On August 31, 2026, Forvis Mazars published a pointed piece on closing the gap between AI governance and internal controls. Its core argument is one every internal audit leader will recognise: many companies have an approved AI policy but no mechanism to monitor actual usage, and as the authors put it, a policy with no monitoring, reinforcement or escalation path is not a functioning control. Employees keep using unapproved AI tools in everyday workflows, and because that use leaves almost no procurement or installation trail, it is largely invisible to the teams meant to govern it.
The timing is not accidental. In February 2026, COSO released Achieving Effective Internal Control Over Generative AI, which maps GenAI risk onto the five components of its Internal Control – Integrated Framework. Audit committees, external auditors, lenders and investors are starting to ask for evidence across those components. And the confidence gap is wide: Grant Thornton’s 2026 AI Impact Survey of 950 business leaders found that 78% lack strong confidence they could pass an independent AI governance audit within 90 days.
For global enterprises, GCCs and listed companies alike, this is a shift in the burden of proof. Governance documents are now the starting point of an audit conversation, not the end of it. Crest.Digital’s position is simple: AI governance becomes real when it is expressed as controls that are designed, operated, tested and evidenced, which is exactly the discipline internal audit already applies to finance and access. The same logic underpins our earlier pieces on why AI compliance is moving from documentation to evidence and why an AI inventory has to come first.
Crest.Digital’s TPRM platform applies the same evidence-first logic to the AI posture of your vendors — tracking governance artefacts, monitoring change after onboarding and keeping an auditable record against each third party.
Explore the TPRM PlatformThe Policy-Control Gap: Where AI Governance Quietly Breaks
A policy-control gap exists whenever a stated rule has no mechanism that observes whether it is followed. AI makes this gap unusually easy to create. Adoption is bottom-up, tools are consumer-grade and browser-based, and a generative AI assistant can be wired into a workflow in an afternoon without a ticket, a purchase order or a security review. The policy says “approved tools only”; nothing in the environment can tell whether that is true.
The pattern is visible at board level too. Grant Thornton’s survey found 75% of boards had approved major AI investments, yet only 48% had set AI governance expectations and just 46% had integrated AI risk into ongoing oversight. Investment moved faster than assurance. For agentic AI the exposure is sharper: 73% of respondents said they give AI agents access to data and processes, while only 20% had tested incident response plans for AI failures. An agent with system access and no tested containment plan is an internal-control deficiency waiting for an incident to expose it.
COSO for GenAI: Five Components, Five Questions an Auditor Will Ask
The COSO framework has anchored internal control over financial reporting for decades, and its latest GenAI guidance deliberately avoids inventing a new vocabulary. It also sorts GenAI use into eight capability types — ingestion, transformation, posting, orchestration, judgment, monitoring, regulatory intelligence and human-AI interaction — so that controls can be matched to what the AI actually does rather than to the technology label. A tool that drafts text needs different controls from an agent that posts entries or approves exceptions.
Read through an internal audit lens, the five components translate into five practical tests.
Control Environment: Who Owns AI, and Who Is Accountable?
Boards and executives set the tone. Test that AI has named owners, defined decision rights and board-level reporting. Grant Thornton found 75% of boards approved major AI investments but only 48% set governance expectations.
Risk Assessment: Is Every AI Use Assessed Before It Scales?
Test that each AI system, tool and agent is inventoried and risk-rated, including unsanctioned use. An assessment completed once at launch and never refreshed is a design gap, not a control.
Control Activities: What Actually Stops or Flags a Bad Output?
Test prompt logging, data masking, access scoping, approval checkpoints and bias or accuracy testing. These are the mechanisms that turn policy language into something that runs.
Information and Communication: Does Evidence Reach the Right People?
Test that exceptions, incidents and usage trends reach owners, risk committees and audit committees in time to act, with a record of what was escalated and decided.
Monitoring Activities: Who Checks That the Controls Keep Working?
Test ongoing and separate evaluations. This is where most AI governance programs are thinnest, and where continuous monitoring and independent testing carry the most value.
Notice how little of this is about the model itself. Most of it is about ownership, inventory, logging, approvals and monitoring — the unglamorous machinery that the IIA’s Global Internal Audit Standards already expect assurance functions to examine. Where AI touches financial reporting, the same discipline connects to our analysis of AI agents in financial reporting and the human approval question.
Crest.Digital’s Agentic Risk & Continuous Assurance practice builds customized agents that connect to your systems of record and test AI controls continuously — with human-in-the-loop review on every conclusion.
What a Functioning AI Control Actually Looks Like
A useful test of any AI control is whether an auditor could, without asking the control owner, reperform it from system records. Forvis Mazars points to automated prompt logging, data masking, human-in-the-loop checkpoints and bias testing as the kind of mechanisms that embed controls into workflows. Each becomes auditable when four attributes are defined: what triggers the control, who owns it, what evidence it leaves behind and what happens on failure.
Take a human approval checkpoint on an AI-drafted journal entry. As a policy, it reads “AI outputs must be reviewed.” As a control, it is a workflow step that blocks posting until a named reviewer approves, records who approved what and when, samples approvals for rubber-stamping, and raises an exception if entries were posted without a review record. The second version can be tested daily; the first can only be asserted annually. This is the same translation we describe for operational procedures in policy-to-control intelligence, applied to AI.
The evidence principle matters because assurance standards care about sufficiency and reliability. The PCAOB’s audit evidence standard favours evidence obtained directly and generated by reliable systems over evidence assembled after the fact. Screenshots and attestations collected in the weeks before an audit are the weakest form. Logs, workflow records and automated test results generated as the control operates are the strongest, which is why continuous collection beats periodic collection. For the evidence side of this argument, see evidence intelligence and control validation.
