Balance the benefits with the risks of emerging technology

The business environment is changing rapidly and presents new challenges for organizations to overcome. Companies face changing stakeholder needs, uncertain economic conditions, increased regulations and many other unforeseen circumstances, such as a global pandemic.

To stay competitive, many companies are turning to emerging technologies. According to ISACA’s “The Pulse: Emerging Technology 2021” survey, emerging technologies can disrupt established markets by solving a current problem or issue. However, the benefits of emerging technologies must be carefully weighed against their challenges.

Benefits of emerging technologies

A well-known example of an emerging technology is AI. This technology has many facets, including machine learning, natural language processing and speech recognition. Almost 50% of the more than 4,500 global respondents to the ISACA survey indicated that they already use AI technology (22%) or are in the planning and trial stages of adopting it (27%).

Companies that have adopted emerging technologies, such as AI, hope to take advantage of the competitive advantages these technologies can provide. For example, cost savings and increased revenue are made possible through increased efficiency and improved customer products and experiences.

Companies can accelerate the adoption of emerging technologies by investing widely across the company and using technologies in a way where the responsibility lies with the process owner. This approach generates better cost savings as process owners can solve a business problem specific to them, leading to operational efficiency and an increase in quality analysis.

Internal audit can also embrace AI technologies to improve risk monitoring and control effectiveness. In a use-case-specific example, machine learning can be used to analyze general ledger data and spot incorrect or fraudulent journal entries among thousands of other transactions. Note that larger and more complex business problems — which may have a broader impact across multiple areas of the business or have aspects that pose greater risk to the company — will require collaboration and consultation with data scientists, who may be internal staff or consultants .

Risks of emerging technologies

Companies adopting emerging technologies must consider not only the benefits but also the risks associated with these technologies. To develop an understanding of individuals’ perceptions, the ISACA survey asked respondents to indicate their views on the risks of adopting AI technology. Most respondents rated the risks associated with AI as low (30%) or medium (33%), while only 9% rated AI as a high risk. In practice, companies must consider the maturity and complexity of the business processes using AI to determine actual risk to the company.

One risk is that these emerging technologies will not meet companies’ expectations. To combat this risk, a clear vision must be established and supported by defined objectives with realistic targets. Due diligence involves thorough research to identify requirements for new projects that have a significant impact on the company. IT governance should play a significant role as emerging technologies are integrated into the business, including representation across different IT groups — such as application development, security and infrastructure — within the IT governance process. This will enable communication across various parts of the business and help identify additional needs, while streamlining project implementation. Monitoring and regular status updates should be communicated to senior leadership throughout the project, as well as post-launch to help determine if ROI was achieved or miscalculated.

Risks can also arise from changing regulations that can limit the success of an emerging technology. For example, privacy laws related to the collection of consumer data may hinder a company’s ability to successfully use certain emerging technologies by disrupting current products and services in production. New regulations are imminent, particularly around algorithmic bias for technologies that affect customers. Continuous monitoring of new regulations and agile development processes are necessary to ensure that models comply with changing and new regulations.

Finally, there is a risk that a misconfiguration of the technology could cause an algorithm error problem, which would affect data quality and create threats to data security. These risks can be mitigated by putting strong change management processes in place. These processes ensure that test cases are efficiently designed and executed, that version controls appropriately record changes to models and source code repositories, and that peer reviews are performed for coding and model changes. Additionally, during the planning and construction phase, it is critical to be mindful of the dataset to identify potential biases and ethical dilemmas.

The adoption of emerging technologies can create competitive advantages, but these advantages naturally come with risk. Process owners can take a proactive approach to identifying risks by engaging in internal audit or enterprise risk management. Starting discussions about risks and controls early in the technology’s implementation will help identify any unaddressed issues and process improvements and ensure that emerging technologies are successfully integrated into the business.

About the AuthorJacob Young, CISA, is a senior IT auditor at Protective Life Insurance Company, specializing in IT audits of application development, infrastructure, operations and cybersecurity. He also assists financial and operational audit teams with data analytics initiatives. He currently serves as the webmaster on the ISACA Birmingham Chapter’s board of directors and is a contributor to the ISACA Now Blog. His previous experience includes external auditing of clients in various industries, including financial services, manufacturing and nonprofit organizations.