Thank You!

You are attempting to access subscriber-restricted content.

Are You Ready to Experience Everything Internal Auditor (Ia) Has to Offer?

The Disruption Imperative

To help raise the bar on innovation, internal auditors can work with stakeholders to nurture opportunities for disruption and manage the risks of falling behind.

Comments Views

​Change can bring new business opportunities for those organizations that are willing to embrace it — or the death knell to those that choose to ignore it. Yet despite that stark choice, organizations appear to be polarized over the pros and cons of disruptive innovation. It has the power not only to accelerate the pace of business and afford new ways of working, but also to turn long-standing business models on their head or make them obsolete. 

Some early adopters have reached meteoric heights quickly: Consider the impacts that "disrupters" Airbnb, Amazon, and Netflix have had on the hotel, retail, and home entertainment industries, respectively. And spare a thought for the former behemoths they left in their wake because they failed to adapt — video rental firm Blockbuster and booksellers like Borders. 

According to Breaking Through Disruption, a report from consultancy Accenture, C-suite mentions of "disruption" during earnings calls, investor conferences, and company announcements have increased significantly over the past decade — and with them, the anxieties of executives across industries. Indeed, in The IIA's latest OnRisk report, chief audit executives (CAEs) cite disruptive innovation as one of the top risks facing their organizations. More ominously, however, they also described it as one of the risks that they had the least personal knowledge of and the least capability to manage. 

But experts say there are many ways internal audit can help their organizations manage disruptive innovation. Looking at both the risks of falling behind industry advancements and the need to explore opportunities for innovation, internal auditors have the ability to add significant value to today's fast-paced, highly disruptive environments. 

A Host of Risks

Remko Renes, assistant professor, Corporate Governance, at Nyenrode Business University in the Netherlands, says the debate organizations face often involves whether they should move first (into the unknown) or second (after a competitor). "Innovation largely requires companies to throw money at a problem, but disruptive innovation can require them to consider completely changing their business model or their service offering," Renes says. "It is little wonder, therefore, that some boards find the whole concept of disruptive innovation a terrifying one."

Gary Connors, partner at business consultancy Oliver Wight in Gloucester, U.K., says the biggest risk is not the disruptive innovation itself, but the lack of foresight in management teams to see it coming. "In the history of disruptive innovation there is nothing that has happened overnight — each disruption has always started with slow burning rumblings that eventually resulted in a disruptive change," he says. Another key failure is that organizations "take too narrow a view of where the disruption may be coming from." They look for technological disruption that relates to their sector rather than disruption coming from the political or macroeconomic landscape, sociodemographic disruption from increased life expectancy, environmental disruption from climate change, or regulatory disruption as markets change and new rules or agreements emerge.

Connors says that organizations also choose to ignore disruptive changes. "Artificial intelligence [AI] in all of its forms is set to disrupt the world to an extent last seen by the advent of the personal computer or the industrialization of manufacturing," he says. "Yet most organizations do not have a strategy to deal with the threat of massive unemployment or exploit the opportunity of better, faster, safer manufacturing processes. To give another example: Blockchain has the potential to massively change all business transactional exchanges — which includes all supply chain exchanges and transactions — but it is being largely ignored by most organizations."

​Increased Awareness and Buy-in

Perhaps one upside that experts see from the pandemic is that boards may be more receptive to the idea that disruptive risks are around the corner and that their organizations can only benefit by preparing for them. "Due to the disruption from the pandemic that management and boards have experienced recently, there seems to be an increased awareness of the need to look at emerging trends to understand how they impact their companies," says Lisa Hartkopf, Risk Markets leader for professional services firm EY in the Americas. She adds that leadership is asking questions such as: "Are we missing something?" "Are we agile and nimble enough to change?"

Investors, too, she says, are beginning to value companies based on their ability to innovate and the perceived value of that innovation. "This is driving more strategic conversations between management and boards on their ability to create and sustain long-term value," she says.

Deepak Shukla, founder of Pearl Lemon, a digital marketing agency in London, agrees that the pandemic will drive disruptive innovation further. "I think as we see more multisector innovation as a result of the pandemic, businesses will begin to see the value in disruptive innovation," he says. "At the moment, many companies want to play it safe with traditional tactics. I anticipate we'll see a huge shift toward more innovative risk-taking in even the more traditional companies soon enough."

Three Key Issues 

Indeed, by its very nature, disruptive innovation can be difficult to see coming until it's too late. "We've seen well-respected and well-managed companies become obsolete by not understanding and adjusting to market shifts," says Lisa Hartkopf, Risk Markets leader for professional services firm EY in the Americas. "However, when organizations are flexible and dynamic enough to change, the opportunities are endless."

Hartkopf emphasizes three key issues to consider when looking at the risks associated with disruptive innovation. First is the speed with which innovation and disruption are happening and an organization's ability to adapt and scale at today's exponentially faster speeds. "Managing risk, while also focusing on agility and flexibility, is critical to keeping up with the pace of change," she says.

Second is being able to keep up with technology — whether it is cloud migration, AI, machine learning, or whatever comes next — and being able to adopt it into the business. "The challenge here is that businesses are asking the wrong question," Hartkopf says. "Rather than asking how to automate their current processes and operating models, businesses should be asking how to disrupt their current processes to create an automated environment. Risk is introduced as these changes are made, but if it's managed, companies can harness the power of technology to enable their business."

Third is managing the talent agenda throughout innovation. "With all this change, companies need to have access to talent that spans the spectrum of driving innovation and disruption, to governing and managing the risks it generates," she says. "Disruptive innovation is only 5% to 10% of innovation in the world," but she adds that failing to appreciate its significance can spell ruin for even the most established organizations. 

