A preview of my session for internal auditors at the IIA Miami Chapter conference
I started my career as an internal auditor, so this week’s speaking engagement feels a bit like coming home. On Friday, October 30, I will join the Institute of Internal Auditors (IIA) Miami Chapter for AI Under Control: Governance, Audit & Resilience in Practice, a full-day, in-person conference focused on turning AI risk into practical action.
| Event | AI Under Control: Governance, Audit & Resilience in Practice |
|---|---|
| Host | Institute of Internal Auditors (IIA) Miami Chapter |
| Date | Friday, October 30, 2026, 7:30 AM–6:00 PM ET |
| Location | Marriott Fort Lauderdale Airport, 166 N Compass Way, Dania Beach, FL 33004 |
| My session | Before AI: Is Your Data Governance Ready? |
You can find the event details and registration here, and the full conference agenda here.
My session is called “Before AI: Is Your Data Governance Ready?” The subtitle says it all: what internal auditors need to know before the first agent goes live. Here is a preview of what I plan to cover.
Why half of AI projects will fail
Gartner predicts that 50 percent of AI projects will be abandoned. When you look at the reasons, most of them have little to do with the model itself:
- Lack of business value. Pilots never connect to a P&L outcome.
- Poor data readiness. Enterprise context is fragmented and ungoverned.
- Escalating total cost of ownership. Token, infrastructure and rework costs compound.
- Responsible AI as an afterthought. Guardrails get bolted on after deployment.
- Poor change management. Adoption stalls at the last mile.
Notice how many of these are audit questions in disguise. Is the data ready? Are the controls designed in or bolted on? Can we show the value? Internal audit is well placed to ask them early, before the money is spent and the agent is in production.
Seven questions every internal auditor should ask
I have organized the session around seven data readiness tests. For each one, I will share a real-world example from the work we are doing at Tavro.
1. Completeness: Is the enterprise context fully documented?
The key question is simple: what AI agents and models are actually running in our business, and how risky are they? Regulators are paying attention. In one example, a large credit union needed automated risk management for AI models to support regulatory scrutiny, aligned to Federal Reserve SR 26-2 on model risk management. The approach saved 70 risk analyst hours per quarter, with a three-year net benefit of $63K for the risk assessment of a single AI model.
2. Lineage: Can you trace every data input feeding an AI decision?
Auditors need to know how the business actually works end to end, and where the gaps, redundancies and risks are. A de novo credit union used this approach to decide whether it had enough information to justify its National Credit Union Administration (NCUA) Phase 1 charter submission. The analysis supported its addressable membership pool, with estimated savings of $1.2M to $1.9M versus a Big 4 consulting engagement, and $84K realized in the first two weeks.
3. Access controls: Who has access to the data the agent touches?
A commercial bank wanted to use AI to improve IT productivity, starting with triage so that support staff are not paged in the middle of the night for non-critical incidents. The solution integrated a ServiceNow NowAssist agent with the CMDB and with Microsoft Copilot and Teams via the A2A protocol. Savings came to 13 minutes per incident, plus lower attrition from reduced burnout, for a three-year net benefit of $580K.
What matters most for auditors is the governance side. We defined rate limits, intent boundaries and tooling constraints to prevent unlimited incidents in ServiceNow. We scoped data access at the agent tool layer. And we tied authentication and authorization to M365 identity, so unauthorized users cannot create incidents through Copilot.
4. Shadow AI inventory: Do you know about the AI embedded in your applications?
The question I hear from boards is: can we prove, on demand, that our AI use complies with the regulations that apply to us? That is hard to answer if you do not know where AI lives. At another commercial bank, applications in the ServiceNow CMDB did not indicate whether they had embedded AI, which created third-party risk. We used agents to conduct deep research and uncover applications with embedded AI. The result was 3.5 hours saved per application and a three-year net benefit of $184K.
5. Critical data elements: What data is the most valuable?
A municipal utility started by capturing applications and processes to reimagine its move-in/move-out experience with AI. It then extended that work to application rationalization, using agents integrated with Microsoft Copilot to surface rationalization candidates and a work plan. The three-year net benefit is $5.2M, with $1.0M of immediate savings from internal analysis that reduced the cost of a Phase 0 consulting engagement.
The part I find most interesting is the “data crown jewels.” Ten application metadata elements, such as license cost, active users, regulatory classification, contract expiration and vendor support status, are what make the AI scoring model possible. Without accurate, complete metadata, the agents cannot do their job. In my session, I will show how we linked each critical data element to a share of the benefit and to an action plan.
6. AI Strategy: Are you prioritizing use cases across value, cost and risk?
The question is where you should actually be using AI, and how you know it is paying off. For a stablecoin payment rails platform, we scored each AI use case on effort, risk and ROI to drive prioritization. That approach saved $276K versus an AI strategy and roadmap engagement from a Big 4 consulting firm.
7. Regulatory mapping: Is sensitive data mapped to applicable regulations?
A contract clinical trials provider needed to understand the guardrails required for an AI-driven solution for pre-emptive invoicing on milestones. We ingested context from applications, data models, processes and financials, including Veeva eTMF. The outcome includes consistent, auditable milestone validation, clause-level and record-level evidence for every billing decision, and full auditability and lineage supporting ICH E6 Good Clinical Practice, 21 CFR Part 11, HIPAA and SOX. The three-year net benefit is $66.6M.
A new mandate for internal audit
The common thread across these examples is that governance is both a control discipline and a value-creation discipline. Done well, it does not slow AI down. It gives leaders the evidence to scale what works, stop what does not, and show why an investment deserves continued funding.
Internal audit does not need to wait for an AI incident to define its role. It can help management set the questions, evidence and control expectations at the start, and look at the whole decision chain, not just model outputs.
Three questions to take back to your organization
- What AI is already operating inside our processes and third-party applications, including capabilities we did not explicitly buy as “AI”?
- Can we reconstruct an AI-assisted decision, from the business outcome back through the agent, model, data, access path and source system?
- For every priority AI use case, can we show both the control evidence and the realized business value?
Join me in Dania Beach
If you are in South Florida and work in audit, risk, controls or technology, I would love to see you on Friday. The agenda also covers AI inventories and risk tiering, cyber resilience, third-party dependencies and AI-assisted SOX testing, so it should be a very practical day.
Register for the conference here and learn more about my company at www.tavro.ai.
Sunil Soares is Co-Founder of Tavro AI and the author of 13 books on data and AI governance.