The Institute of Internal Auditors presents all things internal audit tech. In this episode, Antonio Kadi and Alessandro Kadi join Ricky Martinez to discuss the impact of AI and financial crime. They explore how AI's being used by criminals, the challenges it presents, and how internal auditors can leverage AI to enhance their controls and detection mechanisms. Thank you for inviting us. Thank you, Ricardo, for the invitation on this, uh, podcast.
Thank you both. How are criminals currently using AI for financial crimes? If we think about pure ai, so where AI really is having currently, uh, an impact, AI is an impact on anti, on financial crime. When it goes to mainly misinformation, misinformation may lead to many, uh, different, uh, crimes.
I think we have, uh, most of us already read on, uh, the newspaper, the presidential fraud, how it evolve now, uh, lately with AI where basically the frauds that is impersonating the, the CFO, for instance, and calling for video calls where is actually sitting with the team and be able to make an open transaction of, uh, 2 million or more through that, because, uh, with the possibility of AI to impersonate someone and having the, the voice, the ability to speak, that's may come, uh, very easy.
So unfortunately, misinformation is something that, uh, goes towards ai, but misinformation may impact, for instance, also market manipulation. Uh, if, I mean, uh, typical stock exchange is the company. I mean, if you spread out misinformation through both ai, that can have a huge impact on, uh, the pricing or also lead fraud and maybe to make the right investment to under the money, and they have the right profit from the movement of, uh, the stock market.
So that's, uh, some, uh, different aspects that needs to be considered. And the AI is just at the beginning, uh, both in how criminals are using it, because are always at the front and also our controls are actually being implemented out of that. Okay. Well, thank you. And if I surmise correctly, then, you're saying that there are new ways of, for example, when you talk about market manipulation like spoofing. Um, am I on that, on that line? Is that correct? Yeah, Yeah, that's correct. That's
correct. So I think we are just now exploring all the potentiality for unfortunately, I mean, we are now understanding all the potentiality of ai and uh, we are just at the beginning. So I think the big problem is that you need to think like criminals to catch criminals because the criminals are always the step. And that's also one of our motto that we have. And, uh, on that sense, uh, I think, uh, Antonio also has to say, right? Yeah,
Yeah, yeah. No, I want just to add something that, um, we need to clarify that ai, it's not a new type of cyber attack, but it's an evolution of it. And, um, the evolution, it's reflected in the fact that, um, the, um, AI system facilitates the work of criminals and make their attack more complex to detect. So this is good to clarify. Okay. I appreciate, uh, both of these perspectives, right? Um, 'cause we have right now talked about the risk part of the equation.
Now where we would like to kind of dig a little bit more is in the control side of the equation. So I guess my question to you is, how do an AI based control, um, improves the detection of financial crimes? Okay. There, as I said, we are also at the early stage. We recently run a survey, uh, with 400 selected clients, uh, in, uh, throughout the Europe, middle East and Africa, practices of PWC.
Uh, and through that of course we touch, uh, ours, the A ML market and our A ML controls were going towards, and we touch also how AI was, uh, implemented into that is the hype. And of course, we touch also on that topic and was very interesting because basically there was a wide majority, almost 80% that is really focused on transaction monitoring. There is where they see the biggest potentiality.
And I, I think it's quite clear there because what is the benefit of ai, benefit of AI is in the prediction, in the prediction analysis. And therefore where you can limit the risk is to start to predict better your, uh, transaction, your fraud, the exposure to transaction, and therefore how that can be, uh, take hold and how can be mitigated towards a better predictive analysis that AI can do.
And actually it was interesting because it was absolutely confirmed by, we did the same poll during the intervention today. And indeed transaction monitoring was, uh, the biggest was picked as, uh, the key topic. So indeed there is where probably the market is, uh, seeing it as a key, uh, point for implementing their controls. There are other potential, I mean, for sure, uh, a screening systems, screening against sanctions, for instance, there you can reduce a lot the false positive.
And so helping, uh, the analyst to focus more on, uh, the quality side of the review, and at the same time also customary due diligence on that side, it can help to, for instance, digest big volume of analysis. You know, when you do complex products like in Luxembourg LA such as securitization funds, and you have maybe to review, uh, 600 plus pages. I mean, if done by, we did some proof of concept where, uh, these 600 and plus pages were rather in one hour by the machine.
So with, you know, you come out with analysis and then you can really focus on what are the risks that you need to focus. And that's where, uh, it can give a great added value. ai. Yeah. Uh, I think in order to reduce the false positive, you need to, uh, training, you need to train the system, the AI system, and you also need to train yourself on using ai.
