Internal audit has had quite a glow-up since the early part of this century. From compliance crusader to C-suite confidant, Protiviti’s Jim DeLoach takes a look at how leading professionals have redefined internal audit’s role over two transformative decades.
Generative artificial intelligence (AI) is such an amazing tool. It makes seemingly daunting projects much easier to undertake. To illustrate, since 2005, my firm has sought out best practices among progressive internal audit functions and published them in a series of annual publications titled “Internal Auditing Around the World.” For this year’s 20th edition, we used our firm’s proprietary generative AI tool to review the previous 19 volumes of the series, which collectively contain 244 profiles of leading internal audit functions captured in more than 460,000 words of commentary and insights.
In applying generative AI, our prompting focus was straightforward: Understand how the cutting edge of the internal audit profession had evolved over the past two decades (i.e., what has changed over time?).
Interestingly, we found that this history lesson offered insights into how chief audit executives (CAEs) can advance their internal audit teams going forward. Our technology-enabled review revealed a number of themes and trends underscoring the transformation of internal audit functions.
Rise to strategic adviser
Looking back over the past 20 years, leading internal audit functions were initially focused primarily on compliance. In the United States, for example, the Sarbanes-Oxley Act of 2002 commanded the attention of everyone possessing skills in processes, risks and controls. Over time, however, leading internal audit functions adapted their practices and annual plans to address a broader range of challenges, resulting in an evolution from a compliance focus to one that serves as a strategic partner within the organization. For example, these functions:
- Focused on helping businesses navigate financial crises and economic cycles, manage volatile swings in labor markets and shifting employee expectations, adapt to the realities imposed by a global pandemic, improve operational resilience and evaluate and adopt a wave of emerging advanced technologies;
- Worked closely with boards of directors and executive management to create greater transparency into the risks and opportunities presented by strategic programs and initiatives, establish sound corporate governance and improve understanding of potential risk exposures; and
- Became sought-after strategic advisers to the business by demonstrating relevance and value through their interactions and aligning their focus and activities with the organization’s goals and objectives.
All told, these CAEs and their teams expanded their roles and delivered value beyond assurance services by providing risk management advice in strategic conversations with the organization’s leaders and playing an integral role in fostering enterprise risk management across the company.
All that said, transitioning into a strategic partnership type of role requires internal audit to maintain a balance between becoming a more integral part of the business while also sustaining the function’s objectivity. In preserving this balance, top-performing internal audit functions have learned to adopt a strategic focus that aligns with the organization’s vision and long-term objectives. This focus involves a deep understanding of the organization’s business model and revenue drivers, as well as an emphasis on ensuring audit plans and activities support the organization’s success. As business leaders extracted measurable economic value from the newfound collaboration with internal audit, any initial hesitations about expanding the function’s focus were alleviated.
Interestingly, all of this has become more important as stakeholder expectations have increased as the complexities of markets change. Many boards and management teams now expect input from internal audit not only on specific compliance obligations and governance matters but also on high-risk and emerging risk areas.
Guarding the Golden Goose
Tips to preserve your company’s most precious organizational asset
Read moreDetailsValue delivery
Closely related to internal audit’s rise to the role of strategic adviser has been its ability to deliver and communicate value. The shift from a compliance-and-controls focus to a more wide-ranging mix of assurance and advisory services over the past two decades played a major role in the view of internal audit as a function delivering value and providing sought-after strategic input. Once value is delivered, it is necessary for CAEs to articulate such delivery to business leaders. That, too, is an important communication skill.
Following are some related insights:
- Value delivery begins with understanding the business. This understanding results from engaging early and often with senior executives and other stakeholders throughout the enterprise when performing risk assessments and focusing on potential risks associated with major enterprisewide initiatives such as digital transformations and major systems projects.
- When internal audit helps identify important risks early and provides guidance to ensure they are being managed effectively, a visible contribution is made to more effective risk management across the organization.
- Best-in-class internal audit functions focus on the root cause of identified issues and the broader picture to improve business performance. By adopting a strategic approach to auditing and shifting the focus beyond symptoms or noncompliance issues to assess root causes, internal audit is able to deliver valuable insights and recommendations to improve processes and performance throughout the organization.
Fundamental to value delivery is the importance of internal audit teams building trust and developing strong relationships within the organization and with external auditors, fostering open lines of dialogue with key stakeholders and seeking feedback regularly to understand evolving expectations. To that end, presenting information clearly and in a manner that resonates with the audience is just as vital as the information itself. Engaging stakeholders proactively through ongoing communication about their concerns and potential areas of improvement can bridge communication gaps and translate complex audit findings into a clearly defined and actionable plan.
Board engagement
Effective board engagement, including the value of the insights it provides, is key to the CAE’s success. Best-in-class internal audit functions have, in many ways, cracked the code as their boards regularly seek their advice on governance issues, especially during transformational periods within the enterprise.
