Most organizations recognize that artificial intelligence introduces risk. Many have already responded by developing policies, establishing governance committees, and outlining acceptable use guidelines. But having an AI governance framework and having confidence that it works are two very different things. Recent EY survey findings highlight that disconnect and why internal audit and security teams must work together to close it, a gap that is quickly becoming a core focus of enterprise AI risk management.
A recent EY survey highlighted by CFO.com revealed an interesting disconnect among large U.S. enterprises:
69% report having a fully unified AI governance policy
69% are concerned they lack the internal expertise to effectively evolve their AI governance controls
47% acknowledge bypassing their AI governance processes to accommodate urgent deployments
The findings point to a challenge that extends well beyond artificial intelligence: organizations are establishing governance structures faster than they can operationalize, validate, and maintain them. As AI becomes embedded in everyday business operations, that disconnect is becoming increasingly difficult to ignore.
Why Doesn’t Governance End When the Policy Is Approved?
Developing an AI policy is an important first step. It establishes expectations, defines acceptable use, and creates a foundation for accountability. But what happens after the policy is approved?
Consider an organization that requires employees to use only approved AI tools. On paper, the expectation is clear. But does the organization know which AI tools its employees are using? Can it identify when sensitive information is shared with an unauthorized platform? Does it understand which third-party vendors have introduced AI into their products?
If the answer to those questions is unclear, the organization may have a governance framework without the operational visibility needed to enforce it, a gap no AI governance audit can catch after the fact. The effectiveness of AI governance should be measured by what an organization can demonstrate, not simply what it has documented.
That means connecting policies to defined responsibilities, technical safeguards, ongoing assessments, and evidence that controls are functioning as intended.
Why Is AI Governance Becoming an Internal Audit Priority?
For internal audit teams, the rapid adoption of AI presents both a challenge and an opportunity. Traditionally, internal audit provides independent assurance that an organization’s risk management, governance, and internal controls are operating effectively. AI introduces an entirely new dimension to that responsibility.
Organizations now need to understand not only where AI is being used, but also how its use affects existing business processes, data protection practices, regulatory obligations, and decision-making.
Internal audit teams should ask:
Do we have a reliable inventory of AI applications, models, and AI-enabled third-party services?
Who owns AI risk across the organization?
Are governance requirements followed during urgent deployments?
What safeguards protect sensitive information?
How are risks and control effectiveness evaluated as technologies evolve?
Can leadership demonstrate oversight beyond the written policy?
These questions matter because AI risk rarely belongs to one department. Legal may focus on privacy; security on access and data protection; business leaders on productivity and innovation. Internal audit can evaluate how those responsibilities fit together, identify accountability gaps, and provide an independent assessment of effectiveness. That takes an understanding of both governance and the underlying technology.
Where Do Technical Controls Make Governance Real?
Even a well-designed framework can fall short if the technical environment does not support it. Employees may introduce unauthorized AI applications. Approved platforms may expose sensitive information through their configurations. AI capabilities may be added to existing software without a formal review.
Agentic AI adds complexity. Unlike tools that primarily generate recommendations, AI agents may execute actions, access systems, and interact with business processes with limited human involvement. EY found that 49% of respondents whose organizations use agentic AI said their governance frameworks had not been updated to address its specific risks and requirements.
An organization may prohibit entering sensitive data into certain AI platforms. Without sufficient visibility, access controls, monitoring, and data protection, how does it know whether the rule is followed? If agent deployment requires approval, can it find unauthorized agents, restrict permissions, and monitor activity?
Policies establish expectations. Technical controls help make those expectations enforceable, this is where AI security controls do the real work governance alone can’t. Strong governance connects business risk to operational safeguards so leadership’s requirements are reflected in how technology is deployed and monitored.
How Can Organizations Govern AI Without Slowing It Down?
Nearly half of survey respondents acknowledged bypassing governance processes for urgent initiatives. Organizations should investigate why: unclear requirements, lengthy approval processes, insufficient understanding, or governance that cannot keep pace with technological change.
The answer is not automatically more restrictions. Effective governance should enable responsible innovation through practical, risk-based reviews and proportionate safeguards. An internal productivity assistant, customer-facing AI application, and autonomous agent with sensitive system access do not present the same risk. A risk-based approach directs attention and resources where they matter most.
What Three Questions Should Leadership Ask Now?
These three questions reflect what a serious AI governance best practices program actually requires, not just what it documents.
Do we know where AI is operating?
Visibility should include employee use, approved and unauthorized tools, vendor integrations, and AI embedded in business processes.
Can we demonstrate that our controls work?
A policy is not proof. Organizations need evidence that governance is followed, safeguards function, and deficiencies are addressed.
Do we have the expertise to keep pace?
AI risks evolve quickly. Leadership should determine whether internal resources can sustain continual oversight or whether additional expertise is needed.
The EY findings remind us that AI governance is not a one-time compliance exercise. It demands coordination across leadership, internal audit, risk management, and cybersecurity. Organizations that rely on documents alone risk a false sense of security; those that connect governance with visibility, measurable controls, and continuous oversight are better positioned to innovate confidently.
The question is no longer simply, “Do we have an AI policy?” It is, “Can we prove our organization is following it and that it is actually protecting us?”
How Can Echelon Risk + Cyber Help?
Echelon’s AI Secure program brings together AI visibility, governance, technical controls, and ongoing advisory support to help organizations understand exposure, address gaps, and build a sustainable AI risk management approach. Whether you lead internal audit, manage security, or oversee AI strategy, we help bridge the gap between policy and practice.
Not sure where your organization stands? Start with our AI Risk Scorecard for a clearer view of your AI risk posture and where to focus next.
Sources
- EY. Survey findings on enterprise AI governance, as reported by CFO.com. [Read article]
- Echelon Risk + Cyber. AI Risk Scorecard. [Take assessment]