Why Is Internal Audit Often a Tech Laggard?

While there are some exceptions, let’s face it: internal audit has typically lagged behind on embracing new technologies.

Rarely are internal audit departments on the cutting edge of implementing such innovations as artificial intelligence, advanced data analytics, data visualization, robotic process automation, and other emerging technologies. But don’t just take my word for it. In a recent global survey by Protiviti, internal audit leaders said that the area in which they have the largest talent and skills gap is in enabling technology, including advanced analytics, automation, machine learning, and artificial intelligence, as well as process mining. Furthermore, when asked if their internal audit departments are currently hosting activities that foster transformation initiatives, 74 percent of chief audit executives (CAEs) in North America replied a resounding, “no.”

So, while internal auditors are often quick to point out where the rest of the organization could benefit from better use of technology, many of them admit they are not innovating in their own departments to the level they should be. In my view, this disconnect might be one of the biggest issues facing the internal audit profession and puts its continued relevance at risk. Many internal audit departments know they need to do a better job on adopting new technologies, but struggle at transformative change.

See also, “Survey: Internal Audit Slow to Adopt Latest Technologies.”

So, why is this the case? Why doesn’t internal audit practice what it preaches when it comes to being at the forefront of technology? And what does internal audit need to do about it as a profession?

“The tighter we cling to an identity, the harder it becomes to grow beyond it.”
– James Clear, “Atomic Habits”

Several Emerging Technologies
Although it’s beyond the scope of this article to discuss exactly what technologies internal audit should be adopting, and no vendor recommendations will be forthcoming in this space, here are just some examples of the types of technologies that a growing percentage of internal audit departments are leveraging or at least beginning to consider:

• Automated Workpapers and Audit Management Software: Ugh! Yes, I run across many internal audit departments that are still relying solely on aging software such as Microsoft Office, including Word and Excel. Clearly these audit functions are not leveraging the power of automated workpaper and audit management packages. Hopefully that is beginning to change. According to the Institute of Internal Auditors’ 2022 Pulse of Internal Audit report, 54 percent of internal audit respondents say they want to invest more on dedicated internal audit management platforms.
• Advanced Data Analytics: As a profession, we have been chasing the data analytics ghost for well over a decade. And while plenty of progress has been made, a common lament among internal audit leaders is that they are still not using data analytics sufficiently in their daily internal audit work. According to the IIA Pulse report, 68 percent of respondents want to invest more in this area.
• Open Issue Tracking: Some organizations—if they are large and complex enough and especially in highly regulated industries—might have open audit issues numbering in the hundreds or even thousands that require follow-up and active tracking. To still be doing this in Excel or a simple Access database is fine, but not very effective or efficient. Automating this process won’t be easy, but the payoff can be massive.
• GRC Tools: Internal audit needs to improve at leveraging tools in the GRC space if for no other reason than to better collaborate with some of the key second-line functions in the organization.
• Robotic Process Automation: OK, maybe a bit more advanced, and only early adopters have gone down this path, but leveraging RPA to automate manual tasks, such as copy and pasting data between applications or reconciling and cross-referencing data, can free up precious resources and staff to do what you most need them to do—think! According to the IIA Pulse report, 34 percent say they want to spend more on RPA.
• Artificial Intelligence: According to many consultants, AI has the potential to transform internal audit in ways that we only dreamed about a few years ago. Despite this potential revolutionizing effect, very few have even begun to experiment with using AI in internal audit. It’s a good bet that in a few years the ability to apply AI could separate the leading internal audit departments from the low performers and also-rans.
• Drones, Robots, and the Metaverse: For a vast majority of internal audit departments, these technologies sit far off on the horizon. Some can’t even imagine how they would begin to use them. But the remote work trend has accelerated such advancements. Some companies, for example, are using drones to audit inventory when they can’t walk through warehouses in person. If you haven’t even thought about how these technologies could be applied to internal audit, you might want to get going on it. Indeed, 31 percent of the Pulse report internal audit respondents say they want to invest in these areas in the coming months and years.

Why Is Internal Audit Behind on Tech Adoption?
Most internal audit leaders know that they simply need to get better at adopting new technologies and acquiring or training a new generation of internal auditors that can apply them. The same Protiviti survey that found a huge skills gap in the ability to enable technology finds that internal audit functions that do innovate expect a high rate of return. When asked how they would rate the return on investment of innovation and transformation activities, more than half (54 percent) said they expected a high or medium return. These internal audit leaders know that failure to innovate will continue to erode their ability to be nimble, timely, and responsive, and they will fail to add value in the organization.

