Key findings: Agile IA functions are adaptive

State of the Internal Audit Profession Study, 2017


Create more flexible processes and reporting mechanisms

Agile IA Functions are able to change course and implement decisions at the speed required by the business. They have flexible processes across audit plan development, audit planning, fieldwork and reporting. They also routinely reorganize or redirect resources to help the organization manage and respond to disruption. Innovative talent models such as modified guest auditor programs or access to third-party sourcing help Agile IA Functions adjust capacity as needed. By studying Agile IA Functions, others can identify what they may need to do to disrupt their internal audit functions in the areas of process, technology and talent. 

Read our case study: Adaptive in action


“If we aren’t sitting side by side with people developing this stuff [blockchain, bots, etc.] we won’t be able to develop the right assurance model because we won’t have a deep enough understanding of how it works.”

– Michael Richards, General Auditor,State Street

Creating more flexible processes and reporting mechanisms

Agile IA Functions have built flexibility into their operations including having a more flexible mindset. They modify the audit plan more frequently to adjust for disruptions and changes in business strategy execution. They assemble teams with the skills to address specific risks. Furthermore, they modify their execution plan, testing strategies and even testing timelines as risks are better understood to focus activities as appropriate to higher risk and higher impact areas.

73% of Agile IA Functions change course and evaluate risk at the speed required by the business (vs. 37% of peers)

47% of Agile IA Functions have increased the use of data mining and data analytics for continuous auditing/ monitoring of trends and potential impacts of disruption (vs. 35% of peers)

Driving the use of data analytics and technology

Many internal audit functions are incorporating data analytics into fieldwork and testing. Nearly half of Agile IA Functions are leveraging more advanced applications, including progressing data analytics use into risk assessment and continuous auditing, which increases the likelihood that Internal Audit will generate new insights regarding existing or emerging disruptive risks.

While the percentage of those employing these techniques needs to continue to rise, the Agile IA Functions still significantly outpace their peers.


Case Study: Adaptive in action

Lockheed Martin Internal Audit is using systems of metrics and analytics to provide not only an audit function but also a surveillance function that has had a direct impact on their talent model. CAE Dr. Leo McKay realizes one could debate whether it is a second or third line of defense responsibility to monitor areas known to be problematic. Nonetheless it has become very important to how Internal Audit does its job as it allows the function to be less labor intensive. The function has freed capacity equaling nine full time equivalents through its surveillance efforts.


Food for thought

  • Are your actions able to sufficiently effect change in a timeframe that’s relevant/needed by the business? 
  • Are your performance metrics aligned to building and operating an agile internal audit function? 
  • Is your team able to demonstrate a sufficient grasp of the subject matters important to your stakeholders?
  • How are you preventing your talent pool from becoming complacent?
  • Have you identified a strategic service provider and invested in the success of that relationship?

Contact us

Jason Pett
Risk Assurance Leader, PwC US
Tel: +1 (410) 659 3380

Lauren Massey
Internal Audit, Compliance & Risk Management Solutions Principal, PwC US
Tel: +1 (813) 222 5455

Mark Kristall
Partner, Internal Audit, Compliance & Risk Management Solutions
Tel: +1 (617) 530 7592

Terrence Panfil
Director, Internal Audit, Compliance & Risk Management Solutions, PwC US
Tel: +1 (312) 298-2868

Follow us