Value-driven disruptive digital strategies, business models, skills, and technologies are transforming organizations of all sizes, sectors, and geographies. Digital disruption is also stressing organizational governance. Internal audit (IA) functions are uniquely positioned to contribute to digital innovation, transformation, and governance through assurance and advisory services.

Thank you for reading this post, don't forget to subscribe!

To do so, however, IA needs to be invited to a seat at the table and be heard at the highest levels of the organization at the outset and throughout the digital innovation and transformation journey—to share its perspective; contribute to decisions; effect change; and consider the impact on the nature, timing, and extent of assurance and advisory services. This article explores variables that may enable or constrain IA’s seat at the digital innovation and transformation table.

Digital Disruption, Innovation, and Transformation

A Fourth Industrial Revolution is underway globally, driven by the rapid, wide-scale deployment of digital technologies such as artificial intelligence (AI) and cloud computing. According to the World Economic Forum, “As the global economy rapidly digitalizes, an estimated 70% of new value created over the next decade will be based on digitally enabled platform business models” (https://bit.ly/3KsPK0d).

Fully delivering on the promises of digital innovation is a challenge. According to a 2022 McKinsey survey: “Most organizations achieve less than one-third of the impact they expected from recent digital investments” (https://mck.co/45hx9fP). Why is that?

The magnitude and velocity of digital innovation and transformation inevitably exacerbate existing risks and create new and unknown risks and unintended consequences. According to Accenture, “making decisions amid constant uncertainty and upheaval is at the heart of any transformation journey … and is only possible with good governance” (Accenture, “Make key governance moves like a chess master,” Dec. 10, 2021, https://accentu.re/4556AKM).

Digital Innovation and Transformation and the Role of IA

IA is uniquely positioned and appropriately skilled to valuably and judiciously balance advisory and assurance services to contribute to digital innovation and transformation. To contribute materially, IA needs to have the ear of leadership and the board of directors—invited to the digital innovation and transformation table at the outset and throughout the journey. The authors characterize IA’s seat at the digital table as participating in the following three areas:

  • ▪ C-suite digital steering committees or board-level digital task forces
  • ▪ Digital advisory projects
  • ▪ Digital assurance services.

According to the Institute of Internal Auditors (IIA), however, a seat at the table is not guaranteed. IA “should be suitably positioned, resourced, and have the authority within the organization to enable it to fulfill its role effectively and deliver robust assurance which feeds up through the management and governance frameworks” (https://bit.ly/3OnC4Vq). The qualifications in this statement are crucial; certain material variables may limit the nature and extent of IA’s role. For example, the board may object to the CAE participating in a C-suite digital strategy committee because of a perceived loss of independence when conducting related assurance activities.

In this context, we explore the influence of three macro-level variables on the extent to which IA is invited to a seat at the digital table. Exhibit 1 introduces these variables, which are discussed in greater detail below.

Exhibit 1

Variables that May Influence IA’s Seat at the Digital Table

Variable; Key Question; Expectations Welcome?; Is IA invited to sit at the digital table—at the outset of strategy formation, decision-making, and throughout the digital transformation journey?; ▪ C-Suite Steering Committees?; ▪ Advisory Services?; ▪ Assurance Services? Voice of the CEO, Leadership Team, and the Board Will IA…; ▪ Bring unique perspectives?; ▪ Maintain independence and objectivity?; ▪ Avoid over-committing?; ▪ Understand the business and culture?; ▪ Deliver relevant and mature digital skills?; ▪ Bring solutions, not just problems/issues? Willing?; Is IA willing to take a seat at the digital table?; Voice of the IA Leadership Team Does IA…; ▪ Have the ear of decision-makers?; ▪ Demonstrate independence and objectivity?; ▪ Avoid over-committing / Priority overload?; ▪ Possess relevant, sufficient digital skills?; ▪ Have sufficient digital-staffing levels? Workplace Ready (Able)?; Is IA digital workplace ready (able)?; Voice of the IA Leadership Team Does internal audit possess and demonstrate…; ▪ Unique and value-added perspectives?; ▪ Relevant talent and skills?; ▪ Proven and relevant audit methods and tools?

Welcome? Is IA Invited to Take a Seat at the Digital Table?

The authors define being “welcome” as senior leaders and the board welcoming early involvement of IA in digital innovation and transformation discussions and decision-making associated with strategy, execution, governance, and assurance. According to the Chartered Institute of Internal Auditors, IA “can support management and the board in achieving organizational objectives and adding value through providing assurance, insight, and objectivity. However, [IA] must have a ‘seat at the top table,’ or at the very least, the ear of the audit committee, board, and senior executives to ensure it can do this effectively” (https://www.iia.org.uk/resources/managing-internal-audit/raising-the-profile-of-internal-audit/?downloadPdf=true).

But not all internal audit functions are invited to sit at the table. Why not? While various explanations have been advanced, the authors focus on the following three reasons:

  • ▪ IA independence is perceived to be impaired.
  • ▪ IA is perceived to lack digital capabilities.
  • ▪ IA does not have the ear of the CEO, leadership, and the board.

Impediment 1: IA independence is perceived to be impaired.

Senior leaders and the board assume that IA involvement in digital advisory activities impairs assurance independence. Such assumptions might be misguided because of the inherent complexity of the theory of independence. According to the IIA, “Independence is the freedom from conditions that threaten the ability of the [IA] activity to carry out [IA] responsibilities in an unbiased manner” (https://bit.ly/3qhauRO). Notably, the standard does not prohibit advisory activities. IA should convey the rationale for balancing digital advisory and assurance services while maintaining independence and objectivity.

Impediment 2: IA is perceived to lack digital capabilities.

