The Critical Role of Artificial Intelligence Governance in a World Undergoing Profound Transformation

 

I have been participating in several working groups where we discuss the impact of artificial intelligence (AI) on organizations and society. And I must confess: the deeper I dive into this subject, the more I realize we are living through a moment of transformation far deeper than it seems at first glance.

In recent years, technology has evolved at an unprecedented speed. Innovations that once seemed distant are now knocking on our doors, radically changing how companies operate and compete. If we once spoke of isolated disruptions, we now live in a state of continuous disruption, spanning all areas and directly challenging corporate strategies.

And who is at the center of this revolution? Artificial intelligence, of course. But not AI alone. Technologies like autonomous agents, quantum computing, and neuromorphic computing are reshaping the fabric of organizations and, consequently, of society itself.

What strikes me most is that, despite all this, many professionals and companies have yet to grasp the depth and speed of these changes. And that’s concerning. It could compromise the sustainability of organizations and even the relevance of many professionals.

This new scenario demands more than enthusiasm for innovation. It demands responsibility, structure, and governance. And this is where AI governance comes in—as a viable, necessary, and urgent path to ensure that all this transformation is sustainable, ethical, and strategic.

We are entering an ecosystem of emerging technologies that, when combined, have the potential to completely reshape the fabric of society. More than just new tools, they represent new paradigms.

Much has been said about generative artificial intelligence, which is undoubtedly a milestone. But it’s only the doorway. We are witnessing the convergence of several emerging technologies that together have the power to radically change how we live, work, and relate to one another.

I want to share some of this reflection with you, starting with understanding what is truly happening around us.

Autonomous Virtual Agents

Autonomous virtual agents are not just smarter chatbots. They are systems capable of understanding objectives, making decisions, and executing tasks without continuous human supervision.

These agents are already being tested in financial negotiations, medical diagnostics, and even customer service learning, interacting, and adapting in real time.

Soon we will have our own virtual agent capable of performing simple tasks like receiving our emails, reading, assessing, prioritizing, deciding, and responding as if it were us even carrying out complex operations, such as defining products based on actuarial calculations.

Their ability to operate in complex and dynamic environments raises crucial questions about control, responsibility, and social impact.

Autonomous Robotic Systems

Industrial automation has adopted a new meaning with autonomous robotic systems, where robots not only follow instructions, but they also learn from their environments, correct their paths, collaborate with each other, and make decisions based on data.

Tesla’s Optimus is an example of this, expected to hit the market by 2026, at the price of a vehicle. In sectors such as logistics, healthcare, agriculture, defense, and space, these systems are replacing human labor in critical tasks raising significant questions about employment, ethics, and safety.

Quantum Computing

The promise of quantum computing is simple yet monumental: solving problems that would take a traditional supercomputer millions of years—in just minutes or seconds.

This could transform areas like climate modeling, molecular simulations for new drugs, logistical optimization, and especially cybersecurity.

IBM has already launched the Q System, a commercial quantum computer. Google has achieved “quantum supremacy” by performing a calculation on a quantum computer that would be impossible for classical supercomputers in a reasonable time. Microsoft is advancing in qubit technology, having developed a new quantum chip capable of solving large-scale complex problems.

With this power come significant risks, such as the potential to break encryption systems that underpin the modern internet, exposing sensitive data from governments, companies, and citizens.

Neuromorphic Computing

Although not new—Misha Mahowald and Carver Mead developed the first silicon retina and cochlea, as well as the first silicon neurons and synapses in the 80s neuromorphic computing gain renewed relevance with generative AI.

Inspired by the functioning of the human brain, neuromorphic computing seeks to create systems with learning and adaptation capabilities that closely mirror biological cognition.

This represents a major leap toward the creation of truly autonomous AI, capable of reasoning with context, memory, and emotion.

But it also represents a turning point: how do we regulate machines that think similarly to us?

Observe that what makes this moment unique is not the emergence of one disruptive technology, but the convergence of several.

When autonomous agents operate using neuromorphic neural networks, supported by decisions optimized through quantum algorithms, within robotic ecosystems, we are undoubtedly facing a new form of systemic intelligence—one that, if not properly governed, could surpass our control, with unpredictable consequences.

In 2024, at an AI event, a presenter stated that soon we would have three types of agents operating in companies: human agents, hybrid agents, and android agents.

At the time, I thought, “This speaker is watching too many sci-fi movies.” But today I see how mistaken my view of technological evolution was. Not as an excuse but understand that I’m almost a "time traveler” when I began working half a century ago, the most advanced technology was a manual typewriter, or a communication device called the Telex.

But let’s set aside the nostalgia and continue our reflection. 

Thus, it's clear that beyond the fascination with new technological possibilities, there’s a reality that organizations cannot avoid: the way they operate, protect themselves, and provide accountability is being profoundly reconfigured—so rapidly that it’s difficult to process, adapt to, and integrate innovations into daily operations.

