Unlocking internal audit’s potential

Many audit committees have a powerful tool available to them – their internal auditors. Effective internal auditors give confidence to audit committees that their organisations remain on track to achieve their objectives, while pragmatically managing key risks.

Internal audit’s superpower is its intimate knowledge of the organisational context and strategic direction, processes and culture, a deep understanding of organisational constraints and challenges, and the ability to anticipate what may go wrong based on past events. All of this equips internal auditors to help audit committees make better governance decisions.

While each audit committee is different – both in the role it plays and in its composition – not all use their internal audit function to its full potential.

With that in mind, I interviewed several audit committee members across the public and private sectors, as well as internal audit leaders, to understand the ‘magic ingredients’ for a successful and value-adding internal audit function that helps audit committee members successfully fulfil their duties. Here’s what I’ve learned.

Key expectations of audit committee chairs 

1. Bringing insights. Unsurprisingly, audit committees still want to see more insights and practical process improvement opportunities from the work of their internal auditors. Members expect internal auditors not only to confirm whether processes and controls meet compliance standards, but also to provide insights into how they compare them with other organisations and how to improve operations cost-effectively within the organisation’s strategic context.

Experienced members want their internal auditors to help their organisations ‘push assurance left’, meaning helping line managers (first line of defence) implement self-assurance mechanisms, and empower policy owners and monitoring functions (second line of defence) to play a more active role. This enables internal auditors to focus more on value-adding activities, such as providing insights and strategic advice. Experienced directors do not see this shift from assurance to advice as a threat to independence because they rely on internal auditors’ professionalism and experience to manage any potential conflict.

The rapid advancements in technology provide tools to automate audit activities through continuous monitoring of processes and controls, and identifying control breakdowns and exceptions. One large New Zealand bank is actively developing AI-assisted tools to provide near real-time assurance and insights.

2. Collaboration across the organisation. Audit committee members recognise the need for internal audit functions to shift from being a whistleblower to working collaboratively across the organisation, recognising and highlighting strengths, achievements and success stories.

One audit committee chair noted they want their internal audit function to ‘genuinely support management instead of catching management off guard’, and not be the ‘internal police’.

3. Foresight. Additionally, audit committees want their internal audit functions to be more future-focused and proactive in anticipating challenges and risks. Many internal auditors, due to their audit or compliance backgrounds, feel more comfortable with the certainty of the ‘pass or fail’ world and analysing past events. While the future will always be uncertain, internal auditors can use their professional experience and tools, such as risk sensing and predictive analytics, to provide forward-looking insights.

One audit committee chair stressed the importance of ensuring the internal audit function has appropriate resources – in both number and capability – to provide such foresight. Having the best specialists involved adds credibility to the results. This chair also encourages their internal audit function to seek external skills if needed.

4. Effective communication. Lastly, the value and quality of insight can be lost if they are not presented clearly and concisely. Directors still come across legacy reporting structures that lead to overcomplicated reporting and board papers, especially in the public sector.

Several directors I interviewed want their internal auditors to proactively improve how they communicate findings to the audit committee.

How does it feel being an internal auditor? 

Audit committees are right to expect more from their internal auditors. To help with that, it is useful for directors to understand what it is like to be an internal auditor and some of the key challenges they face.

Internal auditors’ unique position within the business means they often feel lonely and isolated from the rest of the organisation. Few colleagues understand what they do, and some may even perceive them as ‘internal police’, treating them as outsiders. To be effective, they need strong support from senior leaders to be accepted internally.

One senior internal audit leader described going on a ‘charm offensive’ when joining a new organisation, attending social events and team meetings to ‘blend in’ and build trust.

Good internal auditors want to add value by improving processes, identifying issues early, bringing a fresh perspective, and improving risk awareness and culture. However, they often face opposition from those who see them only as a compliance function and do not want them to go beyond ‘tick the box’ reviews. As a result, many feel they lack agency and sponsorship to operate at their best – a situation that can be very disempowering.

