In today’s rapidly changing business landscape, the role of internal auditors is evolving to meet the demands of a dynamic environment. This shift is driven by several critical factors that shape the future of internal audit.
In this short read, we will explore the PwC Global Internal Audit Study 2023 - Seeing through walls to find new horizons. For more than a decade, PwC has conducted global surveys with Internal Audit (IA) leaders and their stakeholders. The 2023 survey was the largest ever. It captures views from 4,680 IA leaders (41%), board members and executives in the business (37%), second-line risk (11%) and compliance (11%) leaders. It covers 81 countries across a wide range of industries. The short read will also refer to the PwC’s 26th Annual CEO Survey to draw a connection between the opinions of the CEOs and the findings identified in the PwC Global Internal Audit Study 2023 (‘The survey’).
Below are the five key findings that the survey highlighted:
- 1. Megatrends are creating a complex and interconnected risk multiverse.
- 2. IA needs more involvement in strategic areas to remain relevant
- 3. Internal Auditor can be a unifying force
- 4. IA’s human ‘superpowers’ are more important than ever
- 5. Internal Auditors can boost their RoI by changing their approach to technology
1. Megatrends are creating a complex and interconnected risk multiverse.
Megatrends are significant, transformative forces that impact the global economy and society. They range from technological advancements and climate change to demographic shifts and geopolitical tensions. These megatrends create a complex and interconnected risk multiverse that organisations must navigate.
PwC’s 26th Annual CEO Survey found that nearly 40% of global CEOs do not think their organisations will be economically viable in ten years if they continue with their current strategy.
Megatrends can disrupt businesses, affecting their operations, finances, and reputation. To succeed in this new reality, organisations will need different approaches, skills, and technology. For IA, it means they are needed more than ever. The survey showed respondents ranked IA’s top attributes as its (1) risk and controls mindset, (2) independence and objectivity, and (3) business knowledge and experience. Enhanced by IA’s organisational reach, this unique combination makes IA ideally placed to help organisations connect the dots and navigate risk and complexity.
2. IA needs more involvement in strategic areas to remain relevant
PwC’s Global CEO Survey asked CEOs what they consider to be the top threats to their business. Inflation and macroeconomic volatility topped the list. The Global IA Survey shows, however, that nearly 50% of IA functions are not addressing these two top threats in their audit plan, and one in 10 have no plans to do so at all. Just 6% said their IA plans are addressing the full spectrum of threats.
The survey shows that many business leaders want more strategic engagement with IA early and proactively with 68% wanting IA to be involved during the risk identification and assessment stage and over 50% seeking IA involvement in management strategy and planning.
Internal auditors must expand their scope beyond traditional audits. They should become strategic partners, providing insights into the organisation's strategic goals, risks, and opportunities. This shift requires a more holistic approach to auditing, focusing on value creation rather than mere rule adherence.
Internal auditors bring an independent, objective perspective to strategic discussions, enhancing decision-making and ensuring alignment with objectives.
3. Internal Auditor can be a unifying force
Risks are not always easy to see—they can sometimes be too big (e.g. geopolitical, macro-economic) or buried in complex and multi-layered technical areas (e.g. regulatory, cyber).
IA’s unique vantage point and risk mindset means that it can ‘see through the walls of the organisation’ and shine a light on areas others may not see. It cannot, however, see everything, all of the time. In many organisations, expertise is distributed across various departments and teams. Internal auditors can act as unifying forces, bridging gaps and facilitating collaboration.
Traditionally, IA functions have relied on guest auditors or co-sourcing to bring in the required expertise and, whilst this is still necessary to reinforce IA’s capabilities, IA needs to also be confident that nothing is missed at an organisational level.
The survey showed that organisations have at least five second-line functions on average with which to collaborate, and most have strengthened their capabilities and ‘levelled up’ over the last three years. The strengthening of the second line represents an opportunity for IA to harness these skills and maximise the power of combining different capabilities; however, there is work to do: just over half (52%) of IA functions show strong alignment with the first and second line on key risks and problems.
Collaboration with other stakeholders will allow IA and others to achieve a ‘multiplier effect’—adding up to better risk coverage, greater efficiency, and more valuable insights.
4. IA’s human ‘superpowers’ are more important than ever
Despite the growing reliance on technology, the human touch remains irreplaceable. Internal auditors possess "superpowers" such as critical thinking, communication, and empathy. These qualities enable them to interpret data, build relationships, and help others see risk differently.
One CAE interviewed indicated that two of the most important strengths an internal auditor can have is the ability to effectively relate to people in one-on-one meetings and to turn interviews into conversations rather than interrogations.
The survey found that a smaller portion of executives ranked strategic thinking (19%) and ability to challenge constructively (23%) as key strengths of IA. As the scale and complexity vary, IA will need human skills to have meaningful and strategic conversations with its stakeholders.
5. Internal Auditors can boost their RoI by changing their approach to technology
IA’s greatest use of technology and data has been for risk assessment activities, audit planning, and continuous monitoring. Some have made great strides in integrating data into IA processes, and are seeing the benefits. Conversely, nearly a third of IA leaders report they are not using data and technology to a great extent in any area, including scoping or testing activities in individual audits.
The advancement of AI is also redefining what is possible for organisations, business functions and individuals. IA leaders have discussed the potential value of automation and AI for years, yet 52% of executives, inclusive of IA leaders, say that IA has not invested in AI and has no plans to do so in the next three years.
There could be various reasons for this. It could be fatigue from other technology investments, or it may be that IA leaders just don’t know how or where to get started.
No one knows for sure where AI will lead, but many have an educated view, and IA needs to be at the forefront of that thinking. The resources available to IA functions vary significantly, but there is still an opportunity—or even a necessity—to make forward strides in embedding technology through all that IA does.
Staying Relevant
Just as CEOs recognise the imperative to keep their strategy and business model viable, IA must continually evolve and remain relevant.
When Pioneers look at risk and change, they see opportunity; when they look at complexity, they see a path forward that avoids hazards and gives the organisation confidence to speed up. The survey affirms that high-performing IA functions are driving broader business outcomes and more value than ever before. Executives agree that stronger governance and risk awareness (42%), and more robust and efficient internal controls (with fewer failures) (39%), are outcomes that result from high-performing IA functions.
Contact us
