Global Knowledge Brief

Social/Human Capital/Culture

Part 3: Tomorrow’s Internal Auditors

C
hange is the only constant in today’s world. Everything around us is evolving rapidly on so many fronts —
from artificial intelligence (AI), to sustainability, to cultural norms — that internal auditors who choose not
to evolve will find themselves unable to fulfill the basic tenets of their role. To keep pace, internal audit
leaders must have a long-term strategy not just for providing organizational assurance, but also for equipping
their functions with the right skills, knowledge, and training to succeed.

Roadmap for Embracing Change

Earlier this year, The IIA released Internal Audit: Vision 2035, a research report designed to guide the long-term development of
internal audit functions in a way that meets the challenges of today and tomorrow. As IIA President and CEO Anthony Pugliese states,
internal auditors “at all levels, across all industries and geographies, must possess the skills necessary to address new and emerging
risks and demonstrate credibility to stakeholders to effectively confront these challenges.” Those skills come in a variety of forms.

• 96% say experienced internal auditors will need to increase their technology skills
Vision 2035 survey to remain relevant.

respondents place • 81% agree that entry-level internal auditors will require an elevated skillset to be
successful.
technology-based
• 92% say technology-driven changes to internal audit could add value to their
skills at the top of organization.

the list: • 93% say technology could help internal audit develop better insights and
recommendations.

Advisory work. According to Vision 2035, internal audit professionals and stakeholders expect the time spent on assurance services
to decline over the next 10 years to 59% of the auditor’s time versus 76% today, with time spent on advisory work growing from 24%
to 41%. Areas where such advisory work can be valuable include operations, compliance, and risk management — all of which require
an understanding of business processes that go beyond both technology and traditional assurance skills.

“The auditors that are only used to doing compliance and internal controls over financial reporting testing also need to have business
savvy,” says Sandy Pundmann, executive vice president, chief audit and risk officer at Warner Brothers, in the report. “They really
need to understand how to peel back the onion and be curious and understand what they’re looking at. Technical skillsets are going
to be important, but they must be combined with business acumen.”

Such changes speak favorably for the future of the profession, but they also create questions on the steps internal audit leaders should
take to adjust to these realities. Fortunately, there are several strategies that will not only better equip internal audit functions to
tackle new roles, but also improve their productivity and efficiency.

Establishing buy-in from leadership and stakeholders. Sometimes it is not enough to do the job well. The most detailed and accurate
findings possible do little if they are presented to leadership and stakeholders who do not understand or respect the value of such
findings. In addition to the technical aspects of their role, internal auditors should improve their soft skills so they can be their own
best advocates and work to establish buy-in organizationwide into what the profession offers.

2 — theiia.org
 • 50% of respondents say internal audit is misunderstood or
Findings from Vision 2035 undervalued. Notably, 23% of respondents highlight this as the

support the importance of most important challenge facing internal audit.

• 45% say there is a lack of sufficient support from leadership and

establishing buy-in, stakeholders. 22% say this is the most important challenge facing

including: internal audit.

Strategies to Evolve
Each internal audit function’s journey will be different based on its unique context. What one function can implement and accomplish
may be outside the realistic budgetary or resource constraints of another. That said, all internal audit leaders should still keep in mind
the long-term goals needed to evolve their functions.

1. Change the workforce perception of the profession. Today’s audit leaders can step forward to spearhead improved relationships
with organizational recruiters, college educators, and third-party hiring services to use language that better educates all players
in the hiring space on what internal audit is. For example, internal audit:

• Offers opportunities to collaborate and network with all organizational departments — an invaluable asset for those with
leadership aspirations. According to LinkedIn’s The Future of Recruiting 2024 study, Gen Z is 47% more likely than Gen X to
prioritize opportunities to advance within the company.

• Is a trusted advisor and change agent. Audit leaders should consider using terms like “strategic,” “holistic thinker,” and
“dynamic” when describing the profession.

• Offers significant opportunities to expand professional knowledge and skills. According to the LinkedIn study, Gen Z is 45%
more likely to prioritize opportunities to develop new skills than Gen X. With their view and work across the organization,
internal auditors are well-positioned to expand their understanding of the organization, from its risk environment to its
first and second-line processes and procedures.

2. Promote internal audit within the organization. Prospective hires are not the only ones who suffer from a misunderstanding of
the full scope of internal audit’s value. Even within the organization, negative or incomplete perceptions of internal audit can
lead to a lack of interest in transferring to internal audit compared to other departments. To counter this, internal audit leaders
can:

• Promote rotational programs to move internal auditors into functional roles, and those in functional roles into internal
audit. This not only broadens internal auditors’ understanding of operational processes for their engagements, but also
offers other employees firsthand experience with all internal audit has to offer. Just experiencing the role of internal auditor
can be the profession’s best marketing strategy.

• Improve communication with the audit committee, board, and senior management. Such communication lines are required
for conformance with the Global Internal Audit Standards™. If views of internal audit are skewed at the top, it will trickle
down to other areas of the organization. Internal audit and its findings and recommendations should always be viewed
positively and not from a point of antagonization. Such communication also should include ongoing dialogue on the full
scope of what internal audit can offer beyond providing assurance, such as valuable consulting and advisory services.

