Power Struggle

North Dakota’s Legislative Council issued a blunt report: “The absence of regulatory authority over data centers means that developers may construct facilities without comprehensive oversight regarding their energy demands, environmental impact, or integration into the state’s energy grid.”

In the past year, internal auditors everywhere, across every industry, have found themselves in the same positions as many of these residents, policymakers, and activists. There’s global confusion, concern, and frustration as people try to comprehend — let alone address — the predictable and unpredictable impacts of the world’s growing number of data centers and the energy needed to power them.

“People are trying to get their arms around it,” says Eric Wilson, director of internal audit for Gulfport Energy, an Oklahoma City-based natural gas and oil company. “But we don’t know enough yet to effectively plan for it.”

Reasons for Concern

A data center is essentially a big warehouse that houses IT infrastructure and data. As the use of artificial intelligence (AI) expands, so does the need for increasingly powerful data centers — and that requires massive amounts of energy.

“It’s more and more computing power that’s needed to be generated,” says Larry Behrens, communications director for Power The Future, a Washington, D.C.-based nonprofit. “If I ask ChatGPT to read a PDF for me, that’s obviously more energy-intensive than asking Google to point me to a report. Make me a video, make me a graphic, make me an image — those are creative tools that require energy to do.”

Tech giants like Google, Meta, and Microsoft are building supersized data centers, but all kinds of multinational companies now want them, too, according to Max Schulze, the Amsterdam-based director of the European think tank Leitmotiv. He says these companies hire other companies to build data centers, and then they rent the space from them. “They’re building the buildings that are empty inside, and then a company like Visa or Mastercard brings its servers and equipment to that building,” he explains.

Add the growing corporate demand for computing resources to applications like cryptocurrency and cloud computing for AI-driven personal and business software, and by 2030, McKinsey & Co. predicts, data-center demands on the power supply will be three times the total current level of consumption. That estimate is not compared to current power consumption by today’s data centers — it’s compared to current power consumption by everyone.

“Some metropolitan cities might be using five or 10 gigawatts of energy,” says Reebu George, a Philadelphia-based leader in Deloitte & Touche LLP’s internal audit practice who specializes in energy, resources, and industrials. “Most of these data centers are going to be 10 to 15 gigawatts per center. It’s going to be very consuming compared to the current demands on our infrastructure.”

Community Impacts

Besides energy, data centers need increasing amounts of water for systems that keep the IT infrastructure cool. “It’s not unlike a meat warehouse,” Schulze says. “If the cooling goes out, the meat can’t be used anymore. That’s why there are diesel generators, cooling systems — these are special warehouses.”

That need demands water resources on such a massive scale that Oxford University’s Kevin Grecksch says he laughed out loud when he heard planners talking about installing a data center near where he lives in the U.K. “Where is all that water going to come from?” says Grecksch, who is an associate professor of water and environmental governance. “Are we going to shut them down if we are in a drought? What happens then, if we can’t cool them down?”

For example, would a water shortage force a large data center that handles banking or flight data to shut down? “There’s a lot of unanswered questions around this,” he says.

It’s incredibly difficult, Schulze says, to understand the unprecedented scale of core resources that may be unavailable for other things a community and its businesses might need. In Germany, for instance, one of the largest chemical factories uses 200 megawatts of electricity, he says. “If you look at the latest announcements of data center capacity in the U.S., it’s sometimes two times, three times, or five times more than that for a data center,” he explains.

For internal audit functions, all of this creates an Olympic-level struggle to quantify potential impacts across everything from costs to physical security to cybersecurity. And those risks will continually shift and emerge, experts say, as technology, regulations, and potential impacts evolve in the short- and long-term future.

“There is a lot of risk out there, and we haven’t uncovered all of it,” George says. “Different risks will surface as this continues to mature.”

View From the Pipelines

From Wilson’s internal audit perspective, an immediate economic concern is whether Gulfport Energy will be able to produce enough natural gas to power the plants that will power the data centers. “It’s going to be a massive demand,” he says. The question is whether companies like Gulfport should invest hundreds of millions of dollars to expand operations and meet that demand, when it’s possible the data centers could then move to a different power source, like nuclear.

A political concern, Wilson says, is that data centers are evolving faster than regulators and legislators can keep up. To power its data centers, Microsoft is working with Constellation Energy to reopen a reactor that was not part of the partial meltdown at Pennsylvania’s Three Mile Island — site of the worst commercial nuclear accident in U.S. history.

