Internal audit has certainly been through a tumultuous few years. At the beginning of 2020, we were barely talking about artificial intelligence and inflation. A global pandemic that would paralyze much of the corporate world for years was unthinkable. And new wars in Europe and the Middle East would have been considered unlikely. Fast forward to late 2023 and all of these things are on the table, along with accelerating climate change, other geopolitical tensions, and economic uncertainty, not to mention polarizing political and social strife here at home.
It was a Greek philosopher who is credited with the phrase, “the only constant is change,” so the idea of increasing upheaval is hardly new. But you would have to be living on a remote island not to notice that the pace of change has hit light speed. The risks our organizations are preparing for today will be different than those that threaten them tomorrow. And nobody expects that break-neck pace to slow anytime soon.
To keep up, internal audit departments have to be nimbler than ever before. Internal audit has traditionally been an observer of past events and reported on what went wrong to prevent it from happening again—commonly referred to as applying hindsight. As much as some malign internal audit for looking in the rear-view mirror, there is a benefit to it. More than ever, though, internal audit must also provide insight into what is happening in the present and what may happen in the future. Audit leaders will need to be more proactive than reactive and better at adapting to change.
It’s not just the world around internal audit that is changing, the profession is changing rapidly too. Internal audit has moved well beyond financial controls testing and company leaders are asking for assurance on areas as diverse as social media, incentive pay, and corporate culture. New tools and platforms are available that are also changing the nature of the job, while advanced data analytics has moved to the center, pushing internal audit leaders to be technologists, data scientists, futurists, and more.
So how will internal audit leaders need to change to be able to take on the challenges of the future?
Even if we can’t precisely predict the future there are some characteristics that will enable internal audit leaders of the future to be more proactive and better at managing change. Our crystal ball tells us that internal audit leaders of the future will need to have certain talents. So, what are the characteristics of the internal audit leaders of the future? … Let’s dive in.
As noted executive coach Mark C. Thompson says, “You can’t scale an organization any faster than you can scale yourself.” And, by extension, you can’t scale your internal audit function any faster than you, as the leader, can scale yourself to the dynamics of the future.
1
Ability to Think Strategically
Senior executives sometimes view internal auditors more as tacticians with their heads down, working on the tasks needed to complete the audit plan, rather than strategists. They often excel at process and project management.
Those skills will still be needed, of course, but internal audit leaders of the future will also have to be expert strategists. They will need to anticipate where things are going and be able to fine tune the audit plan in real time. The world is changing too fast to spend a long time on creating a plan and then closing the door and working on achieving it. Audit leaders must understand the organization’s strategy, the industry, and the competitive landscape as well as any senior executive, and, most importantly, how those things are likely to change in the not-too-distant future.
Good chess players can see the board three or four moves ahead and are always revising their strategy as the game does or doesn’t play out the way they expect it to. Internal audit leaders of the future will have to be able to do the same.
2
Technology Acumen
Long gone are the days where internal audit leaders could delegate technology to one or more IT auditors. Each chief audit executive (CAE) must advance their technology knowledge every single day. Many companies might be selling goods and services, but they are run on technology and are, arguably, technology companies that happen to sell goods and services. But that’s now. What about the future? Could the digital age give way to the AI age?
If they don’t already, CAEs of the future will have to have a command of technology such that they can sustain a conversation with the CIO, CTO, CISO, and others, and all of these C-suite titled individual’s direct reports, and be viewed as a competent peer. Technology is no longer a side part of the job, but it drives everything: technology strategy, technology deployment, and key threats, risks, and controls that govern and secure the company’s systems. You may not be with them lock step, but you can’t be too far behind, or you will be left out of the conversation. Given that technology’s role in the business world continues to evolve, being left out of the conversation would be wholly unacceptable.
Now, before we leave the topic of technology, don’t forget that you need to be the one, as a leader, to drive the technology strategy and lead the technology adoption in your own internal audit function. You have to be able to present a convincing argument about not only how the technology to be adopted in the internal audit function will accelerate both efficiency and effectiveness (so that its funding is in your budget), but you also need to know how to interview candidates and third-party providers who are bringing technology skills to your team in furtherance of your audit plan (and all those technology projects that should be populating it).
Make no mistake, AI will be an important part of the discussion, regardless of industry or region. Get up to speed on it now! It’s been said that AI is going to take the jobs of internal auditors. There may or may not be some truth to that. But what is clear is that the internal auditor who knows how to leverage AI will take the job of an internal auditor who does not!
3
A Contortionist’s Flexibility
Thought leaders, the C-suite, and consulting firms have been sounding the alarm for years now: get nimble and agile or get left behind! Rightfully so, if we can’t react to what is going on around us and change quickly, we become less relevant.
Agile audit has been a constant drumbeat, and not just adopting principles of Agile, but also just being able to adjust rapidly to a changing business environment. As a leader, you must demonstrate your ability to pivot to changing circumstances, immediately, and not freak out about it, so that your staff will learn from your nimble confidence and want to follow you. You must set the tone that change, continuous change, will be the norm, and that it is a good thing. Hence, we truly believe that being a master contortionist, which is more than being nimble or displaying agility, will be a requisite characteristic of an internal audit leader of the future.
