Internal audit · Developments · Value creation
From compliance to value creation: internal audit is evolving
Long seen as a backwards-looking compliance exercise, internal audit has changed profoundly. Recent international standards and board expectations are shaping a more strategic, forward-looking function.
For a long time, internal audit operated on fixed cycles: reviewing, year after year, a list of entities or processes, checking their compliance with procedures. Useful, but limited: this approach could devote as much attention to a minor subject as to a major risk.
From a tick-box audit to a risk-based audit
The model that is gaining ground today is different. Internal audit focuses its work where the risks are most significant for the organisation, and adapts its plan when these risks evolve. We no longer «make the rounds» of everything every year: we go first where the stakes are real.
Create, protect and sustain value
The Global Internal Audit Standards published in 2024 by the Institute of Internal Auditors (IIA) clearly state the purpose of the function: to enhance the organisation's ability to create, protect and sustainably grow value creation. The word «create» is not trivial. A function that limits itself to protecting looks mainly backwards; a function that also helps to create value illuminates decisions, projects and strategy.
What boards expect today
Expectations are rising. According to the report Risk in Focus 2026, coordinated by the European Confederation of Institutes of Internal Auditing (ECIIA), the risk landscape has never been so volatile: cybersecurity, artificial intelligence, geopolitical uncertainty. In this context, boards are demanding faster, clearer assurance that is more geared towards anticipation.
The same report points to a persistent gap between the level of certain risks and the time internal audit can devote to them. Bridging this gap requires trade-offs — and a close dialogue between the board, management and internal audit on priorities.
A forward-looking function
The shift comes down to a single sentence: moving from observation to advice. Not abandoning insurance—it remains the core business—but adding anticipation to it: flagging emerging risks, shedding light on important decisions, and helping the organisation to prepare rather than repair.
ARCAD helps refocus the function on your actual risks and on anticipation.
References & further reading
- Global Internal Audit Standards, Institute of Internal Auditors (IIA), 2024.
- Report Risk in Focus 2026, European Confederation of Institutes of Internal Auditing (ECIIA).