Shining a Light on Shadow AI: Audit Techniques for Unapproved AI (2-Days)

Event Summary:

This eight-hour workshop, delivered in two live half-day sessions, gives IT auditors a practical method for finding and evaluating AI tools operating outside approved channels. Most organizations underestimate this gap until an audit exposes it. Participants build a discovery process, map findings to recognized compliance frameworks, and leave with a repeatable approach to one of the fastest-growing blind spots in enterprise risk.

The first session focuses on discovery. You distinguish Shadow AI from classic Shadow IT, design a 30-day discovery initiative, and build a living AI inventory. The second session focuses on assurance. You map findings to NIST AI RMF, ISO 42001, and the EU AI Act, test for regulated data leaving controlled environments, evaluate DLP and browser-level controls, and practice scoping a Shadow AI audit into your existing IT audit cycle.

What You Will Learn

• Distinguish Shadow AI from classic Shadow IT and explain why Shadow AI spreads faster.
• Design a 30-day discovery initiative using network telemetry, endpoint inventories, and CASB logs.
• Build a living AI inventory dashboard covering approved and unapproved tools.
• Map Shadow AI findings to NIST AI RMF, ISO 42001, and EU AI Act requirements.
• Test for AI-assisted workpapers and regulated data leaving controlled environments.
• Evaluate DLP and browser-level controls for AI interactions.
• Review real audit evidence requests auditors now use for AI discovery.
• Practice scoping a Shadow AI audit into an existing IT audit cycle.

CPE: 8 CPE hours

Time: 8:00 AM - 12:00 PM EST

Location: Live, online virtual classroom platform. Connection details will be provided to registrants via email prior to the training start date.

Cost:

• $30 - Members (Note: IIA and ISSA members can sign-up under the member rate)
• $100 - Non-Members

Note: Training materials will be delivered via email prior to the course start date.

Receiving CPE Credit: Please note that virtual attendance will be recorded, and late arrivals that do not sit for the allotted session time will not receive CPE credit. Certificates of attendance will be issued via email within 1-2 weeks of the event.

Reservations Policy: All reservations made are subject to the Chapter's General Cancellation Policy.