Of course, at the beginning you will have a large amount of positive and then keep training, and you will see that the positive will go down the, to the suspicious transaction. Yeah, you need to training the system. And of course you need a cybersecurity professional. Of course, you, you mentioned the back test. This is a, these are the traditional way to test, but in this case, as is a new kind of risk, we don't know too much about that.
And so in this case, I would say also to go with a simple risk assessment and then to compare the, uh, residual risk with the risk appetite of the organization. But it's important to keep training the system because it's a machine learning system. So if you learn, if you teach the system, the system can produce better result. Okay. And let me put it this way, right? We're talking about this false positive.
What about, and you can comm correct me if I'm wrong, right, are false positive, you would say on the same line of risk as hallucinations that, so-called ais are yielding over, right? Yielding this erroneous output. Uh, once you create the algorithm, you create the AI tool, it can kind of, you know, generate, um, what is, so-called hallucinations incorrect output out of the tool.
So on that side, and we go a bit on the limitation of, uh, AI current, I mean, everything goes depending on the data that you input. Data quality is the essence to train, uh, the, the system, if you don't have the right data is very simple, rubbishing rubbish out. And that, uh, goes together with ai. I mean, if you don't train the algorithm, then of course it will not predict correctly.
That's, uh, where actually we see the biggest limitation because we sound, we sound the market again, also on that point. And the two biggest limitation where data quality and maturity of the system, maturity of the system is clear. I mean, most of, uh, the big corporates lives on system that were created via a legacy. And implementing AI requires probably first an announcement of their system before moving towards, uh, the ai and then to ensure that they will be fitted with the right data.
Because otherwise you can implement the best ferra, but if you don't put the right fool in, uh, it'll not work. Yeah. Let me add something about the data quality, because of course ai, it's a powerful assistant, it's a powerful tool, but it needs to be powered by something in order to be effective. In this case, it's right to talk about data quality.
And during the session we ask the audience what makes AI more efficient between data quality, human skills, privacy, ethics, and coexistence with existing system. And the results were very interesting. They said human skill and data quality, so confirming what Alessandro was saying before. Okay. Um, that's great. That's great.
If I can compliment on that, I think was the greatest outcome o of all the conversation we had here during, uh, these two days, also in the strategy 2035, and also of the result of, uh, the PWC survey, the sense that the human making, the connection between the machine, the regulation and the results. So the human factor is essential for the transition.
So really the what was required by the market to support the technological transition to better controls is the human factor Without human that is able to understand the financial crime itself and make it transform into machine that will never provide then, uh, right output, uh, at the end. And I would also, uh, like to add something because I know that lots of auditors are listening and um, the odd question was also to, um, ask if AI will replace auditors.
And of course, uh, lots of, uh, people say that yes, AI will partially replace auditor, but, um, we showed a statement of a professor, Richard Baldwin, which says that it's not AI that is going to take your job, but someone who know how to use AI might. So this is very important because the human factor behind, it's the human skills that make you unique to your organization, and it's the human touch that builds real connection and drive the real changes.
Okay. So would you argue then that the, the, the skill of internal auditors to basically acquire is the prompting this, this kind of tools, that's what d would differentiate them in the future? Yes. They need to know how to use ai, and of course, someone has to audit AI system. So we need human to audit AI system. And also nobody, no technology can communicate as an auditor can communicate to senior management and the board of directors.
And this is probably one of the key also loopholes in this moment. Most of the AI tools now that you buy are black box behind black box algorithm. So that's very difficult to assess, uh, what there is behind and to understand what is behind. So that's require, let's say, specific upskilling on that sense to ensure that the transition is, uh, achieving the right output to have better unfinancial crime controls.
And for much of this information that there is about auditing ai, like Antonio mentioned Alessandro, the problem with the black box, um, there's some good materials on the i i a with the i i a, um, artificial intelligence knowledge center.
There are a couple of, uh, founding documents and frameworks there that can be leveraged by any internal audit function or any starting auditor or any senior or, you know, director of audit that they can begin, um, building that kind of skillset into, into the talent of the function, um, as we are currently in the Iias internal international conference. Right. Um, I also attended one of the conferences that talked about, you know, AI data analytics.
