Your Auditor Does Not Care That AI Pulled It | Guest: Alan Luk
Source: YouTube · GRC Engineering Club · published Aug 23, 2026 · 30:19
On the Anti-Checkbox Podcast, host Omar and Microsoft GRC practitioner Allan Lockey discuss adopting AI in GRC thoughtfully—warning against "AI-fying everything" without considering determinism, auditor acceptance, and real value 1:26-2:03.
Key Takeaways:
• GRC Engineering is gaining momentum, but auditors—following a 40+ year playbook—risk lagging behind 2:49-3:57
• Separate experimentation from production: AI should augment, not replace learning—you stay accountable 5:40-6:47
• For automated evidence collection, assess determinism, reproducibility, and completeness—auditors will ask 6:58-7:31
• Just because you can apply AI doesn't mean you should—auditor acceptance may take years 8:38-9:41
• The burden of proof is on practitioners: build rigorous standards and challenge firms to explain why new approaches won't work 16:57-19:56
• Smaller audit firms—not the Big Four—will drive change first as clients shift business to evolving firms 23:21-24:13
Like the "cloud solves everything" era, nuance distinguishes practitioners—speeding up a broken process just reaches failure faster 10:46-10:52.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Compliance & GRC. Commonly maps to: Security and Risk Management, Asset Security. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Welcome folks to another what I feel, what I presage is going to be a fun edition of the Anti-Checkbox Podcast. I'm joined today by somebody that I've been admiring from afar on the internet, which makes me sound very weird. Like now that I said it out loud, but I've been I've been a fan of of Allan Lockey for for for quite a while. And you know, he's he's a he he gets he gets out there and gets after it, right? He's he's outspoken. He's um you know, in a polite way, right? It's not brash or anything, but it's it's uh it's not one of those manicured like presences on LinkedIn that you can tell are are done by robots. It's him and it's his his real deal insights and and they're insights that have value, I would posit, because he's in the trenches every day. So, thank you Allan for uh for co…