PROSPECTS, RISKS AND IMPLEMENTATION MODEL OF ARTIFICIAL INTELLIGENCE AND PROCESS AUTOMATION IN THE INTERNAL AUDIT OF THE MINISTRY OF DEFENCE OF UKRAINE

Abstract

This article examines how artificial intelligence (AI) and process automation can be integrated into the internal audit function of the Ministry of Defence of Ukraine in a way that strengthens assurance over the use of public resources while respecting security, confidentiality and legal constraints. The topic is timely because defence management operates under high transaction volumes, complex supply chains, accelerated decision cycles and increased exposure to fraud, error and cyber threats, while audit units are expected to deliver risk‑based assurance and monitor the implementation of recommendations more continuously. The study applies doctrinal analysis of the public‑sector internal control and internal audit framework, a comparative review of international approaches to AI risk management and AI auditing, and a design‑science method to develop an implementable operating model. The results include: (1) a typology of priority AI‑enabled audit use cases (data‑driven audit universe updates, dynamic risk scoring for annual planning, automated tests of controls, anomaly detection in transactional populations, and workflow automation for follow‑up); (2) a dual concept of “AI for audit” and “auditing AI” that clarifies when AI outputs may serve only as risk signals, when they may support substantive testing, and which evidence requirements remain strictly human‑validated; (3) a baseline of governance and controls for defence organisations covering data classification, access control, audit trails, prompt and output logging, model validation and drift monitoring, supplier and third‑party oversight, incident response and cybersecurity safeguards; and (4) a minimal competency profile for internal auditors to work with data, measure model reliability and maintain professional scepticism. Practical value is provided through a phased roadmap with measurable milestones. It starts with data inventory, data quality rules and secure integration with accounting and logistics systems; then introduces dashboards and continuous monitoring indicators; and only after that expands to ML and generative AI components deployed in protected environments. The roadmap links each phase to expected outputs (risk indicators, tested controls, documented assumptions, and improved recommendation closure rates), enabling leadership to evaluate benefits without undermining auditor independence or accountability.