Innovation of Internal Audit: 2 years on. Where are we now?

Over 2 years ago now, I wrote a blog about Internal Audit innovation, or rather the lack thereof. Brief summary: the world is changing at a very fast pace. Apart from geopolitical developments, the changes are mainly driven by technical developments, such as quantum computing, flash channel technology etc. That these developments are determining business models and therefore Internal Audit, is obvious. But what is the right response of Internal Audit to all these developments? How can the profession keep up and remain relevant? What is our profession doing about it and what role does the professional association IIA play?

At the time, in my search for answers, I found myself asking even more questions. Is data analysis still innovative, or will there soon be an Artificial Intelligence tool where you enter your data, the tool itself then involves external databases (the weather, traffic, etc.) and comes up with conclusions that we as auditors could not have imagined? Why is there actually still a separate RE and RO course (albeit with a shared first year)? The disruptive companies like TESLA, Google and Spotify have an Internal Audit function, but looking at some open audit vacancies at these companies, you mainly see the term SOx: will we soon only have a right to exist because of legislation? Given the urgency (which as far as I'm concerned was there), I argued at the time for a "delta works plan" within the IIA that would start keeping the profession future-proof. 

First of all, developments. 2 years on, we can certainly say that the world has changed greatly, the impact of Corona is an obvious one. Technological developments seem to be accelerating (partly because of Corona): online meetings, more online ordering and payment. Companies that were successful before are struggling, and challengers like Picnic are now growing against the odds. Looking at inquiries from our clients, within 2 years the IT auditor and IT risk manager will be in higher demand than the "regular" auditor and risk manager; this applies to both permanent positions and interim positions. Regulators have also clearly shifted their focus to IT.

Then the response to my appeal: fortunately it did not fall on deaf ears. The IIA responded positively and subsequently formed an innovation committee, with a number of enthusiastic volunteers, including myself. The most important developments were identified, including their implications for the audit profession. These were categorized according to the IIA ambition model format. All this was summarized in the innovation platform. For each topic there are moderators and experts who collect and make available as much knowledge on the topics as possible (PS for some topics IIA is still looking for experts). There is also room for discussion. Topics covered include RPA, agile auditing, talent shortage, artificial intelligence & robotics and so on. All this to support audit professionals as much as possible in innovating their departments.

Does this mean that the field is now here and can move with the momentum? Not yet, as far as I'm concerned. There are still many audit departments in the Netherlands that make little progress on the topics mentioned in the innovation platform. Not all developments are (equally) relevant to every internal audit department, but understanding, testing and applying the relevant technological developments is an absolute necessity to remain of value to your organization. Fortunately, I also see more and more bright spots: departments that do put a lot of effort into innovation. Check out the latest AuditMagazine, which covers a number of innovations. There are also more and more audit departments that give more insights and look ahead besides assurance (often looking back), are involved in strategic decisions and have flexible audit calendars with more and more 'exotic' subjects on it. In short: the profession is moving more and more and that is good news.

The work on the committee also got me thinking and prompted me to start writing some handouts on innovation within Internal Audit. The goal is to look at how audit departments have successfully implemented a number of important developments. To inspire other audit departments and provide guidance to audit functions that want to start with the topic in question. Therefore, I would like to make an appeal: if you are currently working within an innovative audit department and would like to share how your department has implemented a specific innovation, I would like to get in touch with you.

In case for some of the innovations mentioned you have no idea what to do with them as an auditor, here is my first tip: take a look at the IIA innovation platform and ask yourself: 'Do the topics mean something to me, are they relevant to my department or organization ... and if so: am I already working on them?' Good luck!

Marc van Heese
Partner ARC People