Who Audits the Algorithm Deciding Your Fate?

Algorithms in your organization may already shape decisions that impact jobs, safety, access to services, or finances. They might decide which job candidates move forward, which loans get approved, which patients are prioritized, or which suppliers are flagged.

These systems are not neutral. They use data that reflects past patterns, including biases. They are designed to meet goals set by their creators, which might not always be ethical. Because they work quickly and on a large scale, it is hard for people to keep track. In many organizations, no one regularly checks if these systems work as intended, fairly, and within the rules.

That gap is not hypothetical. It is a live governance risk that grows in size with every AI system deployed.

The IIA's Vision 2035 research recognized governance and ethics as a critical capability dimension for the future audit function — and for good reason. As AI becomes embedded in organizational decision-making, the question of who oversees these systems becomes urgent. Regulators are beginning to answer that question through legislation. Boards are beginning to ask it in audit committee meetings. And increasingly, the answer points toward internal audit as the function best positioned to provide independent, structured assurance over AI governance.

But that role requires capabilities most audit functions lack. Evaluating an AI model's fairness goes beyond reviewing documentation. Assessing a machine learning system's outputs means understanding how those outputs are made. Providing assurance over an algorithmic process means knowing which questions to ask—and having the technical fluency to judge the answers.

The ethics and governance challenge is not just about new skills. It means broadening what internal audit must assure when systems, not people, now make crucial decisions.

Robinson De Jesús covers governance and ethics as one of ten key audit capabilities in his upcoming thought-leadership presentation, "The Audit Function of 2035." This presentation outlines how audit functions can build the competencies, frameworks, and processes needed to meet this growing responsibility.

The algorithm deciding someone's fate is already running. Asking who audits it is not rhetorical—it's one of the most critical governance questions now.