Audit & Advisory Service Newsletter- Volume 27

New Year's Resolution for Continuous Improvement in 2026

UCSF’s commitment to Continuous Improvement and innovation was highlighted in December with UCSF’s Continuous Improvement (CI) fair, which emphasized how the use of Artificial Intelligence (AI) can help us improve our work through a commitment to a culture of always learning.

"The only secret to Toyota is its attitude toward learning.  We don’t even notice and take it for granted.”  - Isao Yoshino (Former CEO of Toyota)                                                                                                                                                                   "AI will not replace humans, but those who use AI will replace those who don't." - Ginni Rometty (Former CEO of IBM)
 
 

These quotes speak volumes about Continuous Improvement and the future of AI.  The first explains says the key is our attitude towards always learning.  If we don’t learn from our mistakes, how will we ever improve?  Like Toyota, UCSF embraces this attitude. The second illustrates how those who embrace and use AI will not be replaced by AI, but they will likely be doing the work of those people who do not. This newsletter leverages on the lessons of the CI Fair and is dedicated to helping us learn how AI can be used to improve our work and how to create and maintain good work habits for Continuous Improvement while being mindful of the risks.

UCSF’s Second Annual Continuous Improvement (CI) Fair: Connecting People, Practice, and AI

We had a chance to sit down with Berna Declet (Director of Enterprise, Strategy and Transformation) whose team ran the CI fair to talk about this concept of Continuous Improvement, and the role AI will play in our jobs moving forward.

Q: What is the Continuous Improvement (CI) Fair, and why does it matter?
A: The CI Fair is an annual event where people across UCSF to come together to share, learn and build practical capability around improving how work gets done. Now in its second year, the CI Fair is designed to make improvement visible and accessible – highlighting real examples from teams who are trying something new, learning, and adapting in their day-to-day work. This year, more than 250 attendees gathered at Rutter Center for a full-day event centered on the theme: Connect. Transform.  

Attendees explored 19 breakout sessions, 10 booths, and 10 posters, all showcasing improvement work from across FAS, EVCP, SOM, SON, and Health. Sessions highlighted a range of practical examples. CLS Facilities shared how they are leveraging technology and AI to sustain services following resource reductions, including the introduction of IBM Maximo 9.1 to support predictive maintenance, asset planning, and long-term resilience. A small CTSI Research PRP team demonstrated how AI-drive prompt engineering helped scale social media recruitment, remove bottlenecks, and expand without adding workload. 

Across all sessions, including our keynote speaker and leadership panel, it was evident - Improvement is happening everywhere, led by people closest to the work!

Q: For people who could not attend, what was the biggest take away from the CI Fair?
A:  The most important takeaway is that Continuous Improvement is something in which we all can actively participate.  It was not about showcasing perfect solutions. It was about showing progress in action – teams testing ideas, learning from experience, and adjusting along the way. Whether you practiced A3 problem-solving, explored “before and after” workflows in shared research spaces, or built AI prompts using your own work examples, the emphasis was on learning by doing. 

Try something small, rethink a recurring frustration, experiment without needing everything to be fully formed. Continuous Improvement doesn’t require a large initiative. It often starts with noticing what gets in the way and taking one step towards something better. Once you learn that what you tested works, think - how can you scale it? How can you share your learnings with others?

Q: For those who weren’t there, what’s the message about CI and AI?
A: You didn’t need to attend the Fair to practice Continuous Improvement. It reflects a growing CI and AI ecosystem – communities of practice, shared tools, and ongoing learning opportunities open to anyone interested in improving their work. It’s not about adding more work, it’s about making work more effective, sustainable, and aligned with purpose.

AI showed up at the Fair as a productivity multiplier, helping teams reduce rework, speed up routine tasks, and support better decision-making. Importantly, AI was positioned as a support to human judgment and clear thinking, not a replacement for it.
Start small. Try one idea, learn from it, and adjust. You can do that whether you’re improving a process, facilitating change, or experimenting with an AI tool.

