# Deepfakes and AI Fraud Risks for Internal Auditors

An episode of [All Things Internal Audit](https://invisiblenetwork.ai/podcast/1758983201), 13 Jan 2026, 31 min.

Audio: https://traffic.libsyn.com/secure/1984d534-f92f-4772-a722-6ac47400e67e/ATIA_Tech_-_AI_Deepfakes_MP3.mp3?dest-id=3677289

The Institute of Internal Auditors Presents: All Things Internal Audit Deepfakes are reshaping fraud, trust, and evidence, and challenging what organizations can rely on as "proof." In this episode, Andrew Guasp speaks with Corey Chadderton about how AI-generated media is being used to impersonate leadership and bypass controls, why the barriers to entry have collapsed, and what internal auditors must do to strengthen governance, training, and response as these risks accelerate into 2026. HOST:Andrew Guasp, CIA, CFE Senior manager, Standards & Professional Guidance, The IIA GUEST:Corey Chadderton, IAP Internal Auditor, Barbados Water Authority KEY POINTS: • Introduction to Deepfakes and Audit Risk \[00:00:02–00:00:40\] • What Are Deepfakes and Why Auditors Must Pay Attention \[00:00:40–00:02:40\] • How Deepfake Technology Works (Without Becoming a Technical Expert) \[00:02:50–00:04:10\] • Deepfakes as a "Force Multiplier" for Fraud \[00:04:20–00:06:22\] • Real-World Deepfake Fraud and Governance Failures \[00:06:24–00:08:36\] • Reputational Risk, Content Monitoring, and Trust Breakdown \[00:08:36–00:09:32\] • Where Organizations Are Most Vulnerable Today \[00:09:51–00:12:59\] • Applying Cyber Testing Techniques to Deepfake Risk \[00:13:10–00:13:55\] • Red Flags and Indicators of Manipulated Media \[00:14:04–00:16:10\] • The Power of the Pause and Training Against Urgency Attacks \[00:16:13–00:18:22\] • Limits of Deepfake Detection Tools and the Human Factor \[00:18:28–00:22:01\] • Professional Skepticism Beyond the Audit Function \[00:22:01–00:23:51\] • Internal Audit's Advisory Role in Policies and Incident Response \[00:24:02–00:27:14\] • Staying Ahead Through Continuous Risk Assessment \[00:27:23–00:30:04\] • Closing Thoughts \[00:30:04–00:30:19\] IIA RELATED CONTENT: Interested in this topic? Visit the links below for more resources: • GAM 2026 • AI Knowledge Centers • CEO Message: Combating Deepfakes • Global Internal Audit Standards Visit The IIA's website or YouTube channel for related topics and more. Follow All Things Internal Audit: Apple Podcasts Spotify Libsyn Deezer

## Transcript

[0:02] The Institute of Internal Auditors presents all
[0:04] things internal audit tech.
[0:06] Deep fakes are changing how fraud happens,
[0:09] and even what organizations can trust as real evidence.
[0:13] In this episode, Andrew Gu sits down with Corey Chatterton
[0:17] to break down how AI generated media is being used
[0:21] to impersonate leadership, slip past controls,
[0:24] and exploit trust.
[0:26] They also discuss why these tools are now so easy to access
[0:30] and what internal auditors need to do
[0:32] to strengthen governance, training,
[0:34] and response as these risks grow heading into 2026,
[0:40] What are DeepFakes
[0:41] and why should auditors be paying attention to them now?
[0:44] Alright, well, let me begin by saying thank you
[0:47] and Drew for the opportunity for us to be here today and to,
[0:50] and to have this conversation.
[0:52] Well, to the question that you asked, um, DeepFakes,
[0:55] they are realistic looking, but altered,
[0:59] and I want to focus on that word, altered media
[1:03] created using artificial intelligence, ai, those two letters
[1:07] that have been arranged for these past few years,
[1:10] particularly focusing on, um, learning techniques.
