Background
Organisations are entering into the workspace of harnessing artificial intelligence to more efficiently conduct their business and engage with their customers and other stakeholders. This includes both in the routine governance audit workpaper sphere and the wider ESG reporting and data capture obligations. A fundamental artificial intelligence policy is essential to start to set the rules of the road for what can, for some, be a revolutionary journey.
This Real Clear Insight can be fine-tuned to the nuances of your organisation, whether it is fully embarking on artificial intelligence business facing improvements, or more surreptitiously using the technology to manage things like ESG obligations, internal and external audit expectations, or other support function overheads behind the scenes.
Objective of the Policy
The objective of this policy is to ensure the safe, ethical and responsible use of Generative Artificial Intelligence (GenAI) technology. It outlines the guidelines and expectations for the use of GenAI services including ChatGPT.
Definitions to include in the Policy
ChatGPT (GPT stands for Generative Pre-trained Transformer) is a GenAI product developed by OpenAI that responds to user prompts to generate new content based on the data it has been trained on. The current version of ChatGPT is based on training data of internet content up to a published date, that is always older than the current date.
Board means the highest level governing body (e.g., a board of directors, a supervisory board, or a board of governors or trustees) charged with the responsibility to direct and/or oversee the organisation's activities and hold senior management accountable.
Director means one of the individual members of the Board.
De-identification means removing, anonymising, or masking personal information so that it can no longer be used to identify an individual. This process is crucial to protect privacy and comply with data protection regulations.
Generative Artificial Intelligence (GenAI) is technology that uses machine learning to generate digital content such as text, images, videos, audio and code based on large datasets in response to user prompts.
Personal information means any information that can be used to identify an individual directly or indirectly such as a name, address, email, family details or a combination of information from which an individual can be identified.
Team members mean all employees whether employed on a permanent, temporary, or part-time basis. This definition also includes volunteers and employees of businesses and entities contracted to provide services to, or on behalf of the organisation.
Application of the Policy
This directive applies to all team members and Directors who use Generative Artificial Intelligence (GenAI) services and products such as ChatGPT whether corporate owned or BYOD (bring your own device) in the course of their duties.
Board Policy
“We are committed to fostering an innovative culture that includes embracing new and emerging technology to increase efficiency, improve service delivery, enhance the customer experience and drive informed decision making. The Board acknowledges that Generative Artificial Intelligence (GenAI) technology presents enormous opportunities, as well as risks and challenges. We are committed to using GenAI in a responsible and ethical way that is aligned with the values and expectations of our organisation, including customers, suppliers, and other stakeholders. We adopt a proactive and risk-based approach to the selection and use of GenAI technology by effectively managing risk through assessment, governance and human oversight of all new and emerging GenAI services used.
Team member access to GenAI technology will be treated like any other system or dataset and will be granted based on the position role, responsibilities, skills, experience and knowledge along with business need. Access may be limited to a specific time period and may be reviewed when positions or employment status changes. Team members are expected to use GenAI technology for tasks that enhance their productivity, efficiency, and quality of work in a manner that aligns with our strategic focus, and other directions on desired use cases and risk tolerance.”
Vietnam GenAI Principles that support use cases
- Spirit of cooperation, promoting innovation. GenAI technology must benefit communities and the environment.
- Transparency. There must be transparency and responsible disclosure so people can understand when they are being significantly impacted by GenAI, and it is clearly identified when an AI system is engaging with them.
- Controllability. GenAI technology to be inclusive and accessible and will not involve or result in unfair discrimination against individuals, communities or groups.
- Safety. GenAI systems must reliably operate in accordance with their intended purpose.
- Security. Ensure respect for privacy and data protections when using AI systems.
- Privacy. GenAI technology will respect and uphold privacy rights and data protection and ensure the security of data.
- Respect for human rights and dignity. GenAI technology must respect human rights, diversity, and the autonomy of individuals.
- User support. When a GenAI system significantly impacts a person, community, group or environment, there is to be a timely process to allow people to challenge the use or outcomes of the GenAI technology.
- Accountability. People responsible for GenAI technology must be identifiable and will be accountable for the outcomes of the GenAI technology, and human oversight must be enabled.
Example Access Approval Process
- proposed GenAI service,
- proposed use including any data that may be shared,
- any associated costs,
- team member responsible for the product or service,
- team members that will be using the product or service, and
- Manager’s approval.
Any change in the proposed use of the GenAI service will require a further separate approval. Approval can be automatic without further evaluation if criteria is met that results in a low risk to the organisation. Any GenAI service that does not meet the criteria will be assessed for safety, privacy and compliance by the organisation’ s Technology Services Legal Services and Procurement teams as required, before being approved for use, irrespective of the cost involved. The Technology Services team will need to maintain an updated list of approved applications and desired use cases.
Data privacy and security
Team members should not use GenAI services to generate, process, or share sensitive, confidential, personal or private information unless proper safeguards and data protection measures are in place. Team members should ensure proper de-identification processes are in place to safeguard sensitive information to protect privacy and comply with data protection requirements.
Accuracy and suitability
Team members are responsible for verifying the accuracy and suitability of any content generated by GenAI services before using it in official communications, documents, or decision-making processes. Team members should carefully review any generated content and consider its limitations such as bias, discrimination, factual accuracy and timeliness. Team members should always confirm content using other resources. The use of GenAI content does not absolve team members of their professional responsibility for the accuracy and quality of their work.
Ethical usage
Team members should not use GenAI for any unethical, discriminatory, harassing, or malicious purposes.
Referencing and acknowledgement
Referencing for content generated using GenAI technology is evolving and is likely to change over time. Team members should follow standard referencing rules and principles to acknowledge the contribution of GenAI services or content that has directly influenced their work, particularly when publishing or utilising generated content publicly. Team members must clearly indicate if GenAI technology or content was used for/in formal decision-making processes, ensuring transparency and avoiding misrepresentation.
Review and Evaluation
This policy should be reviewed for applicability, effectiveness, and consistency with relevant legislation. Due to the rapid evolution of GenAI technology, reviews of this policy will occur as required, or at least annually.
Key benefits of using an AI approach for ESG reporting
- Automatic data capture.
- Connectivity to operational systems.
- Data normalisation and harmonisation
- Data structuring and hierarchy management.
- Support for data audits and health checks with data able to be easily traced back to source files.
[1] Ministry of Science and Technology (MoST) Issued Decision No. 1290/QD-BKHCN
[2] Organisations can develop this themselves
Next steps
To move forward with TeamMate, Envizi or GreenTrack®, increasingly powered by AI, schedule a briefing from Enterprise Governance Platform – Vietnam at info@egp.vn .
Stephen Coates CIA CISA CGAP CRMA PFIIA FGIA is known globally for his work with the internal audit profession, and lives with his family in Vietnam and Australia. In 2022 Stephen was awarded the Bob McDonald Award from the Institute of Internal Auditors - Australia for his outstanding service to the internal audit profession. He provides real clear insight on matters affecting governance, risk, and compliance; and internal audit. Stephen is available to speak live at your event from small boardroom events to jam-packed conference arenas. He is available to travel anywhere in the world in person or to participate virtually.
