AI Risk Management and Assurance for Internal Auditors Training Course

Course Introduction

Artificial intelligence is becoming increasingly embedded in organisational decision-making, operational processes, customer services, financial activities, analytics and strategic planning. As AI adoption expands, internal auditors must understand the distinctive risks created by algorithms, machine learning models, generative AI and automated decision-making, while developing appropriate assurance approaches that complement existing enterprise risk management and internal control frameworks.

This course provides internal auditors with a comprehensive and practical approach to identifying, assessing, monitoring and assuring artificial intelligence risks. It focuses on the auditor’s role in evaluating whether AI-related risks are appropriately governed, whether controls are operating effectively, and whether management has established sufficient oversight over data, models, algorithms, technology platforms and AI-enabled business processes.

Participants will examine the complete AI risk lifecycle, including AI strategy, use-case assessment, risk identification, data governance, model development, validation, implementation, deployment, monitoring, change management and retirement. The programme emphasises risk-based audit planning and provides techniques for assessing AI risks without requiring participants to become specialist software developers or data scientists.

The training addresses critical AI assurance areas including model risk, algorithmic bias, explainability, data quality, privacy, cybersecurity, third-party dependencies, regulatory compliance, operational resilience and human oversight. Participants will learn how to translate these technical and emerging risks into auditable control objectives, evidence requirements, testing procedures, findings and recommendations that are meaningful to management and governance bodies.

Particular emphasis is placed on emerging AI applications such as generative AI, large language models, autonomous AI agents, automated decision systems and AI-enabled analytics. Internal auditors will explore how these technologies can introduce new forms of operational, compliance, reputational, financial and strategic risk, as well as how continuous monitoring and data analytics can strengthen assurance over rapidly changing AI environments.

By completing this programme, participants will be equipped to contribute effectively to enterprise AI risk management and provide independent assurance over AI governance, risk and control environments. The course develops practical capabilities for planning AI audits, evaluating control effectiveness, challenging management assumptions, assessing emerging risks and communicating assurance results in a clear and actionable manner.

Duration

10 days

Who Should Attend

• Internal auditors responsible for providing assurance over artificial intelligence, technology and digitally enabled business processes.

• IT auditors and information systems auditors evaluating AI platforms, applications, infrastructure and supporting technology controls.

• Risk managers responsible for identifying, assessing and monitoring enterprise AI risks and emerging technology exposures.

• Enterprise risk management professionals integrating artificial intelligence risks into organisational risk management frameworks.

• Compliance professionals assessing AI-related legal, regulatory, policy and governance requirements across business operations.

• Data governance professionals responsible for data quality, lineage, ownership, classification and appropriate use of information in AI systems.

• Model risk professionals involved in model validation, performance assessment, monitoring and independent model assurance.

• Cybersecurity professionals assessing security threats affecting AI models, data, infrastructure and technology ecosystems.

• Privacy professionals addressing personal data, confidentiality, information rights and privacy risks arising from AI applications.

• Senior managers and executives responsible for AI strategy, digital transformation, risk oversight and technology governance.

• Audit committee members and governance professionals seeking greater understanding of AI risk and assurance responsibilities.

• Fraud and forensic professionals assessing AI-enabled fraud, manipulation, synthetic content and automated financial risks.

• Quality assurance professionals evaluating reliability, accuracy, consistency and performance of AI-supported processes.

• AI, data science and technology professionals seeking to understand internal audit expectations and independent assurance requirements.

Course Objectives

• Develop a comprehensive understanding of artificial intelligence risk management principles and their application within internal audit, enterprise risk and organisational control frameworks.

• Identify and assess the strategic, operational, financial, compliance, cybersecurity, privacy and reputational risks associated with AI adoption and automated decision-making.

• Apply risk-based internal audit methodologies to AI systems throughout their lifecycle, from initial business justification and development through deployment, monitoring and retirement.

• Evaluate AI governance structures, accountability arrangements, policies and management responsibilities to determine whether AI risks are appropriately owned and overseen.

• Assess data governance and data quality controls supporting AI systems, including data lineage, provenance, integrity, representativeness, access and authorised usage.

• Evaluate AI model development, validation, performance and monitoring controls to identify weaknesses that could affect reliability, accuracy, robustness and business outcomes.

• Develop practical audit procedures for assessing algorithmic bias, fairness, explainability, transparency, human oversight and responsible use of automated decisions.

• Assess cybersecurity, privacy and technology risks affecting AI models, datasets, interfaces, infrastructure, applications and supporting technology environments.

• Evaluate third-party and cloud-based AI risks, including vendor dependency, contractual controls, model transparency, supply chain exposure and service resilience.

• Apply continuous auditing, data analytics and monitoring techniques to identify emerging AI risks, unusual outcomes, model deterioration and control exceptions.

