Emerging Technology Considerations

Why this topic matters

New technologies change how transactions are processed, what risks exist, and what controls are needed. Information Systems and Controls (ISC) tests the fundamentals of artificial intelligence (AI), blockchain and crypto assets, the Internet of Things (IoT), and other emerging technologies — and, above all, the governance and control considerations each one raises.

Artificial intelligence and machine learning

• Machine learning models learn patterns from data rather than following explicit rules — used for anomaly detection, forecasting, invoice classification, and credit scoring.
• Generative AI (large language models) produces text, code, and images — used for drafting, summarizing contracts, and answering questions.

Risks

Risk	Description
Inaccuracy ("hallucination")	Plausible but false outputs — citations, figures, or legal conclusions that don't exist
Bias	Models trained on biased data produce unfair or skewed results
Lack of explainability	"Black box" models make it hard to understand or evidence decisions
Data leakage and confidentiality	Entering client or personal data into public AI tools may disclose it
Model drift	Performance degrades as real-world data changes
Security threats	Prompt injection, data poisoning, and AI-enabled phishing and deepfakes (for example, fake executive voice calls authorizing payments)

Controls

• An AI governance policy — approved tools and uses, an inventory of models, risk classification, and accountability.
• Model risk management: validation before use, documentation of training data and assumptions, performance monitoring, and periodic revalidation.
• Human review of outputs used for decisions or reporting ("human in the loop").
• Data controls — no sensitive data in unapproved tools; enterprise agreements that keep data private.
• Frameworks: the National Institute of Standards and Technology (NIST) AI Risk Management Framework (govern, map, measure, manage) and emerging laws such as the European Union (EU) AI Act.

Blockchain and distributed ledger technology

• A blockchain is a distributed, append-only ledger shared across a network. Transactions are grouped into blocks, each linked to the previous one by a cryptographic hash, making records tamper-evident.
• Consensus mechanisms (proof of work, proof of stake) let participants agree on the valid ledger without a central authority.
• Public (permissionless) blockchains are open to anyone; private (permissioned) blockchains restrict participation — common in enterprise supply chain and settlement uses.
• Smart contracts are programs on a blockchain that execute automatically when conditions are met — errors in their code execute automatically too.

Crypto assets

• Control over crypto assets means control of the private keys. Key loss or theft means loss of the assets — key management (hardware wallets, multi-signature approvals, custody arrangements) is the critical control.
• Accounting: in-scope crypto assets are measured at fair value through net income under Accounting Standards Update (ASU) 2023-08.
• Audit considerations: evidence of existence and ownership (proving control of keys), reliability of blockchain data, custodians' System and Organization Controls (SOC) reports, related parties, and valuation.
• A blockchain proves that a transaction was recorded, not that it was appropriate, authorized, or correctly classified.

Internet of Things

• Networked sensors and devices — inventory tracking, equipment monitoring, smart meters — generating large volumes of data.
• Risks: weak default passwords, unpatched firmware, and devices as entry points to the network.
• Controls: device inventory, network segmentation, changing default credentials, firmware updates, and monitoring.

Other emerging technologies

Technology	Considerations
Robotic process automation	Bot credentials, change management, failure monitoring (see Business Processes & Automation)
Big data and cloud data platforms	Data governance, lineage, and access control at scale
Low-code and no-code tools, and end-user computing	Business users building applications and spreadsheets outside information technology (IT) change controls — inventory and control critical ones
Quantum computing	A future threat to today's public key encryption; organizations are beginning to inventory cryptography and plan migration to quantum-resistant algorithms (NIST published post-quantum standards in 2024)
Digital twins and augmented reality	Operational uses; data integrity and security of connected systems

A framework for evaluating any new technology

1. Governance: who approves adoption, owns the risk, and oversees use?
2. Risk assessment: what new risks arise for confidentiality, integrity, availability, compliance, and financial reporting?
3. Controls: do existing IT general controls cover it (access, change, operations)? What new controls are needed?
4. Third parties: which vendors are involved, and what assurance do they provide?
5. Monitoring: how will performance and control effectiveness be tracked?
6. Audit impact: how will evidence be obtained, and do auditors need specialists?

How it is tested

• Identify risks and controls for AI and generative AI.
• Explain blockchain concepts — hashing, consensus, smart contracts — and their limits.
• Identify key controls for crypto assets and Internet of Things devices.
• Apply a governance framework to a new technology.