4
Remote Communication Skills
Some people have taken to remote work better than others, setting personal preferences aside. Regardless of where you physically perform your job responsibilities, though, you and your team will be interacting with each other (and the rest of the organization) more frequently via electronic means regardless of the company’s remote work policy. When we are working individually, with our heads down and concentrating on the task at hand, the physical location may not matter for most. However, some people are better at developing interpersonal connections and establishing and sustaining relationships remotely than others.
The internal audit leader of the future must be savvy enough to manage a distributed work force, when it will not be unheard of where you hire, interact with, manage, evaluate, and part ways with an employee without ever spending a lot of time in the same physical space. And, as well, you may have little to no relationship-building moments with audit clients over coffee, lunch, or at the proverbial water cooler. Like it or not, the world is more digitized, and the internal audit leader of the future must be just as good at connecting remotely as advancing relationships in person.
Those internal audit leaders who find that they cannot effectively manage a remote workforce and cannot seamlessly develop, grow, and sustain stakeholder and audit client relationships remotely will, sad to say, begin to start failing at the job. You must be, as an internal audit leader, excellent at remote working, remote leading, and remote relationship building. No way around it.
5
Prescience
The term “prescience” means the ability to predict the future with some level of certainty. Well, that is beyond anyone’s consistently reliable ability. But, in this context, let’s go with the looser definition that is the ability to anticipate what might happen in the future and use that insight to inform what you do today.
Why is prescience so important for internal audit leaders, especially in the future? Well, change is happening at an unprecedented pace. So, we have a choice: wait around for events to unfold and play catch-up or try to better anticipate what’s coming and prepare for it. Our ability to anticipate, at a level equal to or better than much of the C-suite in our organizations, will do a number of things for us: increase our visibility, elevate our profile, position us to be true advisors, and give us the insights necessary to anticipate changes to the dynamic risk profile so that we can position our internal audit resources to where they will be needed most. The often-used quote from hockey great Wayne Gretzky, “Skate to where the puck is going to be, not where it has been,” has never been more relevant.
You may ask, “how can I be better at being more prescient?” It starts with having a strategic mindset (see “Ability to Think Strategically” above), having a strong appreciation of the dynamics of the business sector in which your company operates, paying close attention to domestic and world events, and having conversations with others within and outside your organization who have a broad worldview. You are not going to be a prescient internal audit leader if your head is always down managing the day-to-day of the internal audit function. You need to take the time to digest the many events around you, listen to and make sense of the noise, see the big picture and the trends emanating, and distill them down to actionable insights.
6
Ability to Build Bridges
Let’s face it, internal audit starts out at a disadvantage when it comes to collaboration, which can affect our ability to earn a reputation as a trusted advisor. We all know why. It’s not that people don’t trust us, per se, but they are wary of our motivations. Others in the organization may not know what internal is (or why it exists), they may have a history with internal auditors who lived up to all the bad stereotypes we try so hard to dispel, or they may fear a negative impact on compensation if they get a bad audit report. Yet, we must still strive to be a collaborative, trusted advisor.
As second line functions grow in importance and impact, they will also be competing with internal audit for scarce resources, as well as wanting their own “face time” with the board and audit committee. We could wait around for these emerging governance, risk, and control functions to reach out to us, or we could be proactive and reach out to them. You say, wait a minute, I do that now. Well, if we don’t amp up our efforts to reach out to these functions, and work hard at coordinating our efforts and keeping the ultimate stakeholder (the board) in mind, we could all end up being marginalized.
You will be richly rewarded, and enjoy the job a lot more, if you are someone who is great at collaboration and sustaining key relationships. So, roll up your sleeves, it’s time for collaboration on steroids … you’ll need to be a master bridge builder.
7
Executive Know How
To be able to have the stature in any organization that can directly impact how the organization successfully governs itself, there can be no executive “go-betweens” in the future. Ideally, the internal audit leader will be called a Chief Audit Executive or Chief Audit Officer (something befitting a member of the C-suite) and report administratively to the Chief Executive Officer. But titles and reporting lines are only a reflection of stature, and not true stature. For internal audit to be impactful as the aspirational trusted advisor it knows it should and wants to be, its leader must not only carry the title, but work as an executive on par with others in the C-suite. And that only happens when you deserve to be treated that way … and to be treated that way requires the executive presence, knowledge, savvy, and acumen where all other executives view internal audit’s leader as a peer. Anything less and internal audit will be an afterthought in the organization of the future, regardless of actual title.
Many internal audit leaders may have the requisite executive presence to hold their own in leadership meetings and those with the board and audit committee, but that is likely because they are good at being an internal audit professional. In the future they will have to also be an excellent executive, period.
Unprecedented Pace of Change
The word “unprecedented” has become so common, it is losing its meaning. But, in the absence of a better word, we are in unprecedented times, with an unprecedented pace of change, and on the cusp of unprecedented breakthroughs that will permeate everything we do, and especially our jobs.
The skills and characteristics that internal audit leaders needed in the past will be different than those they will need to excel at to lead the internal audit function of the future. We tried to distill our views on what internal audit leaders need to be great at, the key competencies, if they are going to continue to serve their organizations and their staffs in a way that truly makes a difference.
As Buzz Lightyear from the movie Toy Story says, “to infinity and beyond.” 
Hal Garyn is managing director and owner of Audit Executive Advisory Services, LLC based in FL.
Joseph McCafferty is editor and publisher of Internal Audit 360°.
Great insights and learnings