Reimagining the DNA of Internal Audit through technology enablement and AI
The Internal Audit function is ripe for disruption. As risks accelerate in speed, scale and complexity, internal auditors must reinvent their function and teams to protect their core mandate – independent assurance and risk oversight. Dina Fakih and Fady Sameh of Deloitte explore the shifting landscape and how Internal Audit can respond.
In today’s business environment, boards and management continue to grapple with a volatile geo-political backdrop, while organizations navigate risks posed by environmental, social, and governance (ESG) regulations, emerging technologies like Generative AI (Gen AI), and the evolving future of work.
At the same time, digital transformation is significantly reshaping the internal audit landscape. Technologies such as AI and data analytics enable internal audit to deliver timely and comprehensive insights, driving efficiency and effectiveness in risk management.
The critical role of Internal Audit
Resilience and agility have become the key attributes required for organizations to not only survive but also thrive in the current environment. The Internal Audit function has a critical role to play in helping organizations strengthen and maintain these traits by providing objective advice, anticipating risks, and assisting management in accelerating improvements in governance, risk management, and controls.
Insights from recent surveys reveal significant challenges, such as limited empowerment and technological concerns, while also highlighting opportunities for enhanced impact and innovation brought about by Internal Audit function digital transformation: 86% of functions said they are not achieving very strong potential, and only 14% feel they have a very strong impact.
Further, 55% of auditors are not truly empowered to innovate, needing to ask permission or being confined to innovation in noncore areas that don’t challenge the status quo. More than 50% of surveyed CFOs cite impact to risk and internal controls (57%), data infrastructure and technology needs (52%), and investment needs (51%) among their top three concerns regarding Gen AI.
Challenges facing the Internal Audit function
Navigating the complexities of the current internal audit landscape requires addressing several pivotal challenges. Considering the fast-paced technological advancements within different industries, the traditional Internal Audit function faces many challenges that hinder its ability to deliver proactive insights for its stakeholders. Some examples:
Reactive: The current practices of Internal Audit functions are reactive by nature, as they conduct audit assignments that cover activities which have already taken place, often more than a year ago. This significantly limits their ability to provide real-time insights and make meaningful changes to the outcomes of the entity’s operations.
Transactional: Internal Audit functions conduct testing on samples of operations and activities, building reports based on this information. This approach impacts their ability to capture the big picture.
Isolated: The focus of Internal Audit functions to maintain independence can sometimes come at the expense of maintaining partnership, which may lead to being isolated from the overall value chain of the entity.
Impractical: Some Internal Audit functions have been perceived as providing impractical recommendations, which might have a negative effect on the agility of the operations if adopted. This may occur due to the inability of current auditors to understand emerging business practices and risks introduced by the adoption of artificial intelligence (AI), machine learning (ML), and robotic process automation (RPA) tools.
Ineffective reporting and communication: Many Internal Audit functions have yet to adapt their reporting practices to the trends of audience behavior within the past few years. Reports filled with long text paragraphs fail to deliver key messages effectively to an audience with limited time, particularly in today’s fast-paced business world.
The (needed) evolution of internal audit
To stay ahead of the curve, Internal Audit functions must be strategically transformed through continuous adaptation to cope with the ever-changing landscape. Technological advances enable internal audit teams to perform more efficient and comprehensive audits.
By automating routine tasks and seamlessly analyzing vast amounts of data, the Internal Audit function can provide deeper insights into potential risks and areas of improvement, all while reducing the time and resources required to do so.
The technology enablement landscape
Technology has long been embedded in Internal Audit’s DNA, but recent advances – particularly in data and analytics – have significantly expanded the opportunities to enhance insight, efficiency and impact.
1990s to 2000: The early 2000s marked the rise of big data, driven by the proliferation of the internet and digital technologies. Organizations are beginning to recognize and address the challenges associated with large datasets.
2000s to 2010: RPA evolved, a technology that automates repetitive tasks and uses data analytics to make workflows more intelligent. This development led to increased efficiency and accuracy in business processes.
2010 to 2020: The 2010s saw AI make huge strides, emphasized by the development of deep learning algorithms and large language models (LLMs). In 2020, OpenAI introduced its pioneering language model, GPT-3, making it one of the largest and most sophisticated AI models to date.
The journey from early data analytics to advanced Gen AI illustrates the continual expansion of the technology landscape, shaping the business environment and setting the stage for exploring how these technologies can be leveraged in Internal Audit functions.
Equipping internal audit with technologies
Internal Audit functions should harness the use of emerging technology in their day-to-day operations, and fundamentally integrate these technologies into their DNA. In fact, the following opportunities for the use of emerging technologies in the internal audit life cycle may help enhance its overall effectiveness:
- Dynamic risk assessment
ML and predictive analytics can be used to analyze historical data and external risks, identifying high-risk departmental areas and providing real-time insights into emerging risks across the overall entity. - Audit plan development
RPA automates data collection and risk categorization for efficient planning. - Fieldwork and testing
ML and intelligent automation RPA detects anomalies in transactional data and dynamically adjusts audit testing based on risk, improving efficiency and accuracy. - Reporting and follow-up
Gen AI streamlines audit report drafting, generates executive summaries, and customizes communications to the organization’s style.
The AI-enabled internal auditor
Of all technologies, AI is attracting the most attention – and not without reason. It enables auditors to focus on higher-value activities, accelerating the shift from compliance monitoring to strategic advisory. AI is not replacing internal auditors; it is empowering them.
- Continuous compliance monitoring: AI automates policy adherence, ensuring round-the-clock regulatory oversight.
- Enhanced decision-making: AI supports auditors with predictive models and scenario analysis for deeper risk insights.
- Strategic advisory and governance: Auditors leverage AI-driven intelligence to guide leadership on risk mitigation and business strategy.
The Internal Audit transformation journey fundamentally starts on the ground. By addressing key checkpoints – strategy and vision, operating model, governance and frameworks, technology and enablement, and human capital – organizations can create a resilient and future-ready Internal Audit function.
1) Strategy and vision
The process begins with rethinking the strategic vision to ensure alignment with an organization’s goals. This involves creating a new internal audit vision focused on partnership, proactiveness, foresight, and digital initiatives, while fostering a culture of innovation and adaptability.
2) Operating model
Defining and implementing an operating model that seamlessly supports the strategic vision and extends beyond traditional internal audit boundaries.
3) Governance and frameworks
Realigning internal audit governance and frameworks to establish a robust structure for effective oversight.
4) Technology and enablement
Infusing technology into the internal audit cycle is crucial for enhancing capabilities and improving efficiency.
5) Human capital
Elevating human capital by investing in skill development and upskilling the team is necessary to ensure they can understand and leverage new insights. This also involves rethinking roles, shifting from traditional functions to anticipating and managing emerging risks.
Conclusion
In conclusion, the Internal Audit function should not only strive to deliver its expected value but also aim to exceed those expectations. To achieve this, it must embark on a journey to reassess and redefine its core attributes – its very DNA. By taking pragmatic steps to adapt to the changing landscape, internal audit can ensure it not only meets but also surpasses the evolving needs of the entities it serves.
Now is the time to redesign the internal audit DNA and take decisive action to secure its role and effectiveness in this dynamic environment. This transformation will enhance audit capabilities, and position the Internal Audit function as a crucial partner in any organization’s overall strategy and success.
About the authors: Dina Fakih is Partner at Deloitte, where Fady Sameh is a Director.
