The Road Ahead for Internal Audit: 5 Bold Predictions for the 2020s

Posted on 4th Jun 2020

Article by: Richard Chambers

Internal auditing has a long history of successfully pivoting to meet the growing and changing needs of its stakeholders. From its transition to risk-based auditing in the 1990s to its response to regulatory changes in fraud and corruption laws, financial reporting, and most recently, data privacy and culture, the profession has historically adapted to address the dynamic expectations of its key stakeholders.

As this decade comes to a close, I am looking ahead to exciting new prospects for the future. Last month, I shared some predictions about macro trends that could shape our lives and impact the organizations in which we work. Whether those predictions are spot on, the 2020s will almost certainly pose significant new challenges and opportunities for the internal audit profession. And it will be essential that we respond. To sustain and build on our successes of the past two decades, internal auditors will need to pivot yet again to address the changing needs driven by high-tech disruptions that fundamentally impact how work gets done. To successfully adapt, internal auditors will need to embrace technology like never before.

This theme is what framed much of my thinking in developing five bold predictions for internal auditing. These should spark serious thinking by all practitioners about their readiness to take on the marvels of technology and reinvent this amazing profession yet again.

1. The rise of "Uber" auditing. The "gig economy" — a labor market characterized by the prevalence of short-term contracts or freelance work, as opposed to permanent jobs — will find a natural fit in internal auditing. The demand for tech-savvy internal audit professionals who can skillfully respond to cyber threats and other technology-related risks already outpaces supply. This will make it increasingly attractive for practitioners with these skills and others to offer their services through short-term, on-demand contracts.

From the chief audit executive's (CAE's) perspective, sourcing strategies will include on-demand professionals. There will soon come a time when it will make more sense to simply call a service or turn to an app that will help locate the needed short-term expert to complete an internal audit engagement or advisory project. 

2. Data ethics and artificial intelligence (AI) governance will be the next decade's "culture audits." As we approach the end of this decade, the profession has embraced culture audits. As little as five years ago, many in the profession believed practitioners would struggle to develop the soft skills to audit "how we get things done" in our organizations. But auditing culture, or more specifically, understanding how culture influences all aspects of organizational operations and can sometimes be at the root of control weaknesses and process inefficiencies, is now viewed as part and parcel to sound internal auditing.

Each decade brings new surprises in terms of the kinds of risks internal auditors are asked to tackle, and the 2020s will be no different. We will go through a transition from the culture audit mandate to auditing data ethics and artificial intelligence. Those two areas will play increasingly significant roles in how work gets done, so auditing the ethics of how data is collected and used and how artificial intelligence is leveraged will become a vital tool in the practitioner's toolkit.

Indeed, CAEs identified data ethics as the second fastest-growing risk in terms of relevance over the next five years, according to the recently published IIA report OnRisk 2020: A Guide to Understanding, Aligning, and Optimizing Risk. Only data and new technology rated higher in terms of growth in risk relevance.

3. The torch will be passed to a new tech-savvy and tech-fearless generation. Internal Auditor magazine recently featured its annual list of Emerging Leaders, and reading the profiles of these young dreamers is like peering through a window into the future.

Their embrace of data analytics, robotics, and blockchain technology is a given. Many not only understand technology, but are adept at writing code and designing data-analytics programs. This diverse, multinational group recognizes the value of integrating technology into audit and governance strategies. The most encouraging aspect of this development is that embracing technology is what will best position the next generation of internal auditors to remain trusted advisors.

4. The image of internal auditors as "bean counters" will finally end. For too long, the pernicious stereotype of internal auditing being primarily an extension of the finance function has held us back. But as the profession becomes more adept at addressing emerging risks and embracing technology, stakeholders will increasingly recognize the value that internal audit insight and foresight provide. This will finally allow stakeholders to see the light that independent assurance is vital to all aspects of organizational governance, not just financial reporting and compliance, and that internal audit can deliver that assurance across the organization. 

5. Scandals will heighten awareness that internal audit serves the public interest. I have quoted Danish philosopher Soren Kierkegaard on numerous occasions regarding how all change is preceded by crisis. Judging by the number of high-profile scandals in the past decade, it is safe to say we are near crisis mode in corporate governance. It is very likely that the next decade will spawn new scandals that will drive more government regulation of governance, which could include some form of regulation of the internal audit profession.

Central to this will be the growing awareness among regulators and legislators of internal auditing's role in serving the public interest. There has been a longtime debate among internal auditors over whether the profession serves the public interest or serves the organization. The answer is that it does both. Independent assurance is vital to good governance, and internal audit provides that assurance, from internal controls and financial reporting to cybersecurity and culture. Simply put, internal audit supports good governance, and good governance serves the public interest.

This heightened awareness may manifest itself in a variety of ways, including requiring publicly traded organizations to report on internal audit's role in their risk management processes, requiring organizations to create and maintain a properly resourced and independent internal audit function, and/or requiring internal audit to report to the full board. We may even see a push in some jurisdictions to license internal auditors, which The IIA does not support. The last point is why we must be ever vigilant to regulatory interest and intervention.

These five bold predictions for the 2020s are among many more I considered for this post, but I am confident that some, if not all, will come to pass in some form. The IIA's current strategic plan includes a 2030 vision for the profession that "Internal audit professionals will be universally recognized as indispensable to effective governance, risk management, and control." The boldest prediction that I could make would be that we are embodying that vision in 10 years.

I'm eager to hear your thoughts and predictions, as well.