Skip to Content

The Forward Looking Auditor

Articles The IIA, Sandy Pundmann, Shawn Stewart Mar 07, 2019

Foresight is a skill internal auditors need to master in today's disruptive business environment.

Why is it so important for internal auditors to add foresight to their job description?

Stewart Disruptive technologies and the trends impacting business are expected to intensify in coming years, making markets even more dynamic, competitive, and opportunistic. Successful organizations will need to be agile and accelerate their decision-making in an environment where prolonged periods of rapid change will be the new norm. Internal audit will have an opportunity to help management better evaluate its preparedness to deal with future events and the “what if” scenarios that will most likely impact the business. If successful, internal auditors have an opportunity to inform and shape the critical decisions that their management teams must make. The reality is that most professions — internal audit included — are about to go through tremendous change. Many internal audit functions will need to transform themselves to provide foresight and serve in this new capacity. The real question is whether those currently in the profession will recognize the opportunity, prepare themselves, and rise to the occasion or whether the transformation will be led by an influx of new talent who may be viewed as more equipped to embrace change. I suppose it will be a combination of both, and each of us will decide our future to the extent we are willing and prepared to embrace change.

Pundmann The No. 1 thing I hear from key internal audit stakeholders — namely, chief financial officers, audit committee chairs, and CEOs — is they need new chief audit executives (CAEs) to come into their roles ready to not only provide assurance, but also to advise and anticipate risks. Internal audit must be proactive. That said, assurance activities are critical, and we’re seeing more capabilities like automated assurance help internal audit do block-and-tackle analyses of control effectiveness. Taking those learnings, analyzing them, and using them to identify risks before things actually happen is what sets standout, forward-thinking internal auditors and CAEs apart from the rest.

How can providing foresight help the organization compete?

Pundmann It’s important for internal auditors to take what they’re seeing from a historical perspective and apply it to the future of the organization. If they can identify an emerging risk or trend early and communicate that insight to stakeholders, they can help the business gain competitive advantage. Whether an organization is launching a new product or service or implementing a new technology system, internal auditors should be involved early to assure appropriate steps are taken, anticipate risks, and advise on controls and processes. Things change so fast — it’s important to ensure necessary capabilities and controls are built into major efforts long before launch time, and the organization maintains a regular pulse throughout the planning.

​On the Horizon

Pundmann and Stewart say internal audit should be aware of, and ready to address, several emerging risks, including:

  • Cybersecurity
  • Data and cognitive analytics
  • Artificial Intelligence
  • Robotic process automation
  • Blockchain
  • Culture
  • Third-party
  • The rapidly changing strategies of competitors
  • Threats from alternative products and innovative business models
  • Generational and social trends
  • Climate change
  • Geopolitical changes
  • Government intervention and regulation
  • Competition for investment dollars
  • Fierce competition for talent

Stewart In the future, the success of an organization may be determined more often by an ability to anticipate change, to make the right decision within a compressed time frame, and to execute ahead of the competition. An ability to quickly contemplate the potential risks and benefits of multiple “what if” scenarios will become key to effective decision-making and execution. Internal audit has an opportunity to transition from its past of monitoring historic transactions and controls through more recent efforts to establish continuous monitoring where errors or deficiencies can be quickly corrected, toward a future of what might be termed predictive monitoring, theoretical monitoring, or simply forward-looking assessments, where outcomes can be anticipated, competing ROIs validated, and changes made proactively to enhance execution and improve outcomes. Those organizations that make the best decisions and execute on those decisions in this new paradigm will have an advantage over their competition.

What can internal auditors do to shift to a focus on foresight?

Stewart Internal audit professionals must become more aware of, and educated on, business trends, disruptive technologies, the movements of competitors, and alternatives and must be able to anticipate forward-looking risks. This will require greater industry perspective, stronger interactions between internal audit and the business, greater leverage of subject-matter experts, and advanced risk identification techniques. Internal audit must shift from the traditional and conventional to being more strategic and focused on what might impede the organization’s most important business objectives.

Pundmann Technology can help a lot. In the future, most internal audit functions will tap risk sensing, predictive analytics, robotic process automation, cognitive computing, machine learning, and — someday — artificial intelligence to help them look to risks and opportunities on the horizon.

What is the risk if internal audit doesn’t provide forward-looking assessments?

Pundmann Internal auditors who don’t offer forward-looking insights may diminish their relevance and their level of impact and influence within the organization. Internal auditors need to be proactive and anticipatory to help their companies gain and maintain competitive advantage. New technologies can help give internal auditors broader and deeper views into the risks they help manage, helping them deliver both insight and foresight.

Stewart An ability to adequately and quickly contemplate the potential risks, benefits, and capabilities of the organization to achieve its objectives for multiple “what if” future scenarios will become so important in decision-making that a failure to have this foresight will not be an option for most organizations. This will be particularly true for areas deemed to be most critical to the organization’s success. Management and audit committees will see value in the objective perspective in forward-looking assessments that internal auditors can provide and will seek to transform internal audit functions so they are capable of providing this foresight. Internal audit functions that fail to make this transition likely will find themselves in a less favorable position in the value chain of their organization, will have to deal with an unfavorable contrast to the more advanced internal audit functions of their peers, likely will see more of their budgets and opportunities repurposed to other functions that can support this need, and may ultimately be deemed obsolete and prime to be replaced.


The Institute of Internal Auditors

Sandy Pundmann

CIA, CRMA, CPA, is a retired Deloitte partner and the former leader of the U.S. Internal Audit practice.

Shawn Stewart

Partner and National Controls Advisory Practice Leader, Grant Thornton