Frontier AI developers need an internal audit function

• URL: http://arxiv.org/abs/2305.17038v2
• Date: Sat, 05 Oct 2024 14:10:00 GMT
• Title: Frontier AI developers need an internal audit function
• Authors: Jonas Schuett,
• Abstract summary: Article argues that frontier artificial intelligence (AI) developers need an internal audit function. In light of rapid progress in AI research and development, frontier AI developers need to strengthen their risk governance.
• Score: 0.2913760942403036
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: This article argues that frontier artificial intelligence (AI) developers need an internal audit function. First, it describes the role of internal audit in corporate governance: internal audit evaluates the adequacy and effectiveness of a company's risk management, control, and governance processes. It is organizationally independent from senior management and reports directly to the board of directors, typically its audit committee. In the IIA's Three Lines Model, internal audit serves as the third line and is responsible for providing assurance to the board, while the Combined Assurance Framework highlights the need to coordinate the activities of internal and external assurance providers. Next, the article provides an overview of key governance challenges in frontier AI development: dangerous capabilities can arise unpredictably and undetected; it is difficult to prevent a deployed model from causing harm; frontier models can proliferate rapidly; it is inherently difficult to assess frontier AI risks; and frontier AI developers do not seem to follow best practices in risk governance. Finally, the article discusses how an internal audit function could address some of these challenges: internal audit could identify ineffective risk management practices; it could ensure that the board of directors has a more accurate understanding of the current level of risk and the adequacy of the developer's risk management practices; and it could serve as a contact point for whistleblowers. In light of rapid progress in AI research and development, frontier AI developers need to strengthen their risk governance. Instead of reinventing the wheel, they should follow existing best practices. While this might not be sufficient, they should not skip this obvious first step.

