A New Role for the Internal Audit Function

Key Takeaways

• Expanded Role for Internal Audit: Internal audit leaders can go beyond traditional assurance by actively supporting the effectiveness of boards and audit committees.
• Practical Governance Support: Activities like drafting charters, shaping agendas, coordinating with external auditors, and leading self-assessments can materially strengthen oversight.
• Technology as a Governance Accelerator: AI and other emerging tools can help boards quickly extract insights from large volumes of information and focus on what truly matters.
• CAE as Board Enabler: By acting as staff, advisor, and facilitator, CAEs can help board members use technology more effectively and challenge management with better questions.
• Value Creation and Protection: Elevating internal audit’s contribution to governance ultimately enhances the organization’s ability to create, protect, and sustain value.

Deep Dive

In this article, Norman Marks explores the evolving role of the chief audit executive, moving beyond traditional assurance to actively helping boards and audit committees operate more effectively. With new opportunities emerging through AI and technology, Marks argues that internal audit functions can deliver greater value by enhancing board governance, insight, and performance.

How Internal Audit Leaders Can Strengthen Board Performance in the Age of AI

The IIA has defined our ‘purpose’ this way, "Internal auditing strengthens the organization’s ability to create, protect, and sustain value by providing the board and management with independent, risk-based, and objective assurance, advice, insight, and foresight."

There’s a lot in that sentence (and improvements could be made using words like “proactive”, “valuable”, and “forward-looking”). But there’s a role for internal audit that many successful CAEs play, even if it’s not clear from that purpose statement. That role is helping the board and its committees be effective.

We report to the audit committee and I always saw my purpose including doing what I could to help them in their governance and oversight role. For example, I did the following:

• I drafted the audit committee charter and suggested changes when appropriate.
• Facilitated the development of the audit committee’s meeting agenda. (At one company I also helped with the board’s IT committee agenda.)
• I maintained a schedule of what from the board’s charter needed to be covered when and made sure it was included in that meeting’s agenda.
• I drafted the agenda and discussed it with the chair and the CFO before the chair gave final approval.
• I worked with the external auditor to ensure their materials were presented to the audit committee at the appropriate meetings.
• I nagged everybody to get their materials to the committee members in good time.
• I drafted the audit committee minutes for approval by the chair and general counsel.
• I provided orientation training to new members of the audit committee.
• I led a self-assessment process for the audit committee and its members.
• When the self-assessment identified a need for training, I provided or facilitated it.
• One board member had difficulty with the English language. We met one-on-one at his home before each meeting to help him understand the materials and prepare for their discussion.
• When it was time to assess the performance of the external auditor, I surveyed global management and summarized the results for the audit committee and top management.

Now we can do more. Advances in technology, including the integration of AI into board portals and the more general use of agentic AI, are an opportunity for the board, its committees, and its members to be more effective and efficient. They can gain deeper insights into the organization’s operations more efficiently, enabling them to ask better questions and challenge management when needed.

For example, instead of having to pore over hundreds of pages in the board documents (often delivered to them just before the meeting), they can use AI to summarize them and identify themes and points for discussion. It can help them find the important from a haystack of the trivial.

As CAE, I reported functionally to the audit committee. In many ways, I was their staff; their assistant; their secretary; and their advisor. I embraced that role. We now have the opportunity and perhaps the obligation to help them adopt and use new technology to upgrade their performance.

Many CAEs are thinking about how they can use AI in their operations. How about adding great value (and getting recognition and their thanks) by helping the board and its committees and members be more effective by using AI and other technologies?

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.