Celebrating its 80th anniversary this month, The IIA finds itself in a world of unprecedented turmoil. The transformations taking place in response to dynamic risks, reality-bending technology, and a once-in-a-century pandemic make many practitioners consider this the turbo version of internal auditing. The profession is relevant, fast-paced, and more exciting than ever.
IIA President and CEO Anthony Pugliese points out that just 20 years ago, internal audit was focused primarily on financial controls. "That was the mainstay of who we were," he says. "But internal auditing has grown to include much more, and that's the model that will prevail."
Pugliese says it is worth noting that, even back then, "The IIA had a forward-looking view of where the profession needed to be going, issuing a revised definition of internal auditing that emphasized consulting and adding value. In a time of rapid change and transformation, it's more important than ever that we look forward."
The world's principal provider of standards, guidance, and training for internal auditing faces a formidable challenge in guiding its 200,000+ members and the profession, itself, into a turbulent and uncertain future. However, internal audit leaders from around the globe have a clear and consistent message: We are entering an era of near-constant disruption, and technology won't just drive that disruption, it also will be the answer to successfully managing it.
"The biggest need for the profession overall is to embrace, understand, use, and apply technology in ways we haven't in the past," Pugliese says.
Unlikely Partners: COVID-19 and Technology
One of the defining legacies of COVID-19 will be its influence on technology adoption. Early on in the pandemic, it became clear that the sudden and dramatic disruption to the workplace had greatly eased reluctance to embrace technology. A byproduct or perhaps a companion to this phenomenon is a new business focus on creating resilient and agile organizations that can better manage disruption. For example, GM CEO Mary Barra coined the phrase "ventilator speed" to describe a new mindset on managing disruption after the legacy automaker quickly converted an idled manufacturing facility to assemble and deliver 30,000 desperately needed ventilators in just five months.
These two forces — chronic disruption and organizational resilience — are the drivers internal audit leaders see for the profession in the future.
"COVID-19 has stretched IT developments to support businesses and families as a way of life," says Ruth Doreen Mutebe, head of Internal Audit at Umeme Ltd. in Uganda, and secretary, Board of Directors, IIA–Uganda. "Hence, auditing now and in the future will be technology-driven."
However, the profession must first overcome a fundamental weakness. Historically, internal audit has not been an early adopter of technology. But Pugliese is an ardent advocate for upskilling the profession so that it becomes a critical support for an organization's understanding and leveraging of technology. "We won't all have the same level of understanding on every specific topic," Pugliese says, noting that "technology-enabled" for some organizations may simply mean the ability to understand and use social media. "But we all need a level of proficiency."
Going forward, organizations are going to seek that proficiency over a diversity of risk areas and emerging technologies, including pandemic recovery, climate change, cybercrime, geopolitical instability, blockchain, cryptocurrency, and artificial intelligence. Internal audit functions must be able to respond.
This echoes a point made by Sally-Anne Pitt, director at Pitt Group Pty Ltd. in Melbourne, Australia, and vice chairman, finance, of The IIA Global Board of Directors: The future demands a diversity of expertise, a diversity of response modalities, a diversity of technological development, and a transformation from top to bottom. "The biggest challenge for internal audit is to remain relevant, to respond to a broad range of issues as soon as they arise," Pitt says. "We need to be prepared for the unexpected, such as a pandemic."
The pandemic and other disrupters have raised awareness about business continuity management and taught the world that the concept of black swans — unlikely events with extreme consequences — should be relegated to history. With COVID-19, Mutebe says, organizations "witnessed the real benefit of risk and business continuity management. It is no longer a myth, and internal auditors are no longer considered to be 'prophets of doom.'"
The talent to adapt will be one of the most important traits for businesses going forward, says Ernesto Martínez Gomez, group executive vice president–Internal Audit, Banco Santander in Madrid, Spain, and ONA lead director on The IIA's Global Board. "So much is changing so rapidly on so many fronts — regulatory, macroeconomic conditions and how they influence each other — that it's very challenging, but very necessary, to maintain a balanced focus," he notes. COVID-19 and diversity, for example, "shouldn't express one over the other's need to be adapted."
This will likely manifest itself in an evolution in audit teams. In the past, the team might consist of 70% business and administration or accounting experts and the other 30% lawyers or other specialists, Martínez says. In the future, a better mix might be 50% economists and 50% science, technology, engineering, and math (STEM) experts. Complementary to the focus on STEM skills, emphasizing learning and adapting rather than having specific knowledge will be essential, Martínez says.
Perspectives on the Pandemic
Pugliese: "There will never be a moment when the effects of the pandemic will be gone. It set in motion a whole new way of working. I can find different skill sets anywhere in the world; I don't have to look in my backyard; I have the entire planet."
Pitt: "I'm based in Melbourne, Australia, and we hit the dubious record of the longest lockdown in the world — just lifted. This has meant we have had to completely adapt the way we work, and I've not been face-to-face with most of my clients for 18 months."
"Are we on the right track to put the pandemic behind us? Internal auditors need to add value to their organizations, so they need to have a clear understanding of what their stakeholders value and expect. That is going to look different for each organization; there isn't a one size fits all."
