By now, it’s clear to most internal auditors and to those who follow the profession that internal audit is changing very rapidly. The strategies that have worked in the past will no longer be enough to carry out internal audit’s new mandate. Boards and senior management expect internal audit shops to be advisors to businesses that are undergoing rapid change and disruption across the board. That means internal audit must embrace change and change management as well.
“The 2020s will almost certainly pose significant new challenges and opportunities for the internal audit profession. And it will be essential that we respond,” wrote Richard Chambers, president and CEO of the Institute of Internal Auditors, in a recent blog post. “To sustain and build on our successes of the past two decades, internal auditors will need to pivot yet again to address the changing needs driven by high-tech disruptions that fundamentally impact how work gets done,” he continued.
To address these transformations, internal audit shops will need to do a better job on three major fronts: 1) Creating a mindset of innovation and adaptability; 2) Understanding and employing new technologies; and 3) Acquiring and managing talent that is equipped with the right set of skills to succeed in today’s rapidly evolving landscape.
An Innovator’s Mindset
Advanced new technologies and newly acquired talent and skills will not help internal audit much unless it also adopts a culture of change. Internal audit must improve at innovation and rapid transformation. Bridging the gap between where internal audit sits now and where it needs to go will take much creativity and experimentation. Michael Smith, U.S. intelligent automation and solution lead for internal audit at KPMG calls it being “technology curious.” CAEs need to promote a culture where auditors are free to experiment with possible technology solutions to see what they can accomplish, he says.
For a profession that often runs on tightly maintained schedules and rigorous process, this can be a difficult mentality to embrace. Experts advise chief audit executives to encourage internal audit staffers to take chances, explore pilot programs, and schedule time for experimentation.
For example, Chris Dogas, vice president of internal audit at Internap Corp., a global provider of data center and cloud solutions, encourages internal audit staffers to explore new ways to accomplish traditional tasks that could pay benefits down the line. “Identify suitable audit engagements where the audit team can experiment using technology to perform manual audit steps. I find that we auditors are afraid to ask ‘what if’ questions during the audit process,” he says. “What if we used technology to test controls pertaining to payments, receipts, payroll, tax, and in other areas?”
The spirit of experimentation and innovation can be contagious. It should also be coupled with the idea that it’s OK to take chances and to fail. “It’s not enough to hire people with technology skill sets, you have to create a culture of innovation,” says Herb Chain, assistant professor and Executive Director of the Center for Executive Education and External Programs of the Tobin College of Business at St. John’s University.
Exploring Advanced Technology
While internal audit doesn’t need to adopt all the latest technologies, team members should have a good working knowledge of the tools available and the technologies their peers are using to innovate their processes. “Even if we are not going to use everything, I need to make sure that my team knows what’s out there,” says Yulia Gurman, executive director of internal audit at Packaging Corp. of America.
Here is a run-down of some of the cutting-edge technologies internal audit departments are either deploying or considering deploying:
Predictive Data Analytics: Internal audit departments are increasingly using predictive analytics, which includes a variety of statistical techniques, such as data mining, predictive modeling, and machine learning, to analyze current and historical facts to make predictions about future or otherwise unknown events.
Robotic Process Automation: RPA is the use of software or other technology to create scripts or “bots” to handle high-volume, repeatable tasks that previously required humans to perform. These tasks can include queries, searches for red flags and outliers, complicated calculations, and maintenance of records and transactions.
Blockchain: Blockchain is an advanced record-keeping system, where records or transactions are stored in a digital ledger and linked in a way, using encryption, which makes them difficult to alter without also creating a record of the changes. They can be used to create a transparent system of records that can be stored in a distributed network. It is often used to keep track of crypto-currency transactions, but is also being applied in new ways, particularly in the banking sector.
Artificial Intelligence: AI, while in its infancy, has the potential to transform internal audit. According to John McCarthy, a Stanford University professor who is often considered the father of AI, it is “the science and engineering of making intelligent machines, especially intelligent computer programs. It is related to the similar task of using computers to understand human intelligence, but AI does not have to confine itself to methods that are biologically observable.”
A study by PwC, “State of the Internal Audit Profession: Moving at the Speed of Innovation,” identified other technologies in use at corporations that internal audit must be versed in, including the Internet of Things (IoT), virtual reality, 3D printing, drones, and augmented reality. “Companies want internal audit to provide advice on how their organization should exploit new technologies and to make recommendations as part of the audit process that push the organization’s technological innovation levels,” the report states. “Internal audit functions can serve in this valuable capacity only if they themselves are innovating.”
The IIA’s Chambers has encouraged internal auditors to improve their tech capabilities and skills for some time. “Corporate boards and executive management that understand technology can improve operations, provide a competitive edge, and influence strategy. Internal auditors must show our stakeholders we can adopt and adapt technology to improve the work we do, as well,” he wrote in a recent blog post.
Yet, progress on advanced technology has been slow. RPA and AI, for example, are working their way into internal audit processes, but at a snail’s pace. Just 19 percent of internal audit shops report using RPA and just 17 percent say they use some form of AI, according to Protiviti’s 2019 report, Embracing the Next Generation of Internal Audit. What’s more, no other next-generation technology, including continuous monitoring, agile auditing, and advanced analytics, showed adoption rates of more than 30 percent.
The Battle for Talent
The third broad area where internal audit needs to improve is acquiring and managing talent and skills among internal audit staffers.
Several studies have pointed recently to a shortage of skilled internal auditors. Some commentators have even referred to the difficulty organizations are having filling job openings and the competition for capable internal auditors as a “war for talent.” That means it’s more important than ever to have a robust recruiting and retention program for internal audit to keep star performers from leaving for other jobs. It’s also important to hire the right candidates and communicate with them well so that the organization and the internal auditors they hire are both on the same page.
It is important to communicate with the team what the strategy is and why you make the hiring decisions you make. “You need to communicate your skill needs to the team. And if you go outside for a new hire, they need to know why,” says Jonathan Ngah, a principal and internal audit director at consulting firm Synergy Integration Advisors. “You can prevent turnover if members of the team understand why they were passed over.”
Another strategy is to pursue a more diverse pool of candidates for internal audit jobs. Internal audit recruiters are considering candidates outside the more traditional areas, such as CPAs and Big Four employees. They are looking for candidates with technology backgrounds, those who have more experience in the business, and those with critical thinking skills. A common refrain among chief audit executives is: “I can always teach someone to audit, but it’s much harder to teach great communication skills, critical thinking, and business knowledge.”
Widening the search for internal audit professionals beyond traditional accounting and finance is certainly a strategy worth exploring. Not only is it a potential solution to the shortage of internal audit talent, but it can also help companies meet the new demands of the function and make internal audit a more valued partner with the business.
Improving on these three fronts is no guarantee that internal audit shops will advance their positions and perceptions in their respective companies, but ignoring them is a recipe for disaster. 
Joseph McCafferty is editor & publisher of Internal Audit 360°