How we help you
Wipfli’s internal controls services help you protect assets, strengthen compliance and increase efficiency.
Develop a tailored internal audit plan.
Gain new insight into your daily operational risks.
Improve your organization’s risk culture.
Maintain effective controls for your systems and IT environment.
Elevate value and trust with strong internal controls
Our multidisciplinary team brings the skills and experience needed to both protect and drive value in your organization.
Explore our internal controls services
Streamline SOX requirements with Wipfli. We create a seamless process by identifying your key business processes related to controls over financial reporting, determining the controls and systems supporting the business processes and then testing the effectiveness of the controls. We then turn SOX program data into internal control knowledge and help provide the resources you need to fill technical and capacity resource gaps.
Wipfli’s internal audit team is ready to help your organization identify your true risk and develop an internal audit plan tailored to your unique goals and challenges. We combine extensive industry experience and practical guidance to help your organization choose the solutions and approaches that best suit your needs. We also provide quality assurance reviews and support for your internal audit team.
Help ensure your IT controls are operating effectively and securely with Wipfli. Our IT controls review helps you identify risks and provides your organization with best practices and actionable feedback so that you can be confident that your controls are effective.
Insights and Resources
EVENT | January 19, 2027
January 2027 Uniform Guidance regulation training
Join us for a practical and engaging virtual training of the Office of Management and Budget’s (OMB) Uniform Guidance (2 CFR Part 200) — the cornerstone of federal grant compliance. This training is designed to help nonprofit and government professionals understand federal grant regulations and how to apply them effectively and avoid common pitfalls in managing federal awards. Led by experienced trainers with years of auditing and consulting expertise, this session blends regulatory review with real-world examples and actionable insights. Whether you’re new to federal
ARTICLE
Shadow AI: How to reduce the risks of unauthorized AI use
As AI continues to transform how many businesses operate, too few executives fully understand the risks that come alongside the rewards. One of the most prominent of those risks is called shadow AI. Most commonly appearing in organizations that don’t have a strong AI governance structure already in place, shadow AI can expose your business to financial, regulatory and reputational damage. But it’s also a risk you can dramatically reduce or even eliminate by putting thoughtful policies in place and properly training your team. Keep reading to learn more about what shadow AI is and how to protect against it. What is shadow AI? Shadow AI refers to the use of unapproved AI tools by employees within your business. This almost always happens because well-meaning team members are simply trying to do their jobs, but can create substantial business risks, like exposing your internal or customer data to public AI models. Shadow AI occurs when an organization doesn’t have strong AI governance or an AI use policy in place. Absent such oversight, team members often choose their own AI tools without considering whether those tools meet data privacy, regulatory, anti-bias or cybersecurity requirements. This far into the AI era, you should assume that many of your team members use AI as part of their daily workflows. That means if you don’t have clear AI policies to govern what tools your team uses or how you protect your data, you are already exposed to the risks of shadow AI. Why is shadow AI a business risk? Shadow AI is a significant business risk that can expose an unprepared organization to financial losses, reputational harm, regulatory action and cybersecurity threats. To understand how, consider the following scenario: Working to meet an urgent deadline, a manager at a financial services firm feeds a large dataset into an AI tool, asking the AI to analyze the data and draw conclusions that she can use in a presentation to her departmental leadership the next day. So far, seems reasonable, right? Analyzing large datasets is one of AI’s biggest strengths. But here’s the problem: The manager doesn’t realize that she’s picked a tool that uses its inputs for training data — which means it’s now absorbed all the proprietary customer data in the dataset she gave it. In this scenario, her company’s private customer details could start appearing in answers the AI tool gives to other users. Regulators will be furious, and so will any customers who find out what’s happened, which exposes the manager’s employer to fines, reputational damage and even litigation. If you want to take this example even further, imagine what could happen if the AI tool had security flaws that could allow hackers to reconstruct the full dataset. How does shadow AI happen? Shadow AI happens when an organization’s leadership fails to implement effective AI governance . If you want your employees to use AI in a way that protects your business and mitigates your risks, you need to show them how. Organizations that adopt AI piecemeal rather than through a cohesive enterprise strategy are typically most at risk for shadow AI. In these cases, shadow AI use typically builds up gradually, as team members turn to AI of their own initiative to solve problems or work faster. A few examples include: Putting internal data into a free chatbot model. Connecting an unauthorized AI assistant to company systems. Using an AI to make decisions that affect customers or team members. Asking a consumer-facing AI to summarize a video of a sensitive client meeting. Essentially, any scenario where someone on your team gives data to or relies on outputs from an AI that your IT and governance team hasn’t already approved can put your business at risk. What are the primary risks of shadow AI? Shadow AI use can create unexpected risks for your business. These can be financial, reputational or regulatory and