​The Innovative Internal Auditor​

As businesses strive to find opportunities in a world driven by technological transformation, internal auditors need to continually innovate to stay ahead of the game, says Shannon Urban, 2017–2018 chairman of The IIA’s North American Board.

Comments Views

​In today’s dynamic and disruptive world, most organizations are undertaking some form of fundamental transformation. Whether they are developing new products and services, refocusing on customer expectations, exploring new technologies, entering the next phase of their push to globalization, or simply seeking new efficiencies, radical change is now an everyday fact of life. Organizations and their internal auditors cannot afford to be static if they want to survive in this environment.

The fact that the rate of change is faster and more intense than ever has major implications for both companies and their internal auditors. It affects the nature of assurance that internal audit stakeholders are seeking, but it can also greatly enhance the speed and quality of the assurance we can provide.

Until recently, assurance was more focused on past events. But the rate of change means that the past is no longer a safe predictor of the future. In today’s environment, organizations are calling internal auditors to be more forward-looking. Boards want comfort that as they take their next steps, they can see the potential stumbling blocks and understand what they need to do to get around them. They see internal audit playing a vital role in their efforts to successfully navigate the fast-moving business environment.

That is great news for internal auditors, but it is also a challenge. Traditional auditing is undoubtedly right for many projects; however, when auditors need to deal with the uncertainties inherent in planned business strategies, it is an approach that is less relevant to the velocity of our current business environment. Internal auditors can build upon the steps they have taken to meet these new challenges by focusing more effort on innovation. That is why “Internal Audit Innovation” is my theme as chairman of the North American Board for 2017–2018.

I passionately believe that internal audit has a vital role to play in the success of our organizations. But I also believe that to be up to the task, we need to refresh our commitment to innovation in internal audit. We need to push further and harder on the steps we have taken so far in areas such as audit automation, data analytics, and rethinking our audit processes and methodologies, as well as taking the first steps toward the use of robotics in our audit work. Innovation must be at the core of internal audit’s remit if it is to keep pace with the developments in our own organizations and beyond.

A Work in Progress

THE 2017-18 IIA North American Board Chairman

Shannon Urban is executive director, Risk Advisory, at EY in Boston. With EY since 2001, Urban currently leads growth strategies at the firm as its Northeast Region Internal Audit and Internal Controls Competency leader. She has worked with internal audit departments of all sizes and in multiple industries, including financial services, health care, government, industrial products, and consumer products.

Urban has worked widely on innovation in internal audit, including on EY’s internal audit delivery methodology and tools to support internal audit engagements. Previously, she was audit manager at Fidelity Investments, and senior audit officer at State Street Corp., both in Boston, and senior staff auditor at Citizens Financial Group in Providence, R.I.        

Urban has been The IIA’s North American Board senior vice chair, a Global Board member, an Audit Committee member (2014–2015), and an Institute Relations Committee member (2011–2015). She has been active in The IIA’s Greater Boston Chapter as president (2002–2003), treasurer (2001), and a member of its Board of Governors.

Many internal auditors are working their hardest to meet their stakeholders’ expectations with often constrained resources — including tight budgets, limited staff, and ever-changing competency demands. Even so, stakeholders seem to continually want internal audit to add more value. Most chief audit executives (CAEs) I meet really care about this issue. They speak with their various stakeholders, try to understand what they value, and modify their audit plans and strategies accordingly. But priorities change much more quickly than in the past, so it can be difficult to see how it is possible to keep doing more and still provide the baseline assurances stakeholders expect.

This is precisely why the innovation mindset is so relevant today. It says internal audit should be a work in progress. That processes are adaptable and open to rapid revision as circumstances change. That audit finds more forward-looking ways of working to adapt to stakeholders’ changing needs. And that technology is a great enabler when fully embraced.  

Many internal auditors have already embarked on this journey. But I am calling on everyone to turbocharge their innovation efforts. We can do an even better job of keeping ahead of the rapid developments both within our organizations and beyond if we make a conscious effort to embed innovation in our audit functions.