The world’s oceans are also in play. China has already opened an underwater data center whose surrounding seawater cools the 400 high-performance servers contained inside. “This is something coming at us very fast,” Wilson notes. “And when you look at the political landscape, things move slowly.”

Utility providers, Wilson says, will turn to companies like Gulfport to produce more oil and gas to power the plants that will serve these data centers. He notes that Gulfport’s principal properties for natural gas, crude oil, and natural gas liquids are in eastern Ohio and central Oklahoma. But there’s only so much existing pipe to move the gas and oil through.

“If we need to boost production by 25% or more, very quickly, it’s not just about whether producers can meet the demand, but if the midstream pipes and processing plants can handle it,” Wilson says. “Currently, this is questionable. Some regions are highly constrained, and new infrastructure projects require significant time and capital to complete.”

Gulfport’s leadership has talked about whether to build its own data centers — an idea executives decided is impractical, because the company would have to compete with the likes of Google to obtain key components.

“Most companies will end up licensing these AI agents and systems from the large companies,” Wilson says. “That’s going to increase an entirely different set of controls, with your data going into these third-party companies.” Organizations also need to consider what countries their data centers will be located in and how they will comply with data privacy laws, he notes.

Wilson says he now asks everyone involved about contract language and whether companies that own and operate data centers will be able to exploit Gulfport’s data instead of just storing it. That is an especially important consideration as AI becomes increasingly capable of drawing conclusions about that data. “AI has the ability to make inferences and connections between data, and do projections and analysis on its own,” he says. “You’re putting data out there to be evaluated compared to everyone else’s. That’s where it needs to be clear that external data can be leveraged for analysis, but internal data can never be sent out to train the models or allow others access to it.”

Asking questions about all of this and more, Wilson adds, is all that auditors can do at this point. “It’s such a new technology, we don’t even know what we don’t know,” he explains. “Something could happen tomorrow with AI or data centers or the hardware behind them, and it will throw out everything we’re planning and assuming.”

Competing for Energy

Behrens says internal auditors also need to be aware of behind-the-meter deals. That’s what it’s called when a company secures its own source of power upstream from everyday ratepayers such as local companies and consumers.

Take a company that gets its power from a coal-fired power plant located 200 miles away that runs at 47% capacity. Behrens explains that a company could work directly with the energy supplier that operates the plant to purchase a large amount of megawatt hours of electricity. The company may then build its own power lines to carry that electricity from the plant to its data center.

“Whoever owns the power plant will commit to delivering X amount of megawatts, directly from the source,” Behrens says. “Now that plant is working for however much time behind the meter, to serve that customer.” Power costs in the community may go up for everyone because of the additional strain on the plant. But he notes, “whoever is getting a behind-the-meter deal is not going to be subjected to that, even though they’re getting it from that same plant.”

Internal auditors may not be able to find out if such deals exist, Schulze says. Municipalities worldwide are already signing nondisclosure agreements with data-center companies regarding power and water usage. “You can never find specific numbers,” he says.

The European Union passed legislation to make agreements between data-center companies and municipalities public, Schulze explains, adding that companies with headquarters outside of Europe refused to comply. “But at least getting the information into the public sphere — where are data centers being built, what is the impact, how much water is being used — would allow the citizens to act,” he says.

Even internal auditors at huge companies in the aerospace and defense industries can’t access the information they need to understand all the potential risks. “If everybody started to ask their supply chain what’s going on with the data centers, that could at least get enough information to quantify the risk,” Schulze says.

Powerful Advice

George says that ultimately, the way internal auditors approach their roles will need to change to help them deal with the energy demands of data centers effectively. “Internal auditors usually assess, but do not dictate strategy,” he says. “However, internal audit cuts across so many different areas — risk, cost, cybersecurity — and these areas can influence board-level discussions. I am supportive of a pro-advisory role. We can move beyond compliance and become an embedded partner to make a difference.”

Practitioner Angela Douglas, an IIA senior manager of Standards and Guidance, says internal audit can advise organizations to set up a formal sustainability and risk governance program. That program should bring together internal teams to assess environmental, operational, and compliance risks related to data centers.

In addition, Douglas recommends that auditors assess supply chain dependencies, geographical and geopolitical risks, and business continuity plans. Moreover, they can audit the efficiency of data centers throughout their life cycles, from hardware procurement to decommissioning.

George notes that internal auditors who can get their arms around the big picture and fine details of data centers are likely to become sought-after talent as companies grapple with the ramifications, both as they exist today and evolve in the future.