For decades, the internal audit function at major banks has operated on a predictable, three-to-five-year cycle. It was built as a reactive, manual process of studying the past to ensure compliance. The role of the auditor was to spot compliance gaps, usually in retrospect, and align priorities with and flag issues to the board.

This role was developed at a time when banks mostly operated through brick-and-mortar branches. Banks that are now scaling their digital presence have to contend with a much broader suite of risks, and the retroactive approach is nowhere near sufficient anymore, Group Chief Internal Audit Officer at Mashreq Hassan Ali told EnterpriseAM in an interview.

With a wider digital footprint, risks are more immediate, and a digital failure or glitch could mean a significant disruption to operations, Hassan added.

The solution is to become more agile and proactive, and the big elephant in the room that will help make that happen? AI. Mashreq has been on an aggressive AI rollout across its groups and services, from its client-facing platforms to internal operations like financial reporting, and is now bringing this rollout to its internal audit department, building an in-house platform that uses AI agents to track data in real-time, Hassan explained.

“The audit function is at a crossroads right now,” Hassan said, adding that some leaders of internal audit are skeptical about the impact of AI on their industry. “I would call this the confusion stage — many are skeptical about whether it’s going to work, some are waiting for somebody to do something and playing it safe,” he added. Hassan is in another category — optimistic about the potential benefits AI can have for auditing as a function.

The new platform will start producing results within the next 12 to 18 months as part of a broader five-year rollout plan, Hassan told us. The platform will deploy advanced AI-enabled solutions and risk intelligence that can provide insights and predictive analysis for what’s coming ahead, Hassan said.

“The way and scale at which we are planning to deploy this, I don’t think has been done anywhere globally,” he explained. Specific use cases are being deployed across some internal audit functions, but Mashreq is going full scale — the platform aims to bake traditional audit methodologies into the platform, which can then integrate into systems across the banks’ departments to capture data in real time, analyze it using specific AI prompts, and the data analysis and risk assessment will happen on the spot rather than over several years, he explained.

Where does that leave the internal auditor?

Hassan is direct about what this means for the workforce. Within five years, the role of a traditional internal auditor at Mashreq will be unrecognizable. “If we’ve learned one thing from history, it is that machines always win,” Hassan says, explaining that the internal auditor role must become geared towards overseeing AI agents, rather than perform manual processes at their desks.

Their role will be to ensure AI is not operating in a black box and that there’s explainability, meaning the AI platform’s process can be re-performed and it will arrive at the same result, he explained.

This upskilling process is already happening within Mashreq’s internal audit department, which Hassan likened to an “AI audit academy” that aims to reskill auditors and prepare them for the transformation of their roles.

The glue that ties all of this together? Governance

When asked what’s the one thing that has the potential to uproot corporate resilience and result in corporate failures, Hassan pointed to failures in governance and oversight. “Governance is the most important thing. Sometimes we just have to go back to the drawing board,” he said.

“it’s very important that there is very clear strategic alignment between the board, executive management, and operating management,” he explained. The board defines the overall strategy, executive management drives it, and the operating management implement it — there has to be a loop and that loop must include clear accountability and transparency, he explained.

Internal audit’s role within this framework is as an enabler and provider of either assurance or advice — or what we call foresight, he added.

Next stop: Commercialization?

Mashreq’s history of building proprietary tech often leads to commercial outlets. While the internal audit AI platform is currently being built for internal operations, the bank is considering how it might eventually offer this technology to the wider market, Hassan said.

Tags: