Internal Audit: Oh, the Places You’ll Go!

(This is the second of a two-part series on the evolution of internal audit over the past two decades; read the first part here.)

The 35th anniversary of Dr. Seuss’s “Oh, the Places You’ll Go!” is fast approaching. Published by Random House in January 1990, it is much more than a children’s book. Its messages offer sage advice to anyone navigating their journey through the various milestones of life. It emphasizes the empowering reality of making choices that lead to positive outcomes that shape one’s journey. The following quote illustrates:

“You have brains in your head. You have feet in your shoes. You can steer yourself any direction you choose.”

• It speaks to continuous learning and adapting to new realities: “The more that you read, the more things you will know. The more that you learn, the more places you’ll go.”
• It speaks to resilience in the face of the inevitable challenges: “On and on you will hike and I know you’ll hike far and face up to your problems whatever they are.”
• And it speaks to dreaming big and setting goals for the future: “You’re off to Great Places! Today is your day! Your mountain is waiting, so … get on your way!”

In March 2007, my firm leaned into this book at a global leadership meeting to highlight our intention to take our firm in a new, exciting and more diversified direction with a focus on strategic growth. The underlying premise was that the market was changing and our clients were experiencing new opportunities and risks and we needed to expand our capabilities to help them.

Little did we know the 2008 financial crisis was just around the corner, leading to a lengthy period emphasizing a strong focus on differentiating how we serve clients amid a challenging global economy. Then the market began to shift to a need for more flexible enterprise solutions. New technologies sparked unprecedented disruption and a need for improved agility and resilience. Then a pandemic occurred. Now artificial intelligence (AI) threatens to spark another sea change.

The point? As I think back to that 2007 meeting, I realize that I didn’t come close to imagining the extent of change in the marketplace. In fact, when I was looking forward 10 years ago, I did not envision how dramatically different today’s business landscape would be, much less where it is headed as we look forward to 2025 and beyond.

So, what does this have to do with the internal audit profession? As I noted last month, Protiviti applied generative AI to mine the series of annual publications of “Internal Auditing Around the World” we have produced over the previous 19 years to understand how the cutting edge of the internal audit profession had evolved over the past two decades. The resulting 20th edition offers insights into how chief audit executives (CAEs) can advance their internal audit teams going forward. Previously, I recapped some of the important lessons top CAEs and internal audit functions learned over the past two decades. Here, I will summarize how we used these insights to craft a vision for the future of internal audit.

Below are five key actions my firm recommends for CAEs and their internal audit teams to consider when navigating the function into a dynamic tomorrow and grow as a strategic adviser to the business. My advice to CAEs and internal audit leaders: Evaluate the vision below with an open mind and embrace change either selectively or completely to position internal audit as a strategic, opportunity-focused, risk-centric and technology-enabled adviser that brings the right talent and skills to bear in helping their organizations succeed. 

Prioritize transformation: Be a catalyst for change 

Despite advancements achieved by best-in-class internal audit functions, many organizations continue to perceive internal audit as a compliance or assurance function, and many internal audit groups operate with a similar mindset. This needs to change. With the world and the business landscape transforming fast, CAEs and internal audit teams need to be nimble, technology-enabled with access to data and positioned to be a strategic partner in providing value-centric perspectives to the board and the C-suite.

This transition begins with a change in mindset to embrace change and become comfortable with being uncomfortable. Internal audit leaders and teams need to earn the proverbial seat at the table through their strategic mindset and focus on innovation and their ability to deliver quantifiable value to the business. The function’s transformation efforts should balance its focus on immediate needs for helping the organization elevate business processes and the customer experience by improving quality, increasing operating efficiencies and compressing cycle times. Its efforts should also encompass the management of current risks with an emphasis on long-term strategic planning and the development of relevant skills for facing the future challenges posed by technology advancements. At the same time, internal audit must maintain its objectivity to provide the best guidance to the organization’s leaders. 

With the right talent and technology tools, along with an innovation mindset that prioritizes transformation and embraces change, internal audit functions can position themselves as integral strategic partners to the business. The opportunity cost of not moving in this direction could be quite high in the coming years.

Compliance

Happy Together: Why Internal Audit and E&C Teams Need to Harmonize

by Ellen M. Hunt and Ursula Schmidt

September 23, 2024

Cross-fertilization mechanisms can present truly holistic view of risk

Read moreDetails

Lean on technology 

Invest in the acquisition and implementation of advanced technology tools that are rapidly becoming table stakes for leading internal audit functions. For example:

• Process mining tools will enhance understanding of complex business processes to focus on simplifying, eliminating and automating activities. This will lead to improved outcomes and impact.  
• AI can be deployed to automate routine and repetitive tasks related to data gathering, documentation, report generation and other activities, enabling the function to focus more strategically on expanding its capabilities and value delivered. It can facilitate advanced analytics for risk assessments.

These and other technologies are most effective when viewed as an integral part of evolving audit practices which, when utilized effectively, can enhance the relevance and value provided by internal audits. The convergence of internal audit and AI signifies a deliberate shift toward more sophisticated business practices driven by technological empowerment in which both disciplines can enhance each other’s efficacy in safeguarding organizational integrity and efficiency. More importantly, AI will impact the role of internal audit in helping to shape, govern and control its use throughout the enterprise to ensure it is deployed in the right way with the appropriate human oversight. 

