Artificial Intelligence in Corporate Governance and Internal Control: A Systematic Review of Preventing and Detecting Financial Misconduct

This review examines how Artificial Intelligence (AI) and advanced analytics are used to prevent and detect corporate financial misconduct, and whether that capability translates into organizational control. Following the PRISMA 2020 protocol, 53 publications issued between 2015 and 2025 were retrieved from Scopus, Web of Science, and ScienceDirect and coded along four dimensions: technology family, governance mechanism, misconduct focus, and empirical setting. The corpus is analyzed with an explicit quantitative apparatus. Within this corpus, a log-linear count model places annual growth at 60.8% (β^1=0.475, z=6.64), a doubling time of 1.46 years; 64.2% of the corpus appeared in 2024 and 2025, and the estimate is reported as a pattern in the selected corpus rather than a growth rate of the field. Machine learning dominates the technology side (43.4%, 95% Wilson interval 31.0–56.7), while audit and forensic accounting is the most frequent governance mechanism (45.3%). A descriptive screen of the technology by mechanism matrix, using lift and standardized residuals, flags 7 of 45 cells as departing from the independence baseline, among them machine learning with board governance (r=+2.59) and data analytics with compliance (r=−2.49). Because the coding is non-exclusive, these residuals locate where attention has concentrated and are not hypothesis tests or evidence of a causal relation; under a minimum-frequency criterion, only the data analytics with audit coupling is robust, so the association analysis is exploratory. Financial statement fraud absorbs 83.0% of the outcome coding, which confines the review’s firmer conclusions to that category. The misconduct dimension is the least even of the three coded dimensions (Pielou J=0.62 against 0.94 for technology). A detection-theoretic argument then shows why detection performance alone is a poor guide to control: under a low base rate, precision collapses, and the share of misconduct that reaches remediation is the product of the detection rate and the pass-through probabilities of escalation, investigation, and remediation. We formalize this as a control yield parameter and embed it in an integrative model. The model and its four propositions are conceptual constructions derived from the synthesis, offered for empirical testing rather than established by the review, and each is paired with the parameter a future study would estimate. We set out a research agenda built around field validation, human and machine decision making, and the governance of model risk.