Your Vendor May Be Using AI—Read the SOC Report

Your Vendor May Be Using AI—Read the SOC Report

Why Nonprofit Leaders Should Pay Attention

Nonprofit organizations increasingly rely on outside providers for payroll, accounting, payment processing, donor management, grant administration, cloud hosting, investment reporting, and other functions that affect financial reporting and sensitive information.

A vendor may also be using Artificial Intelligence (AI) within those services—even when the nonprofit has chosen not to use AI itself. AI may classify transactions, identify anomalies, generate reports, support customer service, monitor security, or assist with software development. The important governance question is not simply whether a vendor uses AI. It is whether the vendor’s use of AI is appropriate for the service, the data, the risks, and the non-profit’s expectations.

The AICPA’s recent guidance on SOC 1 and SOC 2 examinations makes a practical point for nonprofit organizations: read the SOC report closely enough to understand how the service works, whether AI is relevant to the service, and what controls the nonprofit must perform as a user entity.

Your Nonprofit’s “No AI” Policy Does not Control the Vendor

A nonprofit may decide not to use AI for certain activities—for example, preparing journal entries, evaluating grant eligibility, reviewing restricted contributions, responding to donors, or making decisions involving confidential information. That decision does not necessarily mean the nonprofit’s vendors are operating without AI.

A vendor may use AI behind the scenes as part of its platform, fraud monitoring, customer support, data analytics, document processing, security tools, or software development process. The nonprofit should therefore read the system description and related disclosures to determine whether the vendor’s use of AI is consistent with the nonprofit’s policies and risk tolerance. The AICPA guidance indicates that when AI is relevant to the service or system the description may need to explain how AI is used, how AI-related risks are managed, what data and assumptions are involved, and what complementary controls are expected from user entities.

This is particularly important when the nonprofit has intentionally decided that AI should not be used for a particular process. The nonprofit should not assume that its internal policy automatically extends to a vendor. The restriction should be addressed through the vendor’s due diligence, contracts, representations, system settings, monitoring, and—where appropriate—an explicit prohibition on the use of the non-profit’s data for training or other AI purposes.

What to Look for in the SOC Report

Read the system description, scope, and controls to determine:

• Whether the vendor uses AI to deliver the service or operate a control
• Whether AI outputs are reviewed, corrected, and independently tested
• How the vendor addresses accuracy, data quality, model changes, explainability, security, confidentiality, and privacy
• Whether sub-service organizations use AI and whether additional reports or evidence are needed
• What complementary controls the nonprofit is expected to perform

AI is more likely to be relevant when it is a key enabler of the service or the output is integral to a control. The SOC report should explain relevant AI use, governance, data and assumptions, subservice organizations, and complementary user controls.

Complementary Controls the Nonprofit may Need

A SOC report may identify controls that the nonprofit—not the vendor—is expected to perform. Those complementary user entity controls should be evaluated, assigned to responsible personnel, and documented.

Examples include:

Questions Nonprofit Leaders Can Ask Vendors

As part of vendor onboarding or annual monitoring, consider asking:

1. Do you use AI in providing our services or operating controls over those services?
2. What functions use AI, and what decisions or outputs does AI influence?
3. Is our data used to train, fine-tune, or continuously improve an AI model?
4. What human review is required before AI output is used or provided to us?
5. How do you test accuracy, completeness, bias, security, and changes in model performance?
6. Can you explain and reproduce significant AI generated decisions or outputs?
7. Which sub-service organizations use AI in supporting our services?
8. What complementary controls do you expect our nonprofit to perform?
9. Does the SOC report cover the relevant AI enabled process and period?
10. How will you notify us if your AI use changes?

The Takeaway

Nonprofits should read SOC reports as part of vendor governance, not treat them as documents reserved for the external auditor. A careful review can reveal whether a vendor is using AI, whether that use is consistent with the nonprofit’s policies, and whether new complementary controls are needed.

If a nonprofit has chosen not to use AI in a particular process, that choice makes vendor review more—not less—important. The nonprofit should confirm that its vendors are not using AI in a way the nonprofit has prohibited, does not understand, or has not approved.

Ultimately, responsible governance requires more than asking whether a vendor is secure or whether it has passed a SOC examination. It requires determining whether the vendor’s people, technology, AI use, and processes are appropriate for the nonprofit’s mission and the risks it has accepted.

Source

AICPA, “SOC Examinations: Effect of the Service Organization’s Use of AI on SOC 1 and SOC 2 Examinations” (Q&A Section 9561) – please contact us if you would like access to this publication.