Topic: AI Governance Under Audit: What Auditors Need to Know About Responsible AI
Abstract: As organizations accelerate their adoption of generative and agentic AI, auditors face a growing challenge: How do we determine whether AI systems are being governed effectively, rather than simply accepting that policies and controls are in place?
AI introduces new considerations around accountability, autonomous decision-making, data integrity, model behavior, third-party dependencies, and human oversight. While established audit principles remain relevant, auditors must understand how these risks affect the design, implementation, and effectiveness of governance controls.
This webinar examines AI governance froman audit and assurance perspective, focusing on how auditors can move beyond reviewing documented policies and management representations to evaluating what is actually happening within an organization.
We’ll explore how governance responsibilities are assigned, how AI-related risks are assessed, how controls are monitored and tested, and what evidence should exist to support management’s assertions.
Particular attention will be given to identifying gaps between expected governance and operational reality, evaluating whether controls are working as intended, and determining whether organizations can demonstrate responsible oversight of their AI systems.
Participants will gain a practical understanding of how to approach AI governance audits, ask more effective questions, identify control deficiencies, and assess whether the evidence supports the conclusions being reported.
Key Takeaways:
- Understand how generative and agentic AI introduce new audit and governance considerations.
- Identify the essential components of an AI governance program, including ownership, accountability, policies, and risk assessments.
- Evaluate governance controls involving data, models, third-party dependencies, security, and human oversight.
- Recognize gaps between documented governance expectations and actual operational practices.
- Understand what evidence auditors should request to evaluate control implementation and effectiveness.
- Apply practical audit questions to assess whether AI governance claims can be independently supported.
- Strengthen audit reporting by distinguishing management assertions from confirmed evidence.
Speaker:
Elizabeth Wu, Founder & CEO, Cybersecurity Auditing Technologies
Bio: Elizabeth Wu is the Founder and CEO of Cybersecurity Auditing Technologies, an IT security auditor, consultant, and author with more than 25 years of experience working with technology, cybersecurity, and organizational risk.
A contributor to the Center for Internet Security (CIS), her work focuses on the gap between what organizations believe about their cybersecurity and what can actually be demonstrated through independent examination and objective evidence.
Elizabeth works with executives and organizations to strengthen cyber governance, accountability, and evidence-based oversight. She is the author of The Illusion of Cyber Governance: Why Proof Matters More Than Protection, which examines why organizational confidence does not always correspond with demonstrable security.
Her current work applies these same principles of accountability, independent examination, and evidence-based assurance to AI governance and emerging technology risks.
