Walk into almost any audit or finance firm today and ask about their AI strategy, and you’ll likely get a confident answer. Ask a few follow-up questions, though, and that confidence tends to crack fast. Cynthia Merhej, founder of AIKit LB, is a CPA and CISA who also holds ISACA’s Advanced in AI Audit (AAIA) credential and a Master’s degree in Artificial Intelligence. She has sat through enough of these conversations to spot the pattern. After training more than a thousand auditors, accountants, and finance professionals across Lebanon and the region, she says most failed AI adoption stories come down to the same three mistakes.
We asked her to walk us through them directly.
Q: Let’s get straight to it. What’s the first mistake you see firms make?
A: Treating AI training as a single event instead of an ongoing process. A firm books a workshop, everyone sits through it for a few hours, then everyone goes back to their desks and nothing changes. The information was there, but nothing about daily habits shifted. Training without follow-through is basically entertainment. It feels productive in the moment, but six months later, you’d struggle to find real evidence it changed anything.
Q: Why does that happen so consistently? Surely firms want the training to stick.
A: They do want it to stick, but they underestimate how much reinforcement real behavior change needs. Learning a new habit, especially one involving unfamiliar technology, isn’t a one-shot event. People need to practice on real work, get feedback, and build confidence over repeated use. That’s why the AI Enablement course at AIKit LB runs as a monthly cohort of five sessions rather than a single training day, and every session is recorded so participants can go back to it when they apply it to their own work.
Q: What’s the second mistake?
A: Letting AI adoption happen without any real governance. This is almost the opposite failure of the first one. Instead of nothing happening, everything happens, just completely unsupervised. Staff start using AI tools on their own because it makes their work faster, but nobody above them has set clear rules about which client data, such as a trial balance, a payroll file or a contract, can go into these tools and which cannot. By the time leadership notices how widespread the usage already is, there’s no way to know what’s already been exposed.
Q: That sounds like a confidentiality risk more than an adoption problem. Are they connected?
A: They’re deeply connected, and that’s why I treat it as an adoption problem and not only an IT one. A firm without governance isn’t ahead on AI, even if usage numbers look high. They’re just taking on risk without knowing it. For an audit firm, client confidentiality under the IESBA Code applies whatever tool the data goes into, and ISQM 1 expects the firm to manage the technology its people use. Real adoption means knowing which tools are being used, by whom and for what, not just hoping nothing has gone wrong yet. I’ve had firms come to me after they realized, almost by accident, that client data had already been typed into a public AI tool multiple times before anyone thought to ask the question.
Q: How does a firm fix that once it’s already happened?
A: First, stop and get an honest picture of what’s being used and by whom. No blame, just information. In the IT audits I work on, the first request is the inventory of systems and who has access to them, and AI tools now belong on that list. Where client data has already gone into a public tool, assess what was exposed and whether the client needs to be told. Then build a simple, clear policy, written down, not just assumed. Which tools are approved, on business accounts rather than personal ones, what can go into them and what absolutely cannot. After that, proper training built around audit and finance work rather than generic advice. It’s fixable, but only if the firm is willing to be honest about where things currently stand.
Q: And the third mistake?
A: Buying tools before understanding the actual problem they’re solving. This one is incredibly common. A partner hears about a flashy new AI feature, buys a license for the whole team, and expects adoption to just happen because the tool exists now. But a tool without a clear use case attached to it just sits there unused, or gets used inconsistently by whoever happens to be curious that week.
Q: Why do you think firms fall into that trap so often?
A: Because it feels like progress. Buying something gives the appearance of movement, even when nothing underneath has changed. It’s much harder, and much less flashy, to sit down and map out exactly which process is eating the most time, where AI could help, and how to measure whether it worked, starting with how long the task took before and after. That groundwork isn’t exciting, but it’s the difference between a tool that gets real use and one that becomes an expensive line item nobody remembers signing up for.
Q: If a firm is making all three of these mistakes right now, where should they start fixing things?
A: Start with honesty, not urgency. Firms panic and want to fix everything at once, which usually just creates a fourth mistake on top of the first three. Instead, pick one real process, something recurring and time-consuming, and fix the governance and training around that single use case properly. In our internal audit work, that process was chasing working papers: Power Automate now sends preparers their notices and a reminder every other day until the reviewer signs off, and a Power BI report shows where each region stands. No new license, just tools the team already had, pointed at one recurring task. Get it working, get people comfortable, then expand from there. Trying to solve everything at once is exactly how firms end up with a pile of unused licenses and little to show for them.
Q: Is there a common thread running through all three mistakes?
A: Skipping the groundwork, in different forms. Training without follow-through skips the practice. Letting AI spread without governance skips the rules. Buying tools before understanding the problem skips the process mapping. Every one of these mistakes comes from wanting the result without doing the slower, less glamorous work that gets you there safely.
The Bottom Line
None of these three mistakes is unusual or surprising once you hear them laid out. That’s what makes them so dangerous. They feel like normal, reasonable steps a firm would take, right up until months have passed and nothing has improved. According to Merhej, the fix isn’t complicated; it just requires firms to slow down enough to get the fundamentals right before chasing the next tool or the next trend. Firms that manage that tend to end up with real capability. The ones that don’t usually end up with a nice slide deck from a training day and very little else to show for it.