can also include security risks. Financial costs: Shadow AI use can expose your business to fines, litigation and other costs associated with giving internal or customer data to unauthorized AI systems. Reputational damages: Customers, clients, partners or vendors whose data is exposed by shadow AI use won’t appreciate that — and neither will anyone else who hears about it. Regulatory challenges: AI use that violates regulatory or anti-bias requirements will generate ire from regulators, which can include sanctions, penalties, fines or corrective actions. Cybersecurity dangers: Security vulnerabilities within an unsanctioned AI tool could create cybersecurity risks by allowing hackers to gain access to your data or systems. Also consider that the quality of AI outputs depends heavily on the quality of the data being input . If your teams are using shadow AI tools outside of an organized, enterprise-level AI strategy, you likely don’t have an AI-ready data foundation (like a data lake house) either. This means that your shadow AI users, which may include executives, run the risk of making business decisions based on unapproved tools operating on poor-quality data. How to reduce shadow AI risks To reduce your shadow AI risks and cut down on unauthorized AI use, make AI a pillar of your overall enterprise risk management strategy . Here are key steps to effective AI risk management: Establish AI governance Setting up a formal AI governance structure establishes oversight on your team’s AI use and protects your business from shadow AI. Effective governance is an ongoing process that involves choosing a governance team, selecting approved AI tools, writing policies and seeking feedback from other stakeholders. Crucially, governance is also an opportunity to talk about how your business can use AI to work more efficiently and effectively. Approve enterprise AI tools Selecting and implementing specific AI tools for your team to use dramatically reduces your shadow AI risks. This is because enterprise-level AI options typically protect your data in a way that consumer AI products don’t. Create an AI policy An AI policy establishes written guidelines for how your team should use AI. Creating clear policies helps your team understand what’s allowed and what isn’t, which helps stop inadvertent shadow AI activities. Train employees You can’t expect your employees to follow your AI policies and responsibly mitigate AI-related risks without training. Like cybersecurity, this should be a process, not a one-time event, in order to keep your AI policies top of mind. Monitor AI use Your IT team and governance committee should monitor your organization’s AI use and continually assess your risk exposure. AI and AI-related risks are constantly evolving, and your policies and governance will need to, too. Read more AI ROI: How to get more business value from your AI spending AI governance checklist: A basic framework for your business AI implementation challenges: Why AI may fail to deliver ROI
ARTICLE
AI governance for tribes: A guide for tribal leaders
Tribal leaders are increasingly integrating AI more deeply into their organizational operations. But leaders who don’t first establish AI governance expose their tribes to risks like data security issues, poor operational outcomes and financial losses. Keep reading to learn how AI governance helps tribes mitigate those risks, plus how to create an effective governance structure and AI policy to protect your tribe. Why do tribes need stronger AI governance? Without governance, tribes face the same risks as their non-tribal peers , like shadow AI, data privacy, bias or inaccurate outputs. But tribal leaders also carry the additional responsibility of navigating sovereignty issues and protecting tribal culture, as well as compliance challenges that are only likely to grow over time. Key AI risk management areas for tribes include: Sovereignty and culture: AI use could expose your tribe’s data, including member, cultural and historical data, to AI models without tribal consent, which risks not only member privacy but culturally disrespectful AI-produced content. Shadow AI: Unsanctioned AI use within tribal organizations can create issues with data privacy, costs and inaccurate information flowing up to leaders or your tribal council. Bias and poor output quality: AI trained on limited or inaccurate data may exhibit biases or output wrong answers, and even well-trained models still hallucinate. Cost overruns: As AI models increasingly move to usage-based pricing, it’s become possible to run up a large monthly AI bill without realizing it until it’s too late. Limited regulations: There is still no comprehensive federal AI law in the U.S., but states are enacting their own rules, and the EU AI Act is already in force, with obligations phasing in through 2027. Lack of ROI: AI initiatives that are poorly designed or implemented will cost money but lack impact (for example, a Gartner survey found 84% of finance organizations have implemented or plan to implement AI, but only 7% report high impact ). Many tribal organizations are also currently lagging behind the private sector in AI adoption, which, if not corrected, will make it harder to catch up. How does effective governance help tribes mitigate AI risks and improve outcomes? AI governance helps manage AI risks and improve outcomes by setting ground rules for how your tribal organizations use AI. Effective governance chooses AI tools, defines use cases and builds guardrails to protect your data and mitigate the risk of bad outcomes. Establishing governance typically starts with creating a governance team. Once formed, your governance team will choose AI governance pillars and create a formal AI policy that will help limit risky AI use and deliver better organizational results from your AI investments . AI governance should be an ongoing effort, with your governance team continuing to evaluate AI-related risks and opportunities. Guide your AI governance using policy pillars like these Before you can write your formal AI policy, you need to define key policy pillars. Each pillar covers a critical aspect of AI governance, including areas like fairness, reliability, privacy and vendor risk. Once you