On the Frontlines: Navigating in a VUCA World

The IIA views itself as a trusted advisor to the board, providing not only hindsight and insight but also foresight. Internal audit’s moment to become relevant as a trusted advisor is now. Only focusing on everyday topics and processes is somewhat inadequate and even risky. If internal audit does not pay attention now, it can become obsolete. If all audit reports have a favorable opinion while the organization is clearly struggling under the influence of external developments, the audit function may have chosen the wrong audit topics.

In the Risk in Focus 2025 list of key risks, macroeconomic and geopolitical uncertainty ranks fifth, according to the CAEs in Europe. Subjectively, this is low, but it may be due to the survey being conducted in the first half of 2024. 

Looking forward, internal audit must ask what audit topics add value in this turbulent world, and where could we place the emphasis?

Risk management. Start with an audit of strategic risk management. To address uncertainties, a strategic risk analysis is indispensable. Internal audit could therefore conduct an audit of strategic risk management within the organization.

Supplier and price uncertainties in procurement. In these uncertain times, it may be questionable whether the supply of certain products and services is guaranteed.

Points of focus include:

• Knowing all strategic purchases.
• Mapping out alternatives.
• Having exit plans to leave a supplier.
• Considering the impact of transport costs on the purchased products.

Inventory. When it comes to inventory, several factors must be considered. Are the necessary strategic inventories known, are they well-monitored, is inventory management looking at new products in development, and is fluctuating market demand being considered? For service providers whose capacity is highly dependent on human resources, different questions apply, such as: Can scaling up or down be done quickly and at what cost? Is specialized expertise needed, and how quickly can it be acquired? 

Locations of production facilities. Given the trade barriers, physical access is becoming increasingly relevant. Access to a production facility in a warzone would be virtually impossible. Consider the following: What criteria are decisive for opening a new production facility — such as access to affordable energy — and are they always applied? How mobile is a production facility (can machines be easily removed), and is there a local market to sell the facility to if necessary? 

Investments in securities. Some organizations, such as insurers, have securities investments related to their primary services. Some companies have them because of a surplus of cash. In a volatile stock market, organizations might consider whether stress tests have been conducted, whether the possible consequences have been discussed in the appropriate forums, how monitoring is done, and if there are dependencies on third parties. Other questions include whether hedging is done, if investments are made with margin calls, and — recalling the collateralized debt obligations of 2008 — if the complexity of the financial product is well understood.

Currency risks. Important points to consider are: What currency risks exist, which are hedged and how, whether currency risk considered in procurement and sales, and if internal guidelines been established for this purpose. 

Investing in other companies through shareholding. Acquiring a significant stake in another company can offer positive benefits. The companies involved might share knowledge, expand markets, and work synergistically rather than competitively. However, this can also lead to additional risks, such if the co-shareholder is based in a questionable country. Details to consider are whether all shareholding agreements are mapped out, whether all co-shareholders are known, whether agreements have been made about the admission of new shareholders, and what the maximum financial impact would be in case of a forced sale.  

Employee safety. With social media, adverse posts about companies can arise very quickly with possible consequences for employees. Has an analysis been done of potential risk areas, including geographical risk areas where employees may be located, the possibility of dangerous customer contact, and visible personnel? Is social media monitored and are relevant employees aware of this?

Depending on the topic and depth of the audit, it may be advisable or necessary to hire an auditor with specific expertise to uncover all relevant risks and to assess control measures. A poorly conducted audit due to a lack of knowledge adds limited value and can damage internal audit’s reputation. 

Of course, internal audit must also remain attentive to the more everyday topics, but a calendar scheduling all processes to be reviewed every three years is no longer sufficient. Audit planning will need to be viewed through a more strategic lens.

The views and opinions expressed in this blog are those of the author and do not necessarily reflect the official policy or position of The Institute of Internal Auditors (The IIA). The IIA does not guarantee the accuracy or originality of the content, nor should it be considered professional advice or authoritative guidance. The content is provided for informational purposes only.