As complexities in the market increase, boards have come to rely more on their internal audit leaders for advice on high-risk areas such as cybersecurity, fraud, new technology adoption, market expansion, sustainability initiatives and more, going well beyond check-the-box compliance activities. This trend is reflected in internal audit’s evolution toward an auditing process that prioritizes different enterprise programs and activities based on potential organizational impact. As boards rely more on internal auditors for their perspective on these matters, internal audit’s advisory role becomes more prominent.
Technology enablement and focus
Over the past 20 years, technology has played an indispensable role in transforming the focus and operations of internal audit. Advancements in technology, particularly in data analytics, AI and automation in all its forms, have revolutionized internal audit’s work, increasing efficiency and productivity of audits performed and expanding the function’s scope of work. As these developments continue to fuel more comprehensive risk assessments, real-time risk monitoring, predictive analytics supporting better and more timely decision-making and deeper insights into business process issues, they have created transformative opportunities for internal audit.
For example, the application of advanced data analytics has provided unparalleled visibility into organizational processes that have helped leading internal audit teams identify patterns and potential risks, thereby enabling more expansive assurance and stronger recommendations to management. Furthermore, embracing technologies such as AI, machine learning, visualization tools, audit management systems, cloud computing, process mining, collaboration platforms and automation has made it possible for internal audit functions not only keep pace with change but also excel at providing strategic insights using fewer resources, thus delivering significant value. In particular, the use of AI is broadening audit coverage by enabling analysis of larger datasets quickly to identify revealing patterns and anomalies.
Despite the clear benefits realized by leading internal audit functions, adapting to new technologies continues to be challenging. Leading functions foster a culture of continuous learning to stay abreast of new auditing techniques and tools. As they adapt to new technologies to fuel operational improvements, it paves the way for them to serve as trailblazers in their organizations by adopting such technologies as AI, process mining and data analytics.
Diversity of talent
Over time, best-in-class internal audit groups invest to attract, develop and retain talent with diverse qualifications, including data analytics proficiency, AI and machine learning capabilities and soft skills like effective communication and leadership. Upskilling team members in areas like technology auditing, data analysis and emerging technologies has become table stakes. As AI takes over routine, repetitive tasks, auditors need to be equipped with advanced analytical skills and a strong understanding of how to work alongside AI technologies to maximize the value added.
This shift has placed a premium on skills in several areas. For data analysis, auditors need to examine large datasets efficiently and reliably to identify patterns, anomalies or trends that provide indicators of risks or opportunities. A working knowledge of AI tools and technologies is essential, as auditors must be able to understand the capabilities and limitations of these systems in order to evaluate them. With rapid technological change, auditors require an ongoing education mindset.
Given these new demands and skills requirements, CAEs have become keenly aware that to recruit talent, especially technical talent, they must provide opportunities that promise professional growth, knowledge expansion and strategic impact within the organization. These opportunities include skills development and talent rotation programs and should be attractive to candidates from diverse backgrounds (i.e., beyond finance and accounting).
Catalyst for change and resilience
Finally, best-in-class internal audit functions have learned to act as catalysts for change within their organizations by providing insights that drive improvement while safeguarding against potential risks. They have transformed the perception of internal audit from a cost center to a valued partner that contributes significantly to achieving organizational resilience and strategic objectives.
For example, rather than operating reactively to help mitigate risks after they occur, leading audit functions focus on providing guidance to build resilience into technology systems so they can withstand attacks before they occur without significant service disruption or data loss. These internal auditors have learned to adapt as they navigate significant corporate changes or shifts in organizational priorities amid major change or a crisis.
Final thoughts
Some readers may react to the above discussion with a view that it is not broadly grounded. After all, 244 case studies from all over the world over a 19-year period may not be viewed as a representative sample of the entire profession. But please don’t shoot the messenger. Our purpose is not to summarize the state of the internal audit profession but to report what leading functions have done to elevate their stature within the organizations they serve. And from where I sit, that is an important game to play.
The developments and trends we’ve recognized in leading internal audit functions over the past two decades offer progressive CAEs a pathway for enhancing the value contributed by their functions over the next three to five years. Rest assured that the CAEs driving the best-in-class internal audit functions we have covered above did not find change easy. It was their courage, willingness to innovate and clarity on what was needed to thrive that fueled where they are today.
In addition, at my firm, we can point to many other internal audit organizations that have experienced similar successes. We are also acutely aware that stakeholder expectations are increasing, whether CAEs embrace change or not. All CAEs should exercise caution sticking with the status quo, take stock of these lessons learned and apply the ones that make the most sense in light of their functions’ respective facts and circumstances.
Jim DeLoach, a founding 