Overcoming Obstacles

Innovating internal audit can be great fun, and those who have done so successfully have reaped the rewards of enhanced risk coverage, deeper insight, and increased stakeholder satisfaction. They have made their organizations nimbler and less prone to surprises. They have often earned a seat at the top table where they provide objective advice and assurance where it is most needed.

But kick-starting an innovative audit culture can be difficult. Because most audit departments work with tight resources, they have little spare time, money, or people power. Working through a packed audit schedule, they may feel that they cannot devote the necessary time and energy to be strategic and innovate.

There is no easy answer to this dilemma. But I urge CAEs and everyone on the internal audit team to make a commitment to embrace innovation today. By making time for regular, meaningful conversations and creative thinking with each other, the rewards will come. Some auditors in a team may take a bit of persuasion that the effort is worthwhile. Some clients may have become comfortable with being audited in a traditional way. And in those cases, auditors will need to have the courage to drive change and insert themselves where they feel they can add value. It takes courage to innovate and to overcome old attitudes resistant to change, to think and act differently, and to show leadership and be an executive in the organization. But by becoming a catalyst for innovation in internal audit, auditors can become a catalyst for change in the organization at large.

The Key to Innovation

Even if the audit team is relatively small and cannot create a dedicated innovation center, the CAE can foster a culture of innovation in his or her team. After all, not all innovation aims to reinvent the world.

If I were starting on this journey today, I would sit down with my team and have an open conversation about what the difficult things in internal audit are — the things we spend the most time on. Where could we be more efficient? What are we not covering as well as we’d like? What is hard to do right now to meet the expectations of our stakeholders and to fulfill our mandate? The key to innovation is to turn the answers to these questions into actions.

Heads of audit also could reach out to other innovation hubs within the business and ask for help. Companies are innovating just to survive, so many organizations have developed techniques for driving innovation that audit could learn from. Give someone in your audit function a part-time responsibility to help the innovation process. And tap into that wealth of often unexploited talent — new professionals. Newer internal audit professionals who aren’t tied to tried-and-true ways of working can bring a fresh perspective and an openness to technology as an enabler of innovation.

From Analytics to Robotics

Innovation Action Points

  • Have the courage to think and act differently and challenge the status quo.
  • Commit to change and to an ongoing journey of discovery.
  • Challenge the assumptions you hold about the everyday processes that make up the audit function’s working practices.
  • Embrace existing technologies to get the full benefit from your investment in areas such as analytics.
  • Communicate findings faster and more effectively by questioning the need to produce an audit report for every project.
  • Explore how advanced analytics and robotics can help free up resources for more high-level audit thinking.
  • Create a culture of challenge in your department and involve newer members in the innovation process.
  • Get help from within other parts of the business that are focused on innovation.

Analytics have been around for a long time. But it is a nut most auditors have not fully cracked, or fully embraced, across the entire audit life cycle. It represents a great opportunity for innovation. Leveraging different types of analytical methods for risk assessment, planning, execution, and reporting can massively boost the efficiency and outcomes of our audit work. Auditors who have not yet innovated their processes in this area can make giant strides very quickly and, in doing so, improve the speed and depth of the assurance they provide.

The biggest conversation I am having in my firm and with cutting-edge internal audit functions is about robotics and what that means for our businesses. Robots, or bots, have moved from the factory floor to finance functions, shared service areas, and other professional areas of work. Internal auditors who take the time to find out what robotics means from a risk and control perspective are likely to be in for a pleasant surprise.

For example, some audit functions are investigating using bots for routine control testing work. They have found that bots can perform those tasks in a fraction of the time and for a fraction of the cost of a real person. So, while some consultants talk about robotics in terms of cutting head count and costs — auditors are beginning to explore how it can alleviate the perennial constraints of resources and budget.

Imagine if the internal audit team could build a series of bots to do all its routine control testing, how much time and how many resources that could free up to focus on higher brain-power auditing and advisory work. It could mean liberating resources to deliver those value-added projects stakeholders demand without sacrificing audit’s ability to provide assurance in traditional areas. I see this emerging innovative technology as an internal audit multiplier.

