Blog
/
Audit & Analytics
Jack Leech Image
Jack Leech
Regional VP, GRC EMEA, Diligent

Expert insights: Transforming internal audit for proactive risk management

November 29, 2024
0 min read
internal-audit-project-meeting

As I talk to clients around the globe, I can see and hear that internal audit teams are feeling the heat in today's fast-paced, uncertain business environment. Many are stuck in a reactive rut, constantly playing catch-up with emerging risks and new regulations.

In this environment, internal audit plans are frequently disrupted as new priorities emerge. It can be hard to get strategic engagement when the function wants to look forward, meaning the cycle of reactivity continues.

Steven Brown of Brave Within described this environment as he addressed the ICAEW Internal Audit Conference recently. He remarked that internal audit functions naturally want to be more equipped to deal with the prevailing environment. But this will need work and investment if teams want to move towards offering collaborative insight into sector risk and guidance on the appropriate response.

He underlined the mindset change that is needed to turn uncertainty from “being the enemy to becoming the place where [internal audit] adds value.”

Steve highlighted three areas that ‌internal audit needs to focus on to achieve this:

Placeholder Image

Putting theory into practice at Irwin Mitchell

Irwin Mitchell’s Group Head of Internal Audit, Mark Penlington, followed Steven’s lead and added practical insight into addressing the challenge. He is passionate about engaging internal audit functions as an enabler for business transformation. In a period where every business is embarking on transformation projects, Mark believes that ensuring internal audit is involved at the start is an important factor in long-term success.

Mark advises that internal audit teams focus on building networks within the business, getting people to know who the Internal Audit team is, and presenting services to them. He also emphasises the importance of internal audit developing a strong understanding of the needs of different stakeholders across the business, from CIOs and IT to Sales and Client Services, learning what their objectives are and how they link to the overall strategic objectives of the business.

Mark also advises building connections with risk and compliance teams to gain a strong understanding of the organisational objectives of the business and how internal audit can support its proposed transformation.

Engagement and independence

Ultimately, this allows internal audit teams to be proactively engaged in the transformation process and demonstrate the value they can add. While it is very important that the department retains its independence, Mark says:

“This doesn’t mean you need to be so removed that you can’t sit in and present the internal audit view, especially on key risks around transformation and key controls. The business should be looking to internal audit in an advisory capacity.”

By getting involved in transformation projects from the start, internal audit teams can understand how the project develops over time, and how objectives and roles evolve along the way. This creates a more positive relationship, as Mark notes: “You can deliver the function of holding people to account in a proactive, constructive way, rather than getting to the end of the project and effectively saying ‘you did that wrong!’”

Download our internal audit guide

Learn how to leverage automated systems and data analytics to revolutionise your internal audit team's impact.

Access the guide

Guidance for supporting large-scale transformation

The key to engaging constructively with large-scale projects is to recognise that they take place over a very extended period and are implemented in stages. So, says Mark, “Don’t try to do too much too soon.”

At the start, the team should explore if the transformation is set up for success. Does it have the right governance framework around it with the right people with the right skills in the right roles? Mark noted that the most successful audits he has been involved in centred around establishing if the right skills were in place to support the project.

The team can also provide support around risk identification, such as highlighting security or regulatory risks around technology projects. This helps ensure the right resources are in place to control these risks from the start.

Skills and capabilities for today’s internal auditors

A new landscape demands an evolving skill set to ensure that internal audit becomes a valued contributor to the business. Mark believes the inherent skills that internal auditors can bring to transformation programmes are being curious, building relationships, and understanding risk. Keeping pace with technology implementations is another vital activity for internal auditors.

“Be curious to know what the impact of technology programmes will be on internal audit and the wider organisation.”

By staying up to date on topics such as AI, for example, internal auditors can better advise the business and provide more sophisticated, rounded answers to AI-related questions.

Another key area for developing skills is around data analytics, which has evolved significantly in the last 20 years. Deep expertise is no longer needed, but a working knowledge of what’s possible is highly valuable.

Internal audit as a strategic enabler: From assurance to guidance

Mark encourages internal audit teams to emphasise that they exist to help the business achieve its strategic objectives. Now that – for the large majority of businesses – those objectives depend on transformation, internal audit must show the link between what it provides and how this helps the business achieve its objectives.

If the risk is that the company fails to achieve the required transformation, internal audit can help mitigate this by identifying what might be the blocker – such as a lack of skills, legacy technology, or unsuitable infrastructure. By articulating this and providing context around the threats that link to the strategy, the business can gain a clearer sight of the route to follow.

Mark notes that internal audit typically does a lot of assurance work but, with the right guardrails in place to ensure independence is maintained, it could undertake consulting too, allowing it to demonstrate skills around transformation and showing value.

Steven and Mark’s presentations offered excellent insight into the future of internal audit, and inspiration for the road ahead.

Learn how companies like Irwin Mitchell draw on Diligent solutions to drive internal audit performance; find out more here.

security

Your Data Matters

At our core, transparency is key. We prioritize your privacy by providing clear information about your rights and facilitating their exercise. You're in control, with the option to manage your preferences and the extent of information shared with us and our partners.

© 2025 Diligent Corporation. All rights reserved.