The Risk Has Moved. Has Internal Audit?
What the IIA’s new Global Chair says the profession needs now
In a 15-minute episode of All Things Internal Audit, IIA President and CEO Anthony Pugliese speaks with Stacey Schabel, the new Chair of the IIA Global Board.
Her theme for the year is:
Risk-Focused, Future-Ready
The message is simple. Risk is changing faster than many traditional audit practices. Internal audit must keep pace.
1. Audit must follow the risk
Technology, artificial intelligence, cyber threats, geopolitical uncertainty, regulation and third-party dependencies are making risks more connected and harder to predict.
Yet internal audit can still spend too much time on familiar controls and yesterday’s problems. Familiarity is comfortable. Risk is under no obligation to be.
Audit must focus on the risks that matter most now, as well as those beginning to emerge.
Schabel’s warning is clear: the gap between where risk lives and where internal audit traditionally looks is widening.
2. Assurance must look forward as well as backward
Traditional assurance remains essential. But it is no longer enough.
Schabel argues that internal audit should also provide:
insight into emerging risks;
foresight about what may happen next;
advice that strengthens organisational resilience;
a clearer link between risk and strategy.
Internal audit should still explain what went wrong. It should also help the organisation see what could go wrong next.
A clear view through the rear-view mirror is useful. It is not a complete method of driving.
3. Internal audit must connect the dots
Boards face cyber risk, AI, operational resilience, regulatory change, third- and fourth-party risk, and strategic uncertainty. Often all at once.
These risks do not sit quietly in separate boxes. They interact.
Internal audit has an organisation-wide view that few other functions possess. It can connect risks that management may otherwise consider separately.
To do this well, auditors must understand how the organisation creates value, how its strategy works and which risks could prevent it from succeeding.
Knowing the control is useful. Knowing why the control matters is better.
4. Audit skills and methods must change
If internal audit wants to remain relevant, it must adapt its:
skills;
methodologies;
use of technology;
understanding of the business;
professional mindset.
AI should not be treated as a distant technical subject reserved for specialists and conference panels. It is already changing how organisations work and how audits can be performed.
Schabel encourages the next generation of auditors to help lead that change.
The technology will not wait until the audit profession feels fully prepared. Technology has rarely shown such courtesy.
5. Curiosity matters more than narrow technical knowledge
Schabel’s advice to emerging audit leaders is practical:
Remain curious and keep learning.
Understand risk, not only audit procedures.
Follow external developments that could affect the organisation.
Learn how the business creates value.
Embrace technology and AI.
Find mentors—and become a mentor to others.
Audit techniques help an auditor perform an engagement. Curiosity helps the auditor understand why the engagement matters.
A technically correct answer to the wrong question remains the wrong answer.
6. Influence must be earned
One of the strongest points in the discussion is that technical ability alone does not create influence.
Technical skills may secure the job. They may also earn someone a seat in the meeting.
Lasting influence comes from:
credibility;
relationships;
trust;
teamwork;
authenticity.
Internal audit becomes a trusted adviser because people trust its judgement. Not because its reports contain particularly impressive footnotes.
Methodology can support credibility. It cannot manufacture it.
7. Integrated assurance must work in practice
Schabel identifies stronger integrated assurance and better application of the Three Lines Model as priorities.
The emphasis is on practical coordination.
Risk, compliance, internal audit and other assurance providers should work together. Significant risks should receive proper coverage. Duplication should be reduced. Gaps should not remain unnoticed.
The model only helps if people use it. A diagram cannot coordinate an organisation.
8. What would success look like?
By the end of her term, Schabel would like internal auditors to be:
more confident in addressing emerging risks;
better prepared for AI and digital change;
recognised as strategic partners;
more effective in applying integrated assurance;
better equipped to support boards and senior leaders;
inspired to develop the next generation of audit leaders.
She also stresses the need to listen to different voices and respect regional differences.
There is no single method of delivering value that works everywhere. A global profession needs common principles, but it should not confuse consistency with uniformity.
The main lesson
Make it stand out
I went out for a run and listened to the latest All Things Internal Audit podcast.
The plan was simple: run, listen and avoid thinking too much about how far I still had to go.
Then Stacey Schabel, the new Chair of the IIA Global Board, raised a question that stayed with me:
What if risk is moving faster than internal audit?
Her theme for the year is Risk-Focused, Future-Ready.
By the end of the run, I had the idea of summarising the discussion for Phronesium.
My main conclusion?
A perfect audit of yesterday’s risk is still the wrong audit.
Apparently, running is good for both cardiovascular health and unnecessary additions to my writing schedule.
The future of internal audit is not simply more technology, more training or more sophisticated methodology.
It is better judgement applied to the risks that genuinely matter.
Internal audit must understand the past, examine the present and help the organisation prepare for what comes next.
Otherwise, it may deliver a perfect audit of a risk that has already moved elsewhere.
Based on the latest All Things Internal Audit conversation between Anthony Pugliese and Stacey Schabel:
https://www.theiia.org/en/content/podcast/all-things-internal-audit/2026/ep-0129/
