Understanding the IIA's Redefined Global Internal Audit Standards

Earlier this year, the Institute of Internal Auditors (IIA), often considered the voice of the profession—at least in North America, released the results of a significant undertaking: a comprehensive revision of its foundational guidance – the Global Internal Audit Standards (Standards). More than five years in the making and released in January, these updated Standards represent more than just a minor adjustment; they signify a fundamental recalibration of the internal audit profession's role and responsibilities in the modern era. Building upon decades of established principles, the new framework injects a renewed emphasis on strategic alignment, risk focus, value creation, and the imperative of embracing technological innovation. For internal auditors worldwide, these changes are not merely academic; they are a call to action, demanding a re-evaluation of methodologies, skillsets, and even the perception of the internal audit function within their organizations.

Alignment with the Business

At its core, the revised Standards aim to elevate internal audit from a primarily compliance-driven function to a more strategic and value-adding partner. This shift is evident in the increased emphasis on understanding the organization's strategic objectives and aligning audit activities accordingly. Standard 2010, "Planning," now explicitly requires the chief audit executive (CAE) to establish risk-based plans that are consistent with the organization's goals. This necessitates a deeper understanding of the business, its industry, and the broader macroeconomic factors that could impact its success. Internal auditors will need to move beyond simply auditing processes and controls to assessing the risks that truly matter to the achievement of strategic goals.

Understanding Risk Management Principles

Furthermore, the updated Standards underscore the importance of a robust risk assessment process. While risk assessment has always been a cornerstone of internal auditing, the new guidance places a greater emphasis on its continuous nature and its integration with the organization's overall risk management framework. Standard 2060, "Reporting on the Achievement of Objectives," now requires internal auditors to report on significant risks and exposures, including those related to the organization's strategic objectives. This implies a need for internal auditors to possess a broader understanding of risk management principles and methodologies, enabling them to effectively identify, assess, and evaluate the significance of various risks.

Leveraging Technology for Audit

However, perhaps one of the most transformative aspects of the revised Standards lies in its explicit and pervasive integration of technology. Recognizing the profound impact of digital transformation on all facets of business, the IIA has woven technological considerations throughout the entire framework. This is not limited to simply auditing IT systems; it extends to leveraging technology to enhance the efficiency and effectiveness of the audit process itself, particularly in the critical areas of risk discovery and monitoring.

The updated Standard 2201, "Information and Technology," provides specific guidance on the internal auditor's responsibilities related to information and technology risks and controls. This standard acknowledges the increasing reliance on complex technological systems and the inherent risks they pose, including cybersecurity threats, data privacy concerns, and the risks associated with emerging technologies like artificial intelligence (AI) and robotic process automation (RPA). Internal auditors will need to develop a strong understanding of these technologies, their potential impact on the organization, and the controls necessary to mitigate associated risks. This may necessitate acquiring new skills in areas such as data analytics, cybersecurity auditing, and AI governance.

Beyond auditing technology itself, the new Standards strongly encourage internal auditors to embrace technology as a powerful tool for enhancing their own work, particularly in the realm of risk discovery and monitoring. The sheer volume and velocity of data generated by modern organizations present both a challenge and an opportunity for internal audit. Traditional audit methodologies, often relying on manual sampling and retrospective reviews, can struggle to keep pace with the dynamic nature of contemporary risks. This is where technology steps in, offering the potential to revolutionize how internal auditors identify, assess, and monitor risks.

Leveraging Technology for Enhanced Risk Discovery

The revised Standards implicitly and explicitly advocate for the adoption of various technological tools and techniques to improve risk discovery. These include:

