{{item.videoDuration}}
{{item.title}}
{{item.text}}
{{item.videoDuration}}
{{item.text}}
Key takeaways:
- Annual risk assessments are no longer sufficient for today's rapidly changing risk environment; leading internal audit (IA) functions are moving toward a dynamic, data-driven risk assessment.
- Five capabilities distinguish more mature risk assessment programs: dynamic risk inputs, stronger ERM alignment, continuous audit planning, clearer translation of risk into audit coverage, and AI-enabled risk sensing.
- Most organizations recognize the need to modernize, but relatively few have embedded continuous monitoring, trigger-based planning, or AI into their risk assessment process.
- Practical near-term and long-term actions can help IA internal audit functions build a more responsive, risk-based audit planning process.
Internal audit's risk assessment has long served as the foundation for audit planning. But as organizations navigate accelerating technology transformation, evolving regulations, geopolitical uncertainty, and changing business models, many are finding that an annual risk assessment is no longer enough. To understand how leading IA functions are adapting, PwC surveyed IA leaders in early 2026. The findings highlight five capabilities that are helping organizations build more dynamic, data-driven risk assessment and audit planning processes.
Practical ways to modernize the risk assessment process
Explore the survey findings, maturity models, and implementation guidance
{{filterContent.facetedTitle}}
{{contentList.loadingText}}
{{contentList.loadingText}}
Follow us
