This audit was undertaken to determine whether the Australian Taxation Office (ATO) has effective arrangements to support the adoption of artificial intelligence (AI). It made seven recommendations relating to AI governance, risk management, evaluation and information management. The ATO agreed to all seven recommendations. 

AI is used in different contexts by the ATO, including to analyse data to assess non-compliance risks, assist with the drafting of communications and help with visualisations.

Key findings

• The ATO has partly effective arrangements in place to support the adoption of AI, including arrangements for: governance, design, development and deployment, and monitoring, evaluation and reporting.
• The ATO is adapting its current arrangements and introducing new arrangements to support its adoption of AI.
• The ATO does not have specific policies and procedures for the design, development and deployment of its AI models.
• The ATO has not sufficiently integrated ethical and legal considerations into its design and development of AI models.
• There are no clearly defined assurance and approval arrangements that set out testing, validation, review and decision-making throughout the design, development and deployment of AI models.
• There was no evidence of structured and regular monitoring of ATO-built AI models in production. 

Recommendations

1. Align implementation arrangements for the automation and AI strategy with enterprise-wide requirements.
2. Clearly define and communicate enterprise-wide organisational structures and governance arrangements supporting adoption of AI, including defining accountabilities and responsibilities at the model and system level.
3. Review the misuse of data and analytics enterprise risk in accordance with its enterprise risk management framework and risk appetite, and update and incorporate controls relating to the impact of AI on this risk.
4. Improve the ATO's arrangements in support of the design, development, deployment and use of AI that aligns with ethical principles.
5. Develop and implement policies and procedures to support the effective design, development, deployment and assurance of AI models.
6. Establish performance measurement and evaluation arrangements for the ATO’s automation and AI strategy.
7. Ensure that the approach to managing information supports transparency and accountability with respect to adoption of AI.