[1:14] Now, if you go back a few years to 2017,
[1:17] when the term made its way into our lexicon,
[1:20] deep fakes were almost exclusively video content.
[1:24] But today, these fabrications have expanded by leaps
[1:28] and bones to to, to not only touch on video,
[1:31] but they also no include image and they also include audio.
[1:36] Now, you asked an important question,
[1:38] why should auditors be paying attention to them?
[1:40] But I think that that the thing for should, has long gone
[1:44] and auditors must pay attention to this technology if
[1:48] for no other reason than for this significant threats
[1:52] that they oppose to our organizations, to the integrity
[1:56] and to the reputational risk that they bring.
[2:00] When we look at it,
[2:01] deep fakes are increasingly used in fraud,
[2:04] and by all the metrics that I have seen, their usage
[2:09] continues to increase year on year.
[2:12] And another reason why you think that we must pay attention
[2:15] to them has quite a bit to do with the fact that
[2:19] the entry barrier, if I may put it that way, has collapsed.
[2:23] So what initially required Hollywood studios,
[2:29] it not only takes a pretty much a $20 subscription
[2:32] and a few seconds of of, of voice audio.
[2:36] So this has catapulted us from being a novelty
[2:40] to becoming a very serious and material business risk.
[2:44] One that we cannot afford not to pay attention to.
[2:50] How does this deepfake technology work
[2:52] and what do internal auditors need to understand without,
[2:55] you know, without us becoming technical experts?
[2:57] At a very basic level,
[3:00] deepfake technology uses machine learning algorithms,
[3:04] and these algorithms have been trained on large data sets,
[3:09] data sets of images, videos, audio, you name it.
[3:13] But depending what the context, this training then is able
[3:17] to facilitate a mapping from one person,
[3:20] from one individual to another.
[3:22] So, for example, what we can have as a result of this is
[3:26] that we can see the swapping of faces in videos,
[3:32] or we can hear and not see,
[3:34] but hear the synthesizing our voices when we listen
[3:38] to audio, when we analyze speech patterns.
[3:42] So internal auditors, we don't need
[3:44] to become technical experts,
[3:46] but we must be able to understand, as I said,
[3:49] at the very basic level,
[3:50] that these DeepFakes rely on vast amounts of data simply
[3:55] to mimic human expression,
[3:57] whether it is appearance or voice.
[3:59] And recognizing the potential for,
[4:01] for misrepresentation is critical for us when it comes
[4:05] to assessing risks in audit scenarios as these fabrications
[4:10] or certainly most definitely
[4:13] can impact the authenticity of the evidence.
[4:17] That's, uh, pretty terrifying stuff. I mean,
[4:20] Telling me about it,
[4:21] I think we, we've all heard a couple horror stories about
[4:23] these DeepFakes, but kind of go along the lines of that.
[4:26] How does AI driven deepfake technology expand
[4:30] or change the traditional fraud risks
[4:32] that internal audit already evaluates like such,
[4:35] these impersonations social engineering,
[4:37] or is there even payment fraud that this is impacting?
[4:40] I see deep fake, as I kinda like to term it,
[4:43] as a force multiplayer for fraud.
[4:45] Hmm. This technology amplifies traditional fraud risks
[4:50] simply by providing these new avenues
[4:53] for impersonation your words, exactly.
[4:55] Horror stories. Who hasn't heard stories of,
[4:59] of CEOs authorizing payments based on, on, on, on
[5:03] what employee perceived to be
[5:05] or thought was the CEO who hasn't heard of stories of,
[5:09] of CEOs misleading employees asking them to do,
[5:13] carry out a particular instruction.
[5:16] And when it turned out quite later to be anyone but the CEO
[5:21] and then you made mention of of, of social engineering,
[5:24] that element, where do we even begin as it relates
[5:29] to social engineering?
[5:31] You see, traditional audit controls, we rely,
[5:35] they rely rather heavily on, on, on confirmation.
