Interested in this topic? Visit the links below for more resources:
Visit The IIA's website or YouTube channel for related topics and more.
00:00:02
The Institute of Internal Auditors presents all things internal audit tech. In this episode, Antonio Caputi and Alessandro Casarotti joined Ricky Martinez to discuss the impact of AI and financial crime. They explore how AI is being used by criminals, the challenges it presents, and how internal auditors can leverage AI to enhance their controls and detection mechanisms.
00:00:25
Thank you for inviting us.
00:00:27
Thank you Ricardo for the invitation on this podcast.
00:00:31
Thank you both. How are criminals currently?
00:00:35
Using AI for financial crimes.
00:00:37
If we think about pure AI, so where AI really is having currently an impact, AI is an impact on anti on financial crime. When it goes to mainly misinformation.
00:00:51
Misinformation may lead to many different crimes. I think we have most of us already read on the newspaper the presidential fraud, how it evolve now lately with AI where basically the fraudster is impersonating the the CFO for instance.
00:01:11
And.
00:01:12
Calling for a video calls where he's actually sitting with the team and be able to make an happen transaction of 2 million or more through that, because with the possibility of eye to impersonate someone and having the the voice, the ability to speak, that may come very easy. So unfortunately misinformation is something that.
00:01:32
Goes towards say I have a misinformation may impact. For instance also market manipulation if I mean.
00:01:39
Typical Stock Exchange. This the company. I mean, if you spread out misinformation through both AI that can have a huge impact on the pricing or also lead first, then maybe to make the right investment to launder the money and have the right profit from the movement of the stock market. So that's some different aspect that needs to be considered.
00:02:00
And the eye is just at the beginning that both in our criminals are using it because are always at the front front and also our controls are actually being implemented out of that.
00:02:11
OK.
00:02:12
Ohh thank.
00:02:12
And if I surmise correctly, then you're saying that there are new ways of. For example, when you talk about market manipulation like spoofing. Am I on that on that line is?
00:02:22
That correct. Yeah. Yeah, that's correct. That's correct. So I think we're just now exploring all the potentiality and for unfortunately, I mean we are now understanding all the potentiality of AI.
00:02:32
We are just at the beginning, so I think the big problem is that you need to think like criminals to catch criminals because the criminals are always there, step ahead and that's also one of our motto that we have and on that sense I think Antonio also has to say, right.
00:02:50
Yeah, yeah. You know, I want just to watch something that we need to clarify.
00:02:55
That AI it's not a new type of cyber attack, but it's an evolution of it, and the evolution is reflected in the fact that the AI system facilitates the work of criminals and make their attack more complex to detect. So this is good to clarify.
00:03:16
00:03:37
00:03:53
And through that, of course, we touch our was the AML market and our AML controls were going towards and we touch also our AI was implemented into that is the hype and of course we touch was on that topic and was very interesting because basically.
00:04:12
There was a wide majority, almost 80%. That is really focused on transaction monitoring. There is where they see the biggest potentiality and I I think it's quite clear there because what is the benefit of AI benefit of AI is in the prediction in the prediction analysis and therefore where you can limit the risk.
00:04:31
Is to start to predict better your transaction, your fraud, the exposure to transaction and therefore how that can be taken and how can be mitigated towards a better predictive analysis that AI can do and actually was interesting because it was absolutely confirmed by we did the same poll during the.
00:04:51
Intervention today and indeed transaction monitoring was the biggest was picked as the the key topic. So indeed there is where probably the market is seeing it as a key point for implementing their controls.
00:05:06
There are other potential. I mean for sure, screening system, screening against sanctions, for instance, that you can reduce a lot of false positive and so helping the analysts to focus more on the quality side of the review and at the same time also customer due diligence on that side. It can help to for instance just big.
00:05:26
Volume of analysis. You know, when you do complex products like in Luxembourg such as securitization funds and you have maybe to review 600 plus pages. I mean if done by we did some proof of concept where these 600 and plus pages were read in one hour by the machine.
00:05:43
You know with, you know, you come out with analysis and then you can really focus on what are the risks that you need to focus. And that's where you can give a great added value AI.
00:05:52
Yeah, I think in order to reduce the false positive, you need to training. You need to train the system, the AI system, and you also need to train yourself on using AI. Of course, at the beginning you will have a large amount of.
