Reimagining Internal Audit, Enterprise Risk and Financial Crime Governance Through Artificial Intelligence and Predictive Risk Intelligence

Abstract

This empirical study investigates how artificial intelligence (AI) and predictive risk intelligence (PRI) are 
reconfiguring internal audit, enterprise risk management (ERM) and financial-crime governance across UK 
FCA/PRA-regulated firms between 2020 and 2024. Using a mixed-methods design that combines a primary online 
survey of 214 Chief Audit Executives (CAEs) with a secondary dataset of 168 FCA final enforcement notices, the 
paper quantifies adoption maturity, detection-efficacy lift, cost-benefit balance and SYSC 6/7 compliance 
readiness. The findings show that production AI deployment in internal audit rose from six percent of firms in 
2020 to thirty-four percent in 2024, while average financial-crime detection rates across six risk categories 
improved from thirty-seven percent to seventy-six percent. Net annual benefit per firm reached GBP 37.7 million 
in 2024, against an average implementation cost of GBP 33.5 million. Critically, FCA enforcement actions 
flagged or escalated by AI tools increased from eleven percent in 2020 to sixty-four percent in 2024, suggesting 
that PRI is materially shaping supervisory outcomes. The study contributes: (i) a four-layer PRI reference 
architecture calibrated to SYSC 6/7, the Consumer Duty and Operational Resilience expectations; (ii) evidence 
that AI maturity correlates positively with audit-finding remediation speed (r = 0.71, p < 0.01); and (iii) 
practitioner guidance on governance, model risk and data-protection constraints under UK GDPR. The paper 
concludes that UK audit committees should treat PRI not as a discretionary technology investment but as a 
foundational enabler of SYSC compliance and prudent risk culture, and that regulators should issue dedicated AI 
assurance guidance to accompany existing SS1/21 operational resilience rules.