Q: How does AI fit into Lean thinking and Plan-Do-Check-Adjust (PDCA)?
A: At its core, Lean thinking is a mindset about learning and AI fits naturally into the PDCA cycle.

  • Plan: clarify the problem or task you want to improve. Designing a good AI prompt is a form of planning as it forces you to be clear about what you need.
  • Do: Test the idea of a small scale. Use AI to draft, summarize, analyze, or explore options.
  • Check: Review the results. Did it help? Did it create new issues? AI outputs are inputs for thinking, not final answers.
  • Adjust: Refine the prompt, change the process, or decide where AI adds value and where it doesn’t.

Change management practices strengthen this cycle by helping teams check and adjust, not only the process, but also how people are experiencing the change, making improvements more likely to last.

Q: What’s next for Continuous Improvement?
A: The CI Fair is part of an ongoing effort to build capability, confidence, and connection across UCSF. We encourage you to try one small experiment, think about what you can showcase with your teams, peers, or even at the next CI Fair. 

If you’d like to learn more or get involved, contact Berna Declet in Enterprise Strategy & Transformation (EST). We’re here to support teams as they experiment, learn, and improve together.

#Back to the top

 

Enhancing Efficiency: How Procurement is Leveraging AI to Support Campus 

To combat recent staffing challenges, Procurement turned to AI to bridge the gap. Rather than replace the expertise of staff, they used AI as a "force multiplier" to streamline manual tasks to ensure they continued to provide high-level service. 

One internal innovation includes using AI to speed up the Contract Cycle. Contract negotiations are long and uncertain, may take up to a month to complete and some become so impacted that UCSF cannot contract with the supplier. To help speed things up, Procurement integrated an AI tool called LegalSifter to handle the heavy lifting. It automates data collection, giving them a better understanding of their portfolio of contracts and associated risks. It also assists with the initial “redlining” allowing staff to quickly identify problems and the Contracts Team to better understand the quality of their supplier contracts. 

Another innovation is the implementation of intuitive keywords in BearBuy. To help a user find what they need faster, Procurement uses AI to generate intuitive keywords for contracts stored in BearBuy. This improvement creates a repository where users can find pre-contracted suppliers with existing agreements whose requisitions are processed 50% faster than new suppliers. 

Additional ways Campus departments can use AI for procurement processes today include:

  • UCOP Policy AI Assistant: Previously, confusion around multiple policies, appendices, and guidelines was only made easier by a call to a friendly Buyer. Last year, UCOP published a Procurement AI Assistant solving this problem. Skip the endless scrolling through PDFs. Use the UCOP Policy AI Assistant to quickly locate relevant UC policies and guidance.  Here's the link:  http://3.20.237.18:8501
  • Drafting Justifications: Writing Source Selection & Price Reasonableness justifications for purchases over $100k can be time-consuming as many are revised or sent back as deficient. However, Versa writes great justifications. By giving it context, like what is being bought, why it’s needed, and a prompt asking it to satisfy CA. State Public Procurement Code, it often provides better wording than if attempted alone. Users are responsible for the accuracy of statements, but this is a time saver.
  • Statement of Work (SOW) Review: UCSF requires suppliers to write a SOW and for staff to review that first draft.  However, review by Versa is an excellent way to identify areas that give suppliers too much leeway and the result can be a detailed analysis providing clear, well-structured feedback used to negotiate with suppliers and improve the likelihood project success.

By embracing these AI tools, Procurement is not just surviving a staffing problem, they are building a more agile, data-driven procurement ecosystem for the entire UCSF community. 

Contributed by Andrew Clark, Executive Director, Supply Chain Management

#Back to the top

 

The Psychology of Habits

Why is it that so many well-intentioned New Year’s resolutions fade within a few weeks? Each new year brings a pull toward change: new routines, new habits, new ways of working. And yet motivation alone isn’t always enough to keep us on track. This is not a failure of discipline or commitment. Our brains are wired for safety and predictability, which is why dramatic overhauls tend to collapse. Research on habit formation shows that behaviors become more automatic only through repetition over time. Sustainable improvement is built slowly, through small, realistic habits that can be repeated even on difficult days. Big goals absolutely matter, but they are usually reached through small, consistent changes.