Inaction on the technology front will be costly. It may lead to slower audits, less thorough risk assessments or reduced enterprise impact compared to what could be otherwise achieved. Over the past decade, new and emerging technologies drove extensive transformation in the internal audit functions choosing to embrace it, and it undoubtedly will prove critical in shaping their future.

Cultivate talent 

Transforming internal audit’s value proposition requires high-performing professionals who can tackle complex audit matters and bring a strategic focus to the table. The days of staffing internal audit functions solely with accounting and finance professionals are long gone. It is necessary to recruit and nurture a wider range of expertise. Consider the following:

• Processes for acquiring and developing talent should expand to embrace a new mindset of emphasizing diversity rather than specific job functions. Diversity encompasses not only gender, race and ethnicity but also experience, thought, background, education and skills, all working toward enhancing the function’s capabilities of solving new and unique challenges. 
• Upskilling current staff members in emerging technologies and tomorrow’s risks — including advanced cyber threats and expanded privacy requirements — while also creating a compelling work environment and career development paths will help attract a broad range of professionals to grow their careers in internal audit. 
• Comprehensive recruiting and training programs to develop skills in data analytics and mining, AI-related competencies and critical thinking are paramount. Other key skills include coding; data extraction, aggregation and analysis; use of visualization techniques; and the ability to link audit objectives and findings to strategic priorities.  

Adopt an innovation mindset 

An innovation mindset is critical to helping internal audit move forward in a fast-changing world. Think about it: If every aspect of the business is expected to innovate, then why not internal audit?

To that end, innovation needs to be about more than technology. Is the internal audit function viewing organizational challenges with a different perspective? Is it bringing creative solutions to the table? Are internal audit subject-matter experts and teams thinking differently as they assess the organization’s current and future challenges?

The opportunity before CAEs is to lead the way in innovating within their respective functions so their teams can deliver value-added insights on major transformation initiatives — technology, operations, market expansion and more — across the organization. The point is clear: Embrace transformation by taking the lead.

Act as a strategic partner – collaborate and communicate 

Everyone knows that meeting expectations — with an emphasis on exceeding — is key to success. To many CAEs, it may be tricky transitioning beyond the status quo if boards and C-level executives are content with internal audit’s present role. Such circumstances may require CAEs to educate stakeholders as to what additional contributions internal audit can make. Admittedly, it takes some gumption to do this with an ask for more budget. But consider the alternative of sitting tight with the status quo. In today’s what-have-you-done-for-me-lately world, it is naive to assume that expectations remain constant. The bottom line: Ensuring greater alignment between what board members and C-suite leaders seek and need from internal audit and what internal audit prioritizes should be the focus of every CAE. 

Acting as a strategic partner necessitates two imperatives for CAEs. First, collaborate with stakeholders to transition beyond compliance and controls to provide value-adding advisory services. Here are some ways to do that:

• Involve stakeholders in the risk assessment process.
• Establish regular communication channels with management, board members and operational heads to obtain feedback on audit findings.
• Conduct meetings to understand stakeholder concerns regarding risks, controls and operational efficiencies.
• Organize sessions to align audit goals with business objectives.
• Implement mechanisms to gather stakeholder feedback on audit reports to improve their relevance and the effectiveness of future audits.
• Deploy advanced data analytics to identify patterns and anomalies that might not be evident without deep data insights, thereby enabling more focused audits.
• Engage continuously with stakeholders during the audit process.

A second imperative for CAEs is the need to build communication skills that enable their teams to convey complex insights in relatable business terms. The ability to communicate findings from sophisticated analytics in a clear and actionable manner enables stakeholders to understand the audit results and their impact on the organization’s risk profile and resilience. Doing this consistently leaves stakeholders wanting more, elevating internal audit’s value.

Expanding advisory services without compromising objectivity can further cement internal audit’s position as a relevant strategic partner within the organization, while proactive management of market opportunities and emerging risks ensures resilience. 

Getting started: Dr. Seuss has the final word

Looking to the successes of leading internal audit functions in the past has provided insights enabling us to visualize the future and direction for progressive internal audit leaders. Perhaps some may view our vision as too optimistic, even a bit rosy. However, looking at the pace of change taking place in the market and in businesses today leaves me shaking my head when I see anyone in any organization with any responsibility in any function clinging to the status quo. True, change is painful and not without risk. But so too is disruption.

To this point, I cannot resist adding my own contribution in the style of Dr. Seuss: While progressive change doesn’t happen overnight, your failure to plan for it leaves you sitting tight.

Pretty corny, huh? I lay no claim to matching the artistic wit of Dr. Seuss, but the question is clear: Are you sitting tight? Or are you and your team ready for change? Again, I reiterate my advice: Consider the above vision and embrace change either selectively or completely to position internal audit as a value-added partner in the years to come.

So, what have you got to lose? As Dr. Seuss said: “You’re on your own. And you know what you know. And you are the one who’ll decide where to go.”