Related papers

• Frontier AI Risk Management Framework in Practice: A Risk Analysis Technical Report v1.5 [61.787178868669265]
  This technical report presents an updated and granular assessment of five critical dimensions: cyber offense, persuasion and manipulation, strategic deception, uncontrolled AI R&D, and self-replication.<n>This work reflects our current understanding of AI frontier risks and urges collective action to mitigate these challenges.
  arXiv  Detail & Related papers  (2026-02-16T04:30:06Z)
• Frontier AI Auditing: Toward Rigorous Third-Party Assessment of Safety and Security Practices at Leading AI Companies [57.521647436515785]
  We define frontier AI auditing as rigorous third-party verification of frontier AI developers' safety and security claims.<n>We introduce AI Assurance Levels (AAL-1 to AAL-4), ranging from time-bounded system audits to continuous, deception-resilient verification.
  arXiv  Detail & Related papers  (2026-01-16T18:44:09Z)
• How frontier AI companies could implement an internal audit function [0.0]
  Internal audit could play a central role in strengthening safety governance.<n>This paper examines how an internal audit function could be designed to provide meaningful assurance for frontier AI developers.
  arXiv  Detail & Related papers  (2025-12-16T20:36:58Z)
• International AI Safety Report 2025: Second Key Update: Technical Safeguards and Risk Management [115.92752850425272]
  Second update to the 2025 International AI Safety Report assesses new developments in general-purpose AI risk management over the past year.<n> examines how researchers, public institutions, and AI developers are approaching risk management for general-purpose AI.
  arXiv  Detail & Related papers  (2025-11-25T03:12:56Z)
• Never Compromise to Vulnerabilities: A Comprehensive Survey on AI Governance [211.5823259429128]
  We propose a comprehensive framework integrating technical and societal dimensions, structured around three interconnected pillars: Intrinsic Security, Derivative Security, and Social Ethics.<n>We identify three core challenges: (1) the generalization gap, where defenses fail against evolving threats; (2) inadequate evaluation protocols that overlook real-world risks; and (3) fragmented regulations leading to inconsistent oversight.<n>Our framework offers actionable guidance for researchers, engineers, and policymakers to develop AI systems that are not only robust and secure but also ethically aligned and publicly trustworthy.
  arXiv  Detail & Related papers  (2025-08-12T09:42:56Z)
• Third-party compliance reviews for frontier AI safety frameworks [2.9934116374607083]
  This paper explores a potential solution: third-party compliance reviews.<n>An independent external party assesses whether a frontier AI company is complying with its safety framework.
  arXiv  Detail & Related papers  (2025-05-03T00:53:55Z)
• AI Behind Closed Doors: a Primer on The Governance of Internal Deployment [33.99253912746621]
  Internal deployment is a key source of benefits and risks from frontier AI systems. This report aims to address this absence by priming a conversation around the governance of internal deployment. It discusses the risks correlated to the loss of control via the internal application of a misaligned AI system to the AI research and development pipeline.
  arXiv  Detail & Related papers  (2025-04-16T15:21:13Z)
• Media and responsible AI governance: a game-theoretic and LLM analysis [61.132523071109354]
  This paper investigates the interplay between AI developers, regulators, users, and the media in fostering trustworthy AI systems. Using evolutionary game theory and large language models (LLMs), we model the strategic interactions among these actors under different regulatory regimes.
  arXiv  Detail & Related papers  (2025-03-12T21:39:38Z)
• Securing External Deeper-than-black-box GPAI Evaluations [49.1574468325115]
  This paper examines the critical challenges and potential solutions for conducting secure and effective external evaluations of general-purpose AI (GPAI) models. With the exponential growth in size, capability, reach and accompanying risk, ensuring accountability, safety, and public trust requires frameworks that go beyond traditional black-box methods.
  arXiv  Detail & Related papers  (2025-03-10T16:13:45Z)
• A Frontier AI Risk Management Framework: Bridging the Gap Between Current AI Practices and Established Risk Management [0.0]
  The recent development of powerful AI systems has highlighted the need for robust risk management frameworks. This paper presents a comprehensive risk management framework for the development of frontier AI.
  arXiv  Detail & Related papers  (2025-02-10T16:47:00Z)
• Engineering Trustworthy AI: A Developer Guide for Empirical Risk Minimization [53.80919781981027]
  Key requirements for trustworthy AI can be translated into design choices for the components of empirical risk minimization. We hope to provide actionable guidance for building AI systems that meet emerging standards for trustworthiness of AI.
  arXiv  Detail & Related papers  (2024-10-25T07:53:32Z)
• Responsible AI Question Bank: A Comprehensive Tool for AI Risk Assessment [17.026921603767722]
  The study introduces our Responsible AI (RAI) Question Bank, a comprehensive framework and tool designed to support diverse AI initiatives. By integrating AI ethics principles such as fairness, transparency, and accountability into a structured question format, the RAI Question Bank aids in identifying potential risks.
  arXiv  Detail & Related papers  (2024-08-02T22:40:20Z)
• Open Problems in Technical AI Governance [93.89102632003996]
  Technical AI governance refers to technical analysis and tools for supporting the effective governance of AI. This paper is intended as a resource for technical researchers or research funders looking to contribute to AI governance.
  arXiv  Detail & Related papers  (2024-07-20T21:13:56Z)
• AI Risk Management Should Incorporate Both Safety and Security [185.68738503122114]
  We argue that stakeholders in AI risk management should be aware of the nuances, synergies, and interplay between safety and security. We introduce a unified reference framework to clarify the differences and interplay between AI safety and AI security.
  arXiv  Detail & Related papers  (2024-05-29T21:00:47Z)
• Affirmative safety: An approach to risk management for high-risk AI [6.133009503054252]
  We argue that entities developing or deploying high-risk AI systems should be required to present evidence of affirmative safety. We propose a risk management approach for advanced AI in which model developers must provide evidence that their activities keep certain risks below regulator-set thresholds.
  arXiv  Detail & Related papers  (2024-04-14T20:48:55Z)
• Approaching Emergent Risks: An Exploratory Study into Artificial Intelligence Risk Management within Financial Organisations [0.0]
  This study aims to contribute to the understanding of AI risk management in organisations through an exploratory empirical investigation into these practices. In-depth insights are gained through interviews with nine practitioners from different organisations within the UK financial sector. The findings of this study unearth levels of risk management framework readiness and prevailing approaches to risk management at both a processual and organisational level.
  arXiv  Detail & Related papers  (2024-04-08T20:28:22Z)
• A Safe Harbor for AI Evaluation and Red Teaming [124.89885800509505]
  Some researchers fear that conducting such research or releasing their findings will result in account suspensions or legal reprisal. We propose that major AI developers commit to providing a legal and technical safe harbor. We believe these commitments are a necessary step towards more inclusive and unimpeded community efforts to tackle the risks of generative AI.
  arXiv  Detail & Related papers  (2024-03-07T20:55:08Z)
• Risks of AI Scientists: Prioritizing Safeguarding Over Autonomy [65.77763092833348]
  This perspective examines vulnerabilities in AI scientists, shedding light on potential risks associated with their misuse.<n>We take into account user intent, the specific scientific domain, and their potential impact on the external environment.<n>We propose a triadic framework involving human regulation, agent alignment, and an understanding of environmental feedback.
  arXiv  Detail & Related papers  (2024-02-06T18:54:07Z)
• Managing extreme AI risks amid rapid progress [171.05448842016125]
  We describe risks that include large-scale social harms, malicious uses, and irreversible loss of human control over autonomous AI systems. There is a lack of consensus about how exactly such risks arise, and how to manage them. Present governance initiatives lack the mechanisms and institutions to prevent misuse and recklessness, and barely address autonomous systems.
  arXiv  Detail & Related papers  (2023-10-26T17:59:06Z)
• International Institutions for Advanced AI [47.449762587672986]
  International institutions may have an important role to play in ensuring advanced AI systems benefit humanity. This paper identifies a set of governance functions that could be performed at an international level to address these challenges. It groups these functions into four institutional models that exhibit internal synergies and have precedents in existing organizations.
  arXiv  Detail & Related papers  (2023-07-10T16:55:55Z)
• Frontier AI Regulation: Managing Emerging Risks to Public Safety [15.85618115026625]
  "Frontier AI" models could possess dangerous capabilities sufficient to pose severe risks to public safety. Industry self-regulation is an important first step. We propose an initial set of safety standards.
  arXiv  Detail & Related papers  (2023-07-06T17:03:25Z)
• Three lines of defense against risks from AI [0.0]
  It is not always clear who is responsible for AI risk management. The Three Lines of Defense (3LoD) model is considered best practice in many industries. I suggest ways in which AI companies could implement the model.
  arXiv  Detail & Related papers  (2022-12-16T09:33:00Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.