And since companies are made up of people, all this deeply and continuously affects individuals’ lives, requiring them to break paradigms constantly. This contributes significantly to professional burnout and rising depression levels.

Corporate structures are being redefined, and this doesn’t only affect IT it impacts the entire operational ecosystem. Every department is being affected, without exception.

Compliance, risk management, and internal audit—traditionally pillars of corporate governance are directly impacted by this new disruptive ecosystem. Let’s examine:

Compliance

With the rise of autonomous agents and real-time decision-making systems, ensuring legal and ethical compliance is no longer a matter of simply “checking processes.” It now demands continuous monitoring, a deep understanding of the technologies involved, and the ability to respond to unforeseen events.

What happens, for instance, when an autonomous AI makes a biased or unethical decision? How can we ensure systems comply with regulations that are still being formulated?

Risk Management

In today’s landscape of exponential innovation, corporate risk management faces one of its greatest challenges: anticipating the unpredictable.

Technologies like autonomous agents, quantum computing, and neuromorphic systems introduce variables that didn’t exist a few years ago—and often aren’t even recognized as risks until they’ve already materialized.

The traditional risk management model—based on static cycles of identification, analysis, response, and monitoring—was already showing signs of exhaustion and now must be completely reimagined. It lacks the agility and adaptability to handle emerging risks that evolve in a matter of weeks, days, or even hours.

Risk is no longer a possibility—it’s a certainty at some point in the journey. The real differentiator now is the speed and intelligence of the response. This demands new organizational capabilities.

Internal Audit

Internal audit, long the guardian of compliance and efficiency, must now also serve as an interpreter of technological complexity.

With increasingly automated processes and decisions made by autonomous systems, auditing the "who did what" requires understanding algorithms, data flows, and machine learning logic.

More than identifying failures, auditing now requires anticipating risks, evaluating efficiency considering new innovations, assessing ethical impacts, and verifying whether digital governance principles are being upheld.

So, the central question is: How will we, and our organizations deal with all this?

In my view, there is no single answer. But one thing is certain: the first step involves a structured approach to effectively manage this technological disruption in a sustainable way, which we can call artificial intelligence governance.

AI governance is not just a control strategy, it is a foundational approach to ensure digital transformation occurs in alignment with corporate, societal, and ethical interests.

In times of rapid and unpredictable innovation, it serves as the backbone for managing disruption sustainably creating a framework that guides organizations not just to innovate, but to innovate with responsibility and long-term vision.

For our reflection, I believe AI governance must address the following key areas:

Defining Responsibilities

AI governance sets clear responsibilities within the organization. Who is accountable for the ethical and safe use of technology? How do we ensure automated or AI-assisted decisions follow company guidelines and legal standards?

Creating an AI governance committee, for instance with executives from IT, compliance, legal, and ethics, ensure decisions are made in a coordinated and informed way, without overwhelming any single department.

Additionally, governance determines how responsibilities align with strategic objectives. Every new AI project should be evaluated not only for its innovative potential, but also for its strategic, ethical, and regulatory impact.

Committing to AI governance means that, while the organization explores new technological frontiers, it also maintains control over the consequences of innovation.

Defining Security Standards

As technologies advance, security becomes a critical issue—not just in terms of data protection, but also regarding the integrity of automated decisions and system reliability.

AI governance establishes the necessary security standards to protect both sensitive data and autonomous systems. This involves implementing advanced cybersecurity mechanisms and protocols to ensure AI makes decisions that are secure and aligned with the organization’s values.

Preventing bias, ensuring algorithm transparency, and auditing automated decisions are all essential governance practices to ensure technologies are not only effective but also safe and fair.

Operational Formats and Monitoring

Governance also defines the operational structure of AI within the organization—creating frameworks for the development, integration, and management of intelligent systems.

AI implementation must be transparent, continuously monitored, and adjusted as technology evolves.

AI monitoring systems are essential to ensure that even when systems make autonomous decisions they remain within established boundaries.

In addition, AI governance demands ongoing monitoring to detect failures, errors, or unwanted behavioral changes, ensuring that unexpected risks don’t arise.

This monitoring must be integrated into strategic corporate management, aligning technological innovation with organizational goals and culture, so that AI contributes effectively to sustainable and ethical growth.

Note that this topic is much broader and far from exhausted here. Organizations through their Boards of Directors and/or Executive Management must address it quickly, seriously, and assertively.

They must take a leading role in structuring robust governance that permeates the entire organization and this is now urgent and non-negotiable.

I leave you with a thought provoking question for reflection:

How are you and your company addressing this issue?

The journey is just beginning. And despite all the challenges, what truly matters in the end is that we continue to find meaning, build together, and be happy
with ethics, awareness, and purpose.

