​Internal Audit's Technology Challenge Is No Easy Road

​I often refer to the end of the first quarter as "whitepaper season" for the internal audit profession. Typically starting in late February and into March, several key players in the profession publish reports that offer a glimpse into how we're doing.

Two recently released reports should raise serious concerns about internal audit's slow progress in adopting and adapting technology to execute its responsibilities: Protiviti's Internal Audit Capabilities and Needs survey, Embracing the Next Generation of Internal Auditing; and PwC's State of the Internal Audit Profession report, Elevating Internal Audit's Role: The Digitally Fit Function.
 
Protiviti's report indicates that three out of four internal audit groups are undertaking some form of innovation or transformation, but most are only beginning that journey. What's more, a significant number of functions have yet to get started. Worse yet, "Less than one in three internal audit functions currently have a roadmap in place to guide their innovation and transformation journeys," according to the Protiviti report.

Internal audit's efforts to become "digitally fit," as described in PwC's report, are equally uninspiring. For the purposes of the report, PwC defines digital fitness in two important components. First, the function has in place the skills and competencies to provide strategic advice to stakeholders and to provide assurance with regard to risks from the organization's digital transformation. Second, the function is changing its own processes and services so as to become more data driven and digitally enabled.

While the PwC report finds 19 percent of internal audit functions are digitally fit, and another 27 percent are taking definitive steps toward digital fitness, 54 percent are described as beginners who are just starting relevant activities or planning them "in far more ad hoc ways."

This is particularly troubling when one considers how long the profession has been talking about updating and transforming its processes. My message to attendees of The IIA's General Audit Management conference in March addressed many of the same themes. In my presentation, Auditing at the Speed of Risk, I lamented the profession's low adoption rates of next generation technology, reliance on weak approaches to identifying emerging and atypical risks, and minimal changes in decades-old audit processes.
What is needed is transformational change, which was the theme of The IIA's 2018 Pulse of Internal Audit. The Internal Audit Transformation Imperative urged practitioners to embrace agility, innovate, raise the level of talent, and engage more closely with boards. The closing words of the report are as relevant and urgent today as ever:

Internal audit's progress over the past, and the successes accomplished, will not be enough to carry the profession forward. Current times require changes in mindset and actions from all internal auditors. Complacency will lead to irrelevance, but decisive moves by CAEs will propel internal audit forward through the transformation required.
I don't wish to be an alarmist, but stakeholders are demanding more from internal audit. Reports such as the ones from Protiviti and PwC suggest we are not ready to meet those demands.

I debated whether to use a crossroads analogy to hammer home this message. At first I thought it a bit cliché. Every crisis doesn't have to be a choice of one path or another. But in this case a slight modification to the crossroads discussion offers an important added level of clarity and urgency.

Most people envision a crossroads as intersecting roads that offer alternatives on which way to go. But that vision is typically two-dimensional, like the x- and y-axes on a quadrant graph. The reality is that there is a third dimension.

In this case, the z-axis offers a measure of how steep the journey toward digital fitness has become. Until we commit as a profession to innovate our approaches, update stale and slow processes, and embrace technology, the grade will get steeper with each passing day. The other direction on the z-axis provides an easier road. Of course, that road is all downhill, which is a direction we can't afford to go.

As always, I look forward to your comments.