Internal audits, if redesigned for frontier AI, can give boards and regulators stronger, system-wide assurance over catastrophic risks; practical trade-offs—scope (model, system, governance), sourcing, cadence and access to sensitive information—determine effectiveness and must be balanced against security and organizational constraints.

Main Finding

An internal audit function—deliberately designed for frontier-AI developers—can provide durable, board-level, evidence-backed assurance over catastrophic and systemic AI risks. The most effective design integrates multi-level audits (model, system, governance), uses a hybrid sourcing model anchored by an internal Chief Audit Executive (CAE) with external specialists, differentiates audit frequency by risk, and implements tiered/controlled information-access regimes to balance assurance quality with information-security concerns.

Key Points

• Purpose and relevance

  • Internal audit = independent, board‑reporting function that provides enterprise-wide assurance over governance, risk management, and controls.
  • Relevant to regulatory obligations (e.g., EU General-Purpose AI Code of Practice commitment 8) that require board-level assurance over systemic risk management.
  • Complements existing external technical evaluations and security certifications by covering organizational controls and pre-deployment internal use.

• Four core design dimensions

• Audit scope: model-level, system-level, governance-level (or integrated multi-level) - Model-level: most direct view of dangerous capabilities but high cost, high deployment friction, rapid assurance decay. - System-level: checks containment/enforcement (logging, access controls, monitoring); more stable and lower marginal technical expertise needed but cannot quantify true model capability. - Governance-level: checks decision-rights, escalation, board oversight; low cost, low friction, temporally stable but can be disconnected from technical reality. - Multi-level integration yields the most resilient assurance (detects/compensates for degradation in any single layer) but is costliest.
• Sourcing: in-house; co-sourced (internal CAE + external specialists); fully outsourced - Hybrid/co-sourcing anchored by an internal CAE is recommended: preserves board reporting and independence while allowing specialist skills and external credibility. - Fully outsourced maximizes perceived independence but raises security and cultural risks; fully internal reduces security exposure but faces independence/perception challenges.
• Frequency and cadence: annual; semi-annual/quarterly; ad-hoc/rapid; continuous - Model-level assurance requires higher cadence due to rapid capability change; system/governance audits can be less frequent. - Rolling/continuous planning and ad-hoc rapid reviews are important given fast iteration and episodic risk spikes.

• Information access: structural, procedural, operational, technical - High-quality assurance, particularly for model- and system-level audits, requires access to sensitive technical artifacts (evaluations, logs, code, models). - Access raises information-security risks; mitigation options include tiered access, clean-room environments, time-bounded and rate-limited access.

• Implementation trade-offs

  • Assurance quality vs security exposure: more access improves assurance but creates attack surface and leakage risk.
  • Independence vs insider knowledge: purely external auditors may lack necessary context; internal auditors may face perceived or real conflicts.
  • Assurance relevance vs operational friction: higher-frequency, technically deep audits can slow development and add cost.
  • Firms can phase capability: start with governance/system audits and build toward integrated model-level capability as processes and secure information-handling mature.

• Practical mechanisms discussed

  • Risk-based audit planning (audit universe, CAE proposes board‑approved plan).
  • Tiered access models, clean rooms, time-limited credentials to manage sensitive artifact exposure.
  • Differentiated evidence expectations across lifecycle stages (appendix D).

Data & Methods

• Nature of the paper: conceptual and normative analysis rather than empirical evaluation.
• Sources and frameworks drawn upon:
  • Professional internal auditing standards and guidance (Institute of Internal Auditors, IIA).
  • Risk-based assurance theory and established audit practices (IT/cyber/audit frameworks such as COBIT, NIST Cybersecurity Framework).
  • Emerging frontier‑AI governance literature, public developer disclosures, and recent capability assessments (e.g., METR, developer whitepapers).
• Analytical approach:
  • Map conventional internal-audit methodologies and audit types to frontier-AI risk domains.
  • Define option spaces for each design dimension and systematically assess benefits, limitations, and organizational/security trade-offs.
  • Produce prescriptive design guidance and illustrative mechanisms (appendices detail stages of risk-based audit planning, planning cadence options, and access-management techniques).
• Empirical content: no new empirical datasets or experiments; relies on literature synthesis, standards mapping, and scenario-based reasoning.

Implications for AI Economics

• Internal audit as risk-management capital

  • Adds an organizational governance cost (set-up and running costs for CAE, specialist evaluators, secure infrastructure).
  • Produces value by reducing residual systemic risk, improving regulatory compliance, and increasing board/regulator/investor confidence.
  • Should be treated as a form of risk-management investment that can alter expected downside tail risks and thus firm valuations and cost of capital.

• Market structure and competitive dynamics

  • Fixed costs and scarce specialist skills (secure evaluation infrastructure, vetted auditors) can raise barriers to entry; incumbents or well‑capitalized firms may adopt more comprehensive audit systems faster.
  • Conversely, credible internal audit and assurance could be a differentiator, enabling safer public-facing releases and partnerships, and potentially reaping commercial and reputational benefits.

• Pace-of-deployment and race effects

  • High-friction, frequent model-level audits can slow deployment, which may reduce “race” incentives and expected probability of catastrophic outcomes—an important externality for social-welfare analysis.
  • Policy design should consider incentives: if regulators or markets reward audited assurance, firms may internalize safety benefits and choose safer pacing.

• Insurance, liability, and capital allocation

  • Strong internal audit practices improve observability and evidence for insurers, potentially enabling insurance products for certain AI risks and lowering premiums for compliant firms.
  • Audits could also affect liability assessments and contract terms (e.g., procurement, third-party use), altering downstream market behavior and costs.

• Regulatory and policy implications

  • Regulatory standards that recognize internal audit as a compliance mechanism (as in EU Code of Practice) can shift enforcement toward organizational assurance rather than only ex-post sanctions.
  • Economists modeling AI policy should incorporate the heterogeneity of firm assurance capacity and the costs/benefits of different audit designs when evaluating regulation (e.g., scalability of audit requirements, subsidies for SMEs, standardized evidence frameworks).

• Signaling and information externalities

  • Boards’ and firms’ ability to credibly signal effective systemic-risk controls depends on audit independence and credible handling of sensitive evidence; hybrid models anchored by an internal CAE with vetted external specialists can increase signal credibility without undermining security.
  • Standardized assurance frameworks would reduce information asymmetries between firms, investors, and regulators.

Practical considerations for economists and policymakers - In cost–benefit assessments of safety regulation, include internal-audit set-up and operating costs, and model how audit-induced deployment delays change risk trajectories. - Consider incentives/subsidies for smaller developers to avoid concentration of frontier capabilities driven by compliance costs. - Promote standards for evidence handling and auditor accreditation to reduce information-security risk while preserving credibility of assurance.