Artificial intelligence and machine learning
AI models learn patterns from training data rather than following explicitly coded rules. That shifts the control questions:
- Data quality and bias — a model trained on biased or unrepresentative data will produce biased outputs at scale
- Explainability — can the organization explain why a model reached a conclusion? This matters enormously for credit, hiring, and accounting estimates
- Model drift — performance degrades as real-world conditions diverge from training conditions, requiring ongoing monitoring and periodic retraining
- Human oversight — who reviews and can override model output, and at what threshold?
- Change management over models — retraining is a change and needs approval and testing, just like code
IMPORTANT: Using AI does not transfer accountability. If a model generates an accounting estimate, management still owns that estimate and must be able to support the assumptions and evaluate the output for reasonableness.
Blockchain and distributed ledgers
| Property | Control implication |
|---|---|
| Immutable, append-only ledger | Strong integrity and audit trail — but errors cannot be edited, only corrected by a new offsetting entry |
| Distributed consensus | No single point of trust; reduces reliance on a central intermediary |
| Smart contracts | Self-executing code — a bug executes automatically and at scale, so pre-deployment code review is critical |
EXAMPLE: A blockchain proves a transaction was recorded and not subsequently altered. It does not prove the transaction was authorized, correctly valued, or that the goods actually exist — so existence and valuation still require traditional audit evidence.
IoT and connected devices
Sensors and connected equipment expand the attack surface dramatically. Common weaknesses: default credentials never changed, firmware that is rarely patched, and devices deployed on the same network segment as financial systems. Network segmentation is the primary mitigating control.
EXAM TIP: For any emerging technology, the exam tends to reward the same instinct: identify what the technology does and does not assure, then apply conventional control concepts — access, change management, monitoring, and human oversight — to the new context.