And, um, going back to the comment that Alessandro was making earlier about the 600 pages being discovered by this artificial intelligence, here's my, where my curiosity goes because one of the speakers said probably we're gonna get as internal auditors, right when we sample, that's gonna sound like a foreign word, maybe in the future, because we are gonna be able to kind of look at a hundred percent of the universe of our transactions when we do an audit instead
of just sampling X percentage of the, of the transactions. What will be your take on that? Are we, are we there yet or are we like 10 years from now? Well, in my opinion, uh, not 10 years because we are very close to it. I believe of course, having 100% of the population, it's very, um, difficult because it's, um, against the statistic rules. I mean, we always need a little margin of error.
We can expand our sample, we can be very close to the population, we can reduce the margin of error, but I think we'll be very hard to analyze the 100% of the population. Then it depends of the population you are, you are analyzing. Of course, if you have a small sample, a small population of course can be possible. But I think in order to have an effective result, you always need the small margin burden. We talk about black box hallucinations, the false positive at the beginning.
Any other concept that you think that we can bring as a, as part of this to, to enrich this podcast? Uh, yes. Um, especially for auditors. I believe that, as I said before, ai, it's a very powerful, uh, tool. But please avoid a false sense of security because auditors can overestimate the, the power of the AI and they can may end up having a false sense of security. So my advice is to always adopt a risk-based approach.
Okay. And this is pretty much in alignment, Antonio and Alessandro with Vision 2035, right? One of the results of, of our survey as an institution, right, the vision of the profession, it's, um, the enhancement of the behavioral or the, so-called soft skills of the internal auditor. This is one where critical thinking might be one, right? Having that, this false sense of security that you just mentioned, auditors need to remain a little bit, you know, vigilant about the output of this tools.
They are tools, right? They're not going to substitute. Um, but I think this is where basically, right, um, soft skills like critical thinking is going to, to help the, the internal audit, uh, profession kind of distinguish itself, not fully relying on, on the, on the artificial intelligence tools in terms of the skillset of the future, why we're talking about vision 2035. Oh, okay. Okay. Yeah. So, um, I see you have a, a multidisciplinary approach.
Um, you know, so you would say Antonio study, you study accounting, i, i your, your, the accounting background, internal audit controls, um, you had more of the economics, diplomacy, um, um, background languages on both sides, right? Multilingual professionals. So yeah, I, I think on that side for, I mean, we, we said, I mean, to transit to technology, you need person that require, uh, also understanding technology.
So indeed, multidisciplinary, uh, is, uh, uh, something that should be kind of key word for the talent of the future. I, I, I do agree with that. And, um, there you need to be able to understand everything. So not only the technology, but so you don't need to forget the governance part. So the regulatory part and also, uh, the business part. So you need to be able to connect the three and make speak the three of, uh, of them, which is, uh, very complex.
Mainly when you also go in niche, maybe like is Luxembourg market somehow because we have type of niche, very complex financial products, and now you need to be able to understand the financial complexity of the products that is not, uh, straightforward. See how, uh, this is applicable on non-financial crime perspective, which are, uh, applied also on a regulatory perspective because regulation media always written always on more general perspective.
And so when you go in niche market, you need to understand how, let's say you can, uh, uh, detail for that and then transform it in a technological solution basically. So how this can really enhance my, my control. So you really need to extend, uh, the type of, uh, knowledge that, uh, talents have to be to, to come in. And that's where probably upskilling is something that is very much, uh, required on every level, uh, to ensure that the transition is, uh, is performed.
Yeah. And the other risk could be that now young generation could rely just on AI without developing human skill, without developing their skill. So, um, I think it's very important before using AI to develop personal skill as internal auditor. And then you can use ai. Because if you don't know what you're looking for, if you don't know how to drive it, you cannot use AI properly. So please keep studying, keep training yourself.
And in my case, for example, well we are young, but it's another generation. We studied a lot before, um, using ai. And it's very important because you have your vision and then you try to adapt the vision to the new vision and to the new approach. Antonio, Alessandro, thanks a lot for your contribution to the internal audit profession. We would really like to Thank you, Gracia. Thank you so much, Ricardo. Thank you Ricardo, for the invitation. Our pleasure.
Enjoying the episode. Hear more from today's guests, Antonio and Alessandro, as featured speakers at the IIA a's 2025 fraud virtual conference happening on February 20th. This is your chance to explore the latest in fraud prevention and detection, guided by industry experts, all from wherever you are. Visit the iia.org or check the show notes to register today and secure your spot. You won't wanna miss it. If you like this podcast, please subscribe and rate us.
You can subscribe wherever you get your podcast. You can also catch other episodes on our YouTube channel@theiia.org. That's THE iia.org.