[5:39] But if I call a vendor to confirm a bank account change and,
[5:43] and a deep fake and answers, the control has failed,
[5:48] the risks haven't changed,
[5:51] but the efficacy of our current controls has diminished.
[5:56] So as internal auditors, we must
[6:00] position ourselves in such a way
[6:02] that we can adapt our methodologies to address these
[6:07] evolving threats and to ensure that the assessments
[6:10] that we conduct are fraud risks include these potentials
[6:16] for manipulative data.
[6:18] We cannot avoid these, we cannot afford
[6:21] to miss out on these.
[6:24] Yeah. You kind of alluded to what I,
[6:25] I wanna talk about next, which is this, you know,
[6:27] you call your vendor thinking that you're getting a,
[6:30] you know, a confirmation to go ahead
[6:31] and, you know, shift some funds around.
[6:34] What are some of these real world examples
[6:36] of DeepFakes being used in ways
[6:38] that internal auditors should view as a control
[6:41] or a governance failure?
[6:43] I think by now, most of us, if not all of us,
[6:46] should have heard somewhere along the line, you know,
[6:50] the impersonation of the CEO, the one there, there was
[6:53] that one coming out of Hong Kong where a call was received
[6:57] and, and because of the urgency that came along with the,
[7:01] with the call, it led to a transaction, $25 million
[7:06] being transferred and not just transferred,
[7:09] but essentially ended up being lost.
[7:11] Why? Because that employee was duped into
[7:15] facilitating that transaction.
[7:16] Because what they thought they saw on the,
[7:20] on the video call, the voice
[7:22] that they thought they were hearing, every other participant
[7:26] was a deep fake other than the employee
[7:29] who was receiving was receiving the instruction there.
[7:32] We had, most of us perhaps might've seen it as well,
[7:34] there were deep fake videos of, of Elon Musk
[7:38] promoting fake cryptocurrency investments, you know,
[7:42] and they were on, on very familiar platforms, X YouTube,
[7:47] you know, so these things,
[7:49] they expose the governance gaps in content monitoring.
[7:53] They're not just content monitoring,
[7:55] but in the response that comes
[7:59] when these things are are, are made known.
[8:02] And we have, there, there are other cases, you know, I mean,
[8:05] sometime back and, and,
[8:06] and this one I found rather, rather hilarious, um,
[8:11] I don't remember the year, but I think it was 21
[8:13] where there was something circulating a a,
[8:16] the pope in a puffer jacket.
[8:17] I mean, that one took the cake for me.
[8:19] You know, when I, when I saw,
[8:21] when I saw a Pope Francis in a puffer jacket, you know,
[8:23] I was like, whoa, what have we come to?
[8:26] And then there was a release at QMO saying
[8:28] that it was a fake, and also seeing is no longer believing.
[8:33] Hmm. Neither is hearing. Yeah.
[8:36] It's funny you mentioned that,
[8:37] but content monitoring, it's, you know, in the initial days
[8:40] of social media and stuff, you,
[8:41] your content monitoring was heavily focused on what are you
[8:45] as a company saying, what are you as a company doing?
[8:48] I think now we we're having this big change
[8:51] where it's not only what are you doing,
[8:53] but then what are people trying to do on your behalf?
[8:57] Correct, correct. And,
[8:58] and it goes back to what, what I would've touched on at the
[9:01] beginning, that element of reputational risk
[9:04] and reputational reputational risk is, is one
[9:08] of the biggest risks
[9:09] that organizations face now when it's not just
[9:12] internally, but externally.
[9:14] Because if you have somebody purporting to be
[9:17] who they are not, imagine the implications for that.
[9:21] You know, so you, you could, d term orange is a new black,
[9:25] but reputational risk is the new cyber risk.
[9:29] So the, the old adage trust but verify mm-hmm.
[9:33] Gets a lot harder when you can't, you know,
[9:36] can't trust these sources either.
[9:38] Very true. So go along those lines like
[9:40] where are organizations the most vulnerable today from a
[9:44] control standpoint, and
[9:45] how can internal audit assess whether existing controls are
[9:48] sufficient against these deep fake enabled threats?
