Venessa Laval

At the beginning of the month, a whistleblowing malpractice was reported for one of our operations in West Africa. Anticipating the reporting assurance, I reviewed 3 different reports across our own audit system, regional powerpoint presentation and data captured in excel sheets to check whether this risk had been highlighted. AI would be useful to link and summarise this cross over information enabling me to easily take the decision and make recommendations. There are 3 different areas that will need focus to enable me to lead differently:
1.      Enhancing Senior Management collaboration:
Our audit work is very important and is the foundation in terms of providing assurance to various stakeholders and improving and showcasing best practice. We have a total of 7 regions and the scheduling of the audits depends on our contractual agreements, prioritized operations depending on business size as well as the risk level of that country. We currently have a system to capture the audit findings however the scheduling, evaluation and synthesis of complex, contextual information  of audit findings, regional analysis, operations profile, compliance, staff practices and risk factors comparison are done manually. When there is a major investigation or results scrutiny, then 2 other different systems are being used. Very often, there is cross over of information depending on the incident and in terms of collaboration we rely a lot on the senior managers of that sub-function to provide an update in the senior management meeting.
When we discover a major malpractice incident in one of our 7 regions, we have an escalation process where this is discussed as a triage and we involve other senior managers when relevant to contribute as per the subfunctions. AI could proceed with the analysis of our audit findings cross region, linking that to the analysis of the other sub functions system flagging patterns, trends, non compliance and risks supporting the whole decision making process. For instance if we have a major investigation in a particular region/operation following a major incident, the AI could flag whether an audit was scheduled for that operation/centre, whether any audit findings picked up any major concern in that operation and within the whole region, potential other operations where this could be a risk to enable prompt mitigation and assurance to stakeholders. The AI however could fall short in terms of understanding the reason why it happened leading ultimately to the non-compliance. For example, AI could highlight trends in the CCTV footage evidence, but we wouldn’t know there was non compliance by staff unless we did interviews to gather this information and agree on the final outcome. Thus although the AI would be key in drawing the dots, as a leader I believe that we would still need to proceed with the human intervention to agree on the outcome and decision. Henceforth if it was lack of training/understanding of the process which was the gap, we can re-define the governance and agree with the other senior lead on training initiatives, monitoring of understanding and checking of implementation through a second audit (face to face or desk based).
Thus the ideal new workflow for this incident would be : AI triggers the trend, within 24 hours our regional manager and senior audit manager jointly review this checklist as per below:
i)                    Did the staff follow the mandatory training?
ii)                  Date and details of refresher training?
iii)                Is there any evidence of training that we could review (attendance register/online evidence)?
iv)                What is the evidence and gap leading to the conclusion that it was a lack of training from the interview meeting notes?
v)                  Can the line manager confirm the training of this staff member?
After this review, both should sign off the process.
 
2.      Resource Allocation:
Managing 30+ auditors across 110 locations with limited resources is our biggest challenge. Currently, scheduling is spread in 4 to 7 Excel files that occasionally get corrupted. Here's the decision that as senior managers we keep also asking: if AI recommends optimized audit scheduling, how do we know when it is trustworthy and can we reject/override it?
 We have an ambitious audit plan with limited valuable audit resources. We have 3 staffs supporting the scheduling which is demanding in terms of administrative effort. The AI system could optimize the scheduling and deployment of audit resources based on risk data, availability of auditors, past audit findings, etc.  The only challenge for the AI however would be whether it would understand the specifics of the 7 regions as these have different context based on the country risk, business profile, fraud and perception index, etc. For example, we have some regions who are highly compliant and other regions who are compliant with high risk level associated with business or country risk itself. It’s still unclear whether the AI will understand if the highly compliant region would only need more capacity building while the other high risk region would need more enforcement hence more audit scheduling. Before finalizing the audit deployment, we could initiate a validation where regional leads must either confirm or reject the AI recommended scheduling with a justified explanation and relevant documentation. This would prevent the AI from overriding local knowledge of the context while still benefitting from the pattern analysis.
 The AI could also help us identify the locations where we could use desk based audits given we have limited resources and 110 locations. We would of course need to agree the criteria and business rule to enable this selection.
Overall, AI could propose the scheduling but the allocations to high risk regions must go through a monthly audit meeting where risk, capacity, auditor profile are reviewed and debated/approved. AI doesn’t decide but the data it generated informs the decision.
3.      Audit Observation and Quality Assurance:
When we are writing our observations, we are stating factual observation, accountability, writing a professional tone and making recommendations. We have a quality assurance process reports are reviewed to ensure clarity to the relevant audience and benchmarking/standardizing our auditors performance as well. AI could potentially refine the draft by making consistency checks. However given the confidential nature of those reports, we wouldn’t want AI to decide or change the whole report which would impact our reputation.
Thus AI could flag inconsistencies but the scheduled auditor reviews and signs off that they have verified its accuracy, observed facts while the confidential details remain protected.
The lesson learnt from this incident is that AI’s real value isn’t about speed but preparation. My new role as a leader is to become a data driven leader focusing and interrogating the data AI surfaces, and not taking a decision quickly. These validations and sign-offs are controls that will let me actually trust what the system is saying.