Comments are welcome! Be happy.

This article was written with the help of human intelligence!

Domain III: Governing the Internal Audit Function, Evolution from the IPPF 2017

Domain III of the Global Internal Audit Standards defines the necessary attributes to ensure that the chief audit executive, together with the board and senior management, maintains the independence of the internal audit function, ensuring its effectiveness.

In the IPPF 2017, the attribute standards already emphasized the need for a solid relationship between internal audit and the board to ensure independence. The new standards expand and strengthen this concept, consolidating essential principles.

This domain is structured into three principles and nine standards, providing the foundation for meeting normative requirements. Below, we highlight the key advancements compared to the previous model.

1. Formalization of Internal Audit Function Authorization

Principle 6 reinforces the need for the board’s formal authorization of the internal audit function, supported by the following standards:

• Standard 6.1 - Audit Mandate
• Standard 6.2 - Audit Charter
• Standard 6.3 - Board and Senior Management Support

The mandate defines the authority, role, and responsibilities of internal audit, which, through a systematic and disciplined approach, aims to enhance governance, risk management, and internal controls.

The Internal Audit Charter becomes an essential document, formalizing the purpose, scope of activities, organizational positioning, responsibilities, and authority of internal audit.

Senior management and the board play a fundamental role in supporting internal audit by ensuring unrestricted access to data, information, and assets, enabling the effective execution of its work.

2. Strengthening Organizational Independence

Principle 7 addresses the independent positioning of internal audit, supported by two standards:

• Standard 7.1 - Organizational Independence
• Standard 7.2 - Chief Audit Executive Qualifications

Independence is ensured through the direct reporting line of the chief audit executive to the board, without interference from senior management. This communication channel must allow open discussions, including without the presence of management.

A new addition is Standard 7.2, which details the desired competencies for the chief audit executive, previously addressed in a general manner under the ethical principle of competence in the IPPF 2017. Now, five essential competencies are explicitly defined:

• Deep understanding of the Global Internal Audit Standards and best practices;
• Experience in establishing and managing an effective internal audit function;
• Certified Internal Auditor® (CIA) designation or equivalent credentials;
• Leadership experience;
• Industry-specific expertise.

This clearer definition strengthens the relevance of internal audit and its ability to add value to corporate governance.

3. Board Oversight of Internal Audit

Principle 8 establishes the board’s responsibility for overseeing internal audit, ensuring its effectiveness. The related standards are:

• Standard 8.1 - Interaction with the Board
• Standard 8.2 - Resources
• Standard 8.3 - Quality
• Standard 8.4 - External Quality Assessment

The board must ensure that internal audit has adequate resources, enabling it to fulfill its mandate efficiently. The chief audit executive must transparently communicate any resource limitations and their impact on the audit plan’s execution.

Quality management is also reinforced, requiring an internal and external quality assessment program, with periodic review by the board.

4. Challenges for Organizations Without a Formal Governance Structure

In organizations lacking a formal board, the concept of independence may be compromised. The definition of a board, according to the global standards glossary, includes any high-level governing body responsible for oversight, such as audit committees or advisory boards.

To ensure compliance in these cases, a more robust external assessment program with documented evidence is recommended, including:

• Board meeting minutes discussing audit-related topics;
• Approved audit charter;
• Validated audit plan and budget;
• Audit manual;
• Continuing education plan for the chief audit executive;
• Records of participation in professional events.

Conclusion

Domain III of the Global Internal Audit Standards enhances concepts already present in the IPPF 2017, emphasizing internal audit independence, qualifications, and board oversight. The board’s role is strengthened in ensuring resources and quality supervision, guaranteeing that internal audit has a strategic impact within the organization.

My recommendation is to conduct a compliance assessment against the standards in this domain and, for any identified gaps, define the necessary actions to ensure adherence.

Be happy!

Produced with the help of human intelligence

Demystifying the concept of risk-based auditing, back to basics

 

Risk has always been at the core of internal auditing, serving as an essential element for defining priorities, evaluating controls, and identifying opportunities for improvement. Risk-based auditing is not an alternative approach or a passing trend; rather, it is the correct and structured way to conduct audits effectively and in alignment with corporate governance. Below, we explore three fundamental aspects that highlight the importance of risk in auditing.

1. Corporate Risk as a Driver for the Annual Audit Plan

Internal auditing must be aligned with the organization's strategic objectives and corporate risks. The development of the Annual Audit Plan should consider the identified risks and prioritize critical areas that could impact business continuity and success.

The Global Internal Auditing Standards reinforce this approach:

• Standard 9.4, under Principle 9, states that the head of audit must develop an audit plan based on a documented assessment of the organization's strategies, objectives, and risks.
• Standard 9.1 requires the audit manager to understand the organization's governance, risk management, operational, and control processes.