[9:51] Thinking about it, there, there are really a few areas
[9:55] of vulnerable vulnerability,
[9:57] but if I, if I have to name a, a few of them on the fly,
[10:00] I'd say that organizations are especially in particularly
[10:04] vulnerable in, in two areas, areas
[10:08] that involve one remote authorization processes
[10:13] and why, because of the heavy reliance that they have
[10:16] that they employ, that they engage as it relates
[10:19] to digital communications.
[10:22] So that's area number one, remote authorization processes.
[10:26] And then another area that I would say would be areas
[10:30] where there are high pressure workflows.
[10:33] Now, what do I mean when I say high pressure workflows?
[10:38] Those will be areas where the workflow, you know,
[10:41] including things like financial transactions and,
[10:45] and those things that require executive approvals.
[10:48] Let's go back to the same example I gave the,
[10:50] the well-documented case of the, of the CEO in Hong Kong.
[10:54] If a CEO calls a controller or calls or calls his secretary
[10:59] or calls whoever he has to call demanding an urgent
[11:02] transfer, the psychological pressure combined
[11:06] with the voice clone, these things immediately bypass logic.
[11:11] If our employees are trained, you know, when I say trained,
[11:15] I mean really, really trained to really pause,
[11:19] pause for a moment.
[11:21] Those two seconds can really make a tremendous difference.
[11:25] But these things and,
[11:27] and the attackers, they understand this, they understand,
[11:30] and they, they work on our response
[11:33] to urgency when they can hype it up
[11:36] and get us to, you know, have to create that sense
[11:38] of urgency and all that logic goes through the door.
[11:43] And then what I mentioned about the remote authorization
[11:46] processes is being documented as well, you know,
[11:49] attackers using deep fake voices to reset passwords or,
[11:54] or even bypass MFA by pretending multifactor authorization,
[11:59] sorry, by pretending to be an employee in distress.
[12:03] As internal auditors, I think we've come to the stage
[12:05] where our internal audits, they, they need
[12:08] to assess the effectiveness of controls
[12:12] by evaluating processes that authenticate identity
[12:16] and those that validate content.
[12:19] Those two things authenticate identity and validate content.
[12:24] Internal audit can assess sufficiency
[12:29] by conducting threat analysis, you know, by, by testing
[12:32] controls, biometric multifactor authentication,
[12:36] reviewing incident response plans.
[12:39] And it would even go as far as saying that internal audit
[12:43] should even to the greatest degree possible, even
[12:48] simulate deep fake attacks.
[12:51] What better way are we able
[12:53] to identify gaps in our detection
[12:56] and verification protocols?
[12:58] So it's almost like taking some of those cybersecurity,
[13:01] uh, control tests and applying them to these deep fake area.
[13:05] You know, they, they talk about doing penetration testing,
[13:08] but then also you hear of some places
[13:09] where they leave random flash drives in the parking lot
[13:12] to see if people will pick them up and try to plug them in.
[13:15] So it's almost a applying some
[13:16] of these old testing techniques
[13:18] and tips to this new area. Correct.
[13:22] Looking back at what you've said,
[13:24] these are trade and true methods.
[13:27] You know, these, these, these aren't things that are
[13:31] what we would call or considered to be out of the box.
[13:34] They're things that we have always been accustomed doing,
[13:37] and that's the beauty of it.
[13:39] The technology improves, we have advancements
[13:43] and all of these kind of things,
[13:44] but the basics are still tried and true,
[13:48] and we can always revert to them
[13:51] with a great degree of success.
[13:55] What indicators or red flags can internal auditors look
[13:58] for when assessing whether media communications
[14:01] or approvals may have been manipulated?
[14:04] There are quite a few of them that we should be,
[14:06] that we should be on the lookout for.
[14:08] And, you know, internal auditors, red flags, you know,
[14:10] they go together like the chiefs and Super Bowl.
[14:13] Well, up until this year, that is right.