00:06:08
Positive. And then keep training and you will see that the positive will go down the to detection of suspicious transaction. Yeah you need to training the system and of course you need a cyber security professional. Of course you you mentioned the back test. This is these are the traditional way to test. But in this case.
00:06:29
As is a new kind of risk, we don't know too much about that. And so in this case.
00:06:35
I would say also to go with a simple risk assessment and then to compare the residual risk with the risk appetite of the organization. But it's important to keep training the system because it's a machine learning system. So if you learn, if you teach the system, the system can produce better result.
00:06:55
00:07:12
Yielding this erroneous output. Once you create the algorithm, you create the AI tool. It can kind of, you know, generate what is so-called hallucinations, incorrect output out of the tool.
00:07:24
So on that side and we go a bit on the limitation of AI current, I mean everything goes depending on the data that you input. Data quality is the essence to train.
00:07:39
The the system, if you don't have the right data is very simple. Rubbish in rubbish out and that goes together with AI. I mean, if you don't train the algorithm, then of course it will not predict correctly. That's where actually we see the biggest limitation because.
00:07:59
We we sounded the market again also.
00:08:01
That point, and the two biggest limitation where data quality and maturity of the system maturity of the system is clear. I mean, most of the big corporates lives on system that were created by a legacy and implementing AI requires probably first an announcement of their system before moving towards the AI and then to ensure that they will be feeded with the right data.
00:08:24
Because otherwise you can implement the best Ferrari, but if you don't put the right fuel in it will not work.
00:08:31
Yeah, let me add something about the data quality because of course AI, it's a powerful assistant. It's a powerful tool, but it needs to be powered by something in order to be effective. In this case, it's right to talk about data quality and that during the session, we ask the audience.
00:08:52
What makes AI more efficient between data quality, human skills, privacy, ethics and coexistence with existing system? And the results were very interesting, they said. Human skill and data quality. So confirming what Alessandro was saying before.
00:09:09
OK.
00:09:11
That's great. That's great.
00:09:12
If they can complement on that, I think was the greatest outcome of all the conversation we had here during these two days. Also in the strategy 2035 and also of the result of the PwC survey, the sense that the human making, the connection between the machine, the regulation and the results, so the human factor.
00:09:33
Is essential for the.
00:09:34
Position. So really that what was required by the market to support the technological transition to better controls is the human factor. Without human that is able to understand the financial crime itself and make it transform into machine that will never provide then.
00:09:54
Write output at the end.
00:09:57
And I would also like to add something because I know that lots of auditors are listening and the odd question was also to ask if AI will replace auditors.
00:10:13
And of course, lots of people say that yes, I will partially replace auditor, but we showed a statement of a professor, Richard Baldwin, which says that it's not an eye that is going to take your job, but someone.
00:10:33
Who know how to use AI might. So this is very important because the human factor behind it's the human skills that make you unique to your organization and it's the human touch that.
00:10:48
Builds real connection and drive the real changes.
00:10:53
So would you argue then that the the the skill of internal auditors to basically acquire is the prompting this these kind of tools? That's what different would differentiate them in the future?
00:11:04
Yes, they need to know how to use AI and of course someone has to.
00:11:12
Audit AI system. So we need human to audit AI system and also nobody. No technology can communicate as an auditor can communicate to senior management and the Board of directors.
00:11:27
And this is probably one of the key. Also loopholes in this moment most of the.
00:11:34
AI tools. Now that you buy, are a black box behind black box algorithm. So that's very difficult to assess what there is behind and to understand what there is behind. So that's require say specific upskilling on that sense to ensure that the transition is achieving the right out to to have better anti financial crime.
00:11:54
Controls.
00:11:55
And for much of this information that there is about auditing AI like Antonio mentioned Alessandro, the problem with the black box, there's some good materials on the IA with the IA artificial Intelligence Knowledge Center. There are a couple of founding documents and frameworks there that can be leveraged by any internal audit function or any starting auditor or any senior or.
00:12:17
You know, director of audit, that they can begin building that kind of skill set into into the talent of the function.
00:12:26
As we are currently in the IAS internal International Conference right, I also attended one of the conferences that talked about, you know, AI, data analytics and going back to the comment that Alessandro was making earlier about the 600 pages being discovered by this artificial intelligence, here's why where my curiosity.
00:12:46
Those because one of the speakers said.
