Rethinking auditing and transparency in the age of A.I.

“We know that we must enter into this new world in a major way—there’s no turning back once the genie is out of the bottle,” said Price.

But Price—a board director at Accenture, Bristol Myers Squibb, and Warner Bros. Discovery—believes that with each step of progress in A.I., companies must act responsibly as they consider different constituents and the implications for privacy and data protection. “There’s no short or easy answer,” Price said.

A group of board directors and executives who met up for a virtual discussion hosted by Fortune on Thursday all broadly agreed that A.I. is a topic requiring at least some board attention. A recent survey of Fortune 500 CEOs shows 59% of companies are already using or experimenting with generative A.I.

Charlotte Simonelli, a board member at consumer data and analytics provider NIQ and CFO of Anywhere Real Estate, said that A.I. was a topic of conversation at NIQ’s board meeting earlier this month, but that it hasn’t yet reached the maturity to warrant a regular dialogue.

“A.I., from my perspective, is still in very early stages at the board,” said Simonelli. That said, she added, it is a requirement of the board to “take a deeper dive in it and scope out all the different facets of the impacts that A.I. can have to make sure we are properly addressing it.” 

Helle Bank Jorgensen, founder and CEO of Competent Boards—which offers online climate and ESG programs—is writing a book on the future of the boardroom, and one key topic surfacing in her research is how to address A.I.

“One issue that I keep hearing, that people have not thought too much about, is where does all the information go, that we are putting into the A.I.,” said Bank Jorgensen. She noted there are a lot of privacy concerns that boards and companies will have to contend with if information is shared with an open system like A.I. that wouldn’t normally be out in the open.

Brian Stafford, president and CEO of software company Diligent, said his company will soon unveil a certification program on A.I. and ethics, because there is such strong interest in the topic. Diligent is also adding a few new A.I. tools to its application in the next 60 days. 

“What was the most frequently talked about subject among our board-member users last year—which was ESG—this year quickly has [become] A.I.,” said Stafford. Price shared a similar view: “It certainly has landed as part of the board discussion on a couple of my boards.”

One challenge, as it pertains to auditing ESG, is that disclosure requirements greatly vary by region. “Having some sort of a global standard would be helpful,” said Stafford. “Most of our clients would argue that ESG is powerful in that it is such a broad umbrella, but it also is a challenge because it covers so many things.” The interpretation in Europe tends to be wider in scope, while in the U.S., it often focuses on carbon footprint and related disclosures, Stafford added.

Price said that ESG must be integrated within the business strategy and that corporations should determine individually where they can have the biggest impact—in either the “E,” the “S,” or the “G.” At Bristol Myers Squibb, where Price serves as a board member, health equity is the best opportunity, which falls within the “S.”

“It is important for businesses to think strategically and where they can have the biggest bang for their buck,” Price said.

Simonelli advised that for “E” and “S,” investors want companies to take a stand. 

“Pick what’s important to you and pick what matters to your company, and be willing to put a stake in the ground around what you are going to do to try to advance things,” Simonelli said. “The expectations are increasing for companies to take a stand on something that matters to them.”

Governance committees tend to focus on the “G,” which, of course, stands for governance. This could result in board members evaluating their colleagues, as well as their own performance, and what sort of training might be needed to support the board. Other teams who may support the governance committee, including functions like legal, may be brought in to provide suggestions for improvement as well. 

Experts on the panel agreed that diversity on boards has become a greater area of focus, and that diversity should include not just race and gender, but also age, experience, and even geography. “Being able to have people on your board who have a different, broader [range] of experience than your management team can be incredibly effective in helping a company to avoid risk and also see opportunity,” said Stafford.

On the subject of internal audits, there is a notion that audit committees are increasingly being asked to measure and assess risk of future events, rather than their typical nature of evaluating the past. 

“When things are audited, it is past tense, but the spirit behind the audit is to prevent future mistakes or mishaps,” said Simonelli, who points to the evolution of cybersecurity, an area of risk assessment that has matured a lot but will continue to evolve in future.

Price suggested internal auditors should be closely involved as businesses enter new technologies or new revenue streams so that controls can be built in at the beginning. 

“You cannot operate a business with zero risk,” Price said. “How do you mitigate the risk as much as you should?…So that you can grow. The role of internal audit is not to say ‘no,’ but to say ‘how?’”