To do so, however, IA needs to be invited to a seat at the table and be heard at the highest levels of the organization at the outset and throughout the digital innovation and transformation journey—to share its perspective; contribute to decisions; effect change; and consider the impact on the nature, timing, and extent of assurance and advisory services. This article explores variables that may enable or constrain IA’s seat at the digital innovation and transformation table.
Digital Disruption, Innovation, and Transformation
A Fourth Industrial Revolution is underway globally, driven by the rapid, wide-scale deployment of digital technologies such as artificial intelligence (AI) and cloud computing. According to the World Economic Forum, “As the global economy rapidly digitalizes, an estimated 70% of new value created over the next decade will be based on digitally enabled platform business models” (https://bit.ly/3KsPK0d).
Fully delivering on the promises of digital innovation is a challenge. According to a 2022 McKinsey survey: “Most organizations achieve less than one-third of the impact they expected from recent digital investments” (https://mck.co/45hx9fP). Why is that?
The magnitude and velocity of digital innovation and transformation inevitably exacerbate existing risks and create new and unknown risks and unintended consequences. According to Accenture, “making decisions amid constant uncertainty and upheaval is at the heart of any transformation journey … and is only possible with good governance” (Accenture, “Make key governance moves like a chess master,” Dec. 10, 2021, https://accentu.re/4556AKM).
Digital Innovation and Transformation and the Role of IA
IA is uniquely positioned and appropriately skilled to valuably and judiciously balance advisory and assurance services to contribute to digital innovation and transformation. To contribute materially, IA needs to have the ear of leadership and the board of directors—invited to the digital innovation and transformation table at the outset and throughout the journey. The authors characterize IA’s seat at the digital table as participating in the following three areas:
- ▪ C-suite digital steering committees or board-level digital task forces
- ▪ Digital advisory projects
- ▪ Digital assurance services.
According to the Institute of Internal Auditors (IIA), however, a seat at the table is not guaranteed. IA “should be suitably positioned, resourced, and have the authority within the organization to enable it to fulfill its role effectively and deliver robust assurance which feeds up through the management and governance frameworks” (https://bit.ly/3OnC4Vq). The qualifications in this statement are crucial; certain material variables may limit the nature and extent of IA’s role. For example, the board may object to the CAE participating in a C-suite digital strategy committee because of a perceived loss of independence when conducting related assurance activities.
In this context, we explore the influence of three macro-level variables on the extent to which IA is invited to a seat at the digital table. Exhibit 1 introduces these variables, which are discussed in greater detail below.
Exhibit 1
Variables that May Influence IA’s Seat at the Digital Table
Welcome? Is IA Invited to Take a Seat at the Digital Table?
The authors define being “welcome” as senior leaders and the board welcoming early involvement of IA in digital innovation and transformation discussions and decision-making associated with strategy, execution, governance, and assurance. According to the Chartered Institute of Internal Auditors, IA “can support management and the board in achieving organizational objectives and adding value through providing assurance, insight, and objectivity. However, [IA] must have a ‘seat at the top table,’ or at the very least, the ear of the audit committee, board, and senior executives to ensure it can do this effectively” (https://www.iia.org.uk/resources/managing-internal-audit/raising-the-profile-of-internal-audit/?downloadPdf=true).
But not all internal audit functions are invited to sit at the table. Why not? While various explanations have been advanced, the authors focus on the following three reasons:
- ▪ IA independence is perceived to be impaired.
- ▪ IA is perceived to lack digital capabilities.
- ▪ IA does not have the ear of the CEO, leadership, and the board.
Impediment 1: IA independence is perceived to be impaired.
Senior leaders and the board assume that IA involvement in digital advisory activities impairs assurance independence. Such assumptions might be misguided because of the inherent complexity of the theory of independence. According to the IIA, “Independence is the freedom from conditions that threaten the ability of the [IA] activity to carry out [IA] responsibilities in an unbiased manner” (https://bit.ly/3qhauRO). Notably, the standard does not prohibit advisory activities. IA should convey the rationale for balancing digital advisory and assurance services while maintaining independence and objectivity.
Impediment 2: IA is perceived to lack digital capabilities.
Situations may exist where senior leadership and the board are unaware of the depth and breadth of IA’s digital capabilities and mistakenly assume IA is not digital-ready. IA leadership can address this by communicating and demonstrating relevant qualifications.
Impediment 3: IA does not have the ear of the CEO, leadership, and the board.
If IA does not have the ear of the CEO and the board, they may be overlooked for a seat at the digital table. The root cause is sometimes related to limited access caused by organizational reporting lines. For instance, the IIA’s 2023 North American Pulse of Internal Audit showed that only 38% of IA functions reported administratively to the CEO (https://bit.ly/3Qqy9tQ). Such circumstances may limit internal audit’s visibility and opportunities to convey its digital value proposition. Establishing lines of communication with the CEO/C-suite enhances IA’s ability to communicate its strategic value.
Willing and Workplace Ready (Able)?—Is IA Willing and Able to Take a Seat at the Digital Table?
“Willing” is characterized here as the willingness of IA leadership to engage in digital assurance and advisory services. “Workplace Ready (Able)” is described as IA operating at the necessary and expected digital capability/maturity level. The question is: “If IA is invited to the digital table, why would it turn down the offer?” The authors focus on the following reasons.
- ▪ IA is not digital-ready.
- ▪ IA capacity and resource constraints.
Impediment 4: IA is not digital-ready.
Declining an invitation to contribute from senior leaders and the board is generally rare for IA functions. In certain situations, however, it will be necessary to do so. For example, IA leadership concludes that they still need to gain additional digital capabilities. In this case, IA must convey this decision and its reasons to senior leaders and the board, including their plans and timing for filling this gap.
Impediment 5: IA capacity and resource constraints.
A Protiviti survey reported that 52% of CAEs identified a “lack of capacity (competing priorities)” as their top barrier to transforming the IA function (https://bit.ly/3QzQLYt). In this case, IA could add value, but does not have the capacity to do so. For example, priority overload is the pressure to expand the originally agreed-upon audit universe and audit plan beyond capacity on short notice. Another example is budget constraints; IA teams may be understaffed and have limited budgets for hiring and sourcing, restraining their ability to provide assurance and advisory services. In such circumstances, IA should convey this decision and its reasons to senior leaders and the board.
Addressing Impediments Constraining IA’s Seat at the Digital Table
IA is uniquely skilled and positioned to balance advisory and assurance services valuably and judiciously to contribute materially to digital innovation and transformation. To do so, IA needs to be heard at the highest levels of the organization during digital innovation and transformation discussions—to share its perspective; contribute to decisions; effect change; and consider the impact of digital transformation on the nature, timing, and extent of assurance and advisory services. Impediments, however, may limit IA’s ability to do so, such as IA’s organizational position and authority; resource limitations; burgeoning technology; digital skills and staffing; and independence concerns. Exhibit 2 presents suggested macro-level actions for those IA functions facing one or more of the above-mentioned impediments.
Exhibit 2
Actions Addressing Impediments to IA’s Seat at the Digital Table
