Future-proofing internal audit: Tackling emerging technological disruptions

As everyone is aware, the weather is becoming increasingly unpredictable; similarly, technology is also becoming increasingly erratic. Let us imagine for a moment that internal audit is a lighthouse standing strong on a rugged coastline, guiding ships through these increasingly turbulent seas. The storm represents the fast-evolving world of technological disruptions, with uncontrollable winds and shifting tides threatening to pull organizations off course. The lighthouse must do more than shine its light; to remain an effective guide in these modern storms, it must be equipped with the latest radar, automated systems, and other advanced technologies to detect ever increasing changes in weather and sea conditions. Similarly, internal audit has to evolve more frequently to ensure it remains a reliable beacon for organizations navigating the uncertain waters of technological innovation.

Emerging technologies are advancing at an unprecedented pace, offering transformative possibilities while exposing organizations to new risks. According to ISACA’s 2024 State of Digital Trust Report, three out of four organizations have experienced significant technological disruptions in the past year, and 67% identified these disruptions as their primary operational risk. For internal audit, the challenge is clear: they must help to anticipate these risks, future-proof their business processes, and instill an effective control environment to help their organization thrive in a world defined by rapid innovation.

Generative artificial intelligence (GenAI) tools such as Co-Pilot can create highly customized outputs, like risk and control matrices, and even audit reports. They can even work alongside AI agents, which autonomously execute tasks and adapt to new data. These tools are transforming industries and enabling organizations to pivot quickly while creating risks that internal auditors must address proactively.

Just like the lighthouse standing up to 15-foot waves, let’s explore how internal audit can rise to the challenge of technological disruption, outlining proactive strategies, practical tools, and actionable steps to help organizations weather the storm and thrive.

• The expanding scope of technological disruption
  • What is technological disruption?
  • What are examples of disruptive technologies?
• The role of internal audit in mitigating technological risks
  • Proactive vs. reactive risk approaches
  • Leveraging technology to enhance audit efficiency
• Practical steps to future-proof internal audit
  • Step 1: Create a disruption radar
  • Step 2: Conduct incident planning and stress testing
  • Step 3: Invest in continuous education
  • Step 4: Discuss potential risks of disruptions with stakeholders and the audit committee
  • Step 5: Build collaborative frameworks
• Conclusion

Practical steps to future-proof internal audit

Step 1: Create a disruption radar

A disruption radar helps internal audit identify and monitor emerging technologies and risks. Follow these steps to implement a disruption radar:

• Trend analysis: Assign team members to track and document developments in technologies like Agentic AI or quantum computing. Listen to podcasts, follow industry publications, or have the team consistently interact with your IT and InfoSec staff on these newest technologies.
• Impact assessment: Use quarterly or bi-annual workshops with your IT and InfoSec colleagues to assess how new technologies can affect internal controls, cybersecurity, and compliance.
• Prioritization: Rank identified risks by their likelihood and severity, ensuring critical risks are addressed first. For example, since the banking sector is anticipated to be one of the first industries to implement quantum computing, you might want to give quantum computing risk a higher priority if encryption flaws expose private information.
• Action plans: Develop action plans to address each identified risk. For example, implement quantum-resistant encryption protocols before quantum computing becomes mainstream. This allows you to address these risks proactively, while ensuring organizational resilience.

Step 2: Conduct incident planning and stress testing

Effective incident planning and stress testing help to make sure there is organizational readiness. To strengthen these:

• Simulate cyber threats: Run simulations including AI-powered cyberattacks to evaluate organizational reaction times and identify gaps in incident protocols.
• Stress test autonomous systems: For organizations using robotics, simulate operational disruptions (e.g., a supply chain breakdown caused by a malfunctioning robot) to test resiliency.
• Evaluate recovery frameworks: Review disaster recovery strategies to ensure they consider emerging threats, such as ransomware attacks targeting AI systems. Bonus: Review the cyber insurance coverage of your organization to determine what is covered and what is not. For example, a system that falls under a subsidiary may not be covered by your identified policy!

Step 3: Invest in continuous education

For audit teams, keeping current with new technologies calls for continuous education. Practical ways to achieve this include:

• Certifications: Encourage auditors to pursue certifications in AI, robotics, and cybersecurity, such as those offered by The Institute of Internal Auditors (IIA) or ISACA.
• Workshops: Organize quarterly workshops to educate audit teams on emerging risks including quantum computing or autonomous systems.
• Cross-functional training: Partner with risk management and IT teams to give your audit team practical hands-on training in assessing technological risks.

Step 4: Discuss potential risks of disruptions with stakeholders and the audit committee

Effective communication with the audit committee and your key stakeholders guarantees alignment on the risks posed presented by technology changes and the organizational readiness. To ease these conversations:

• Present concise, actionable insights: Summarize potential risks in clear, non-technical language, explaining how—such as artificial intelligence bias or quantum computing's encryption concerns—could affect strategic goals. Make conclusions easily available via dashboards or heatmaps.
• Schedule regular updates: Host quarterly or semi-annual risk briefings to provide information on emerging risks, mitigating techniques, and technology-related opportunities including automation or AI.
• Emphasize the cost of inaction: Emphasize the financial, operational, and reputational consequences of neglecting to address emerging risks.

Step 5: Build collaborative frameworks

Building collaborative frameworks ensures that internal audit works seamlessly with other departments to address cross-functional risks and leverage diverse expertise. To establish effective collaboration:

• Create cross-functional teams: Form working groups that bring together internal audit, IT, compliance, and risk management teams to address emerging technological risks such as AI misuse or supply chain vulnerabilities.
• Establish shared goals: Align on objectives for managing disruptions, such as improving cybersecurity protocols or ensuring compliance with evolving regulations tied to technologies like blockchain or IoT.
• Utilize collaborative tools: Employing centralized reporting systems, shared dashboards, and real-time communication technologies can help to improve transparency and streamline team decision-making.

Conclusion

Internal audit must always change to meet the risks and opportunities given by disruptive technology, much as a lighthouse must update its equipment to remain essential in modern storms. Emerging innovations like generative AI, quantum computing, neuromorphic computing, and autonomous systems may create uncertainty, but they also provide opportunities for growth and innovation—opportunities that internal audit can help organizations seize responsibly.

By adopting proactive strategies, leveraging solutions like Wolters Kluwer TeamMate, and fostering collaboration, internal audit can remain a trusted guide, steering organizations safely through turbulent waters. Those who adapt, innovate, and lead will shape the future of internal audit. This is not just a challenge—it is an opportunity to shine brighter as the trusted beacon of resilience for internal audit.