Episode 2: AI Governance, with Lillian Chisholm

Assurance Matters - Episode 2

AI Governance, with Lillian Chisholm.

Welcome to Assurance Matters, the Chartered IIA podcast exploring the latest thinking in internal audit, governance, risk and leadership.

In this episode, host Ann Brooke, Chartered IIA's Director of Knowledge and Learning, is joined by Lillian Chisholm, Vice President of Group Internal Audit at AstraZeneca, to discuss one of the most pressing challenges facing organisations today: balancing AI innovation with effective governance.

Drawing on her experience in finance, business leadership and internal audit, Lillian shares practical insights into how organisations can embrace AI while managing emerging risks around data quality, cybersecurity, third-party providers and accountability. The conversation explores how governance frameworks can support innovation rather than restrict it, and why internal audit has a key role to play in enabling responsible AI adoption.

Lillian also reflects on the future of the profession, highlighting the growing importance of critical thinking, business acumen and adaptability as AI transforms the way organisations operate. For internal auditors, boards and senior leaders alike, it's an insightful look at navigating the opportunities and challenges of AI with confidence.

Listen on Apple Podcasts Listen on Spotify Listen on SoundCloud

Key points

00:37 – From finance to internal audit leadership: Lillian reflects on her career journey and how experience across different industries has shaped her approach to delivering value through internal audit.

02:01 – Building an internal audit function that delivers value: Why internal audit needs to understand organisational strategy, support future growth and tailor its approach to the needs of the business.

05:49 – How AI is changing the risk landscape: The emerging challenges around AI models, data protection, third-party dependencies and the shift towards continuous assurance.

08:55 – Balancing innovation with effective AI governance: How organisations can encourage experimentation while introducing proportionate controls that don't slow down innovation.

12:40 – Establishing clear ownership of AI risk: The importance of collaboration between IT, enterprise AI teams and the wider business, alongside the growing cybersecurity challenges associated with AI.

15:55 – Why data quality is fundamental to AI success: The role of data readiness, classification and protection in ensuring reliable AI outputs and maximising the value of AI investment.

18:47 – The growing role of internal audit in AI governance: How internal audit can provide ongoing challenge and assurance as AI technologies, organisational responsibilities and risk profiles evolve.

22:50 – The skills internal auditors need in an AI-driven world: Why critical thinking, business acumen, adaptability and continuous learning are becoming more important alongside technical knowledge.

26:21 – Developing AI knowledge and business understanding: Why auditors don't need to become AI specialists, but must understand enough to challenge AI outputs and engage confidently with the business.

28:07 – Practical advice for internal audit leaders: The importance of leading by example, embracing AI personally and positioning internal audit as an enabler of responsible innovation.

29:25 – Making AI adoption deliver measurable value: Why internal audit teams should prioritise practical use cases, focus on return on investment and take an agile approach to implementation.

30:50 – What boards need to know about AI governance: The importance of clear accountability, transparency around failures and recognising that effective AI governance is an ongoing journey.