Beyond Governance: How Internal Audit Builds Real Trust in AI

Key Insights

• KPMG argues that having AI policies, governance committees and approval processes does not automatically mean AI is trustworthy. Internal Audit should test whether controls actually work in practice.
• AI assurance should extend from design and development through deployment, monitoring and ongoing use, rather than focusing only on governance documentation.
• KPMG recommends maintaining visibility over custom-built AI, vendor AI, embedded AI, online tools and shadow AI. An inventory helps organizations understand what systems exist, who uses them and what risks they introduce.
• KPMG describes an AI assurance approach that combines governance and internal-control testing with quantitative model testing. Examples include fairness checks, class-imbalance analysis and robustness testing.
• For LLM applications such as chatbots, copilots and document-generation systems, KPMG highlights risks including hallucinations, inappropriate content, prompt manipulation, information leakage and overreliance on AI-generated outputs.
• KPMG describes agentic AI as dynamic and adaptive, with systems capable of making real-time decisions and autonomously adjusting to changing conditions. Its TACO framework is used to categorize agents according to goal complexity, planning depth, coordination and orchestration.
• KPMG recommends integrating EU AI Act readiness with broader AI governance and assurance rather than treating compliance as a standalone legal checklist. Areas include risk classification, documentation, human oversight, monitoring, incident handling and AI literacy.