Shadow AI: The Control You Cannot Test Without Discovery
No control framework works on systems nobody knows exist. Shadow AI — generative tools and agents used outside sanctioned processes — is the hardest part of the inventory problem because it leaves no purchase record. Detection has to come from signals that already exist: network and identity logs, browser and SaaS-discovery data, expense and card transactions, and API and OAuth grants to AI services. Our earlier piece on shadow AI as the new shadow vendor problem covers the third-party angle: every unsanctioned tool is also an unassessed vendor receiving company data.
Agents add a further requirement. An agent that can act needs its own identity, scoped access and an audit trail, otherwise accountability dissolves at the moment something goes wrong. We have written about why AI agents need audit trails and why an independent assurance layer for agent testing is becoming necessary; both are direct consequences of the monitoring component in COSO’s framework.
From Policy to Tested Control: A Six-Step Playbook
Crest.Digital delivers this as a configurable “Risk Automation Pod” rather than a bespoke build. The reusable stack — integration connectors, agent orchestration, evidence capture and exception workflow — is configured around your control environment, so first results arrive in weeks and not in a multi-year implementation.
The Discover → Design → Connect → Deploy → Validate → Transfer Model
- Discover: Inventory AI systems, tools and agents, including unsanctioned use, and map each to an owner, data classes and business process.
- Design: Translate policy statements into testable controls with pass-fail logic, evidence requirements, thresholds, owners and human review points.
- Connect: Integrate identity, ticketing, GRC, document, procurement and AI-gateway logs so tests read systems of record rather than self-reported answers.
- Deploy: Start with the highest-consequence uses, such as AI touching financial reporting, customer data or autonomous actions, then widen coverage.
- Validate: Run parallel tests against known-good and known-bad cases to calibrate accuracy and false-positive rates before results are relied upon.
- Transfer: Hand the framework to internal audit or risk to run, or continue it as a Crest.Digital-managed service with human sign-off on conclusions.
Two design choices keep this credible. First, human-in-the-loop governance: agents test and flag, while internal audit owns thresholds, judgment and conclusions, so the monitoring layer strengthens rather than replaces professional skepticism. Second, independence: the monitoring should be separable from the teams operating the AI, so its evidence can be relied on by audit committees and external auditors. For organizations already running ISO-based management systems, much of the document control and corrective-action machinery carries over; our recent view on why an ISO 42001 certificate is not the same as AI governance makes the complementary point.
For boards, the takeaway reduces to three questions. Which AI systems and agents do we actually have, including the ones nobody approved? For each material one, which control tests run continuously, and where is the evidence? And when a control fails, who is told, how fast, and what is recorded? If the answers live in policy documents rather than in system-generated records, the organization has governance intent but not yet governance assurance. Our related analysis of the agentic AI governance gap in audit testing goes further on testing methodology, and ISACA’s COBIT-style control mapping offers a common vocabulary for the exercise.
Crest Perspective
AI governance programmes that treat AI risk as a technology problem will be underprepared for the regulatory environment taking shape in 2025–26. The EU AI Act, NIST AI RMF, and emerging FCA guidance all frame AI risk as a governance and accountability question first — the technology controls follow from having clear answers to who is responsible, what decisions the AI influences, and what the escalation path is when the system behaves unexpectedly.
Frequently Asked Questions
In February 2026, COSO published Achieving Effective Internal Control Over Generative AI, which applies the COSO Internal Control Integrated Framework to GenAI. It organizes the response across the framework’s five components: control environment, risk assessment, control activities, information and communication, and monitoring activities. It also groups GenAI uses into eight capability types: ingestion, transformation, posting, orchestration, judgment, monitoring, regulatory intelligence and human-AI interaction. The practical message is that GenAI does not need a separate governance universe. It needs the same disciplined design, operation and testing of controls that organizations already apply to financial reporting and operations, adapted to the way AI systems behave.
A policy states an intention; a control is a mechanism that operates repeatedly, has an owner, produces evidence and triggers action when it fails. An AI use policy that says employees must not paste confidential data into unapproved tools is a policy. A control is the mechanism that detects such use, such as prompt logging, data masking or discovery of unsanctioned tools, plus a named owner who reviews exceptions and an escalation path. Auditors and audit committees increasingly look for the second thing, because a policy with no monitoring cannot show that anything actually happened between the day it was approved and the day it was tested.
Expect requests for an inventory of AI systems and their owners, records of approvals and risk assessments, logs showing how AI systems were used and what data they touched, evidence that human review occurred where the policy requires it, results of testing for accuracy or bias, and records of how exceptions were raised and closed. The common thread is that evidence must be generated by the operation of the control rather than assembled after the fact. Evidence collected continuously from systems of record is more reliable than screenshots and attestations gathered in the weeks before an audit.
Internal audit can define a short list of AI controls with clear pass-fail logic, such as every registered AI system having a current owner and risk assessment, every in-scope agent having a defined access scope, and every human-approval checkpoint recording a reviewer. Agents connected to systems of record can then test these controls on an ongoing basis, flag exceptions to owners, and retain the evidence. This extends continuous controls monitoring from finance and access controls to AI governance. Human auditors stay in the loop for judgment, thresholds and conclusions, while automation handles the volume of routine testing.
Crest.Digital’s Agentic Risk and Continuous Assurance practice builds customized AI agents and continuous-control solutions around your systems, risks and control environment, delivered as a configurable Risk Automation Pod rather than a bespoke software build. The agents connect to existing GRC, identity, ticketing, document and procurement systems, test the controls behind your AI governance framework on an ongoing basis, route exceptions to named owners and keep the evidence trail. The same capability extends to third-party risk, where Crest.Digital’s TPRM platform monitors the AI posture of the vendors your business depends on.