Start with Why. How great leaders inspire action. TED Talk by Simon Sinek.

From an auditor's perspective is the understanding of the agents and AI associated with your integrated framework and your level of automation and having the ability to understand that well and draw conclusion by being a human in the centre. That for me is the future of ERP. Welcome to the Future of ERP. A podcast where we discuss hot topics, best practices and the latest innovations in today's global business. I'm Richard Howells and as ever I'm joined by my wonderful co-host IQ. Hello everyone, I'm Erkyl Gar, marketer blogger and podcaster in the ERP and supply chain area at SAP. Today's topic tackles the question that's been gaining a lot of attention. Will AI replace the auditor? To do so we are joined by Shailin Muddly. Shailin, welcome to the show. Could you please introduce yourself? Sure, thanks, Richard. Thanks, Okoo. I'm Shailin. I'm a director with one of the big four songs and I look after a range of 4250 clients in the UK but from an external audit perspective, IT in particular and similarly from controls advisory perspective in their transformation programmes. So maybe we'll address the elephant in the room and then ask the big question. So from your perspective as an auditor, do you think AI could eventually replace auditors and yourself in your job? The big bold answer? No, there's a number of reasons for that. AI is fantastic, definitely from an audit perspective. But the one thing one is always they conscious of his judgement. They would always be an apprehension to give away judgement from an auditor. So the short and simple answer for that is no week will not but there's a lot of benefit to be obtained in the near term and long term. How do you think about trust when it comes to this? I mean do people really trust AI to handle auditing? There is an element of trust associated with leveraging AI in the audit. So I think it's two examples. So even external audit world, we would love to trust and do trust AI to do another mundane task. So examples that some of the viewers or the listeners will appreciate these things like use access, reviews and so on and so forth. So a lot of the tasks is an auditor we would take to be able to analyse extracts, views, opinions and judgements. We would leverage AI to do it. But at the same time as an auditor unless you're able to articulate why you've come to a conclusion as an auditor without AI, you'll be in a fearful position. So similarly with AI you want to leverage it but you want to know how it's made the decisions and the closer you are to it, the better. So it reduces the amount of Monday tasks but you still want to stay close to it. On the other side from a more transformation perspective and leveraging AI to create controls for you as an organisation. One of the areas we've used it is designing frameworks. So how do I go into a session with organisations before FIMO is talked about a business process from an interview and have AI understand, transcribe and then evaluate all of the risks and controls that we may have identified in a composition. We step out, go for a small coffee break as on the other side and then we come back to the framework is there. Coupled with the framework, it's what are the other areas that we have not discussed. AI made it, they're identifying that and then crawl some questions. So there's one around removing them and Dean tasks that generally takes an external or a long period of time. There's another thing around using it to identify as much as possible in the quickest time lane, based on conversations that you have to shape a framework for an organisation. In that environment, just curious as a follow on, do you record the sessions that you have and then you could leverage AI then to summarise that to our conversation that you just had. Pretty much. It summarises, it gives views, it probes, it also follows up on whether there's specific things that might be what discussing then and there, which is helpful. It also probes things that you may have had in a conversation and not necessarily adopted as a risk or not necessarily identified as a control but it will probate based on what a library of leading practice perspectives are combined with a conversation to say, "Have you considered this, should you consider this?" And it's not just the risk in controlling the business process as an example. It's also the systems that may have been mentioned within that business process and therefore, as an external auditor, what are the set of IT general controls you probably need to have over the systems because it touches risks within that process. So you use it to transcribe but you also use to probe that thinking. I like that approach and that's how I think many different job functions are leveraging AI is to pull out things that you may have missed, make sure that you've covered everything in that discussion and then allows you to leverage your judgment to see where I go from "Yeah, but I wanted to also, I mean you've started to talk about how AI is currently being used in auditing from your perspective at least. How do you expect it to change the auditors role in the future?" It's a difficult one because I feel it's being used quite well in Shazin but I think where the gap to full and complete expectation of it is around the hesitation to use it because the regulations that are not present. So again, as an external auditor, there's a lot of desire to use it from an operational point of view but then also from a testing of controls perspective. But the regulation doesn't exist to the same local agree. So to what I was saying earlier, if you use it you want to walk alongside it so you know that it calls it's made and the judgments it's made to almost get away the whole hallucination of AI. You want to stay close to it so you don't have that problem where you can't answer it. So I do think right now it's being used to the extent possible within the guardrails that it cut in cases. After regulation changes, then maybe there's potentially more operation of it. How do you use AI to operate controls, test controls because an assurance model around it that gets the order to comfortable and similarly organizations comfortable. By short, we have looking at it is there's a lot of operational efficiency from AI in the first line across three lines of defense. The second line, I have a little bit of an uplift in terms of how do they assure that to make sure