A new report from The Institute of Internal Auditors found digital disruption and climate change to be climbing among top risks for North American organizations. We spoke with Anthony Pugliese, president and CEO of The Institute of Internal Auditors, about this development, as well as the ways that boards can work with internal auditors to provide better results for their companies.
Directors & Boards: Can you tell us about any recent Institute of Internal Auditors initiatives and projects that you believe will have a particular impact on the work of public company boards?
Anthony Pugliese: This September, The Institute of Internal Auditors (IIA) released our newest Risk in Focus report, which explores the most pressing risks facing organizations across industries. The research was derived from feedback from more than 3,500 internal audit leaders globally and offers a closer look at the current risk landscape as well as projections for how the threat environment is expected to evolve over the next several years. Importantly, it revealed that climate change and digital disruption are the two fastest-growing risks for organizations today.
The findings are especially relevant to boards of public companies. The risks associated with climate change and digital disruption — defined as the technologies that are rapidly reshaping how companies do business — are ever-changing and complex, and they have significant implications for how boards approach certain risk areas and how they work with their teams to ensure proper compliance in order to protect shareholder value.
This year, we also introduced the new Global Internal Audit Standards, which become effective on January 9, 2025. The new standards are designed to serve as a basis for evaluating and elevating the quality of the internal audit function in line with the evolving needs and challenges faced by the profession and organizations worldwide. In addition, we launched our Vision 2035 research project, which essentially provided a roadmap for internal audit and priorities for the profession over the next decade. The research found that internal audit is shifting to play a more strategic advisory role, in addition to providing boards and management with assurance services.
This trend is especially pertinent to boards as it signals a shift in the ways that boards and internal audit functions operate. As the risk landscape becomes increasingly complex, internal audit can and should lean into their ability to be more of a strategic partner to boards, offering both insights and recommendations to help boards more deeply understand the risk landscape and ensure the proper procedures are in place to protect the companies that they oversee.
DB: How would you say the role of boards and management has changed over recent years and how has that change affected the way internal auditors work with boards in particular?
AP: As the risk landscape becomes increasingly complex — spanning heightened geopolitical tensions, supply chain concerns post-COVID, and the rise of emerging technology and AI, for example — the responsibilities of boards and the various risk areas they must oversee have evolved and expanded.
This has also changed the ways that boards and senior management approach certain risk areas and has given rise to new considerations or aspects of risk management they might not have previously considered. For example, supply chain disruption and potential risks to supply operations have become a greater concern and a priority for companies in the aftermath of the COVID pandemic, and the advent of AI has complicated the risks associated with cybersecurity and digital fraud.
As the risk environment continues to evolve and expand, we see a growing need for boards to leverage internal audit as an invaluable part of their risk management strategy. They must use internal audit not just for assurance purposes, but as a strategic partner that can provide proactive recommendations for how to stay ahead of potential risks.
DB: How does the constantly evolving landscape of risk affect how boards work with internal audit and what do boards need to know to ensure that those two entities have a strong, successful relationship?
AP: Historically, internal audit has been viewed strictly within the realm of compliance and assurance services. However, as the threat environment continues to change and become increasingly complex, boards and senior management should look to shift their perception of internal audit and view them first and foremost as a strategic partner and advisor when it comes to risk management.
What this looks like in practice will vary from company to company and across risk areas. However, we can look at climate reporting and sustainability as a good starting example.
Sustainability regulations in the United States are still very young but as concerns over climate change grow, we'd expect heightened regulatory oversight and reporting guidelines for climate-related activities. One of the important ways that internal audit can help is by offering a team of risk management experts who closely follow climate reporting and standards such as the International Sustainability Standards Board and can help boards and senior management understand what needs to happen at the company level in order to remain compliant as regulations develop. For boards and internal audit to establish an effective working relationship, it's imperative that boards understand how internal audit can provide value as a strategic advisor, not just a compliance and assurance function, and look to internal audit to provide more proactive guidance on the risks facing their company.