Modernizing risk management: How AI-powered automation is redefining audit and controls testing

The financial services industry faces a whirlwind of challenges: complex regulations, evolving digital landscapes, and an ever-growing number of risks. In this environment, robust internal audit and controls functions are more crucial than ever. However, traditional approaches often grapple with inefficiencies, scalability limitations, and the ever-present risk of human error. And as evidenced by the $5 billion in fines issued by United States (U.S.) regulators in 2023, these shortcomings can have a significant negative impact to firms’ bottom lines.

The cornerstone to a financial services firm’s risk management is how they deploy their personnel across three lines of defense. Traditionally, those three lines include:

• Protocols ensuring processes are completed correctly and accurately within the line of business itself

• Controls teams responsible for testing the accuracy of data and processes flowing from the first line

• An internal audit team—the safety net—that identifies deficiencies in the first two lines of defense.

The problem with this framework? It’s usually manual and defensive, as opposed to automated and preventative.

To better protect against an increasingly complex risk environment, financial institutions need to rethink the traditional approach to audit and controls frameworks. Assigning more people to these critical functions is unsustainable. So firms need to turn to technology, specifically AI-powered automation, to transform the status quo and improve how they safeguard their institutions.

AI-powered automation shifts a firm's risk posture from defensive to proactive

Financial institutions often overlook the audit and controls function in their business transformation journeys. This is a missed opportunity, especially considering the rising regulatory scrutiny and evolving risks faced by financial services firms. By embracing AI-powered automation, organizations can propel their audit and controls into a future-proofed operating model capable of:

• Expanding data sample sizes: leverage automation to analyze significantly larger datasets, approaching or even achieving 100% coverage where appropriate. AI can extract and process a greater quantity of data, including from traditionally hard to access, unstructured data sources like documents, and communications like emails. This enables a more comprehensive understanding of risks and strengthens the validity of assessments.

• Improving testing accuracy: by eliminating manual data entry and removing the risk of human error, automation ensures absolute accuracy in testing procedures. AI algorithms can dynamically generate test cases based on evolving business requirements, system changes, and emerging risks. This fosters trust in the audit results and removes the risk of undetected errors.

• Increasing testing frequency: implement continuous testing powered by automation. This allows for real-time monitoring of controls, enabling immediate detection and response to any failures, significantly mitigating potential risks.

• Automating data gathering and preparation: unleash the potential of your audit team by automating repetitive tasks. AI-powered automation tools can integrate data from multiple sources and aggregate it into a centralized repository or data warehouse. AI-powered natural language processing (NLP) algorithms enable the extraction of information from unstructured text, such as contracts, financial statements, loan applications, and audit reports. This frees up the audit team's time and expertise to delve deeper into complex issues and strategic analysis.

Automation in action: Customer transformation with the UiPath Platform

A top U.S. bank

A top U.S. bank aimed to reduce their regulatory risk, increasing capacity and accuracy in quality control and audit functions. Here's a look into the types of controls they automated:

• Validations being followed for breach labeling

• Foreclosure fees charged in compliance with state

• Foreclosure process initiation checks

• Checks performed prior to external/regulatory reporting and disclosure submissions

• Delinquency checks being performed

• Appropriate fees and settlement charges being raised

Yapi Kredi

AI-powered Automation has enabled Yapi Kredi, a Turkish bank, to better adhere to specific regulations, particularly in executing controls, conducting reconciliations, raising flags, and identifying suspect transactions.

Yapı Kredi has now started incorporating AI into its governance, risk, compliance (GRC) automations. For instance, in the auditing process, the bank has implemented AI, document understanding, and image processing to not only help automate various processes, but also use automations as smart assistants for the auditors, allowing them to focus on more value-added activities.

This audit process now operates as follows: the robot collects the relevant documents and information, which would then be run through an AI algorithm for signature and other checks. Any exceptions would be first flagged by a robot, and then checked by a human auditor. This has returned a substantial amount of time to auditors, who are now less burdened by operational and repetitive work.

The value captured with AI-powered automation

The benefits of the audit and controls function of the future are clear, including significant cost reductions and enhanced efficiency. Automation fosters trust and reliability, leading to decreased reliance on external auditors and the near elimination of human error (and the resulting rework this often causes). Real-time monitoring minimizes the risk of regulatory actions and penalties. And all of this culminates in lower costs, both from smoother operations and from avoided penalties.

• Audit cost reduction: automation instills trust and reliability throughout audit and controls, meaning firms can spend less money hiring external auditors to review their governance. Organizations that automate at least 25% of their internal controls paid 27% lower audit fees on average.

• Reduction in remediation expenses: automation prevents a larger number of defects from occurring in the first place, requiring less personnel and resources to be allocated into resolving and fixing them down the line.

• Reduction in regulatory action and penalties: automation provides accurate continuous monitoring, allowing defects to be spotted and resolved in real time, eliminating scenarios where missed items result in regulatory action and penalties.

Conclusion

According to McKinsey and Company, the potential annual value of AI and automation in banking risk, compliance, and governance is a staggering $372 billion. This statistic underscores not just a potential tool, but an entire paradigm shift in how technology can redefine the financial services industry’s approach to governance, risk, and compliance.

The fast-evolving nature of the industry demands a departure from traditional error-prone methods. The future of audit and controls, enabled by AI-powered automation, will feature more accurate and efficient monitoring (while auditing larger samples of data), increased testing frequency, and the freeing of human auditors to focus on higher value-added tasks.

The real-world impact automation brings is evident in the reduction of audit fees, rework, as well as fines—affirming AI-powered automation as not just an innovative tool, but a strategic imperative for financial services firms navigating today’s financial landscape. The value derived from these implementations solidifies the role of AI in reshaping audit and controls, setting the stage for a more agile and resilient financial services sector.

For a deeper dive into risk management and mitigation, I'll be talking with KeyBank's Thomas Langton in a webinar on April 16. Register now to save your spot.