Role
Description
Insights
Traditional assurance
Providing an independent and objective view on current state control environment by assessing current and historical performance of control activities
All internal audit functions have this role as part of their role regardless of level of maturity.
Providing the board, audit committee and management with an independent perspective on the effectiveness of the control environment is at the core of internal audit's purpose.
Most internal auditors feel comfortable in this role, but it can be limiting when it is the only role they play.
Proactive assurance
Accelerating the audit process during a period of organizational change or working with the organization to improve the control environment where there are weaknesses
This is the role most internal audit functions gravitate toward as they seek to elevate their brand and create / protect more value for the business.
Internal audit has expertise in risk and controls, and traditional assurance capabilities can be applied in a different capacity.
What is different is the mindset of internal audit needs to shift to working with the business to align on what needs to change and how to change it in a practical, meaningful and sustainable way
Risk foresight
Identifying a potential future issue and gaining consensus with the business to further assess business implications and/or take action to address when action was either missing or moving slower than needed
This is a role internal audit functions should embrace as it advances because it offers the function the ability to have an impact on the organization outside individual audit projects.
It requires internal audit to be intellectually curious, exercise strong business acumen and translate risks that are not fully understood within the industry (nor sometimes even acknowledged by the organization) into potential impacts.
It is critical that internal audit have a strong brand as a trusted advisor and possess advanced skills and diverse capabilities to play this role effectively.
Business collaborator
Working with the organization to understand an emerging or evolving risk area as well as its potential impacts on the organization and develop a plan to address those risks
This role is an evolution of the "risk foresight" role and is typically pursued by more advanced internal audit functions. Many functions struggle to gain alignment on whether this role is part of their responsibility and how much time to dedicate to playing this role.
Addressing risk as an organizational collaborator often requires access to a wide range of subject matter expertise and the development of new capabilities, including advanced technologies.
Risk areas are often new or complex. Traditional audit approaches are less applicable, and innovative audit techniques (e.g., scenario planning, training/educations, facilitated session, simulations, etc.) must be embraced.