Where should you start? Begin by identifying one specific, realistic habit goal that either reflects something you care about or supports a responsibility you need to manage well and fits your actual life. It helps to be clear about why this habit matters to you. For example, if the goal is improving heart health, the deeper “why” might be wanting to live longer, have more energy, or be able to stay active with your children or grandchildren. Rather than setting a vague goal like “exercise more,” a more workable habit goal might be “take a 10-minute walk three times a week” or “use the stairs instead of the elevator once a day.” These are small, specific behaviors that connect directly to the larger goal of heart health and longevity. Once the goal is clear and you have identified your “why”, decide exactly when and where it will happen, using an existing routine as the cue.

Next, it helps to practice mental rehearsal, briefly walking through the exact sequence of steps in your mind before you do the habit. This technique is used by athletes, pilots, and surgeons as imagining an action activates many of the same brain networks as physically performing it, allowing the brain to practice the behavior before the body does. This helps strengthen neural pathways making follow-through more likely. If your goal is to add more movement through walking, set an intention such as, “I will take a 10-minute walk after lunch around my building.” Then, close your eyes and mentally rehearse finishing lunch, standing up from your desk, putting on your shoes, walking outside, and completing the short loop. This helps you notice where friction might show up, such as feeling rushed or forgetting your shoes, and adjust the plan before you even start.

Barriers such as low motivation, busy schedules, and competing demands are a normal part of habit formation, not personal failures. The key is to reduce friction and shape the environment to support the behavior. Keep walking shoes at work. Schedule a reminder. Invite a colleague. As we continue into a new year, it may be helpful to think less about making big changes all at once and more about choosing small, steady habits that support larger goals. Over time, these repeatable practices can shape how we think, feel, and show up for ourselves, our work, and for one another.

A Habit-Building Formula

  • Identify a specific, realistic habit goal: Choose one small habit that reflects something you care about or supports a responsibility you need to manage well. Be specific and clarify your “why.”
  • Decide when and where it will happen: Use a time, place, or existing routine as the cue.
  • Practice mental rehearsal: Briefly walk through the exact steps in your mind.
  • Remove friction: Shape your environment to make the habit easy to repeat.

Contributed by Ana Dolatabadi, Psy.D., M.A.; Clinical Psychologist and Director of The Faculty and Staff Assistance Program (FSAP).  If you are interested in learning more or would like support with habit-building or other challenges, attend one of the FSAP’s virtual webinars or request to connect with a counselor for individual support. For more information: https://tiny.ucsf.edu/FSAP.

#Back to the top

 

Four Fraud Schemes that Use AI

As we embrace AI technologies to enhance efficiency, it’s important to understand that cyber criminals have a head start on us and are leveraging their tactics and AI capabilities to do harm. These criminals are constantly evolving their AI capabilities that learn from past failures to develop more sophisticated schemes. Here are some threats to watch for in the coming year:

  • Automated Phishing Attacks: Traditional phishing relied on a “spray-and-pray” approach by sending large volumes of generic emails, hoping that someone would fall for the scam. With AI, phishing attacks have become more targeted and precise. AI algorithms analyze social media profiles, public databases, and previous communication patterns to craft personalized messages that bypass security measures and exploit human trust.
  • AI-Powered Malware: AI enables malware to adapt its behavior based on the environment it infects, making it harder to detect and remove. By constantly modifying its code, AI-powered malware evades signature-based detection methods, allowing it to remain hidden and active for longer periods. Additionally, AI can automate the creation of new malware variants, accelerating the development of threats.
  • AI-Driven Reconnaissance: Cyber criminals use AI to scan vast amounts of data quickly, identifying potential vulnerabilities within an organization. AI assists in analyzing user behaviors, website traffic, and system configurations, enhancing reconnaissance activities and enabling attackers to plan more effective breaches.
  • Deepfake Technology: AI creates hyper-realistic images, videos, or audio communications known as deepfakes. These are so convincing that it can be difficult to distinguish between real and fraudulent content. Criminals use deepfakes to impersonate vendors or colleagues, deceiving employees into transferring funds or sharing sensitive information. Management must ensure employees and vendors are aware of the risks posed by deepfakes and other AI-driven threats. In addition to detailed policies and procedures, adopting a “zero trust” mindset is critical.

