Skill.reWhat Is Artificial Intelligence?
Why Understanding AI Matters
Establish a precise, non-technical understanding of artificial intelligence that allows oversight professionals to correctly identify AI, distinguish it from automation, and assess risk.
At the Awareness level, your primary goal is to build a solid conceptual foundation. You do not need to operate AI systems yourself at this stage — but you must understand what they do, how they work at a high level, and why they matter for oversight. This knowledge will be the bedrock upon which all subsequent levels build.
This lesson is designed to be accessible to professionals at all experience levels while providing the depth needed for practical application. Whether you are encountering these concepts for the first time or building on existing knowledge, the material ahead will strengthen your ability to navigate AI governance challenges with confidence and competence.
Why This Matters for Risk, Compliance, and Audit
Understanding concepts in the abstract is valuable, but the real test is whether you can apply them in professional practice. A precise grasp of what AI is — and is not — lets oversight professionals tell genuine AI apart from deterministic automation and assess the governance implications of each.
As you continue through this credential program, you will build on the foundation established in this lesson. Each subsequent lesson adds new dimensions to your understanding and expands your capability to work effectively with AI in oversight roles.
Core Concepts
Artificial intelligence is learned behavior derived from data, not explicitly programmed logic. This distinguishes it from traditional automation, where the rules are written by hand. The key vocabulary below frames the rest of this lesson.
Distinguishing AI from Automation
Traditional software is deterministic: it always produces the same output for the same input, and you can read its logic and understand its behavior completely. Modern AI is probabilistic: it learns patterns from data and produces outputs based on likelihood, so identical inputs may yield slightly different outputs. If you can write the logic explicitly, you do not need AI.
Practical Use Cases
Understanding concepts in the abstract is valuable, but the real test is whether you can apply them in professional practice. This section bridges the gap between theory and application with concrete scenarios drawn from oversight work.
In risk and compliance work:
- Analyzing narrative risk assessments for common themes (learning from historical assessments)
- Generating first drafts of compliance policies (then requiring expert review)
- Classifying incoming controls documentation (policy, procedure, evidence) from submissions
- Summarizing board-level risk registers for executive briefings
In audit work:
- Analyzing transaction logs for unexpected patterns (fraud detection)
- Summarizing meeting notes for audit workpaper structure
- Categorizing vendor correspondence to identify overlooked control gaps
- Generating test plans based on prior-year audit findings (with required validation)
In governance work:
- Tracking emerging risk mentions in earnings calls, news, regulatory guidance
- Summarizing regulatory guidance for impact assessment
- Analyzing board minutes for recurring themes or governance trends
Example 1: AI in Fraud Detection
Scenario: Your organization uses an ML system to flag suspicious payment transactions for manual review.
How it works:
- It was trained on 5 years of transactions: 99% normal, 1% confirmed fraud
- It learned patterns of normal (employees, vendor payments, payroll) vs. unusual (high velocity, new vendor, unusual amount)
- When a new transaction arrives, it scores the risk and flags transactions above a threshold for human investigation
Why it's AI, not automation:
- You cannot write a simple rule ("if amount > $100k, flag it") because not all large transactions are fraud
- The system detects subtle patterns (e.g., "combination of new vendor + timing outside business hours + unusual department") that explicit rules would miss
- It is probabilistic: it scores risk, it doesn't certify the transaction is fraudulent
Governance implications:
- Even flagged transactions are not confirmed fraud; they require human investigation
- The threshold for flagging is a governance choice (more sensitivity = more false positives)
- The system can be biased (e.g., if fraud in the training data was disproportionately from certain departments, the system may over-flag that department)
Example 2: Summarization in Compliance Monitoring
Scenario: Your compliance team uses an LLM to generate first-draft summaries of regulatory guidance for a preliminary impact assessment.
How it works:
- You feed the regulation and guidance documents into an LLM
- The LLM outputs a summary of key obligations, timing, and implications
- Your team reviews, corrects, and builds the full assessment from there
Why it's AI, not automation:
- You don't have a deterministic rule for "what is the essence of this regulation"
- The LLM infers emphasis and importance from language patterns
- Different prompts might yield different summaries (probabilistic)
Governance implications:
- The AI summary is a draft, not the judgment
- Your team must verify that the summary captures the regulation correctly (the LLM might misinterpret or hallucinate obligations)
- You must document that human expert review occurred before the assessment is used in governance decisions
Example 3: What is NOT AI
Scenario 1: Rules Engine A system that flags all payments > $500k for approval.
Why it's not AI:
- The logic is explicit: if amount > 500000, then flag
- The system always behaves the same way for the same input (deterministic)
- You can read the rule and understand the behavior completely
Scenario 2: Excel Pivot Table Analyzing transaction data by vendor and month to find anomalies.
Why it's not AI:
- You are using mathematical formulas (sum, average, count) to transform data
- The output is deterministic and reproducible
- No learning from data is occurring; you are applying fixed logic
Scenario 3: Database Query Running a SQL query against transaction records to find "all payments to vendors created in the last 30 days."
Why it's not AI:
- Deterministic logic (created_date within last 30 days)
- Explicit criteria (vendor created_date)
- Reproducible and auditable
Putting It Into Practice
As you complete this lesson, keep these guiding principles in mind for immediate application:
- Start with awareness: Begin observing where AI is currently being used — or proposed for use — in your organization. You do not need to evaluate it yet; simply notice it.