00:12:49
Probably we're going to get as internal auditors right when we sample, that's going to sound like a foreign word, maybe in the future because we are going to be able to kind of look at 100% of the universe of our transactions when we do an audit instead of just sampling X percentage of the of the transactions. What would be your take on that? Are we are we there yet or are we like?
00:13:09
10 years from now.
00:13:10
Well, in my opinion, not ten years because we are very close to it, I believe of course having 100% of the population.
00:13:20
It's very difficult because it's against the statistic rules. I mean, we always need a little March of error. We can expand our sample, we can be very close to the population. We can reduce the margin of error by think will be very hard.
00:13:40
To analyse the 100% of the population then it depends of the population you are you are analyzing. Of course, if you have a small sample, a small population of course can be possible, but I think in order to have an effective result you always need a small margin.
00:14:00
We talk about black box hallucinations, the false positive at the beginning.
00:14:04
Any other concept that you think that we can bring as a as part of this to to enrich?
00:14:09
This podcast, yes especially for auditors. I believe that, as I said before, AI, it's a very powerful tool, but please avoid a false sense of security because auditors can.
00:14:24
Overestimate.
00:14:26
The the power of the AI and they can may end up having a false sense of security. So my advice is to always adopt A risk based approach.
00:14:40
00:14:56
This is one where critical thinking might be one right. Having that this false sense of security that you just mentioned, auditors need to remain a little bit, you know, vigilant about the output of these tools. They are tools, right? They're not going to substitute. But I think this is where basically right, soft skills like critical thinking is going to.
00:15:15
To help the the internal audit profession kind of distinguish itself, not fully relying on on the on the artificial intelligence tools in terms of the skills that of the future. Why we're talking about Vision 2030.
00:15:28
5.
00:15:29
00:15:34
You know, so you would say, Antonio study, you study accounting your your the accounting background internal audit controls you have more of the economics diplomacy background languages on both sides, right, multilingual professionals so.
00:15:51
Yeah. I I think on that side for I mean we we said I mean.
00:15:55
To transit to technology unit person that require also understanding technology. So indeed multidisciplinary.
00:16:02
Is a something that should be kind of keyword for the talent of the future. I I I do agree with that and there you need to be able to understand everything. So not only the technology but so you don't need to forget the governance part. So the regulatory part.
00:16:22
And also the business part, so you need to be able to connect the tree and make speak the tree of of them which is.
00:16:30
Very complex, mainly when you also go in niche, maybe like is Luxembourg market somehow because we have type of niche, very complex financial products and there you need to be able to understand the financial complexity of the products. That is not straightforward. See how this is applicable on anti financial crime.
00:16:51
Perspective, which are?
00:16:53
Applied also on a regulatory perspective, because regulation media always written always on more general perspective. So when you go in niche market, you need to understand how, let's say you can the take for that and then transform it in a technological solution basically. So how this can really enhance my my control. So you really need to extend.
00:17:13
The type of knowledge that.
00:17:17
Talents have to be to to come in, and that's where probably upskilling is something that is very much required on every level to ensure that the transition is is performed.
00:17:29
Yeah. And the other risk could be that now young generation could rely just on AI without developing human skill without developing their skill. So I think it's very important.
00:17:44
For using AI to develop personal skill as internal auditor and then you can use AI because if you don't know what you are looking for, if you don't know how to drive it, you cannot use AI properly. So please keep studying, keep training yourself and in my case for example.
00:18:05
Well, we are young, but it's another generation. We studied a lot before using AI and it's very important because you have your vision and then you try to adapt the vision to the new vision and to the new approach.
00:18:23
Antonio, Alessandro, thanks a lot for your contribution to the internal audit profession. We would really like to thank you Gratia Mile.
00:18:31
Gracia, thank you so much.
00:18:32
Ricardo, thank you, Ricardo, for the invitation, my, our pleasure.
00:18:36
Enjoying the episode? Hear more from today's guests Antonio and Alessandro, as featured speakers at the IAS 2025 Fraud Virtual Conference happening on February 20th. This is your chance to explore the latest in fraud prevention and detection guided by industry experts, all from wherever you are. Visit theia.org or check the show.
00:18:57
Notes to register today and secure your spot you.
00:19:00
Won't want to miss.
00:19:01
If you like this podcast, please subscribe and rate US. You can subscribe wherever you get your podcast. You can also catch other episodes on our YouTube channel at the dia.org that's theiia.org.
