Internal Controls

The framework of policies, procedures, and organisational structures that guide the responsible development, deployment, and monitoring of artificial intelligence systems. AI governance encompasses risk management, ethical guidelines, regulatory compliance, model validation, and accountability mechanisms.

The body of laws, regulations, and procedures designed to prevent criminals from disguising illegally obtained funds as legitimate income. AML compliance requires financial institutions to implement customer due diligence, transaction monitoring, suspicious activity reporting, and record-keeping.

Adherence to the requirements of the Sarbanes-Oxley Act of 2002 (SOX), US federal legislation mandating rigorous financial reporting, internal controls, and audit standards for publicly traded companies. SOX Section 302 requires CEO/CFO certification of financial statements, while Section 404 mandates annual assessment of internal controls over financial reporting.

The policies, procedures, and controls organisations implement to ensure they do not engage in prohibited transactions with sanctioned countries, entities, or individuals. Sanctions regimes are administered by bodies including OFAC (US), OFSI (UK), and the EU Council, and violations can result in severe criminal penalties, asset freezes, and reputational damage.

A chronological record of system activities, transactions, or document changes that provides a verifiable history of who did what, when, and why. Audit trails are essential for regulatory compliance, fraud detection, and internal controls, and are required by standards including SOX, GDPR, and ISO 27001.

A controlled testing environment established by a financial regulator that allows fintech companies and other innovators to test new products, services, or business models with real customers under relaxed regulatory requirements for a limited period. The FCA launched the first regulatory sandbox in 2016, and the concept has since been adopted by over 50 jurisdictions globally.

The body of laws and corporate policies designed to prevent the offering, giving, soliciting, or accepting of bribes in commercial and public transactions. The UK Bribery Act 2010 is among the strictest globally, creating a corporate offence of failing to prevent bribery with a defence only for organisations that can demonstrate adequate procedures.

Government regulations that restrict the transfer of specified goods, software, technology, and technical data across national borders for reasons of national security, foreign policy, or non-proliferation. Export controls in the UK are administered under the Export Control Act 2002, while the US uses the Export Administration Regulations (EAR) and International Traffic in Arms Regulations (ITAR).

What does AI due diligence involve for investors?

AI due diligence evaluates a company's AI capabilities, data assets, model performance, technical debt, governance practices, talent dependency, and the defensibility of its AI competitive advantages.

What is responsible AI and why does it affect enterprise value?

Responsible AI is the practice of developing and deploying AI systems that are fair, transparent, accountable, and privacy-preserving — it affects enterprise value by reducing regulatory risk and building stakeholder trust.

What AI governance frameworks should companies adopt?

Companies should adopt AI governance frameworks covering ethical principles, risk management, transparency, accountability, and compliance — drawing from standards like the EU AI Act, NIST AI RMF, and ISO/IEC 42001.