As compliance professionals, our roles evolve constantly, shaped by new technologies and emerging risks. One of the most significant developments in recent years has been the rapid growth of artificial intelligence (AI) and machine learning systems in the corporate environment. The 2024 Evaluation of Corporate Compliance Programs (2024 ECCP), under the Management of Emerging Risks to Ensure Compliance with Applicable Law section, asked several key questions.

• What is the company’s approach to governance regarding the use of new technologies, such as AI, in its commercial business and compliance program?
• How is the company curbing any potential adverse or unintended consequences resulting from using technologies, both in its commercial business and its compliance program?
• How is the company mitigating the potential for deliberate or reckless misuse of technologies, including by company insiders?
• To the extent that the company uses AI and similar technologies in its business or as part of its compliance program, are controls in place to monitor and ensure its trustworthiness, reliability, and use in compliance with applicable law and the company’s code of conduct?
• Do controls exist to ensure the technology is used only for its intended purposes?
• What baseline of human decision-making is used to assess AI?
• How is accountability over the use of AI monitored and enforced?

One key tool for answering many of these questions is auditing. In his recent article in the Harvard Business Review, What Leaders Need to Know About Auditing AI, author Luca Belli outlines crucial insights that business leaders must understand about auditing AI. I have adapted his thoughts for a Chief Compliance Officer and compliance professional.

While audits are becoming a core feature of working with AI, they do not have a predetermined process that follows a straight line; rather, they are a web of different decisions, both from the business and the technical side. Specifically, audits often face four core challenges: 1) they do not follow a straight line, 2) data governance is messy, 3) they require internal trust, and 4) they focus on the past. Leaders can take steps to help audits succeed. Compliance professionals can help instill the right culture and incentives and help design the audit. During the audit, they can shape the process and remove red tape.

AI is no longer confined to back-end analytics. It has stepped confidently into customer-facing roles, making decisions in critical areas such as finance, healthcare, and housing. With such reach and influence, AI poses significant ethical, reputational, and legal risks if left unchecked. Audits of AI systems, therefore, have become a cornerstone of modern compliance frameworks. Policymakers worldwide, including through the EU’s Digital Services Act and New York City’s AI bias law, are mandating external audits of AI systems. Even where not mandated, businesses voluntarily engage in audits to manage risk, mitigate potential crises, and anticipate regulatory developments.

However, auditing of AI is not straightforward. Compliance professionals must understand four fundamental challenges inherent in AI audits.

1. Non-linear Audit Processes

AI audits rarely follow a straight, predictable path. Instead, they often resemble a “random walk,” as auditors must continually adjust their focus based on emerging data and shifting business needs. Consider an audit to detect racial bias in decision-making algorithms where direct data on race is unavailable. Auditors may pivot to proxy measures like zip codes to approximate racial data. This approach, while practical, introduces discrepancies and limitations that must be carefully managed and transparently documented.

2. Complex Data Governance

Effective auditing relies heavily on data governance practices, yet data management often resembles an “old building” layered with historical inefficiencies rather than a clean, structured system. Many organizations struggle to locate and interpret data due to outdated documentation or employee turnover. Compliance teams must actively collaborate with technical teams to ensure data accuracy and completeness. As Belli suggests, robust internal documentation and dedicated data custodians can significantly ease this challenge.

3. Building Internal Trust

Audits can strain internal team dynamics, particularly if audit results lead to perceived criticisms of operational decisions. Compliance professionals must proactively foster a culture of trust, reinforcing that audits are not punitive but integral to operational excellence. As Belli notes, incentives should align accordingly: supporting audits should positively influence personal and professional evaluations, signaling organizational value in transparency and continuous improvement.

4. Historical Focus and Technical Limitations

Most audits evaluate past performance, and evolving AI systems and datasets pose challenges in replicating historical conditions. A user deleting their profile data or changes in system algorithms can complicate audits significantly. Compliance professionals must advocate for real-time monitoring or, at minimum, detailed record-keeping, ensuring auditors have sufficient context to interpret their findings and recommendations accurately.

Given these complexities, how can corporate compliance officers effectively lead their organizations through AI audits? Belli provides several practical steps:

• Proactive Preparation: Companies should not wait for external mandates to build auditing capabilities. By establishing internal audit teams or clearly defined points of contact within existing teams, organizations can swiftly respond to audit needs while minimizing operational disruption.
• Cultural Alignment: Corporate culture profoundly impacts audit effectiveness. Compliance professionals must champion transparency and accountability at the highest organizational levels, ensuring that audits are critical to long-term business success rather than occasional inconveniences.
• Strategic Audit Design: Choosing between external auditors and internal audit teams requires careful consideration of organizational dynamics. Internal teams offer in-depth institutional knowledge, while external auditors provide objective perspectives without internal friction. Belli suggests a hybrid model, often ideal, balancing centralized expertise with distributed operational familiarity.
• Leadership Engagement: Active, informed involvement by senior leadership during audits can clarify organizational priorities and remove operational roadblocks. Leaders should regularly engage with technical teams to understand key decisions, encourage thorough documentation, and ensure audit findings align clearly with broader business objectives.

The author underscores the CCO’s crucial role in navigating the nuanced landscape of AI auditing. As technology’s reach expands, compliance teams must proactively address these emerging complexities, continually adapting their oversight frameworks to meet the dynamic challenges presented by AI systems. By fostering robust internal collaboration, aligning incentives, and strategically preparing audit infrastructure, compliance professionals not only mitigate risks but also enable their organizations to harness AI’s transformative potential responsibly and ethically.