[14:17] But as it relates to these, what we should be looking for,
[14:19] these indicators.
[14:21] But if it is that we are talking about in a visual,
[14:25] a visual context where we are having a conversation and,
[14:28] and say digital communication, that we're, we are having a,
[14:31] a remote conversation,
[14:32] that we are looking at someone on a screen, you know,
[14:36] there's what is referred to these days as you, you look
[14:40] for these factors that contribute to
[14:42] what we call liveliness, you know,
[14:44] whether the act the liveliness is, is what they describe it
[14:47] as, active or passive.
[14:49] So they encourage you to look,
[14:51] look at things like skin tune, if you can see the person is,
[14:54] if, if they're inconsistencies between the words
[14:57] that you are hearing and, and,
[14:59] and the sinking of the licks, the movement of the licks
[15:02] and the words and how those things are, are aligning.
[15:06] Right? But if we're not talking about in a visual context,
[15:10] if we consider perhaps just the auditory,
[15:13] we can perhaps look at things such as unusual requests
[15:17] where, where there is an an a request that has come through
[15:20] for, for you to make
[15:22] or to take an urgent action that doesn't quite square
[15:27] with your established protocol.
[15:30] There could also be,
[15:31] and we, we always are on the lookout for these, a lack
[15:34] of corroborating documentation to, you know, to support the,
[15:38] to support the communication.
[15:40] I mean, there, there are, there are so, so very many things
[15:44] that we can be and should be on the lookout for,
[15:48] because these red flags, as I said, in terms
[15:51] of this facial expression, the lighting, the shadows,
[15:54] those environmental mis mismatches,
[15:57] those things, they are key.
[15:59] So it's not just a matter of just talking, you know,
[16:01] but we have to be observant, especially,
[16:04] especially in this age of technology in which we live in,
[16:09] we can't get away from it at all. At all.
[16:13] Yeah. That seems to be a recurring theme
[16:15] with these DeepFakes, is this pressure
[16:17] and this like, you need to do this immediately.
[16:20] There's all this like pressure coming from someone above
[16:23] that, you know, we need something to be done
[16:25] and it, it's so timely.
[16:26] It needs to be done immediately.
[16:27] It needs to be done right now. There's no time to think,
[16:29] there's no time to act.
[16:30] And it's like we, you constantly try to tell people,
[16:32] take a deep breath, read it.
[16:34] That doesn't seem right.
[16:36] Have I ever gotten a request like this from this person? No.
[16:38] Why would today be the day that I get one?
[16:41] So I think, yeah, taking it back to some of these things,
[16:43] you know, how we apply it through other fraud lenses, um,
[16:46] is no different than applying it here in
[16:48] the deep fake situation
[16:50] To continue along the same, the same football line.
[16:53] You know, I mentioned the Kansas City Chiefs and the,
[16:55] and the Super Bowl analogy.
[16:56] I, I think fraudsters,
[16:59] they have their own play book as well.
[17:02] The sooner we recognize that there are certain things
[17:05] that they play on creating scenarios
[17:09] of urgency where the pressure is so great that, you know,
[17:13] you don't have time to reach out to anyone.
[17:14] You have to, you have to address this thing now.
[17:17] They play on these things, you know, they,
[17:20] they work on these, these, these, um, mental
[17:23] and emotional heuristics, you know,
[17:26] and they, they, they really, really do a very good job
[17:30] when it, when it comes to these things.
[17:32] And again, why, why are they so successful?
[17:35] Because I don't think that
[17:37] or organizations give
[17:40] the emotive respect to, to training in,
[17:44] in these particular areas that is, is really necessary
[17:48] and appropriate for the threats that we face today.
[17:52] So to my mind, and that's just,
[17:54] that's just my opinion to my mind.
[17:56] That is one of the reasons why these things will continue
[17:58] to grow and they will continue to proliferate
[18:01] because the training as it relates to teaching, teaching,
[18:05] teaching our employees to, you know,
[18:08] value the power of the pause.