Wright: "On The IIA's 100th anniversary, we'll look back at 2020 and the COVID-19 pandemic being the year that caused an order of magnitude jump in the focus on technology, bio-nano-tech, and electric."
Mutebe: "2020 and uncertainty are synonymous — uncertainty of life, business continuity, family/societal gatherings or celebrations, and resumption of normal internal audit operations. 2020 taught practitioners that those who are resilient win."
Mubete agrees. "An ideal audit function will have strategy specialists and 'numbers' specialists, as well as generalists with combinations of the skills," she says. "Regardless, it will soon be unusual to see an audit function without access to data analysts."
The IIA's current Global Board chairman, Charlie Wright, says the next 10 years will bring more innovation and change than throughout all of human history, and the profession needs to be prepared for the convergence of several disruptive technologies. Indeed, Wright, chief risk officer at Jack Henry & Associates in Oklahoma City, built his chairman's theme around creating the future-ready auditor.
"Internal audit is at a pivotal point in history," Wright says. "New processes, entire companies, and probably industry verticals will pop up in the next 10 years. The technology shift will bring both opportunity and challenge for internal auditors and the organizations we support."
The profession has already moved from a heavy focus on financial statements, he adds, acknowledging the need for internal audit to be more strategy-focused. He notes that becoming so won't require an either/or divergence. "We'll need to be both strategic and tech-savvy." Many internal audit functions are realizing that the transition will be difficult, Wright says. New technology is hard to learn. Skills take time to improve and resources are in high demand. "I doubt most internal audit shops are staying ahead," he adds. "We need to be doing more."
Social Upheaval: COVID-19 and ESG
There's little debate that the profession's embrace of technology is not optional. Technological change is accelerating, and failure to act now only promises to make catching up that much more difficult. Indeed, failing to act now could threaten internal audit's relevance in the future. But this transformation won't happen in a vacuum, and practitioners will continue to be pressed to provide valued services across a growing spectrum of risk areas. One of the most pressing today is nonfinancial reporting.
Environmental, social, and governance (ESG) considerations are a priority, Mubete says, and she predicts the mandate of internal audit will progress from assurance over governance, risk, and compliance to governance, risk, and sustainability. Internal control will be subsumed into risk management, and sustainability will encompass aspects of profit, people, and planet as well as compliance beyond country borders, she adds. "The scope of internal audit will expand to include context beyond the organization, in-country stakeholders, compliance, and strategy."
ESG does present a new opportunity for internal audit, but it does not have to become one of the top challenges, Pugliese asserts. As organizations respond to ESG-related demands from stakeholders and regulators, internal audit is already integrating new audits and audit activities into annual plans. This is one area where internal audit's existing skills are more than adequate to provide value, whether that means performing audits of a company's carbon footprint, helping implement new ESG programs, or reviewing annual sustainability reports, Pugliese says.
Mutebe agrees, but offers a warning, as well. "Evaluation of corporate governance is part of the mandate of internal audit, but audit of the same is usually outsourced," she says. That practice will slow the speed at which internal auditors can hone necessary skills and delay acceptance by management that internal audit can actually do a better job. Internal auditors need to prioritize skills required to effectively audit environmental and social aspects, including systems to reduce carbon footprints, integrity of production and disposal systems, disclosure of the impact of products and services on the environment, and overall transparency, Mutebe says.
"This is critical, especially now that the trend toward more corporate transparency around ESG is growing and is being considered in the credit rating analyses of institutions," she says.
Transformation: COVID-19 and Internal Auditing
Many of the changes auditors will grapple with in the near future center on COVID-19-induced challenges, including learning how to optimize execution in a remote environment, Mutebe says. "How can internal controls, segregation of duties, information security controls, asset controls, and ergonomics oversight be monitored, tested, and audited in a remote environment?" she asks. Mutebe suggests online interaction with audit committees and boards, consideration of soft-copy evidence, and interrogation of IT systems to gather evidence.
Pitt says the loss of personal contact is significant, but she adds that the profession is already making progress precisely because of pandemic-accelerated technology changes. "The challenge for internal audit is meeting the increased expectations, but I think they're up to that. I can't see internal auditors completely returning to their previous ways of working," she stresses.
Historically, internal auditors have grown into the opportunities presented to them by change, Pugliese says. However, he warns that as the profession gets involved in more subspecialties, the learning curve sharpens. Still, the adaption to remote work proves practitioners are up to the task. "The whole logistical piece of being present is significantly reduced — permanently and with positive effect — proving without having to experiment that we can do what was considered undoable," he says.
For Wright, that adaptability inexorably must be tied to technology. "The astounding technological disruptions require an immediate pivot to auditors who can use a variety of tools to execute audits, a skill set that is so flexible that it allows them to transition seamlessly from one tech audit to another," he says. The pandemic also brought into sharp relief the need for auditors to build their audit tools into technology as it is implemented, Wright adds, and that auditing after the fact no longer adds value.
This brings the discussion on the future of the profession full circle.
"The internal audit profession has an opportunity to rethink its professional contribution to stakeholders, re-skill and re-tool itself to remain relevant regarding ESG; diversity, equity, and inclusion; and privacy issues," Mutebe states. "We have no option if we still want to be counted as a critical and value-adding profession. What made us succeed yesterday may not grant us the same effect tomorrow."