Today’s organizations face a risk environment best described as permacrisis, a new term to define our “extended period of instability and insecurity.” In permacrisis, risk is growing, accelerating, and evolving, becoming more interconnected and complex — but organizational capacity to manage risk isn’t keeping up. The fallout is a growing risk exposure gap that leaves organizations vulnerable to potentially devastating impacts, from the escalating costs of cyber attacks and third-party failures to material weaknesses.
This unprecedented risk landscape is extraordinarily challenging for internal audit, requiring strategic planning and decisive, transformative action. Unfortunately, as AuditBoard’s 2024 Focus on the Future survey of more than 450 internal audit leaders found, many internal audit departments seem complacent or even overconfident in the face of permacrisis. The report’s findings should be a wake-up call for the profession. Download your copy of the full report, 2024 Focus on the Future: Widening Risk Exposure Gap Demands Internal Audit Transformation, and read on for key takeaways.
2024 Top Risks: Are Internal Auditors Embracing AI?
Some internal audit leaders are delaying crucial transformation efforts and technology investments in generative artificial intelligence (AI) and automation: 75% have yet to implement generative AI in internal audit, and only 40% have a clear understanding of how AI is used in their organizations, and as few as 25% have defined the risks of or created guidelines for the use of AI.
2024 Top Risks: Are Internal Auditors Underestimating the Risk Exposure Gap?
Each year, Focus on the Future takes a fresh look at the leading risks commanding internal audit’s attention. Unsurprisingly, many of the risks that dominated the landscape in the 2023 survey are expected to carry over into 2024. None of these risks are expected to abate; many are growing in complexity and impact. However, internal audit leaders’ collective predictions for 2024 rank three of the top four risks lower than in 2023.
Of the top four risks, only top-ranked cybersecurity and data security maintained its high profile from 2023 to 2024, with 81% of internal audit leaders rating the risk as “very high” or “higher than average” for their organizations in 2024, versus 83% in 2023. Respondents rate other top risks — changing economic conditions, ability to attract and retain talent, and regulatory and legislative changes collectively lower for 2024 versus 2023. Is this wishful thinking? Or are internal auditors simply becoming conditioned to a state of permacrisis? Download the full report for a closer look at each risk.
Audit Effort vs. Risk: Ongoing Misalignment on Key Risks
Internal audit’s focus should align with the most significant risks facing organizations. Unfortunately, the 2023 and 2024 Focus on the Future surveys signaled gaps between planned audit efforts and key top-ranked risks.
While highly ranked risks such as cybersecurity, IT, and regulatory and legislative changes appear to be getting the focus they deserve in 2024, audit efforts still lag for two of the key risks noted in 2023, with even fewer internal audit functions reporting that they expect to devote significant effort in these areas versus 2023. Why don’t these critically important vulnerabilities receive more attention on their own, given their obvious impact on so many other critical audit areas?
Resources and Talent: Optimism at Odds With Ongoing Uncertainty
Budget and resource limitations impact internal auditors’ ability to help their organizations scale the risk exposure gap. Planning for effective coverage requires a clear and realistic outlook on both resources and talent. Accordingly, it’s worrying that internal audit leaders continue to predict increasing budgets and stable staffing plans against a backdrop of continuing macroeconomic uncertainty, recessionary fears, and the ongoing transformation of the U.S. workforce. AuditBoard’s Focus on the Future has tracked this trend of optimism since our 2022 report (2021 data). In particular:
- More than 60% of respondents anticipate their 2024 budgets will increase (38% more than inflation, and 23% less than inflation). Compared with prior years, fewer respondents expect their budgets to stay the same, and only 9% expect decreases. Will 2024 internal audit budgets truly increase more than they did in 2023?
- A large majority (63%) of respondents anticipate staffing staying the same in 2024. That said, the 31% of internal audit leaders who anticipate growing their headcount in 2024 should ask themselves: In the face of severe workforce talent constraints, where will internal audit departments find these auditors?
Strategic Plan: A Lagging Practice Likely to Become a Compliance Mandate
For the first time, Focus on the Future explored internal audit’s use of forward-looking strategic plans. Survey results suggest that use is not widespread, with only one in five functions saying they have “a comprehensive, well-documented strategic plan” looking out three to five years. Meanwhile, one in four have no strategic plan whatsoever, focusing only on next-year priorities. Lastly, while a slim majority report either having thought through or documented some elements, such documentation is either informal or inconsistent.
Strategic plans are a key mechanism CAEs can use to proactively manage and transform the internal audit function. Further, The IIA announced plans for a new requirement (expected publication by January 2024). If adopted, the new standard would require every internal audit function to have a long-term strategic plan that the CAE reviews annually with management and the audit committee.
In permacrisis, organizations need internal audit’s insight and foresight more than ever. Auditors must be resolute in taking transformative action, embracing key opportunities in enhancing strategic planning, risk identification and monitoring, talent management, stakeholder communications, cross-functional collaboration, use/governance of enabling technologies, and more. For a comprehensive look at the report’s findings and a series of forward-looking auditor tips, download the full report, 2024 Focus on the Future: Widening Risk Exposure Gap Demands Internal Audit Transformation.