[18:11] Yes, you hear what you are hearing,
[18:13] but just talk for a minute.
[18:15] Take a deep breath, listen to what they're saying.
[18:19] How does it square with what we have been doing?
[18:22] You know, and a couple other things that I somehow think
[18:24] that we were touch on as we continuing our conversation.
[18:28] I really like the way you put that, the power
[18:30] of the pause, like just mm-hmm.
[18:32] Take a step, reevaluate what's going on,
[18:34] what's being presented to you before you act.
[18:36] And a lot of times we act quickly, it,
[18:39] you know, can spell for disaster.
[18:41] How effective are current deep fate detection tools
[18:44] and how should internal audit
[18:46] evaluate management's reliance on AI based detection tools,
[18:50] including their limitations?
[18:52] That is a gem of a question, Andrew. It really is.
[18:57] You know, because I have no
[18:58] preference for any particular vendor.
[19:00] As a matter of fact, I, I like to think of myself as,
[19:02] as being vendor, vendor agnostic, you know,
[19:06] but when we, when we look at
[19:07] what is being offered there on the market, you know,
[19:11] the tools that are being offered,
[19:13] they're vary ine effectiveness.
[19:15] When you look at the reviews and you read
[19:17] and you listen, the reports, they vary as it relates
[19:20] to the effectiveness of these tools.
[19:22] You know, I touched on ma made mention
[19:24] before of, of liveliness, you know, whether
[19:26] that liveliness is active or, or passive.
[19:29] But, but the reality is this anju more often than not,
[19:34] if we think about it, detection tools are
[19:39] invariably one step behind the generation to think about it.
[19:44] More often than not, what comes out is a response
[19:47] to something that has come before.
[19:50] And to answer your question, I like to go back to, again,
[19:52] going back to the basics and,
[19:54] and banking provides a really, a really
[19:57] powerful analogy for me.
[19:59] Because when you come into banking, let's say for example,
[20:04] you have a customer service representative, someone who,
[20:07] whose, whose function it is to take
[20:10] and to share money over the con
[20:13] that customer service representative, that agent,
[20:16] when they are onboarded, when they are being trained,
[20:20] culture feet, money has always, always been a big thing.
[20:25] Wherever you go in the world, comfort feet,
[20:27] money has always been a big thing.
[20:29] But when it comes to banking, lemme put it this way,
[20:33] employees are trained to detect culture feet money.
[20:36] Not by focusing on comfort feeds,
[20:39] but by focusing on the real thing.
[20:43] The permutations
[20:44] and combinations that can result where it, when it comes to
[20:48] ves are endless.
[20:49] They're countless, but the real is limited.
[20:53] And when we train in that, using that same bike in context,
[20:57] when those employees are trained to know
[21:00] what the real looks like, what it feels like,
[21:03] what it smells like, they're then better able
[21:08] to detect what is not real.
[21:12] So for me, instead of depending heavily
[21:16] or even solely on, on, on AI to catch ai, if I can term it
[21:21] that way, I'm a firm believer in training,
[21:25] supporting and empowering
[21:29] the human beings that have to still stand as the,
[21:34] as, as the, as the guardians
[21:36] or the watchdog of, of these, of this software, of these
[21:40] software detection tools.
[21:41] Organizations really need to invest, uh, in,
[21:45] in the human component as the, not,
[21:48] I would say the ultimate,
[21:49] but a very important control
[21:53] in this whole exercise.
[21:55] Yes, detection tools are a layer of defense,
[21:59] but they are not the solution. Yeah,
[22:02] That, that's a really good point.
[22:04] I think we get so wrapped up in these technologies that, oh,
[22:07] we gotta have the latest tech and all of this,
[22:09] and we kind of forget to go back to the basics,
[22:11] like the soft skills of internal auditing,
[22:13] those interview techniques, getting to know your auditee,
[22:16] just getting to know your audience.
[22:18] You know, the best way
[22:20] to detect if your CEO is acting erratically
[22:22] through a deep fake is to truly know your CEO.
