ChatGPT is a chatbot launched in November 2022 by OpenAI that is based on their GPT-3 extensive family of language models that have been fine-tuned by applying both reinforcement and supervised learning techniques.

With ChatGPT bringing transformational changes to artificial and augmented intelligence, GRC professionals can take the opportunity to create and evaluate use cases that enhance the overall automation of repetitive resource-intensive tasks.

To better understand where ChatGPT can be leveraged for GRC programs, let us evaluate their key elements and discuss how it can be integrated to achieve benefits.

Elements of GRC Program

1. Key elements for the success of any automation driven GRC program includes:
2. Establishing the “expected outcome” of the processes
3. Building checks and balances for the process as documented
4. Adopting a GRC tool to automate the GRC processes and workflows
5. Identifying feasible “integration points” for the GRC tool with other technologies using the SECOPS, risk management, policy compliance and other data input modules
6. Setting up “automated feeds” or the best “possible integration” inputs with the GRC tool for the “continuous data feeds” required to assess and review the operational environments
7. Custom building modules for process reviews with workflow automation to ensure that the checks and balances designed for the processes test the process modification or identify any anomalous process execution to trigger alerts
8. Integrating advanced algorithms to “evaluate baseline configuration output vs. the revised configuration output to help with variance calculation”

Use Cases for ChatGPT Integration

For effective and efficient use of GRC, organizations must integrate GRC with business and IT. This aspect can very well be the first use case of AI where the basic integration aspect of business and IT processes can be achieved by leveraging AI.

To further the integration of AI with GRC function, the core components of audit, compliance and risk management can leverage AI to develop the initial blueprint, with human intelligence implementing the fine-tuning as per the requirement of the engagement. Other areas that can be good use cases for ChatGPT integration include:

1. Identifying normal CI configuration parameters versus anomalous configurations with business analytics algorithms
2. Using AI to analyze past configurations versus baseline configurations and the changes introduced to provide predictive analysis results for “Risks” & “Compliance Breach” scenarios
3. Reviewing most of the change updates for the control environment, control Language and evidence requirements
4. Verifying design standards against benchmarks
5. Reviewing and validating architectural designs
6. Evaluating IT processes, data flow, data segregation, data classification, etc.
7. Evaluating SDLC and STLC to ensure that software design and components are tested and validated
8. Threat and vulnerability tracking and updates
9. Risk tracking review and status updates

Way Forward

However, the challenge of going forward with the adoption of ChatGPT or any AI in the GRC space is about the target audience. This challenge is driven by the sensitive and critical data that is handled by GRC professionals versus the training model and data sets required to train the AI tool.

Key Take Away

While AI can pave the way for successful GRC program development and execution, the key aspect would always be the overall review of the program and to tailor it as per the scope of the project and organizational requirements. Additionally, the models used to train AI tools as well as the techniques and data sets used need to be more reasonably determined so they do not create any additional risk for the organization.

While the evolution of AI is certainly a beneficial advancement, the limitations caused by the uncertainties associated with GRC components may need to be regularly reviewed so the AI can be trained for better output.

Share  

While the evolution of AI is certainly a beneficial advancement, the limitations caused by the uncertainties associated with GRC components may need to be regularly reviewed so the AI can be trained for better output.