- What are we auditing that no longer moves the dial? And what are we ignoring that will sink us in 18 months?
Most audit plans are tombstones of yesterday’s risks. You are auditing inventory while AI is writing fake invoices. You are counting laptops while algorithms are manipulating procurement. Stop asking for past data, start interrogating future failure.
Build a live, dynamic risk radar, use AI signal tracking, and predict disruptions before they become KPIs. Audit what has not gone wrong, yet. You are not preventing fraud,d but you are avoiding the need for fraud. That is ROI no spreadsheet can capture.
- How did this audit shift executive behaviour?” Not just the process, did it rewire thinking?”
Most audit reports end in the shredder of “noted, will revert.” Audit should be a leadership intervention, not a compliance formality. If your audit doesn’t cause tension at the ExCo table, you’re not telling the truth. Comfortable auditors are redundant.
The best ones are a little scary. Introduce “behavioural audit metrics.” Track changes in strategic decisions, not just control implementation. A process fixed is good. A mindset shifted. That’s cultural capital. Priceless. Perpetual.
- If we were a startup audit firm, how would we disrupt this function?
What would we automate, outsource, or eliminate today?”
Internal audit should cannibalise itself before disruption does. Outsource controls testing, automate routine, insource strategic foresight, operate like a lean fintech, and build modular skills, offer data analytics, ethical hacking, ESG assurance, and boardroom advisory under one roof.
You not only protect value but also create it, faster, cheaper, and smarter than any regulator could imagine. The internal audit must stop being the internal affairs department and become the venture capitalist of control. The ethicist of algorithms. The conscience in board decisions.
When that happens, you will not just retain value but be the reason it multiplies.
I remain, Mr. Strategy