it's coming to the right decisions. And the third line have independent assurance that they have to get out of reach. So until the second line is able to prove that independent assurance or assurance along the use of AI, that that line's work will always be independent. I think AI is a two-edged sword here as well because AI is going to be used by the company that you're auditing. Correct. And it's often seen as a tool to improve efficiency. But it may increase the workload of the auditor because of the AI tools that are being used within the organization themselves. What do you think of that? I agree with that, but I also feel it's not too different from what we've had historically. So I'll give you an example in an external audit where there's a level of automation and the system that becomes a relevant system for an external audit. How do I make sure it's computing the right sort of things? However, conceptually prior to that, there is a lot of configurations, standard approaches etc, particularly where you can get that conclusion. Even if you get the level of customization as an auditor, you could have the conversation with the teams that would have created that customization and potentially come to the same conclusion that it's doing what's necessary. With AI, it becomes a bit complicated because AI has the ability to make its own judgments and its own decisions. So I feel unless we are able to identify and walk through that, what does the AI do or alongside? We will struggle to get to that position. But I do feel it evolving because I give you an example, again, for some of the listeners, things like firefighter reviews. There's a number of options associated with the three options, firefighter 1, DUs, AI, T, evaluate logs, or 2, DUs, AI to watch over the shoulder of someone while they are evaluating logs or say while they're performing tasks. Well, the third thing is you autonomously let AI do it. The most important thing with all three is how do you ensure the agent or AI or whatever it is is producing the right level of evidence associated with that activity so an external audit can come to the same conclusion. That is the difficulty that needs to be maneuvered and is still cheap. We're seeing a lot of questions coming around this shift, right, especially as companies explore AI across different industries. There's also growing concern that maybe this mini level entry jobs are starting to disappear as automation and AI takes over. With that in mind, if entry level audit tasks become automated, how will the future auditors develop these professional judgment required for this role? A debut example for me, right, I historically as an external audit to tick-to-tick-to-tack, a range of people who are being interest system extracts, got to be able to help comfortable that I could make a judgment call based on everything, right? That allows me now to be able to use AI and walk around society. I see a lot in terms of the younger generation when they come out, they are very proficient in AI. So it tends to be me wanting to walk alongside and come into a conclusion. They are able to get to the same conclusion quicker based on the way they live in there. I don't think the model will change significantly, but what I do think is there'll be a lot of emphasis on their ability to put judgment over the conclusions. Rickardless of who is doing it, they will be a lot of emphasis. There'll probably be a leveraging of the old cool in the new school, particularly until the regulation is shaped so that you can get the assurance over it. And they'll definitely be uplifted in the training models. How do you leverage AI, but make sure that you are comfortable with it so as to avoid the hallucination aspects that is a reality today? So, Salem, you did mention you work with 40 or 50 customers over the year from an auditing perspective. Do you think the expectation moving forward is that we will leave less auditors. because of AI and you'll be able to work with more companies. Oh, don't you think that that's going to shrink the time it takes to audit a company? I think potentially it will shrink the time it takes to audit a company, but I don't think it removes the complexity of how it will become when auditing an organization. Because what I mean by that is right now we've got years, decades of an understanding of how to audit. Now we've gotten the last two years or so, the in-venue swing of AI and then the shaping around how you use it and how you audit. I think time will reduce, when they need tasks will reduce, but conclusions will still need to be judgment-based. Judgment-based needs to be human-centric. The auditing needs to be at the front of that judgment. So I don't remember that the judgment aspect is going to come away, but yes, potentially the time associated with auditing is going to reduce. One more thing I would add to that is as AI evolves, there's a lot of desire for particularly amongst organizations, more automation, more automation, reduce the complexity, reduce the amount of effort associated with audit, but in order for you to get that, there is a deep understanding of how the automation works, how the AI works. So there's a time scale, you are first understanding it, then getting into a short-range water and then in the next analytic world, the concept of benchmarking, how can I then get comfortable over a rolling period that it's continuing to be the same thing and that will take time, that will evolve over the next three to five years I feel. You're the expert, you're the auditor, what have I missed, what other question should we have asked you that you think it's important for our listeners to know about AI, it comes to auditing. I think there's two questions, one is my personal experience of it, as an auditor, personal experience of it just generally, because there's a little bit of how I maneuver it and stuff, which I think is helpful from a controls perspective. The second thing is what's my honest view of the adoption of it right now in controls? You've asked your probing questions, let's have your answers for those questions. So the first one around my personal use of AI, so I have historically, and when I say historically over the last year, so I've been aptly answered to use AI, because I felt it being just a quantum better phrase, glorified Google, but what I did find particularly helpful when I started engaging with it is use it in a conversation way, because to the whole idea about