Predictive cyber risk management using artificial intelligence: Implications for audit and compliance

The increasing sophistication of cyber threats has exposed the limitations of traditional cyber risk management approaches that rely on reactive controls and periodic assessments. Simultaneously, audit and compliance functions continue to operate in a largely retrospective manner, creating a disconnect between emerging cyber risks and governance mechanisms. This paper proposes an AI-Driven Predictive Cyber Risk Management (AIPCRM) framework that integrates predictive cybersecurity intelligence with audit and compliance operations. The framework combines machine learning techniques, including behavioral analytics, anomaly detection, and threat forecasting, with enterprise governance, risk, and compliance systems to enable proactive risk identification and continuous monitoring. A key contribution is the Explainable Predictive Risk Index (EPRI), which converts AI-generated risk outputs into interpretable and auditable metrics for governance stakeholders. The framework further aligns predictive outputs with established standards such as COBIT 2019, ISO/IEC 27001:2022, and the NIST Cybersecurity Framework, enabling real-time compliance validation and continuous auditing. A scenario-based illustration demonstrates how predictive intelligence can identify potential cyber incidents before exploitation and trigger automated audit responses. The study highlights improved risk visibility, faster governance response, and enhanced compliance effectiveness while addressing challenges related to explainability, model governance, and regulatory acceptance.