PwC’s Global CEO Survey asked CEOs what they consider to be the top threats to their business. Inflation and macroeconomic volatility topped the list. The Global IA Survey shows, however, that nearly 50% of IA functions are not addressing these two top threats in their audit plan, and one in 10 have no plans to do so at all. Just 6% said their IA plans are addressing the full spectrum of threats.

The survey shows that many business leaders want more strategic engagement with IA early and proactively with 68% wanting IA to be involved during the risk identification and assessment stage and over 50% seeking IA involvement in management strategy and planning.

Internal auditors must expand their scope beyond traditional audits. They should become strategic partners, providing insights into the organisation's strategic goals, risks, and opportunities. This shift requires a more holistic approach to auditing, focusing on value creation rather than mere rule adherence.

Internal auditors bring an independent, objective perspective to strategic discussions, enhancing decision-making and ensuring alignment with objectives.

Risks are not always easy to see—they can sometimes be too big (e.g. geopolitical, macro-economic) or buried in complex and multi-layered technical areas (e.g. regulatory, cyber).

IA’s unique vantage point and risk mindset means that it can ‘see through the walls of the organisation’ and shine a light on areas others may not see. It cannot, however, see everything, all of the time. In many organisations, expertise is distributed across various departments and teams. Internal auditors can act as unifying forces, bridging gaps and facilitating collaboration.

Traditionally, IA functions have relied on guest auditors or co-sourcing to bring in the required expertise and, whilst this is still necessary to reinforce IA’s capabilities, IA needs to also be confident that nothing is missed at an organisational level.

The survey showed that organisations have at least five second-line functions on average with which to collaborate, and most have strengthened their capabilities and ‘levelled up’ over the last three years. The strengthening of the second line represents an opportunity for IA to harness these skills and maximise the power of combining different capabilities; however, there is work to do: just over half (52%) of IA functions show strong alignment with the first and second line on key risks and problems.

Collaboration with other stakeholders will allow IA and others to achieve a ‘multiplier effect’—adding up to better risk coverage, greater efficiency, and more valuable insights.

Despite the growing reliance on technology, the human touch remains irreplaceable. Internal auditors possess "superpowers" such as critical thinking, communication, and empathy. These qualities enable them to interpret data, build relationships, and help others see risk differently.

One CAE interviewed indicated that two of the most important strengths an internal auditor can have is the ability to effectively relate to people in one-on-one meetings and to turn interviews into conversations rather than interrogations.

The survey found that a smaller portion of executives ranked strategic thinking (19%) and ability to challenge constructively (23%) as key strengths of IA. As the scale and complexity vary, IA will need human skills to have meaningful and strategic conversations with its stakeholders.

IA’s greatest use of technology and data has been for risk assessment activities, audit planning, and continuous monitoring. Some have made great strides in integrating data into IA processes, and are seeing the benefits. Conversely, nearly a third of IA leaders report they are not using data and technology to a great extent in any area, including scoping or testing activities in individual audits.

The advancement of AI is also redefining what is possible for organisations, business functions and individuals. IA leaders have discussed the potential value of automation and AI for years, yet 52% of executives, inclusive of IA leaders, say that IA has not invested in AI and has no plans to do so in the next three years.

There could be various reasons for this. It could be fatigue from other technology investments, or it may be that IA leaders just don’t know how or where to get started.

No one knows for sure where AI will lead, but many have an educated view, and IA needs to be at the forefront of that thinking. The resources available to IA functions vary significantly, but there is still an opportunity—or even a necessity—to make forward strides in embedding technology through all that IA does.