Situations may exist where senior leadership and the board are unaware of the depth and breadth of IA’s digital capabilities and mistakenly assume IA is not digital-ready. IA leadership can address this by communicating and demonstrating relevant qualifications.

Impediment 3: IA does not have the ear of the CEO, leadership, and the board.

If IA does not have the ear of the CEO and the board, they may be overlooked for a seat at the digital table. The root cause is sometimes related to limited access caused by organizational reporting lines. For instance, the IIA’s 2023 North American Pulse of Internal Audit showed that only 38% of IA functions reported administratively to the CEO (https://bit.ly/3Qqy9tQ). Such circumstances may limit internal audit’s visibility and opportunities to convey its digital value proposition. Establishing lines of communication with the CEO/C-suite enhances IA’s ability to communicate its strategic value.

Willing and Workplace Ready (Able)?—Is IA Willing and Able to Take a Seat at the Digital Table?

“Willing” is characterized here as the willingness of IA leadership to engage in digital assurance and advisory services. “Workplace Ready (Able)” is described as IA operating at the necessary and expected digital capability/maturity level. The question is: “If IA is invited to the digital table, why would it turn down the offer?” The authors focus on the following reasons.

  • ▪ IA is not digital-ready.
  • ▪ IA capacity and resource constraints.

Impediment 4: IA is not digital-ready.

Declining an invitation to contribute from senior leaders and the board is generally rare for IA functions. In certain situations, however, it will be necessary to do so. For example, IA leadership concludes that they still need to gain additional digital capabilities. In this case, IA must convey this decision and its reasons to senior leaders and the board, including their plans and timing for filling this gap.

Impediment 5: IA capacity and resource constraints.

A Protiviti survey reported that 52% of CAEs identified a “lack of capacity (competing priorities)” as their top barrier to transforming the IA function (https://bit.ly/3QzQLYt). In this case, IA could add value, but does not have the capacity to do so. For example, priority overload is the pressure to expand the originally agreed-upon audit universe and audit plan beyond capacity on short notice. Another example is budget constraints; IA teams may be understaffed and have limited budgets for hiring and sourcing, restraining their ability to provide assurance and advisory services. In such circumstances, IA should convey this decision and its reasons to senior leaders and the board.

Addressing Impediments Constraining IA’s Seat at the Digital Table

IA is uniquely skilled and positioned to balance advisory and assurance services valuably and judiciously to contribute materially to digital innovation and transformation. To do so, IA needs to be heard at the highest levels of the organization during digital innovation and transformation discussions—to share its perspective; contribute to decisions; effect change; and consider the impact of digital transformation on the nature, timing, and extent of assurance and advisory services. Impediments, however, may limit IA’s ability to do so, such as IA’s organizational position and authority; resource limitations; burgeoning technology; digital skills and staffing; and independence concerns. Exhibit 2 presents suggested macro-level actions for those IA functions facing one or more of the above-mentioned impediments.

Exhibit 2

Actions Addressing Impediments to IA’s Seat at the Digital Table

Impediment; Actions Limitations on IA's Organizational Position and Authority; If CAE reporting lines impede communication, IA should explore alternatives for securing the ear of the CEO, leadership teams, and the board to convey and promote IA's digital-value proposition. Perceived or Real Independence and Objectivity Concerns; Demonstrate how IA can valuably and judiciously balance advisory and assurance services to contribute to digital innovation and transformation without compromising independence and objectivity. Ensuring that IA policies and procedures include appropriate independence guardrails is also essential. Perceived or Real Lack of Digital Capabilities; If IA's digital capabilities are lacking, or perceived to be lacking, develop a digital readiness and change strategy aligned with the organization's digital strategy and future digital state.; Include the current state of digital readiness, identified gaps, action plans to fill gaps, and progress toward the desired future state of digital maturity.; This digital strategy may also include the following:; ▪ Strategic sourcing from qualified external providers; ▪ IA's role in shared responsibility for governance with third-party technology service providers (e.g., cloud service providers); ▪ Digital learning & development (L&D), digital upskilling:; ▪ Collaborating with the organizational L&D group; ▪ Rotate IA staff through organizational functions (e.g., CIO); ▪ Rotate CIO organization staff through IA; ▪ Collaboration with other governance functions (e.g., ERM) IA's Digital Value Proposition–Communication Gaps; Communicate, promote, and demonstrate IA's value proposition, including:; ▪ The importance of IA's early involvement in the organization's digital strategy and decision-making to inform the future scope of IA assurance activities and to contribute to decision-making and advice.; ▪ The current state of IA's digital readiness and relevance, including digital advisory and assurance experience; in-house digital talent, skills, and external sourcing; methods, tools, and reporting; and opportunities to collaborate with other governance functions (e.g., ERM) engaged in digital transformation; ▪ IA's digital strategy, including the alignment of IA's strategy to organizational strategies; the crucial role of IA in providing assurance services related to third-party digital providers involved in shared governance responsibilities (e.g., cloud service providers). Resource Constraints; Convey a compelling value proposition for securing the necessary digital resources (e.g., funding, staffing, training, digital tools) to deliver during the current state and for future readiness.

Steven S. Mezzio, PhD, CPA, CISA, is a former partner with PricewaterouseCoopers, the executive director and founder of the Center for Sustainable Business, and a professor of accounting, auditing, and ESG at Pace University, New York, N.Y.
J. Douglas Watt, CPA, is a former partner with PricewaterhouseCoopers and recently retired from Fannie Mae, where he served as senior vice president and chief audit executive (CAE).
O. Mira Shadrina, CPA, was formerly with Deloitte, formerly with the internal audit group of Meredith Corporation, and is currently Peregrine Group’s human capital business manager.