By following this structured approach, the audit function ensures that efforts are focused on evaluating high-risk areas, generating real impact, and contributing to a more efficient and secure management process.

2. Evaluating the Effectiveness of Risk Management

Internal auditing plays a crucial role in assessing the effectiveness of risk management. The primary objective is to verify whether the organization's processes and controls are sufficient to keep risks within acceptable levels. To achieve this, auditors should:

• Assess whether the inherent risks in the audited processes have been correctly identified.
• Examine the management of IT risks, ensuring information security and system resilience.
• Evaluate integrity and legal compliance risks, ensuring that the organization adheres to its ethical values, laws, and applicable regulations.
• Analyze whether the established controls are sufficient and effective in mitigating risk factors and keeping them within acceptable limits.
• Recommend improvements to strengthen risk management and enhance process efficiency.

If auditing identifies gaps in risk management, these represent potential vulnerabilities that may compromise the organization's objectives and should be addressed as soon as possible. The same applies to opportunities for improvement or refinements that can enhance operational efficiency.

3. Considering the Risk of Auditing

Beyond evaluating organizational risks, internal auditing must also consider audit risk, which refers to the possibility that the applied auditing procedures and techniques are insufficient to detect failures, non-compliance, or significant events. This risk can be minimized through:

• Proper selection of tests and sampling methods.
• Application of appropriate techniques for data and evidence analysis.
• Use of analytical tools to identify patterns and anomalies.

Ensuring that auditing is rigorously planned and executed using sound methodologies strengthens its credibility and enhances the reliability of findings and recommendations.

Final Reflections

Risk-based auditing is not an option; it is the correct way to ensure that internal auditing delivers real value to the organization. Risk guides planning, directs the assessment of control effectiveness, and demands that auditors remain aware of the limitations of their own analyses. By following this approach, internal auditing strengthens governance and helps the organization become more resilient, transparent, and prepared for future challenges.

Questions for Reflection:

1. Is your organization’s annual audit plan aligned with key strategic risks?
2. Is internal auditing evaluating whether risk management for the audited entity is effective and sufficient to keep inherent, IT, integrity, and legal compliance risks at acceptable levels?
3. How does your audit team assess and mitigate audit risk to ensure reliable results? Are detection risks being considered in the audit planning process?

Reflect on these points and consider how you can contribute to the evolution of internal auditing, ensuring it adds even more value to the organization!

Be happy!

Governance Without Culture Is Just a Concept; With Culture, It Becomes a Transformative Force!

 

Corporate governance, when reduced to rules and bureaucratic processes, is nothing more than a set of cold, disconnected guidelines. Without culture, the essence of what truly sustains ethics, transparency, and excellence in management is lost. Governance is not about rules, it is about behavior. And what shapes behavior? Culture.

If we want governance to go beyond theory and become a transformative force, we must embed it into the organization’s DNA, ensuring that its principles are naturally incorporated into daily decisions and conduct. Without this cultural foundation, governance remains fragile, superficial, and, in many cases, ineffective.

Governance Without Culture: A Structure Without a Soul

Many companies implement governance policies believing that simply adopting codes of conduct, audits, and controls will be enough to ensure integrity and efficiency. However, without a culture that supports these principles, such initiatives become mere formalities—easily bypassed or neglected when pressures and challenges arise.

Culture is what happens when no one is watching. It determines whether professionals follow the rules because they believe in them or are merely out of obligation. In an organization without a governance culture, processes exist but are not lived; guidelines are written but not respected.

When Culture Strengthens Governance

Governance gains strength when it is supported by a solid organizational culture. And this culture is built through examples, consistency, and genuine commitment from leadership. A company that wants to solidify its governance must ensure that its values are not just communicated but practiced.

Organizations with a strong governance culture have teams that understand that best practices are not burdens but foundations for sustainable growth. When this happens, controls are no longer seen as bureaucracy but as tools for protection and excellence.

From Concept to Real Impact

Organizational culture must be the foundation upon which governance is built. To achieve this, some key pillars are essential:

1. Exemplary Leadership – A flawless code of ethics is meaningless if leadership does not practice it. Governance starts at the top. Leaders must embody the values they preach.
2. Alignment Between Speech and Action – Governance cannot be a set of rules disconnected from the company’s reality. It must be integrated into the organization’s identity and purpose.
3. Engagement at All Levels – Effective governance is not just the responsibility of compliance officers or senior management. Every employee must understand their role in building an ethical and sustainable environment.
4. Continuous Education – Culture is not imposed; it is built. This construction happens through training, dialogue, and experiences that reinforce the importance of governance in daily operations.

When governance is anchored in a strong culture, it becomes a natural part of the company. It does not need to be enforced because it is understood, valued, and lived by everyone. Governance without culture is an empty theory; with culture, it is the driving force that propels organizations toward excellence.

 

Be Happy