• Develop high-quality AI audit findings, recommendations and management actions that clearly connect control weaknesses with business risks and potential consequences.

• Strengthen internal audit advisory and assurance capabilities by communicating AI risk insights effectively to senior management, audit committees and governance stakeholders.

Comprehensive Course Outline

Module 1: Foundations of AI Risk Management and Internal Audit Assurance

• Artificial intelligence concepts, applications, machine learning, generative AI and automated decision-making from an internal audit perspective.

• The evolving role of internal audit in identifying, evaluating and providing assurance over artificial intelligence risks.

• Differences between conventional technology risks and AI-specific risks involving algorithms, models, data, automation and decision processes.

• Key principles of AI risk management, assurance, accountability, human oversight and responsible technology adoption.

Module 2: AI Risk Governance, Accountability and Management Frameworks

• AI governance structures, executive oversight, risk ownership, accountability arrangements and organisational responsibilities for AI deployment.

• Integration of AI risk into enterprise risk management, internal control, technology governance and strategic risk frameworks.

• AI policies, standards, procedures, acceptable-use requirements and governance mechanisms supporting controlled AI adoption.

• AI risk governance maturity, risk appetite, escalation mechanisms and management reporting for significant artificial intelligence exposures.

Module 3: AI Risk Identification, Assessment and Risk Profiling

• Identification of strategic, operational, financial, compliance, privacy, cybersecurity, ethical and reputational AI risks across organisational processes.

• AI risk assessment methodologies covering inherent risk, control effectiveness, residual risk, impact and likelihood considerations.

• AI use-case inventories, risk registers, risk taxonomies and prioritisation of high-impact or high-dependency artificial intelligence applications.

• Developing risk profiles that consider the purpose, users, affected stakeholders, data, technology, decision impact and level of automation within AI systems.

Module 4: AI Audit Planning, Scoping and Engagement Design

• Developing risk-based AI audit strategies, engagement objectives, scope boundaries, audit criteria and assurance priorities.

• Identifying auditable AI processes, systems, models, data environments and business controls within complex organisational technology landscapes.

• Designing AI audit programmes, testing procedures, evidence requirements, sampling approaches and documentation standards.

• Coordinating AI assurance activities with IT audit, cybersecurity, privacy, compliance, risk management and other assurance functions.

Module 5: AI Lifecycle Risk and Model Development Assurance

• Risk and control considerations across AI conception, design, development, testing, deployment, operation, modification and retirement.

• Model development governance, documentation, assumptions, requirements, version control and traceability of important design decisions.

• Independent validation, testing, approval and deployment controls supporting reliable and appropriately governed AI models.

• Change management, model updates, retraining, configuration changes and revalidation requirements throughout the AI lifecycle.

Module 6: Data Risk Management and AI Data Assurance

• Data quality risks affecting AI outcomes, including accuracy, completeness, consistency, relevance, timeliness and representativeness.

• Data lineage, provenance, ownership, sourcing, transformation and documentation controls supporting trustworthy AI decision-making.

• Training, testing and validation dataset governance, including data selection, partitioning, contamination and inappropriate data-use risks.

• Data access, privacy, classification, retention, security and authorised-use controls for information processed by AI systems.

Module 7: Algorithmic Risk, Bias and Fairness Assurance

• Identification of algorithmic bias arising from data, model design, assumptions, proxy variables, implementation and operational environments.

• Assessment of fairness risks, discriminatory outcomes and potential disparate impacts associated with automated decision-making.

• Audit procedures for evaluating algorithmic fairness, threshold selection, outcome patterns and contextual limitations of fairness assessments.

• Management responses to identified algorithmic risks, including remediation, human review, escalation, documentation and ongoing monitoring.

Module 8: Model Risk, Validation and Performance Assurance

• Model risk concepts, validation principles and independent challenge processes for assessing AI model suitability and reliability.

• Performance monitoring covering accuracy, robustness, stability, model drift, data drift and deterioration of expected outcomes.

• Scenario analysis, stress testing, sensitivity analysis and exception testing for evaluating AI behaviour under changing conditions.

• Model limitations, uncertainty, confidence measures, validation evidence and governance processes for managing unreliable AI outputs.

Module 9: AI Cybersecurity, Privacy and Technology Assurance

• Cybersecurity threats affecting AI systems, including data poisoning, adversarial manipulation, prompt injection, model exploitation and unauthorised access.

• Privacy risks involving personal information, confidential data, sensitive inputs, generated outputs, retention and secondary use.

• Identity, access, encryption, logging, monitoring and infrastructure controls supporting secure operation of AI environments.

• AI incident management, vulnerability management, resilience and response controls for technology and information security events.

Module 10: Generative AI, Large Language Models and AI Automation Risks

• Risk management considerations for generative AI, large language models, enterprise AI assistants and automated content-generation systems.