So, what is holding them back? What gets in the way of technology adoption in internal audit? Here are some of the barriers internal audit leaders cite as challenges to doing a better job at adopting emerging technologies. They may sound like excuses to some (and in some cases they may well be) but they are the challenges internal audit needs to overcome if it wants to be a tech leader, rather than a tech laggard.

Don’t Have the Budget
Like many functions, internal audit never really has enough money, time, or resources to get done what it needs to get done. Every internal audit leader can legitimately say that. If some major expenditure is not in the budget, the only time you will likely get to spend non-budgetary dollars on it is when there is some crisis. By that point, though, it is probably too late.

“Investing money is the process of committing resources in a strategic way to accomplish a specific objective.”
― Alan Gotthardt, The Eternity Portfolio

Well, adopting technology is not a crisis. But failure to do so is likely to create a future crisis, just one that will be brewing under the surface until it manifests itself in lost relevance, timeliness, and reduced value.

If you have a well-crafted and broadly embraced strategic plan, and the tactics to achieve your strategic plan are thoroughly understood, then the only battle should be getting enough money in your budget for what you need to do. Keep in mind that the cost of the technology purchase is only the beginning: You also need to be prepared for organizational delays, employee training, vendors that overpromise and underdeliver, downtime for your staff, a steep learning curve, and more. Those all cost time and money and will increase the all-in price tag for innovation.

The good news is that internal audit, in many cases, is gaining more support from senior management and the board when it comes to adopting new technologies. The Protiviti 2022 Next-Generation Internal Audit Survey found that nearly two-thirds (66 percent) of CAEs said that the audit committee showed a medium or high level of interest in internal audit’s plan to undertake innovative and transformative activities.

Don’t Have the Time
We all feel like we never have the time to get done what we need to get done. There is this thing called the “tyranny of the urgent.” Basically, we know what is pressing and those immediate things fill our to-do lists. We tend to focus on the things that feel urgent in the moment: the overdue internal audit report, the scheduling meeting, the next audit planning call, the person standing in our doorway, and many other demands. As the day ends, we do not get to all the things on our to-do lists because of all those urgent items that came up.

“Don’t say you don’t have enough time. You have exactly the same number of hours per day that were given to Helen Keller, Pasteur, Michelangelo, Mother Teresa, Leonardo da Vinci, Thomas Jefferson, and Albert Einstein.”
― H. Jackson Brown Jr.

It can become a Catch-22: we don’t have time to innovate because we need to get done the tasks at hand; and the tasks at hand take up so much time because we didn’t innovate and automate them. It’s a never-ending treadmill. The only answer is to disrupt the vicious cycle. What was important (technology adoption) has to become urgent. Full stop.

Don’t Have the Right People
When they are hiring, internal audit leaders are usually just looking for people who will be great internal audit professionals. They do not think enough about emerging technologies and limit their view to the technology that is needed to perform in the current environment. That is what ends up populating the posted job descriptions for almost all internal audit job openings: what we need now.

That is not a very strategic approach, however. I’ll spare you the worn-out Wayne Gretzky quote, but hire for what you will need in the future, not what you need right now. Some progressive internal audit functions are hiring data analysts and scientists with the expectation that these folks can learn internal auditing along the way, as just an example. I can’t tell you how many times I’ve heard CAEs say: “I can teach someone to audit, but I can’t teach them to be critical thinkers.”

If you have the wrong people to adopt technology, only you can fix that. Hire, train, or seek out third parties to acquire the skills you need to not only execute that risk-based audit plan, but also those intradepartmental continuous improvement initiatives that no doubt should include technology adoption.

Don’t Have the Right Leadership
CAEs, or equivalent audit leaders, cannot execute everything in a hands-on way. Trying to will only result in suboptimization of everything. So, if your CAE is busy with other things or is not best suited to lead a technology adoption within internal audit, that is fine. But then, who will? Who is most suited to do this, and how will they be held accountable for getting it done?

Assuming you have the budget dollars, you have planned the time, and have the right people, the project still needs to be led, and the right person to do this must be chosen. Even if you are leveraging third-party resources, vendors, and others, you need someone internal to the department to lead the effort. And, they need to be held accountable to milestones, to completion, and to continuous improvement. Too many projects fail for lack of the right leadership held to the right accountabilities.