[22:25] Right? If you,
[22:26] or in the sense your CFO, if your CFO has never talked
[22:29] to you about going and buying a bunch of gift cards online
[22:32] and sending them to them, why would, why would
[22:34] that be a normal course
[22:35] of visits if you truly knew your CFO?
[22:38] Absolutely. You know, you know, and even to expand it,
[22:41] even, even beyond auditing, I mean,
[22:43] we are internal auditors, you know,
[22:45] but if we can have the employees in our organizations
[22:50] to employ an internal auditing mindset, I think
[22:55] that that would go a significant ways in terms
[22:59] of empowering them as well.
[23:01] Help our employees, the non auditors to develop, um,
[23:05] professional skepticism.
[23:08] You know, I see you, I hear you,
[23:10] but this is what you're saying to me.
[23:12] You know, but you know, I think we've come to the stage
[23:16] where, where we, where we don't see it as necessarily,
[23:21] or, or, or, or take it personal when persons ask us
[23:25] questions, you order to fully verification is,
[23:28] is very, very important.
[23:30] Especially when we are talking about
[23:33] what we are discussing here this afternoon.
[23:35] Deepfake technology, we have to insist
[23:40] on these, on these verification protocols.
[23:43] They must be part and parcel of our control framework.
[23:48] Yes, this is what you say to me. But,
[23:51] So going along those lines,
[23:53] what role should internal audit play in helping management
[23:56] design or strengthen policies, training
[23:58] and incident response plans related to deepfake?
[24:01] The proactive,
[24:03] and I want to emphasize that word,
[24:04] the proactive conversations need to be had
[24:09] with management so that they can develop comprehensive
[24:13] policies, policies around things like, like,
[24:15] like media integrity and communication verification.
[24:20] As internal auditors, you know, we can't design it
[24:24] because it's a conflicted design then to have to turn around
[24:28] and to audit it.
[24:30] So while we may not necessarily be involved in the design,
[24:34] you know, that there is an advisory role that
[24:38] internal audit plays.
[24:39] And if we want to talk about being value, and,
[24:42] and I don't know about your experience,
[24:44] but mine has been, as I have met, no shortage
[24:47] of internal auditors who love
[24:49] to talk the value added concept, internal audit,
[24:53] we'll add value to our organizations,
[24:55] but if we really, really want to have, have,
[24:58] and to add value to our organizations
[25:02] and to add meaningful value, should I add
[25:06] to our organizations then our response to my mind.
[25:10] It can't be a responsive one.
[25:13] It has to be, it has to be proactive.
[25:15] So as internal audit, we have to have those conversations,
[25:19] as I said, you know, help them not to say, this is
[25:23] what you must do, but have you considered
[25:27] including incorporating X, y,
[25:30] and Z when it comes to building out your, your,
[25:32] your policies around, around media integrity, your policies
[25:36] around communication verification,
[25:39] because these things can assist.
[25:41] Internal audit rather can assist
[25:43] in designing training programs that raise awareness.
[25:48] Again, going back to the basics.
[25:50] Raise awareness about defects
[25:52] and outlining protocols
[25:55] for responding when we believe that
[26:00] these kind of things have happened in our organizations.
[26:03] Anything that by facilitating these mock incident responses,
[26:07] you know, internal audit can really, really help ensure
[26:11] that staff are equipped to identify
[26:15] and having identified to take the next step now
[26:18] and to escalate these concerns when they should arise.
[26:23] So summarily then internal audit, we, we should act as,
[26:27] as I said, as advisors,
[26:28] that's a crucial word in this context,
[26:30] by conducting risk assessments to help to identify
[26:34] deep fake vulnerabilities, you know, recommend policies,
[26:39] as I said, a main mention of, of those, of those two.
[26:42] Um, what were the media integrity,
[26:45] communication verification?
[26:47] You know, we help our organizations to refine our
[26:51] incidents response plans.
