Conflicts of interest in auditor selection
Conflicts of interest can arise if there is no independence in the auditor selection process or if the auditors are closely associated with the developer [123, 157]. In such cases, the conflict of interest can appear even if third-party evaluators are involved. In the case of external auditing, the potential candidates might be selected from a narrow group of auditors, or have conflicting financial incentives for whether to report model shortcomings publicly.
ENTITY
1 - Human
INTENT
3 - Other
TIMING
1 - Pre-deployment
Risk ID
mit1127
Domain lineage
6. Socioeconomic and Environmental
6.5 > Governance failure
Mitigation strategy
1. Mandate Strict Independence Standards and Pre-Engagement Disclosures Require all prospective auditors (both individuals and firms) to adhere rigorously to independence standards, both in fact and appearance, ensuring freedom from conditions that compromise professional judgment. Auditors must submit comprehensive disclosures detailing any current or past financial interests, personal or professional relationships with the model developer, and any prior consulting services provided to the audited entity. This protocol serves as a foundational screen to eliminate direct conflicts of interest before engagement. 2. Establish Independent Governance for Auditor Selection and Oversight Delegate the responsibility for the selection, appointment, and ongoing evaluation of the auditor to a fully independent body, such as an Audit Committee or an external Governance Review Board. This body must operate with complete autonomy from the model development team and the organization's management to ensure that the auditor is chosen objectively and that all decisions regarding the audit process are made without bias or undue influence. 3. Implement Structural Safeguards: Rotation and Prohibitions on Non-Audit Services Enforce mandatory rotational assignments for key audit personnel to mitigate the familiarity and self-interest threats that arise from long-term relationships. Furthermore, strictly prohibit the auditor from providing any non-audit services, such as consulting or advisory work, to the developer during the audit period to eliminate self-review threats and prevent the auditor from having a vested interest in the outcome of their own recommendations.