Internal Controls in the AI Era: 3 Designs SMEs Should Implement Now

The New Question AI Adoption Poses for Internal Controls

With generative AI becoming a standard part of business operations, I've been receiving more questions from SME owners like, "What happens to our internal controls when we use AI?" This question actually hits the nail on the head. That's because unlike traditional IT systems, AI steps into the human domain of "judgment."

In a report titled "New Considerations for IT Internal Controls Amid Expanding AI Adoption," EY has organized specific points of discussion regarding internal controls in the AI era. Using this report as a springboard, I'd like to explore the essence of "internal controls in the AI era" that SME owners should understand.

Start with the Premise That "AI Is a Black Box"

In its report, EY highlights the need to ensure "explainability" and "auditability" as key points for internal controls when introducing AI. What's especially important is maintaining a state where you can later verify what data the AI used and what logic it applied to reach its decisions.

Here, I want SME owners to think about drawing the line between "what we'll allow to remain a black box" and "what we need to make visible" when introducing AI. Perfectly visualizing everything like a large corporation isn't realistic. However, if the areas where you simply say "because the AI decided so" expand too far, it becomes a significant risk down the road.

The "Three Visualization Lines" Owners Should Decide

Specifically, I recommend including the following three areas as targets for visualization:

1. Input Data Management
What data are you feeding into the AI? Does it include personal or confidential information? This is the most fundamental checkpoint.

2. Recording the Decision-Making Process
What process did the AI use to reach its conclusion? Is the system designed to leave logs? This is essential, especially when using AI for customer-facing or contract-related tasks.

3. Human Final-Check Points
Where do humans need to review the AI's decisions rather than accepting them as-is? If you don't clarify this, you'll end up with "irresponsible operations" left entirely to AI.

It's Not "AI Will Take Our Jobs" but "AI Will Change the Quality of Work"

On the ground at SMEs, there's a mix of expectations that "AI will make work easier" and fears that "AI will take our jobs." But from a business owner's perspective, what matters is neither—it's "how AI will change the quality of work."

Consider, for example, introducing AI into accounting operations. Traditionally, the accuracy of journal entries was paramount, but after AI adoption, a new task emerges: monitoring whether the AI is making correct entries. This isn't simply task substitution; it's a structural change in how work is done.

As EY's report points out, internal controls in the AI era center on managing the processes that use AI rather than managing the AI itself. SME owners need to understand this structural shift and redesign their internal business processes accordingly.

Three Actions SMEs Can Take "Right Now"

Building on the EY report, here are three concrete actions that SME owners can start implementing today.

Action 1: Take Stock of AI Usage

First, identify "which business processes are using AI" within your company—including cases where employees are personally using ChatGPT. Without this inventory, any discussion of internal controls is premature. You'd be surprised how many employees are using AI tools for work without authorization.

Action 2: Create a One-Page "AI Usage Policy"

You don't need a thick policy document like large corporations. On a single A4 sheet, outline "what's allowed," "what's prohibited," and "which tasks can use AI decisions directly versus which ones require human review." This single page becomes the foundation of your internal controls in the AI era.

Action 3: Make an Annual AI Audit a Habit

AI usage changes daily. Even once a year is fine, so build a habit of cycling through "AI usage inventory → policy review → employee training." Companies that keep this cycle running will be a step ahead in AI governance.

Internal Controls in the AI Era Are About "Design Philosophy," Not "Technology"

Finally, here's what I want to convey to business owners: What truly matters in AI-era internal controls isn't the technical details—it's your design philosophy around how you position AI.

If you see AI merely as a "convenient tool," internal controls will be put on the back burner. But if you see AI as a "new decision-making entity," you'll naturally develop a perspective on how to manage those decisions. As EY's report suggests, internal controls in the AI era demand a paradigm shift from "managing technology" to "managing judgment."

The strength of SMEs lies in their small size and fast decision-making. Leverage this advantage to design "internal controls for the AI era" more nimbly than large corporations. You don't need to aim for perfection from day one. What matters is steadily accumulating small steps you can take starting today.

*This article is an original analysis and commentary from the perspective of SME owners, based on EY's published report "New Considerations for IT Internal Controls Amid Expanding AI Adoption."