Topic starter
19/08/2026 3:25 pm
TL;DR: AI tools have already contributed to failed audits or lapsed standards for 71% of IT and security professionals, with accountability most often landing on the CIO or CISO, according to Drata’s 2026 State of GRC in the Age of AI report. The real problem is not deployment speed but the lack of evidence, ownership, and traceability when AI participates in control operation.
Editorial analysis by NHI Mgmt Group, based on content published by Drata: “The Accountability Problem: When AI Negatively Impacts the Audit, Who’s Responsible?”.
By the numbers:
- 71% of IT and security professionals say AI tools have already led to a failed audit or a lapsed regulatory standard.
- 53% have seen AI tools lead to a failed audit or lapsed standard once or twice, while 18% have seen it multiple times.
- Only 5% of respondents said they have not been audited yet.
Key questions
Q: What breaks when AI participates in a control but ownership is unclear?
A: The control may still run, but it becomes hard to prove who owned the result, how the decision was made, and whether the process met audit expectations.
Q: Why does AI in GRC create accountability risk for the CIO or CISO?
A: Because executive leaders remain accountable for control outcomes even when AI changes how those outcomes are produced.
Q: How do audit teams prove that AI-related controls are working?
A: They need a traceable chain from policy to approval to access change to transaction outcome.
Practitioner guidance
- Define outcome owners for every AI-touched control Map each AI-assisted control to a named business or technical owner, and document exactly which outcome they are accountable for when the control is audited.
- Embed evidence capture into control workflows Preserve decision inputs, outputs, exceptions, and reviewer sign-off so auditors can reconstruct how the control operated without relying on memory.
- Rewrite vendor contracts around owned outcomes Specify which outcomes the tool owns, how success is measured, and what happens when the tool’s output contributes to a failed audit or lapsed standard.
Bottom line: AI creates audit exposure when it participates in a control but cannot produce a defensible record of how the outcome was reached.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:10 pm
AI accountability is now an evidence discipline, not a policy statement. Once AI participates in control operation, governance has to prove operating effectiveness, not merely declare responsibility. That changes the assurance model for GRC, because auditors care about traceable outcomes, not intent. Practitioners should treat evidence capture as a control requirement, not an administrative afterthought.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who is accountable when audit automation exposes a control failure?
A: Accountability sits with the control owner and the governance team that defined the workflow, not with the audit function alone. If remediation is not assigned, tracked, and verified, automation only improves visibility while the underlying exposure remains open.
👉 Read our full editorial: AI accountability is now an audit issue, not just a governance one