3 — theiia.org
3. Embrace technologies. Internal audit should be viewed as an advocate for innovation and positive change. This needs to come
through not just in its communication, but also in its actions. Few actions show this better than incorporating new tools and
technologies, including:

• AI. The uses of AI in internal audit processes to generate content, as well as to analyze patterns and identify trends, are
nearly endless, and not all of them require significant budget investment. AI use cases include:

o Audit planning.

o Report writing. View an AI use case video on

o Data analysis.
risk assessment.
o Ongoing monitoring.

o Incorporation into risk assessments.

• Automation. Internal audit should be a driver of data analytics. Analytics provide a variety of benefits, including larger
sampling sizes that maximize the vast data generated by today’s organizations. Drastically improved resource management
leaves more time for internal audit to pursue consulting and advisory services, and it provides an improved organizational
perception of internal audit being on the cutting edge.

• Digitization. The world is becoming increasingly digital by the day, and the format of all internal audit deliverables and
initiatives should reflect this.

Embracing technology also means embracing an environment of continual learning and development. To accomplish this,
initiatives could include:

• Increased cross-learning and interactions with IT-focused departments during assessments.

• Establishing ongoing learning expectations within the audit function through resources such as LinkedIn Learning,
technology-focused IIA learning resources, and offsite training via classes and seminars.

4. Rethink internal audit. Independence and objectivity will always be central tenets of the internal audit profession. However, the
complex demands of today’s organizations (as well as the complex risk environments they operate in) often demand that internal
audit leaders take on responsibilities beyond their traditional duties. Instead of shrinking away from these duties due to potential
concerns related to independence and objectivity, audit leaders should consider embracing them.

Stephen Bell, executive group chief risk and compliance officer for the
Bank of London, offers this perspective in Vision 2035: “Internal audit
Audit focus
needs to be scrupulously independent, but it can’t live in a bubble. It The IIA’s All Things
could do a better job of tuning into the wider environmental Internal Audit podcast
series is dedicated to
organizational context in setting objectives for the next period, without
providing our members with critical insight on
worrying that doing so would harm its independence by having too
all of today’s most relevant industry topics from
strong an opinion on what needs some of the most respected minds in the
to happen.” profession. In a recent episode, Risk and Cyber
Audit Opportunities With AI, experts discuss
Fortunately, the profession appears to be making great strides in this strategies to mitigate the risk of sensitive data
regard. According to Vision 2035, 71% of internal audit leaders surveyed disclosure in public AI tools, as well as the
importance of governance and monitoring in AI
report taking on additional roles, the top three of which are fraud
implementation.
investigation (43%), compliance/regulatory matters (32%), and
enterprise risk management (32%).

4 — theiia.org
Seeing such a profound shift supports the belief that just because the duties of internal audit are expanding does not mean it cannot
maintain its independence and objectivity — if the Standards are adhered to, which calls for the implementation of safeguards. Within
an organization’s unique context and needs, internal audit leaders should consider where internal audit can best fit. The function could
provide great value in places not initially considered.

It’s a Movement
The common thread that binds all the initiatives listed herein is the need for action. Internal audit leaders should not
expect the perception of their profession to change on its own. Indeed, audit leaders need to embrace the idea that they
are their own best advocates. This means championing the profession through all interactions within the organization,
from the board to frontline employees. This means reaching out to educators and providing resources to colleges to keep
the profession top of mind — perhaps even offering to provide presentations on the profession to students. No outreach
effort is too small or insignificant. The evolution of internal audit needs to be a movement, and a movement can only go
as far as its members take it.

5 — theiia.org
About The IIA
The Institute of Internal Auditors (IIA) is a nonprofit international professional association that serves more than 245,000 global members and has awarded more than
200,000 Certified Internal Auditor® (CIA®) certifications worldwide. Established in 1941, The IIA is recognized throughout the world as the internal audit profession’s
leader in standards, certifications, education, research, and technical guidance. For more information, visit theiia.org.

Disclaimer
The IIA publishes this document for informational and educational purposes only. This material is not intended to provide definitive answers to specific individual
circumstances and as such is only intended to be used as peer-informed thought leadership. It is not formal IIA Guidance. The IIA recommends seeking independent
expert advice relating directly to any specific situation. The IIA accepts no responsibility for anyone placing sole reliance on this material.

Global Knowledge Briefs are intended to address topics that are timely and relevant to a global internal audit audience, and each topic covered is vetted by members of
The IIA’s volunteer North American Content Advisory Committee. Subject-matter experts are primarily identified and selected from The IIA’s list of Global Guidance
Contributors.

To apply to be added to the Global Guidance Contributors list, email [email protected]. To suggest topics for future Global Knowledge Briefs, email
[email protected].

Copyright
Copyright © 2024 The Institute of Internal Auditors, Inc. All rights reserved. For permission to reproduce, please contact [email protected].

September 2024

6 — theiia.org