have a list of pillars, you can use it to help write your AI policy. Here are common policy pillars that may make sense for your tribe to build into your own AI policy: Fairness and bias management AI models can show bias towards individuals or groups based on certain characteristics like culture, ethnicity or gender. Assess how your AI tools are trained, as bias is especially likely for models that rely on smaller datasets. Reliability and validity With AI, input quality plays a major role in output quality. Evaluate whether you are giving your AI tools the clean, organized data they need, and regularly check AI outputs for errors. Sovereignty, privacy and security Sharing private tribal data with public AI models risks exposing that data to users outside your tribe. Set up controls to help ensure that tribal data is only shared with enterprise AI tools that are contractually bound to protect it. In vendor contracts, ask for explicit terms: No training on tribal data, no benchmarking and a full data export if you leave. Transparency and explainability Leaders should understand how AI models are being used within tribal entities. Conduct regular AI transparency and explainability reviews to make sure that’s the case. Accountability and oversight AI needs human oversight to manage risks, protect against bias and avoid damaging mistakes. Make sure your tribe has clear guardrails and defined oversight structures in place. As vendors embed AI agents directly into finance and ERP systems, govern each agent like an employee: Define what it can reach, who approved it and how to shut it off. Inclusiveness AI tools built on broad, diverse datasets are more likely to deliver outputs that reflect the broad range of human experience. This can help you not just avoid bias but actively promote inclusiveness. Legal and regulatory compliance Legal and regulatory compliance rules for AI are still in their infancy. However, tribes, specifically, should evaluate how AI could affect their existing compliance obligations and watch for future developments in this space. Vendor and third-party risk Your vendors are likely using AI too, which means that any tribal data you share with them could be at risk of being fed to public AI models . Regularly discuss this risk with your vendors and make sure they have their own responsible AI governance policies in place. Acceptable IP use AI outputs that draw on trademarked or copyrighted IP could create liability for your tribe. Be aware of this risk and train your employees to flag potential problem areas. Sustainability AI relies on resource-intensive, energy-hungry data centers to function. If your tribe has sustainability goals, you may want to restrict unnecessary AI use or buy carbon offsets. Again, this list is just a starting point. You may wish to include some or all of these pillars when writing your own AI policy, but you may also determine you need others not mentioned here. AI governance checklist: Follow these action steps to establish your tribe’s own AI governance process To establish an AI governance process for your tribe, you should create a governance team or working group. This group should define AI dos and don’ts, choose governance pillars and consider how AI will affect your tribe, its data and its operations. At that point, you can write your tribe’s formal AI policy. Here are key steps to follow when establishing AI governance: 1. Choose your AI governance team Establish a diverse group of tribal leaders, organizational managers and other stakeholders. This group should include a range of perspectives to help the group consider how AI affects your tribe, its businesses and its people. 2. Level set for AI knowledge Your whole governance team needs to have an active working knowledge of AI. Make sure everyone on the team understands the different types of AI, like agents or generative AI, key risks and how technology is evolving today. 3. Decide on AI dos and don’ts Define your AI dos and don’ts. This is essentially deciding how you want your tribal organizations to use AI, and what sort of usage is off-limits. For example, using an AI tool to help with grant writing or assist in conducting fraud checks may be a do, but delegating those tasks entirely to AI would be a don’t. 4. Select AI governance pillars that fit your needs Based on your do’s and don’ts, along with other considerations like compliance requirements or tribal culture, choose your AI governance policy pillars. Use the policy pillars list in the previous section as a starting point here and then adapt it to meet your tribe’s specific needs. 5. Collaborate with other stakeholders Your AI governance team needs to be able to make crucial governance decisions without getting bogged down, but it should also consult a wide range of stakeholders when possible. Open communication between your governance team, tribal leaders and employees within tribal entities will help ensure both more effective policies and stronger policy adoption. 6. Talk about any new oversight processes you may need Your governance team should create specific oversight processes for areas like AI monitoring or approving a new AI tool. These can then be included in your formal AI policy. 7. Clarify which AI tools are acceptable to use Clearly define which AI tools your tribal organizations are allowed to use. For example, you may want to state that tribal employees can only use enterprise AI tools your tribe has specifically contracted with, as those will protect your data. 8. Write your formal AI policy Turn your dos and don’ts, policy pillars, oversight ideas and acceptable tools list into a formal written AI policy. You can write your own policy from scratch, but you may also find it simpler to download a sample AI policy and adapt it to fit your needs. Read more AI for Tribes: Managing risk and maximizing impact AI ROI: How to get more business value from your AI spending AI risk management: Business strategy, governance and more
Reach out to our team
Connect with our team to get proactive support for mitigating risk, strengthening controls and building resilience.
LET'S CONNECT
See how Wipfli can help you implement risk management that supports compliance, productivity and long-term success.
