3 minute read 27 Aug 2020
Business woman in meeting with laptop

COVID-19: How CAEs can shape the future of internal audit

By Lisa Hartkopf

EY Americas Risk Markets Leader

Strategic leader in transforming internal audit and controls. Generates energy and passion that can be leveraged in authentic ways to enable others to recognize their talent and potential. Mother.

3 minute read 27 Aug 2020
Related topics Consulting COVID-19

Internal audit must focus on transforming technology, talent and trust to help deliver more strategic value.

In brief
  • Chief audit executives (CAEs) should monitor internal audit plans for alignment with the new key priorities of the wider organization and adjust accordingly.
  • CAEs should be driving the focus of IA to be integral to recovery plans by understanding, assessing and monitoring the effectiveness of response to all risks.
  • CAEs must develop their team’s ability to be innovative, dynamic and to think out of the box, challenging the status quo and relentlessly driving improvement.

Chief audit executives (CAEs) were largely caught by surprise when the COVID-19 pandemic hit, which has unexpectedly thrown the role internal audit (IA) plays into the spotlight. As organizations move forward from the pandemic, internal audit (IA) can seize the opportunity to reinvent itself and improve its perceived value to the organization.

The situation and expectation for CAEs

IA functions that weren’t well prepared for business disruption and remote working struggled to carry out audit plans and had to reduce scope or cancel some field audits as they searched for ways to adjust their approach. By contrast, some IA functions helped to support the wider business in its pandemic response and have been able to demonstrate their value in new ways.

In the immediate term, an IA function that the business perceives as a trusted advisor will withstand tightening budgets and workforce reductions. In parallel, CAEs and the IA function also need to start reinventing themselves and delivering on their true purpose to the organization. 

Four actions for CAEs

1. Accelerate technology deployment

Most CAEs have plans to use technology better – now those plans must be accelerated so that routine work can be automated, and the IA function can focus on moving into strategic analysis and helping the board leverage data to make better risk-based decisions.

2. Focus on the effectiveness of risk and trust:

CAEs should be integral to business recovery in a post-COVID-19 world. Risk and trust are core to the recovery, ­so CAEs should help understand, assess and monitor the effectiveness of response to all risks – from the more traditional downside risk considerations, to upside (risks to take to get ahead, and highlighting the right indicators to make decisions) and outside risk (on which there is now renewed focus).

3. Begin the transformation of the function

CAEs need to develop their team’s abilities to be innovative and dynamic and to think out of the box. These are typically not technical audit skills, but rather knowing where the business is going is critical to the function’s future role. Some organizations are recruiting chief insight advisors to lead IA. With no internal audit experience, they are being tasked with breaking complacency and building a new IA function unconstrained by old ways of thinking. CAEs need to be aware that bold leaders who can challenge the status quo to relentlessly drive improvement will distinguish themselves and the IA function, while providing the confidence that management and the board need to take calculated risks and identify opportunities for growth.

4. Recruit and develop talent to support this transformation:

CAEs must reflect on the inherent uncertainty of the new normal by embodying a growth mindset to drive innovative progress in new directions. Even before the pandemic, IA needed more people with analytical skills, and now CAEs should focus efforts on recruiting more digital skills too. Internal audit leaders should also encourage their teams to take on new challenges, be curious, incorporate feedback to adopt more effective problem-solving strategies, and help build both their business acuity and emotional intelligence to help advance the traditional skillsets of the function.

Lead through the COVID-19 crisis

We have a clear view of the critical questions and new answers required for effective business continuity and resilience.


Contact us for immediate support

Gain access to our help with crisis management, business continuity and enterprise resilience.




This is an opportunity for the IA function to reshape and refocus itself, and show management and the Board how it can add greater value with improved risk response effectiveness and new growth mindsets.

About this article

By Lisa Hartkopf

EY Americas Risk Markets Leader

Strategic leader in transforming internal audit and controls. Generates energy and passion that can be leveraged in authentic ways to enable others to recognize their talent and potential. Mother.

Related topics Consulting COVID-19