how you use AI to be able to do some of the mundane tasks and you still have judgment, the more I conversed with it, the more I jointly come up with the output. So I test it, it tests me. We go back and forth on that to a point where I'll say you ask me targeted questions, I frame my thinking at all, is this a risk, is this a control, and then jointly we come up to your what we agree. So yes, it removes the mundane tasks, but it challenges me and I challenge it to come up with it. And it's become a sounding board in effect for your thoughts. Precisely, it's become a sounding board where I can throw my views, it can throw its views, and then I feel to the whole idea of keeping judgment from moving any hallucination, I feel comfortable and concentrated in the output that it produces because we collaborate to run it. So I think from a risk and a control perspective, from an external art perspective, the more you collaborate with it, rather than just feed it tasks, the more you feel comfortable with the output and the judgment that you place in it. So your guidance would be, try it, don't knock it till you've tried it, I guess, and from your own experiences with the tool. Converses, don't use it as an output generating type of thing and you'd rather do it to the point where you both feel comfortable with where you land. That I feel is being pathcroll from a risk, from a control perspective, but from the way of how you shape it on an opinion, an external audit, but also on a suggestion in a transformation perspective. And that leads on to your second question of, are people actually doing that? What's the actual adoption that you're seeing of AI? Day to day, a lot of people are using it, but I think from an external audit perspective, there's a lot of adoption at the moment around leveraging AI to draw conclusions to get to views quicker. It does not remove the fact that judgment is there. So there's a lot of adoption from it from a control's testing perspective. If I look at it on the other side, from an, when I advise clients on being able to implement AI in a control perspective, there's a lot of use cases that are out there, but to what I was saying around the regulation, there's apprehension to fully adopted from a control's perspective. It's being leverage to a lot of organizations for the first line, but from an operating off control, there's apprehension due to the regulation not being this. I feel it will take shape over time, but right now there's a lot of use cases and there's a lot of testing that needs to happen in terms of can AI completely interrogate my system. Give me the assurance that I need while it's interrogating my system. Give me an opinion or a decision at the end and can I be comfortable with it? It always comes back to that trust. It's trust. It's in the data that it's analyzing and the tool that is actually analyzing that data. We've precisely did that because we're moving away from the point of systems that are automated, particularly with SAP. How does the automation work? Which is effectively the configuration that routing all of those nitty gritty's associated with automation to automation with decisions and judgment being made by an agent. That is a fundamental shift from automation in a system to automation plus judgment and decision being made by someone that is not a person or that needs to be there. At some point it will evolve, but I still feel the adoption is taking shape all the time. Human is going to be in the loop and as you say it's going to be in the center. We had a conversation with another speaker that we had and he was mentioning that we are always going to have this human in the loop because at the end of the day you need someone to blame. AI is making a mistake. You always did someone to blame. You can't blame the AI. That's not going to fly. And precisely that I always look at the whole concept when I look at it in the next hour. You have a risk. You have a control. If the control fails, who's a look and who owns that risk effectively. And if you start pointing to AI, you can't. Right? There needs to be someone on the hook, ultimately that rolling to different people within the organization. And if they are not comfortable with it, you can't really take the human out. Right? You need to have a human there. I always feel until you're able to articulate how it's come to a conclusion, why it's come to a conclusion. You're not pros and after it. You're not going to be comfortable. I've got the last question for you, but I wanted to highlight something that you said a little earlier because you said in the last two years, AI has evolved a lot. And that's something we need to take in consideration as we are talking about the last 18 months, two years and starting leveraging this tool which seems to be the answer to everything. But I wanted to ask the final question that we ask all of our guests. And with everything that we've talked about, keeping that in mind in a sentence or two, what's the future of the VRP from an auditor's perspective? From an auditor's perspective, I'm definitely more automated. And that's quite ironic because I always feel with the RPR trying to achieve automation as much as possible. Certainly more automated. And I give you an example with ACP, my view is always you could get 65% automation out of an SAP instance for controls where they are you looking at the 75 to 85% automation on top of that. So I think you're definitely getting a more automated environment combined with the RPR and an AI. The second thing is as a result of that, you need a lot more integration in your control frameworks. Because that surfaces a number of risks and how you govern that and how you control that is going to be as important, but not more important. And then from an auditor's perspective, it's the understanding of the agents and AI associate with your integrated framework and your level of automation and having the ability to understand that well and draw a conclusion by being a human in the center. That for me is the future of the RP. That's a great summary. Shailin, thanks for a great conversation. It's been really interesting. I've really enjoyed it. It's been a new topic for me to be totally honest. Great, fantastic chatting to you all. For everyone listening, please mark us as a favourite. You can get regular updates and information about future episodes. But of course, until next time from Shailin or Q&I, I'm just for discussing the future of ERP.