• Hallucinations, unreliable outputs, inappropriate recommendations, confidential information exposure and excessive reliance on AI-generated content.

• Governance controls for prompts, outputs, human validation, acceptable use, content provenance and organisational accountability.

• Emerging risks from autonomous AI agents, AI-enabled workflows, multimodal systems and increasingly automated organisational processes.

Module 11: Third-Party, Cloud and AI Supply Chain Risk Assurance

• AI vendor risk assessment covering external models, cloud platforms, APIs, datasets, software providers and outsourced AI capabilities.

• Due diligence, contractual requirements, service levels, transparency, security obligations and audit rights for third-party AI arrangements.

• Evaluation of supplier assurance reports, independent assessments, model documentation and control evidence supporting third-party AI assurance.

• Fourth-party dependencies, concentration risk, supply chain vulnerabilities and resilience considerations within interconnected AI ecosystems.

Module 12: AI Monitoring, Continuous Assurance and Data Analytics

• Continuous monitoring of AI performance, risk indicators, control effectiveness, model behaviour, incidents and emerging technology exposures.

• Application of data analytics, anomaly detection, automated testing and exception analysis to AI risk and assurance activities.

• Development of AI key risk indicators, key performance indicators, thresholds, alerts and escalation mechanisms for ongoing oversight.

• Continuous auditing approaches for AI environments where models, datasets, configurations, vendors and business applications change frequently.

Module 13: AI Compliance, Ethics and Human Oversight

• AI compliance considerations involving applicable laws, regulations, organisational policies, contractual requirements and governance expectations.

• Ethical risks involving accountability, fairness, transparency, responsible innovation and appropriate use of artificial intelligence.

• Human-in-the-loop, human-on-the-loop and human-over-the-loop controls for automated and semi-automated decisions.

• Audit assessment of excessive automation, inappropriate reliance on AI, decision displacement and ineffective human review mechanisms.

Module 14: AI Risk Incidents, Resilience and Business Continuity

• Identification and management of AI incidents involving model failures, unreliable outputs, security breaches, data problems and inappropriate decisions.

• AI incident response frameworks, escalation procedures, management responsibilities, communications and post-incident review processes.

• Business continuity and resilience considerations for critical AI-enabled processes, platforms, models and third-party dependencies.

• Recovery, fallback, manual override and contingency controls for situations where AI systems become unavailable or unreliable.

Module 15: AI Audit Evidence, Findings, Reporting and Remediation

• Gathering and evaluating AI audit evidence from governance records, model documentation, datasets, technical controls, monitoring results and business processes.

• Developing AI audit findings that clearly explain control deficiencies, risk exposure, root causes, consequences and supporting evidence.

• Communicating AI assurance results to management, audit committees and governance bodies using clear, balanced and decision-useful reporting.

• Remediation planning, management action tracking, follow-up testing and validation of corrective measures for identified AI risk weaknesses.

Module 16: Advanced AI Assurance Strategy and Emerging Risk Management

• Developing an enterprise AI assurance strategy that integrates internal audit, enterprise risk, cybersecurity, privacy, compliance and technology assurance.

• Advanced assurance considerations for autonomous agents, foundation models, synthetic data, multimodal AI and AI-enabled critical business processes.

• Emerging AI risks involving rapid model evolution, algorithmic dependencies, AI-generated content, technology concentration and autonomous decision-making.

• Future-ready internal audit approaches for continuously evolving AI environments, including assurance innovation, specialist collaboration and continuous risk assessment.

Training Approach

This course will be delivered by our skilled trainers who have vast knowledge and experience as expert professionals in the fields. The course is taught in English and through a mix of theory, practical activities, group discussion and case studies. Course manuals and additional training materials will be provided to the participants upon completion of the training.

Tailor-Made Course

This course can also be tailor-made to meet organization requirement. For further inquiries, please contact us on: Email: training@upskilldevelopment.com Tel: +254 721 331 808

Training Venue 

The training will be held at our Upskill Training Centre. We also offer training for a group (at a discount of 10% to 50%) at requested location all over the world. The Onsite course fee covers the course tuition, training materials, two break refreshments, buffet lunch, airport transfers, Upskill gift package, and guided tour.

Visa application, travel expenses, dinners, accommodation, insurance, and other personal expenses are catered by the participant

Certification

Participants will be issued with Upskill certificate upon completion of this course.

Airport Pickup and Accommodation

Airport pickup and accommodation is arranged upon request. For booking contact our Training Coordinator through Email: training@upskilldevelopment.com, +254 721 331 808

Terms of Payment:

Unless otherwise agreed between the two parties’ payment of the course fee should be done 3 working days before commencement of the training so as to enable us to prepare better.