, communicated with the risks, so everyone understands the methods and risks in using AI to build a level of efficiency, and assist them in their daily tasks and routine. However, due to misinformation and disinformation risks it is always imperative to cross reference and apply a level of humanisation to justify your objectives.
From your experience in auditing organisations, what does it look like when a business has genuinely, and successfully, integrated a new technology into its management systems?
Amazing. If the AI tools and AI Governance is well managed, the organisation can reduce costs, optimise their profits productivity and build in efficacy. I have seen organisations triple their profits whilst using AI correctly and empowering employees to use AI tools in the correct way to benefit internal processes and client engagements.
The entire value chain is optimised at a fraction of the time, reducing costs for all interested parties, making everyone happy.
Did you find this Q&A insightful? Let us know in the comments section below.
*Image courtesy of contributor and Canva