Risk Insight

Hartkopf says that internal audit has a strong role to play in identifying and mitigating these risks. "Internal audit has the mandate to look across the organization holistically," she says. "Internal audit sees where there are opportunities for adjacent innovation or continuous improvement, or where disruption is occurring and what needs to change to keep pace. Many organizations operate in silos, and so by sharing observations and making strategic connections, internal audit can bring invaluable insight to leadership."

She adds that internal audit can help promote the strategic and long-term "upsides" and opportunities linked to disruptive innovation. "Companies need to foster a safe space for innovation," Hartkopf says. "A safe space means having the right governance structure, risk management procedures, and an environment enabling confidence to try and potentially fail. Internal audit's role is to help with governance of the risk management function and make sure the right processes and procedures are in place to create an environment that enables trust in innovation." 

Embracing Disruption

The upside of disruption figures prominently in some organizations. In fact, CAEs working in cutting-edge, disruptive companies view disruptive innovation as a near corporate imperative.

Dominique Vincenti, CAE at Uber, says innovation of any kind should always be viewed positively. "Thinking about disruptive innovation as a negative event is nonsensical to me," Vincenti says. "Like risk, innovation is an event. It is not inherently good or bad. Well managed, it becomes a value-creation driver; mismanaged, it destroys value."

As an organization, Uber has a high risk appetite — not unusual for a company that is seen as an industry disrupter. The company is highly competitive and likes to innovate constantly and quickly to stay ahead of the pack, grow market share, increase revenue, and create long-term value. Management's role, Vincenti says, is to determine "what's on the horizon," and internal audit's job is to help plan accordingly. 

"Deciding corporate strategy is firmly in the hands of management and the board, and internal audit has no business giving an opinion on it," Vincenti says. Instead, she explains, internal audit can help optimize "the strategic and innovation process" by supporting objective postmortems or by reviewing the flow and quality of management information, the robustness of the assumptions, and the rigor of the analysis and scenarios that underpin the strategic decision-making process. 

Vincenti also says internal audit should help ensure management is clear about how it identifies, assesses, and manages strategic risks. For example, she says, internal auditors should ask executives about how the strategy has been decided, how it is going to be implemented, and how success will be measured. They should also help ensure the goals are achieved and that new risks that emerge are identified and managed. Moreover, she says, internal auditors can ask how the organization intends to keep innovating, and what steps it will take if disruptive elements derail its strategy. 

"Internal audit has an important role in helping make any strategy involving disruptive innovation achieve its aims," Vincenti says. "By focusing on the key and often basic questions as to how it will be implemented, internal audit can help keep the project grounded."

Lucy Jacobs, partner at Oliver Wight, also says internal audit is in a unique position to bring value to discussions about how to take strategic advantage of disruptive innovation. "Internal auditors are practiced at understanding and assessing risk and materiality," she says. "Disruptive innovation is a response to risk or opportunity, but unless risk is evaluated correctly, any innovation will be pointless."

Jacobs adds that "unpalatable truths are often overlooked" and that internal audit — with its independence — is in a good position to present challenge. "Internal audit needs to embed closely with management and the board to understand strategically where the organization is headed," she says. "The function then needs to use the same processes to look for opportunities as for scanning for risks, and rank and rate them with a focus on the largest ones. The internal audit team should then ask whether — with a different spin on a risk — there could be an opportunity: If X were to happen, what could we do to exploit these?"

Understand the Strategy, Avoid Harm

Speaking in a personal capacity, Lisa Lee, vice president, Audit, at Google, agrees that internal audit can play a vital role as risk advisor in identifying and mitigating risks around disruptive innovation, as well as ensuring the business has appropriate plans and actions in place.

Lee points to the importance of internal audit's role in helping identify the downside of risks as well as their upside, and examining both in the context of the organization's risk tolerance. "Not innovating could be an existential risk, so if the focus is only on 'what can go wrong' then the message might be mistakenly taken to be 'don't do anything as it's too risky,'" she says. "This is why I've always tried to get our auditors to focus on what is the business trying to do? What is the strategic objective? Based on that, we can develop an understanding of what has to go right and what can go wrong to help the business identify all the risks and ensure there are mitigation plans in place." 

However, Lee says that unintended or unforeseen uses or consequences associated with disruptive innovation could cause a fear of new technology and a reluctance by some organizations to move forward. "It can be difficult to know in advance how a new technology may be used in unintended ways, so it's important to innovate responsibly and to find ways to protect or prevent any misuse from happening," she says.

Organizations should take several steps, Lee says, to ensure that innovations being developed do not cause harm:

  • Seek frequent engagement and feedback from diverse sets of stakeholders and experts.
  • Create a safe environment — akin to a regulatory sandbox — where products can be tested at scale over time.
  • Embrace a culture that understands that the organization "needs to operate with speed, but also care."

Ultimately, a balance needs to be struck. "We may never have all the facts, but we need to be able to move forward, learn, adapt, and do better," Lee says. "Inaction or moving too slow may be just as — or more — destructive." 
Neil Hodge
Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to remove comments.

About the Author



Neil HodgeNeil Hodge<p>​Neil Hodge is a freelance journalist based in Nottingham, U.K.</p>


Comment on this article

comments powered by Disqus
  • AuditBoard-September-2021-Premium-1
  • FastPath-September-2021-Premium-2
  • All-Star-September-2021-Premium-3



Stopwatch Auditing Auditing
Thanks, We Already Know That, We Already Know That
U.S. SEC: Environmental, Social, and Governance Risks Better Be on Your Radar SEC: Environmental, Social, and Governance Risks Better Be on Your Radar
Newswire: Week of July 5, 2021 Week of July 5, 2021