Articles Stefano Comotti, CIA, CRMA Aug 11, 2025
To be leaders in the organization, internal audit must adopt a strategic mindset and become the go-to resource for management.
The challenges and threats to effective risk management, internal control, and sound governance have become increasingly complex, making independent assurance and advice more valuable than ever. Thus, the need for the internal audit profession to reach its full potential has never been greater.
The IIA’s three previous Global Board chairs set the groundwork for the profession to take a great leap forward. Benito Ybarra identified a common purpose with his theme of “One IIA.” Sally-Anne Pitt followed with a call to change perspectives and “Think Different.” Terry Grafenstine most recently encouraged us to “Ask Questions” and be heard. Each theme moved the profession toward an inflection point.
Now, it’s time for internal auditors to take the next step by aggressively and unapologetically positioning themselves as leaders within their organizations. That’s why, as the 2025-2026 global chair, I’ve chosen “Be the Future” as my theme.
The IIA’s Vision 2035 report identifies the factors that will determine whether we can decisively prove our value in the coming decade or watch our relevance and influence fade or be seized by others. Internal audit must shape its future by being proactive and assertive, and providing service that goes beyond traditional audit recommendations and advice.
The Vision 2035 executive summary spells out clearly what the profession must do to thrive in the future (see “The Future in Vision” below). Two sentences in particular lay out the tasks we face and how internal auditors’ existing skills can help them overcome those challenges:
“These core skills provide internal auditors the adaptability and agility to navigate the future successfully. The profession must recognize these strengths, build upon them, and be ready to use them in new business contexts.”
Part of the challenge not articulated in the report is changing the view of who we are. We keep hearing internal auditors say, “We must prove that we add value.” Have you ever heard a chief financial officer or a marketing director say that? No company is wasting money on people they don’t need. So, if you are there, it’s because you are needed.
Once we embrace our vital role in the complex process that is governance, risk, and control, we must learn to effectively communicate not only what we do, but also what we know.
The challenge of doing anything successfully is getting the message across. For internal auditors, it’s all about effectively communicating what we bring to the table.
If I were the CEO of a company, the first person I would want to see in the morning is my CAE, because he or she knows everybody in the group, their managerial value, and their ethics. The CAE knows what is going on and what is the latest buzz.
For internal audit leaders, embracing confident leadership requires adopting a bold and strategic mindset and becoming the go-to person for executive management. This means daring to step outside the comfortable cocoon of assurance and limited advisory services. Internal audit’s immersion into all aspects of governance, risk, and control gives it a holistic view of the organization that few others have. CAEs must assertively share that knowledge.
Any discussion about internal auditors stepping outside of assurance and limited advisory services invariably raises the red flag of independence. But there is a big difference between raising a red flag of caution and a white flag of surrender. Simply stated, independence is not a barrier to becoming assertive and bold — it’s the key.
Ideally, internal audit should be positioned independently of executive management by reporting functionally to the board or audit committee. Its scope of work and position within the organization should grant it unfettered access to information and people.
In return for this extraordinary leeway, internal audit must operate as an honest and unbiased broker that delivers risk management assurance, advice, insight, and foresight to executives and the board. Internal auditors weaken that independence when we shy away from sharing all that we know.
Whenever internal auditors say, “Oh no, I cannot do this. I can only audit the process,” that leads to management saying, “OK, I’ll hire a consultant for that.” We have lost an opportunity, and worse yet, in the eyes of management, we have forfeited the role of an unbiased and honest broker.
The Three Lines Model and the Global Internal Audit Standards provide all the license practitioners need to boldly share what we know. The Three Lines Model clearly states independence does not imply isolation: “There must be regular interaction between the internal audit function and management to ensure internal audit work is relevant and aligned with the strategic and operational needs of the organization.”