In fact, the Protiviti report mentioned above recommends appointing a transformation champion. “To ensure the next-gen journey stays on course toward the North Star vision, internal audit needs to identify who in the organization will be accountable for the success of the function’s transformation,” the report’s authors write.

Don’t Have Proper Support
Internal audit cannot function on an island. While most of the organization may not really understand what internal audit does or how it does it, they know you are there. Hopefully, you have strong collaborative relationships with all the people in the organization that are critical to internal audit’s success, and they have a full appreciation of the value you add as you go about your work.

Everyone in the organization is competing for their desired share of scarce resources and limited dollars, just like you. What make you so special? If they think their initiatives are more important than yours, you might be at risk of not having or getting the support you need across the organization to implement a major technology initiative.

At every opportunity, help the rest of the leadership in the organization understand what you are trying to accomplish and garner their support even when you do not need it. Internal audit leaders need to convince senior management that when it wins, the whole organization wins. That way, you are investing in a bank of goodwill and collaboration, so that when you do need to make a withdrawal (figuratively and literally) you have the support you need to get what you must get done, including the technology initiatives that you have, hopefully, already socialized throughout the organization and you have the full support you need.

Don’t Have the Right Knowledge on the Team
There is no doubt that advanced technology adoption is not for the faint of heart. It is not cheap and will require a dedicated effort to make sure the investment yields the desired result. A big part of that will demand a knowledge set that the internal audit team may not currently possess but will need to obtain through hiring and training. Not knowing how to do something that still needs to get done is no excuse. If we audited ourselves, we would include a finding with the recommendation to obtain the requisite skills and knowledge to evolve as needed with the necessary changes.

Inertia and Complacency
Many of the above challenges are true barriers to innovation. This one, I dare say, is a true excuse and is the most troubling of them all. If you find yourself, or anyone on your team, saying: “That’s the way we have always done it,” beware, you’ve entered the complacency zone. Another phrase that should bring a cringe to any internal audit leader is: “If it ain’t broke, don’t fix it.”

“Ninety-nine percent of the failures come from people who have the habit of making excuses.”
―George Washington Carver

As much as we know, intuitively and intellectually, that this is not the right answer, we also would not be honest with ourselves if we did not allow a little (or for some, maybe a lot) of inertia and complacency to set in. Things are working fine right now and change initiatives can wait until tomorrow. That is, until they don’t, and now it’s too late to get it fixed.

Do your best to be objective and not let complacency and inertia set in. And quell any inevitable feelings of fear (or at least hesitating trepidation). If you have done a respectable job with your strategic plan and are being appropriately pressed to deliver more and continuously improve, you will be well-insulated from inertia. If not, you might find yourself out of a job in the not-too-distant future. Furthermore, do not hesitate to leverage an upcoming quality assessment review (QAR) as a possible means of support to help get what you need. It’s never been truer of internal audit to say that, “the only constant is change!” If you are not innovating you are falling behind.

What Can Internal Audit Do About It?
Apart from the fixes mentioned above, here is the most important and yet simplest point: Be strategic; do not be tactical. Have a strategic plan for the internal audit function that embraces emerging technologies and innovation. Regardless of the size of your internal audit department, create a process for reviewing the viability and potential of nearly every emerging technology that comes down the pike. Nobody is saying you need to be wearing a virtual-reality headset and directing drones around the office or holding internal audit meetings in the Metaverse, but don’t put your head in the sand either.

Be clear on your mission, and what outcomes are important to achieving your mission strategically. Then be extra hard on your evaluation and assessment of what systems and processes will get you the most success and leverage them to realize these outcomes. I will bet technology adoption will be part of it. Next, go about the task of cost-justifying what you need by talking about how it will make the internal audit function better, how it will allow it to attract better talent, increase throughput, and, ultimately, add more value to the organization. Make the case and tie it to successful execution of your strategic internal audit plan, which should be connected to the company’s strategic plan.

Find or create the budget, make the time, get the right people, be a leader, garner the needed support, and obtain the knowledge you need. Fight inertia, nip complacency in the bud, and be fearless. Your technologically dependent, value added, and relevant future depends on it. Your audit committee will be pleased with your tech-enabled evolution and elevating value.  

Hal Garyn is Managing Director and Owner of Audit Executive Advisory Services, LLC based in FL.