• Data Analytics: The ability to analyze large datasets can uncover patterns, anomalies, and trends that might be invisible through traditional sampling methods. By applying data analytics techniques, internal auditors can identify potential areas of heightened risk, such as unusual transaction patterns indicative of fraud, inefficiencies in operational processes, or deviations from established policies. For example, analyzing procurement data across various departments could reveal instances of unauthorized vendors or unusually high spending limits, prompting further investigation.
• Artificial Intelligence (AI) and Machine Learning (ML): AI and ML algorithms can be trained to identify risk indicators and predict potential future risks based on historical data. For instance, in the realm of fraud detection, AI-powered systems can continuously monitor transactions and flag those that exhibit characteristics associated with fraudulent activity, providing real-time alerts to internal auditors.
• Process Mining: This technique involves analyzing event logs to gain insights into how business processes are actually executed. By visualizing and analyzing process flows, internal auditors can identify bottlenecks, inefficiencies, and potential control weaknesses that might not be apparent through traditional process documentation reviews. For example, process mining could reveal instances where segregation of duties is not being properly enforced in a critical financial process.
• Natural Language Processing (NLP): NLP can be used to analyze unstructured data sources, such as emails, customer feedback, and social media posts, to identify emerging risks and sentiment that could impact the organization. For instance, analyzing customer complaints could reveal systemic issues with product quality or service delivery that warrant further audit attention.

Continuous Risk Monitoring through Technology

The new Standards also emphasize the importance of continuous monitoring, a concept that is significantly enabled by technology such as that of Supervizor’s. Rather than relying solely on periodic audits, internal auditors are encouraged to establish mechanisms for ongoing risk assessment and monitoring. Technology plays a crucial role in facilitating this shift:

• Continuous Auditing Tools: These tools automate the monitoring of key controls and transactions in real-time or near real-time. By setting up predefined rules and thresholds, internal auditors can receive alerts whenever deviations or potential issues arise.
• Dashboards and Visualization: Technology allows for the creation of dynamic dashboards that provide a real-time overview of key risk indicators (KRIs) and performance metrics. These visual representations enable internal auditors and management to quickly identify areas of concern and track the effectiveness of risk mitigation efforts.
• Cloud-Based Platforms: Cloud-based audit management software can facilitate collaboration and real-time information sharing among audit teams and stakeholders, enabling more agile and responsive risk monitoring. These platforms often incorporate features for issue tracking, remediation management, and reporting, providing a centralized view of the organization's risk landscape.

Implications for Internal Auditors

The IIA's revised Global Internal Audit Standards represent a significant evolution for the internal audit profession. The increased emphasis on strategic alignment, risk focus, and, crucially, the integration of technology, particularly in risk discovery and monitoring, has profound implications for internal auditors:

• Skill Development: Internal auditors will need to acquire new skills and competencies in areas such as data analytics, AI, cybersecurity, and process mining. Continuous professional development will be essential to keep pace with technological advancements.
• Methodological Adaptation: Traditional audit methodologies will need to evolve to incorporate technology-driven approaches. This may involve adopting agile auditing techniques, leveraging data analytics throughout the audit lifecycle, and implementing continuous monitoring processes.
• Collaboration and Communication: Effective collaboration with IT departments and other business units will be crucial for accessing data and implementing technology-based audit solutions. Strong communication skills will be needed to convey the insights derived from technological analysis to stakeholders.
• Strategic Mindset: Internal auditors will need to develop a more strategic mindset, understanding the organization's business objectives and aligning their work to provide value in achieving those goals. This includes identifying and assessing risks that could significantly impact the organization's success.
• Embracing Innovation: Internal audit functions will need to foster a culture of innovation, encouraging experimentation with new technologies and approaches to enhance their effectiveness.

The IIA's updated Global Internal Audit Standards mark a pivotal moment for the internal audit profession. By placing a strong emphasis on strategic alignment, risk focus, and the transformative power of technology, the new framework provides a roadmap for internal auditors to become more relevant, impactful, and value-adding partners within their organizations. For internal auditors who embrace this new era, the revised Standards offer a framework for charting a new course, one that is more strategic, more technologically empowered, and ultimately, more vital to the success of the organizations they serve.

Learn how Supervizor can help internal audit teams adopt the IIA's Redefined Global Internal Audit Standards through its technology platform that facilitates continuous monitoring of financial data, automates controls testing across various systems and entities, and offers comprehensive risk discovery and analysis.  Want to learn more? Sign up for a demonstration of Supervizor.