Additionally, the Standards defines independence as, “The freedom from conditions that may impair the ability of the internal audit function to carry out internal audit responsibilities in an unbiased manner.” The Standards also requires an internal audit mandate that clearly defines the function’s scope and the types of services it will provide. Neither the definition of independence nor the mandate limits internal audit leaders from sharing what they know.
Finally, it is important not to conflate independence with objectivity. Independence positions internal audit to effectively carry out its mandate. Objectivity relates to how we carry out that mandate in an unbiased and honest way.
We have all heard that internal auditors should develop an “elevator pitch” — a brief description of the audit function’s value proposition. However, communicating our value is more than that. It’s about selling our product.
I know some will find it unseemly — even inappropriate — to think about internal auditors as sales associates. However, there is a significant difference between convincing someone to buy something they may or may not need and educating stakeholders about our knowledge, the scope of our services, and the insights we can provide.
Let me share two real-world examples. The risk descriptions we were posting in my function’s audit reports were too generic. So, we focused more on explaining our reasoning and illustrating our value. We also began including potential consequences of inaction in our risk analysis.
For example, when an audit team discovers there is no contract with a supplier or consultant, it should explain to management the associated risks, including the potential for misunderstanding or litigation with the counterparty. The reaction from management may be, “Oh, this is so formal. You just want the contract because you want the contract.”
In response, internal audit can explain the real risks behind not having a contract: To whom does the intellectual property belong? What happens if we don’t deliver? Who owns the merchandise at a certain point in time? Is there a service level agreement?
So, when I say internal auditors need to become sales associates, I mean we should seize every opportunity to provide executives and the board with insights and context. Share what you know.
However, auditors should be mindful of the context of the industry in which they work. Heavily regulated sectors, such as banking, insurance, and pharmaceuticals, must operate within rules that often dictate processes, aspects of risk mitigation, required reporting, and related assurance.
I’ve presented a course of action that may be difficult for some internal auditors to embrace. Admittedly, it pushes the envelope of what has been the norm for the profession for decades. But the complexity and volatility of today’s risk landscape demands no less.
As Vision 2035 notes, internal auditors have the problem-solving and analytical skills to adapt to the challenges of modern risk management. I am confident we can build new competencies, leverage new technologies, revolutionize our processes, and become more proactive. But those accomplishments will be weakened if we don’t share what we know.
If internal auditors confidently and assertively speak up for our profession, we can take our rightful place among the pillars of risk management. We can “Be the Future” together.
The IIA’s Global Board is focused on implementing all facets of Vision 2035, which highlights five key goals for the internal audit profession to achieve for an optimal future. This is how each goal can help us “Be the Future.”
1. Changing the perception of internal audit. The IIA is addressing this goal on two key levels. The recently updated Competency Framework, built on a career ladder model from entry level auditor to CAE, identifies minimal competencies for each role and includes related assessment tools. An update to the Three Lines Model also is in development, aimed at better reflecting how internal audit operates across all regions and industries.
2. Helping internal auditors embrace technology. The daring internal auditor welcomes innovation. The IIA supports this goal by providing training, benchmarking, and thought leadership on the latest technologies. For example, The Institute’s Artificial Intelligence (AI) Knowledge Center gathers the latest AI-related articles, papers, podcasts, events, guidance, and tools in one place.
3. Aligning internal audit’s work to the organization’s strategic objectives. When internal auditors position ourselves as a go-to resource for executive management, we must thoroughly understand the organization’s strategies and objectives. This must be reflected in our audit priorities and color the advice, insights, and foresight we provide.
4. Helping internal auditors expand their scope to include more advisory services. This goal aligns with our work in supporting the organization’s strategic objectives and sharing our knowledge. While assurance services will always be the bedrock of what we do, providing informed advice will help elevate the profession.
5. Growing our pipeline of talent into the profession. The IIA is reaching out to students and educators to promote awareness about the profession. Part of being a daring internal auditor is networking beyond the confines of our jobs to attract and recruit the next generation of practitioners.