Looking Close At Hand

One of the most powerful tools for innovation in internal audit is fresh thinking. I am very encouraged by how many CAEs with whom I work are open and receptive to new ideas. They want to incorporate those ideas into their work, but with a busy work schedule, we all know how difficult it can be to turn ideas into action.

Fortunately, innovation can start from looking differently at those things that are closest at hand. When I was thinking about my theme, I realized that the way most internal auditors work has not fundamentally changed over the nearly 25 years I have been in the profession. Of course, the red pencils, hard copy ledgers, and ring binders are gone. We work on computers and smartphones. But most of us could not genuinely say that we are digital internal auditors, even though most of us live and work in a digital world.

Internal auditors have embraced technology to assist in achieving consistency and quality in our work. But we can go further and fully embrace technology the way our businesses are embracing it. That can be as simple as leveraging the tools that auditors use in their everyday work to their utmost capacity.

But not all innovation relies on technology. For example, not every risk needs a full audit or full audit report. I have worked with many clients to adapt their audit response to the risk, and to be flexible in how they define an audit. For example, they can carry out more remote monitoring, or they can do a design assessment of controls, rather than conduct a full audit. Sometimes, the equivalent of kicking the tires is enough. As we all know, getting an audit report finalized can take a long time because so much value is placed on that report. Yet The IIA’s International Standards for the Professional Practice of Internal Auditing only requires us to communicate the results of our activities — and that can take various forms. Yes, sometimes a formal audit report is vital. But other forms of communication can be more effective, including, for example, issuing an executive memo, preparing and delivering a presentation, or providing additional training to deal with control weaknesses. These techniques can be more efficient and timely than an audit report that arrives three to six months after completing the work.

The Only Option

Innovation in internal auditing is both crucial for its growth and necessary in meeting the ever-changing needs of stakeholders. It is a messy, frustrating, and ongoing program that demands commitment and courage. And it is fun, surprising, and rewarding. All auditors can take a few easy steps to start, or reboot, their journey today. If we want to understand our stakeholders and serve them well in the future, embracing innovation is the only option.  

​As I assume the chairmanship of the North American Board, I am extremely grateful and humbled by this opportunity. My career has given me the chance to work with and learn from some incredible internal auditors, and I hope to continue to do that through this role. I would like to thank my employer, EY, for giving me the support and flexibility over the last several years to pursue my interest in IIA leadership opportunities, and for providing me tremendous opportunities to work with some of the leading thinkers on internal audit, risk, and controls. I am also deeply grateful to my husband Matt and sons Luke and Drew for their understanding and support as I pursue my career goals.

In addition to working toward our strategic goals for North America — focused on driving professionalism, advocacy, sustainable value, and The IIA as leader — I am also focused on two objectives that are personally exciting for me. First, I look forward to encouraging all practitioners to become more innovative in how we practice as internal auditors and to adopt a continuous improvement mindset. Second, I will be supporting our diversity and inclusion efforts to both promote success of women in the field of internal auditing and encourage more diversity in our volunteer organization and leadership structure.

Shannon Urban
Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to remove comments.

About the Author



Shannon UrbanShannon Urban<p>​Shannon Urban, CIA, CRMA, is an executive director with EY in Boston.</p>https://iaonline.theiia.org/authors/Pages/Shannon-Urban.aspx


Comment on this article

comments powered by Disqus
  • AuditBoard-January-2022-Premium-1
  • CIA-January-2022-Premium-2
  • 2022-GAM-January-2022-Premium-3



Stopwatch Auditinghttps://iaonline.theiia.org/blogs/jacka/2021/Pages/Stopwatch-Auditing.aspxStopwatch Auditing
Thanks, We Already Know Thathttps://iaonline.theiia.org/blogs/jacka/2020/Pages/Thanks-We-Already-Know-That.aspxThanks, We Already Know That
Remember the 98 Accounthttps://iaonline.theiia.org/blogs/jacka/2021/Pages/Remember-the-98-Account.aspxRemember the 98 Account
Hidden Goalshttps://iaonline.theiia.org/blogs/jacka/2021/Pages/Hidden-Goals.aspxHidden Goals