[26:53] And I think we've come to the stage now
[26:55] where any incidents response plan that does not
[26:59] incorporate an AI detection element
[27:03] or an AI detection integration is outdated.
[27:08] It needs to be revisited
[27:10] and it needs to be revised at the earliest opportunity
[27:14] because AI is in everything,
[27:20] the rethink.
[27:23] So as these deepfake technologies
[27:25] and AI more broadly continue to evolve,
[27:28] how can internal audit stay ahead through risk assessments,
[27:30] audit planning and ongoing assurance
[27:33] To get ahead and to stay ahead?
[27:36] Internal audit needs to,
[27:37] and we've heard this in, in, in, in, in other,
[27:39] in other places and on other platforms and other forums,
[27:43] but it becomes more accentuated
[27:47] given this discussion that we are having around DeepFakes
[27:50] and, and deepfake technology and artificial intelligence.
[27:54] But internal auditors, we need
[27:57] to adopt a forward thinking approach from much
[28:01] of my career, much of what I've done
[28:05] until quite recently has always focused on, on,
[28:08] on looking back what has happened
[28:12] and, you know, having a focus in the, in the,
[28:14] in the rear view mirror.
[28:16] But given where we are at in today's world, our, we
[28:21] have to be, we must be adopting a forward thinking approach.
[28:27] We've come to the time where we need
[28:28] to be continuously updating our risk assessments to account
[28:32] for these emerging technologies.
[28:35] We can't just wait for them to be happening
[28:37] and then say, okay, let's see
[28:39] what adjustments we can make here.
[28:41] We need to engage in ongoing assurance activities.
[28:46] I mean, I touched on it, um, in the previous question
[28:48] that you asked, you know, such as regular workshops,
[28:52] engaging with management
[28:53] and staff on the implications of, of artificial intelligence
[28:57] and, and this deep fake technology.
[29:00] I think doing things like these will help auditors,
[29:03] and not just auditors
[29:04] but our organizations to remain informed.
[29:09] We must shift from a periodic mindset
[29:13] as has been the culture in many places
[29:16] to a continuous risk assessment mindset
[29:20] As internal auditors, we are very well positioned,
[29:25] very well placed in our organizations to
[29:30] act or rather to be the catalyst
[29:34] for preparedness.
[29:35] What do I mean by that?
[29:36] You know, I, I may mentioned earlier of, you know,
[29:39] of, of the policies.
[29:40] We can't, we can't craft the policies,
[29:42] we can't write the policies,
[29:44] but we are well positioned to, to review.
[29:47] It is incumbent on us.
[29:50] It is a necessity that auditors remain s strive
[29:55] to remain ahead of the curve.
[29:57] We must be constantly upskilling and
[30:00] and that's something that I am passionate about personally.
[30:03] Well, Corey, thank you for joining us today.
[30:05] This topic seems like it can go on and on forever and ever,
[30:08] but we gotta frame it somewhere.
[30:09] So I really appreciate you joining us, taking the time
[30:11] to explain all these scary things that are, are coming up,
[30:15] but also how we can, uh, start
[30:16] to manage them some way somehow. So thank you.
[30:19] Not a problem at all, Andrew.
[30:21] Thank you so very much for having me.
[30:22] The pleasure was all mine.
[30:25] If you wanna hear more from Cory on DeepFakes
[30:28] and Digital Deception, you can catch him live at GAM 2026
[30:32] happening March nine through the 11th in Las Vegas.
[30:35] Secure your spot and register@theia.org.
[30:38] You can join audit leaders from around the world
[30:41] for three days of insight, innovation,
[30:43] and forward-looking conversations.
[30:47] If you like this podcast, please subscribe and rate us.
[30:50] You can subscribe wherever you get your podcasts.
[30:53] You can also catch other episodes on YouTube or@theia.org.
[30:57] That's THEI a.org.

Shows are listed from Apple Podcasts' charts and directory, and Podcast Index where it is used. Every show and episode belongs to its publisher and plays from the publisher's own feed; this site hosts none of them.