Key Reminders: 

  • Slow Down: Avoid rushing to click on links or respond to unexpected messages. Scammers rely on urgency to trick victims.
  • Verify Independently: Look up the organization that supposedly sent the message, find a legitimate customer service number, and confirm the request.
  • Don’t Engage: If you receive a suspicious communication, do not interact with the sender.

#Back to the top

 

AI and Fraud Risks

AI is changing how quickly fraud risks can be identified, exploited, and concealed. Both internal and external threats can use AI to pinpoint weaknesses in our systems, and ungoverned or overly trusted AI may unintentionally weaken fraud detection by embedding incorrect assumptions into our controls and monitoring processes. These risks are amplified in decentralized operations and when access to our policy materials is broadly available. For example, a malicious insider or well-intentioned user misapplying AI tools could inadvertently map fraud pathways, accomplishing in hours (or less) what previously required months of observation or insider knowledge. Below are four ways using AI can help (or hurt) fraud prevention and detection efforts.

How AI can be leveraged to identify fraud risks:

  • AI can analyze policies, procedures, and workflows to identify exploitable gaps and inconsistencies at scale. From a fraud risk perspective, this includes:
    • identifying approval thresholds that fraud can be structured around to minimize likelihood of detection
    • highlighting exception processes that lack secondary review
    • exposing discretionary language that allows informal decision-making
    • revealing weak segregation of duties
    • detecting misalignment between written controls and system permissions

How over-reliance on AI can weaken fraud detection:

  • AI can generate outputs known as “hallucinations” that appear credible but are factually incorrect or incomplete. In fraud prevention, this creates risks when AI is used to summarize policies, interpret regulations, prioritize alerts, or support reviews. If these outputs are not independently validated, incorrect or flawed assumptions can get embedded into fraud prevention or monitoring systems. Over time, this can normalize blind spots in detection, reduce skepticism to anomalies and increase false negatives (fraud events that go undetected.) 
  • The danger is not just isolated errors, but systemic erosion of fraud prevention frameworks when AI-generated conclusions are trusted without challenge or corroboration.

How governing AI use can reduce risks:

  • One of the controls for responsible AI use is prompt discipline – ensuring queries to AI are structured thoughtfully to produce reliable outputs. One example for queries is to use the Introduction, Context & Prompt structure:
    • Introduction: establish the role, intent, and risk sensitivity of the inquiry
    • Context: provide the context by explaining the operational use such as fraud risk assessment, control testing, or policy review
    • Prompt: pose precise, bound questions or commands to guide the AI response
  • This approach can reduce hallucinations, over-generalization, and misaligned assumptions. Additional effective prompting may also include explicitly stating what the AI should not do. Treating AI prompts as a formal analytical input, rather than ad hoc queries improves accuracy, repeatability, and defensibility of AI-assisted analysis.

How AI can stress test controls:

  • Departments can use AI tools, such as Versa, to proactively stress test their controls and systems. By entering an introduction, context, and internal processes, policies, and procedures, AI can help identify gaps and weaknesses that could be exploited by both internal staff and external threats using publicly available information.  
  • Departments can then use these insights to bolster controls where needed.  

AI-enabled exploitation of control gaps or normalization of incorrect assumptions can expose organizations to risks such as billing fraud, grant misuse, payroll abuse, and regulatory enforcement.  Failure to address risks proactively undermines our ability to detect fraud early, respond credibly and demonstrate effective oversight to regulators, auditors, and funding agencies. By understanding how AI can both enhance and challenge fraud prevention efforts, organizations can take steps to mitigate risks and strengthen their governance frameworks.

#Back to the top