Faced with a complex regulatory environment, new technologies, cybersecurity challenges, and an ongoing shortage of talent, today’s internal audit leaders are as swamped as any CFO.

Much like the finance chief, today’s internal auditors have also seen their traditional roles morph away from just crunching numbers to being asked a key question: “What’s coming next?” said Andrew Struthers-Kennedy, global leader of Protiviti’s internal audit and financial advisory practice.  

Protiviti released its 20th annual “Internal Auditing Around the World” report in late July. The report utilized artificial intelligence to delve into the 19 past reports in its audit series and identified six major trends that have impacted the internal audit space over the past two decades, according to a press release.  

Becoming a strategic advisor was a top change, together with higher engagement from the board, becoming a catalyst of change and a deliverer of value. The report also identified diversity of talent and technology and data enablement as noteworthy trends.

“Tell us what we need to be thinking about how we are performing,” Struthers-Kennedy said of what is being asked of audit leaders, together in an interview with Chris Wright, global leader for business performance improvement at Protiviti, a consulting firm based in Menlo Park, California. “How is our performance helping align to and drive the strategic priorities that we've established for the organization, the business drivers that we've determined to be supportive of that strategy?”

Retrospective to prospective audit  

The changing role of the finance function to a strategy driver has been ongoing for several years, impacted by a number of catalysts. For audit leaders, this shift can roughly be traced back to the passing of the Sarbanes-Oxley Act in 2002, which “shifted and pivoted the focus of many internal audit teams on that fairly narrow — critical, but narrow — portion of a company's broad risk profile, financial integrity, financial reporting,” Struthers-Kennedy said.

While internal audit may not hold sole responsibility for SOX compliance in an organization, the act sparked an evolution for internal audit’s position in a business from “retrospective compliance reviews and oversight activities, to more prospective advisory and performance-based reviews, that are focused on providing insight and even foresight,” he said.

“Chief auditors can orient their teams to provide robust. real time assurance in sort of a ride along, or ride with capacity, which I would say is very differentiated from what we might have seen a decade, certainly 20 years ago,” Struthers-Kennedy said.

As the role of internal audit changes, its relationship with the CFO is also shifting. To understand how the two functions must work together in today’s environment, it’s important to note that the CFOs’ world is “ one of ‘and’ statements, never ‘or,” Wright said.

CFOs and internal audit leaders need to collaborate on everything from non-GAAP reporting, cyber risk management, and non-financial reporting areas such as ESG reporting, “which carries with it not only stakeholder demands but regulatory constructs,” he said.

“We see that point of inflection between CFO and internal auditor increasing around those areas, but at the same time still having to do some of the basic blocking and tackling,” Wright said.

Driving transformation  

While the organizational structure differs depending on the business, there’s “often an operational reporting line, or at least a dotted line to the finance organization” from the audit leader, Wright said.

A close collaboration between the two functions is especially key as finance faces notable pressures, including ongoing talent and skill shortages and the growing potential impact of new technologies such as artificial intelligence. Finding tech-savvy audit talent is a top priority for finance leaders, as “new technologies invariably will morph the entire internal audit workforce,” the Institute of Internal Auditors said in a report previously cited by CFO Dive.

Today, “you’re not just an accountant, you're not just an auditor, you're also a data scientist,” Wright said. For CFOs, that means a strong working relationship with audit is essential to be able to effectively tap the technologies they need to keep pace with their competition.

Take something as deceptively routine as an Enterprise Resource Management system implementation, for example, Wright said. Historically, audit might have come into such a project at the end, conducting a post-implementation review or checking on data migration. However, going through that process in the typical way means the CFO needs to allocate time and team members to oversee the project, limiting the resources they have available for day-to-day functions.

Bringing audit in at the start instead means that finance chiefs can have deeper insights throughout the process, allowing them to respond to bugs and apply fixes in real-time. This is “one way of using the business insights that the chief audit executives are getting from their increased profile,” Wright said.