In the worst-case scenario, internal auditors are moved to lower tiers of the organisational structure, limiting their ability to build cross-organisational knowledge and influence changes in processes and the control environment.

One audit and risk committee chair stressed the importance of giving internal audit leaders sufficient authority. They described an example where a proposed restructuring would have the Internal Audit Manager report to the Financial Controller, becoming a Tier 4 position. The chair challenged this, believing the lower position would limit access across the organisation and the ability to communicate with senior leaders. The restructuring did not proceed.

Several internal auditors I interviewed observed little organisational change occurring because of their work and insights. Recommendations, even when accepted by management and reported to governance, are sometimes not implemented or ignored entirely. This can be demotivating and suggest the organisation is paying lip service to robust governance.

Some internal auditors face additional challenges navigating organisational politics and overly bureaucratic reporting processes. This is particularly evident when they sit low in the hierarchy.

One senior internal audit leader described a new process introduced by a chief executive requiring all communications with directors and board members to go through the Office of the Chief Executive. While centralisation can optimise information flow, such rigid processes may limit openness of advice and could be perceived as internal ‘censorship’.

What can audit committees do? 

1. Establish trust through quality communication
Trust was the most consistent theme raised in my interviews. Internal audit leaders want to feel the chairs have their back and know it is safe to raise matters with them in a confidential, constructive environment. Similarly, directors want to trust their internal auditors to have the capability and business acumen to do their job well, collaborate across the business, challenge existing practices constructively, and be fair, objective, and professional.

Regular, quality communication between the audit committee and the internal auditor is essential. While it may sound like a considerable time commitment, what matters most is quality, not frequency.

All audit committee members I interviewed have regular one-on-one meetings with their internal auditors several times a year. One chair meets more often during times of significant change. Many invite internal auditors to ‘committee only’ time at the end of meetings, and some attend internal audit team events to share the organisational strategy and board priorities.

2. Help define the vision and purpose

The internal audit function exists to serve audit committees. Committees are best placed to define its purpose and articulate the value they expect. Yet some operate in isolation with little alignment to the organisation’s strategy or the committee’s priorities. Given the cost of the function, it is important to ensure effort is focused in the right areas.

A quality session between the committee and internal auditor to agree on the vision, purpose and value can bridge any gaps. There is no single ‘right’ answer – not every function needs to be leading-edge in technology. What matters is alignment with current formalised priorities and clear expectations.

For example, organisations that have recently established their internal audit function, or are undergoing notable change, may want to focus on strengthening core operations and providing assurance over essential activities. Internal auditors should be positioned to support these priorities meaningfully.

Following the release of the new Global Internal Audit Standards by the Institute of Internal Auditors, one experienced governance professional joined an Audit and Risk Committee and worked with the internal audit manager to re-establish the function’s role. Through engagement across the organisation, they formalised expectations in an updated Internal Audit Charter and reset the relationship between committee and internal audit.

3. Provide ongoing support and be an advocate for the function

From my interviews, there is a clear correlation between the level of engagement from audit committee chairs and the perceived value of the internal audit function. The more time directors and management invest, the better the return – provided the internal audit function delivers quality insights in return.

At one large organisation, the chair of the Audit and Risk Committee views the Chief Internal Auditor role as a milestone on the pathway to senior leadership, given its unique organisation-wide view and relationship-building opportunities. The role provides deep understanding of the organisation’s operations, culture, challenges, bottlenecks and opportunities – all invaluable for future leadership positions. To support this development, the chair ensures the Chief Internal Auditor is visible at the leadership table and involved in key initiatives and decisions.

In Summary

Kirill Voronchev

My interviews show clear opportunities for audit committees and their internal auditors to work together to realise the potential benefits of high-performing internal audit functions. There are several pragmatic and simple – and usually free – steps audit committee members can take to move the dial.

By building trust, aligning the function with strategic priorities, and actively advocating for its role, committees can transform internal audit from a compliance checkpoint into a strategic asset. The return on that investment of time and attention is better insight, stronger governance and a more resilient organisation.