The Evolving Role of Internal Audit: Unpacking IIA’s Vision 2035 Report

JAMES ELDRIDGE: Hi everybody. Welcome to the first in a series of risk advisory podcasts provided by Cherry Bekaert, supporting the IIA's Internal Audit Awareness Month.

I’m James Eldridge, a senior manager in the Risk Advisory practice at Cherry Bekaert. On today’s podcast, I’m joined by Scott Payton, partner and Risk Advisory leader.

We’re excited to delve into the IIA’s Vision 2035 report, which was highlighted at the recent Mid-Atlantic IIA district conference by Anthony Pugliese, president and CEO of the IIA.

This report outlines key themes and shifts in the role of internal audit as we look forward to the future. Our discussion today will focus on how these changes will impact our profession and the opportunities they present.

There’s a lot of enthusiasm about what lies ahead, and we look forward to an engaging conversation about the future of internal audit. This will be part one in a four-part series celebrating May's Internal Audit Awareness Month.

I hope you will join us for all four sessions. Scott, thanks for joining me today on part one.

SCOTT PAYTON: Hey James, thanks so much. Happy to be here. I'm excited to support the IIA's Internal Audit Awareness Month and talk about the Vision 2035 report with you today.

JAMES ELDRIDGE: Let’s get right into it. We heard the president of the IIA discuss the Vision 2035 concept in depth last month. What are your thoughts on this vision as a whole, and what were some of your main takeaways from the report?

SCOTT PAYTON: It’s a great report. For those who have not had a chance to read it, you can pull it down from the IIA's website.

The report features two different areas. First is a series of surveys where the IIA polled chief audit executives and audit leaders from across the globe.

These surveys provided insightful metrics and perspectives on where the profession is and where it’s heading. Secondly, it provided a comprehensive vision for where the internal audit profession will be by the year 2035.

One of the key takeaways is the evolution of internal audit into strategic advisors leveraging advanced technology like AI and quantum computing to provide real-time, evidence-based insights.

The topics covered emphasize the importance of shifting the perception of internal audit and harnessing new technologies. This requires increased leadership and stakeholder support from the board and executive management.

Key insights from the report show internal auditors adapting to emerging risks and providing more advisory services. We will get into each of those topics in more detail as we continue.

JAMES ELDRIDGE: That paradigm shift was one of my biggest takeaways. Traditionally, internal audit has focused on compliance and independence, but now we are seeing a shift toward strategic advisory and driving value.

How do you see this playing out in the industry? What do you see as the opportunities and risks that go along with this paradigm shift?

SCOTT PAYTON: We can’t avoid the headlines we see these days. As internal auditors, we are the eyes and ears of the organization.

The board and management rely on us to bring light to the emerging risks of the company. Our organizations are influenced by the rapid pace of technology and the increasing complexity of business operations.

This complexity includes third and fourth-party reliance and cybersecurity. These areas are changing dramatically and quickly, leading to a much more complex risk profile for all organizations.

Because of that, internal auditors need to change as executive management responds to their world from an operational perspective. To address this paradigm shift, we must start by assessing our level of maturity as an internal audit team.

Traditionally, we focused on assurance services, such as Sarbanes-Oxley (SOX) compliance or rotational audits. While those building blocks must remain as table stakes, there will be an increased focus on advisory services.

In addition to core SOX and rotational audits, we need to provide proactive advice, insights, and foresight to help our organizations anticipate and mitigate future risks.

Internal audit has a unique opportunity because of our purview. There are few areas of an organization that we don't have access to, including operations, technology, finance, treasury, strategy, and risk management.

If we lean into strategic advisory services and leverage technology, we can bring a truly unique, independent, and insightful view to both executive management and the board.

JAMES ELDRIDGE: It is fascinating. Speaking personally, there has definitely been an increase in strategic-level questions related to internal audit over the last five to ten years.

Let’s talk about the technology piece. Advanced technology is emerging every day, both in the internal audit space and the broader business environment.

What are some of the more impactful technology trends you are seeing? What can internal auditors do to stay ahead of the curve?

SCOTT PAYTON: I find the headlines regarding ChatGPT and Generative AI fascinating. It was everywhere, with articles explaining how it impacts organizations and the associated fear or excitement.

From an internal audit perspective, it is important to be knowledgeable and embrace advanced technologies to become a differentiator.