- Build your vocabulary: Use the terminology from this lesson precisely. Clear language prevents misunderstandings that lead to governance gaps.
- Ask questions: When colleagues mention AI, ask clarifying questions: What type of AI? What data does it use? How are outputs verified? Your questions alone improve organizational awareness.
- Document what you learn: Keep brief notes on AI-related observations and questions. This habit will serve you well in later levels when formal documentation becomes a professional requirement.
Anti-Patterns
Misuse 1: "It's just advanced search"
The claim: "Our LLM is no more risky than Google. It just finds and ranks information."
The risk: LLMs do not find information; they generate plausible text that resembles information. They hallucinate (invent) facts at scale. Google search returns actual documents you can verify; an LLM returns new text that may be entirely fabricated.
Misuse 2: "The AI is too complex to audit, so we trust it"
The claim: "The model has 70 billion parameters. We can't audit how it decides."
The risk: Opacity is not a reason to trust. It is a reason to require stronger human oversight. If you cannot explain an AI decision, you cannot govern it.
Misuse 3: "AI is neutral because it's mathematical"
The claim: "The model learned from data, so it's objective."
The risk: AI systems learn patterns in the data they are trained on. If the training data reflects historical bias (e.g., "this department had more fraud"), the AI will learn and replicate that bias. Mathematics is not neutral if it is applied to biased data.
Misuse 4: Assuming AI precision means AI accuracy
The claim: "The model's output has 10 decimal places, so it's precise."
The risk: Precision (repeatability) does not mean accuracy (correctness). A model can be precisely wrong. A fraud-detection model might consistently score a legitimate transaction type as high-risk, with or without decimal places.
Human Judgment Checkpoints
Before accepting an AI system for use:
- Verify the problem: Does this actually need learning, or would a rule work? (If you can write the logic explicitly, you don't need AI.)
- Understand the training data: What data was this AI trained on? Does it represent your organization's context? (A fraud model trained on US transactions may fail on international patterns.)
- Assess for bias: What groups or categories appear in the training data? Are any overrepresented or underrepresented? (This affects fairness.)
- Define success: How will you measure whether the AI is working correctly? (Beyond "it seems to give reasonable answers.")
- Require explainability threshold: For this use case, can someone explain why a specific decision was made? (Not always possible, but more important for high-stakes decisions.)
- Establish human review: Who investigates when the AI is wrong? How frequent are errors?
Responsible AI Considerations
Transparency:
- Users of an AI system should know they are interacting with AI, not a human or deterministic software.
- Decision-makers should understand when AI contributed to a decision.
Accountability:
- Even though AI makes a prediction, a human is accountable for the decision to act on it.
- This accountability must be clear and documented.
Auditability:
- The system, its training data, and its performance must be auditable (within the limits of proprietary technology).
- Vendor contracts for AI tools should mandate this.
Traceability and Defensibility
In audit work: Audit evidence must be traceable. If you use AI to generate a summary of a risk assessment, you must document which human reviewed and validated it, when, and on what basis. The AI output is input to the audit process, not the audit conclusion.
In compliance work: If AI assists in classifying policies or controls, you must be able to show the training data used, the validation process, and the human review of any automated classifications. For regulatory submissions, AI-generated content must be reviewed and attested to by a qualified human.
In risk work: If AI is used to detect risks, document the threshold for escalation, the false-positive rate, and the review process for flagged items. Governance must understand that the AI system is a detection tool, not a judgment.
Key rule: If you cannot tell an auditor or regulator how a conclusion was reached and who is accountable for it, the conclusion is not ready for use.
Practice and Reflection
- In your organization: Can you identify an AI system currently in use? What type is it (ML, LLM, generative)? What is it trained to do?
- Distinguishing AI: You hear about a new tool that "automatically categorizes risks from the risk register." Is this AI? Why or why not? What would you need to know?
- Your skeptical question: A vendor says, "Our AI is 95% accurate." What follow-up questions would you ask before trusting that claim?
- In your work: Where do you currently use rules engines or deterministic logic that someone might mistakenly call AI?
Key Takeaways
- AI is learned behavior from data, not programmed logic. This is the fundamental difference from traditional automation.
- Today's AI is narrow. It excels at specific tasks; it cannot generalize like humans.
- LLMs generate plausible text, including false text. They predict the next word; they don't verify facts.
- AI is probabilistic, not deterministic. Identical inputs may yield slightly different outputs. This is not a bug; it's how learning-based systems work.
- Opacity is a governance challenge, not a reason to trust. Strong oversight is required precisely because the decision logic is not human-readable.
Frequently Asked Questions
Glossary
- Artificial Intelligence (AI): Software designed to learn patterns from data and perform tasks without explicit step-by-step instructions.
- Machine Learning (ML): AI where the system improves by learning from data, rather than being programmed explicitly.
- Large Language Model (LLM): AI trained on vast text data to predict and generate language.
- Generative AI: AI systems that produce new content (text, images, code) from a prompt.
- Narrow AI: AI designed for a specific task. All AI today is narrow.
- Deterministic: Always produces the same output for the same input (traditional software).
- Probabilistic: Produces outputs based on likelihood; may vary slightly for the same input (modern AI).
- Black box: An AI system whose decision-making process is opaque or difficult to explain.
- Hallucination: When an AI generates false information presented as fact.
- Bias: When an AI system learns skewed patterns from training data and replicates them.