Beyond Intuition: Redefining Internal Audit Risk Assessments Through Machine Learning Paradigms

Abstract

Established literature has found that Internal Audit Functions (IAF) increasingly view AI- powered innovation as being indispensable to continue staying relevant in the light of in- creased organisational complexity and regulatory expectations. This thesis explores opportunities to deploy Machine Learning (ML) capabilities to assess how IAFs can benefit from increased precision, objectivity and efficiency for delivering internal audit risk assessments. Specifically, this thesis explores how the risk assessment process, a fundamental component of the audit lifecycle, can be redefined through ML to generate measurable value for the IAF. In doing so, this thesis makes several researched assumptions and acknowledges the impact of relevant limitations. Three research questions were framed for evaluation throughout the thesis, to explore the relevance and findings of prevailing literature, identify suitable ML techniques for practical implementation, and measure value from any proposed implementations. In doing so, the thesis supplements the findings of prior academic research, whilst laying the groundwork for further practical improvement by other IAFs. The thesis applied multiple ML techniques to answer these research questions, combining academic ML principles with real-world datasets and implementation techniques, offering a meaningful starting point for IAFs looking to improve their approach to internal audit risk assessments. Three rounds of experiments were performed to reframe risk assessments as specific problem statements for ML models, supported by (1) an examination of the ex- tant risk assessment methodology used by the Senior Leadership Team (SLT) at the subject organisation, a world-leading financial services firm, (2) an analysis of organisational data relevant to the risk assessment, anonymised for the purposes of this thesis, and (3) the construction and application of several ML hypotheses on this dataset. The conclusions of these experiments were consolidated to answer the research questions, including an assessment of how the value arising from such efforts could be measured for continued sponsorship and improvement. Overall, the thesis noted that there is no single best ML approach for practical implementation in all cases, and that the choice of ML models would vary based on the quality of underlying data, consistent audit methodologies, as well as the size of the dataset including the final set of input features. The thesis found that a supervised machine learning approach was most suitable for internal audit risk assessments, given the high class-specific precision ratio of the final model (c.88%) on the test dataset. However, the thesis noted significant dependencies on high-quality datasets and a requirement to carefully curate relevant features to ensure meaningful model outputs. Although the thesis evaluated unsupervised machine learning techniques, these were discounted from practical implementation due to comparatively lower accuracy, inhibiting practical implementation for the given dataset. However, the thesis also noted that such techniques may generate better results in alternative practical settings, where significantly larger datasets are used for risk assessment cycles.