To be a leading internal audit practice and a strategic advisor, we must lean into technologies like artificial intelligence, GenAI, machine learning, and data analytics.

Leveraging Python and other advanced tools will be critical. Executive and operational management already have access to these tools.

If we don’t keep up with the pace of the organization, our ability to drive value will diminish. For example, if operations are leveraging GenAI for supply chain models or fraud detection, we must keep pace.

If we don't embrace these technology changes and move with them, we will provide less value. We either move into making this part of the fabric of what we do every day, or our value will be diminished over time.

The Vision 2035 report noted that 97% of respondents believe new technology will allow auditors to manage more complex data. Additionally, 74% affirm that AI is crucial for the profession's ideal future.

Most teams globally know that technology is critical and that AI will be part of that future. However, a critical step that must not be missed is data.

Embracing technology is fantastic, but step one is accessing reliable, real-time data. You need to consider if you have access to a data lake and if you are a consumer of data alongside other parts of the enterprise.

Finally, we must find a tipping point. We often dabble in new technology on a single engagement, but we need to move toward making it how we actually operate.

The question should not be where we can find a use case for AI, but rather why we are not using AI on all of our engagements. It is a paradigm shift that must be baked into how we use advanced technology and data analytics.

JAMES ELDRIDGE: Data analytics is frequently cited as one of the top areas of technology needed by organizations from an internal audit perspective.

However, there is also the question of subject matter expertise. While internal auditors were previously considered generalists, we now see a need for deep knowledge in narrow systems or areas.

How should internal audit shops approach sourcing this subject matter expertise while balancing the cost-benefit calculation?

SCOTT PAYTON: It is a tough question. When we think about the investment required to bring in these skill sets, it comes down to how we operationalize the use of advanced technology.

As an internal audit leader, it is important to understand where you are today and where you want to be tomorrow. This "North Star" defines how you deliver resources and capabilities.

Operationalizing advanced technology is not a zero-to-100 process overnight. It is a step-by-step process that often involves phases.

First, consider investing in continuous training and development for your own people. If you have IT auditors on staff, they might start by leveraging GenAI in simple ways or pursuing certifications.

Second, leverage external consultants strategically. You can use a limited budget to bring in subject matter specialists to execute a particular audit, such as fraud or supply chain analysis.

You can create a partnership with those who have knowledge in AI or data analytics to perform the audit while also training your staff.

When I mention external consultants, I also mean resources external to the internal audit department but internal to the company. Leverage your own IT or data analytics teams within the organization.

Finally, create a diverse team with hybrid skills. Rather than having a dedicated IT person, you can train business process auditors to run Python scripts or understand data lake structures.

You can also develop internal expertise through rotational programs. If someone is passionate about technology, give them a six-month rotation with the IT organization to learn and bring that knowledge back.

JAMES ELDRIDGE: Those are very interesting concepts. Looking at the longevity of our teams and the next generation of auditors, what should we be doing now to be good stewards of the profession?

How do we ensure we maintain high-quality people who are ready to carry the baton into the future?

SCOTT PAYTON: I am very excited about how the Vision 2035 report discusses providing value as a strategic advisor and leveraging technology to be more impactful.

People coming out of college or those early in their careers will be excited about this growth. Most people would rather jump into a GenAI model for predictive analysis than tick and tie a sample of 25.

It is up to chief audit executives and service firms to create a career path and a mission that drives toward this modern audited approach.

We need to provide a vision and a place for people to develop themselves through training and certifications, becoming valued advisors rather than compliance auditors.

Establishing mentorship and coaching programs is also critical. We must help new staff understand what the possibilities actually are.

Internal audit provides a purview across the entire organization that few other roles offer. This makes it a great way to bring in talented folks.

A plan might involve a person spending several years in internal audit to understand the organization before moving into a management role in another part of the company.

It all starts with a strategy and being forward-thinking. Our leadership must have a plan to become strategic advisors that leverage technology.

JAMES ELDRIDGE: Great ideas. Scott, thank you so much for sharing this insight and your knowledge.

We are excited to announce the next three parts in our series. In the upcoming episode, we will explore the top three critical skills for the internal audit profession.

After that, we will explore empowering your business through data analytics in internal audit. We will close the series with a discussion on how to audit AI.

Stay tuned for these insightful discussions throughout May. As always, please like, share, and subscribe to the Risk Advisory Podcast. Thank you for listening.