4 Priorities and 33 Questions to Help Your Internal Audit Team Increase Impact in 2027

What happens when you put 100 high-caliber Internal Audit leaders in one room for two days? 

More info for your calculations: Very few open laptops. Thoughtfully assigned tables. CAEs and direct reports only, all genuinely interested in doing their jobs better. No distractions beyond the mountain views, fall colors, better-than-average catering, and table conversations. 

At APEX, the Internal Audit Collective’s first in-person leadership retreat, we got to find out. It proved what I’ve always believed: If you surround yourself with great people, great things happen. 

The quality of the sessions = universally high. The level of engagement = off the charts. As we’d hoped, the 11 sessions weren’t about our presenters “telling.” Instead, they shared their ideas and how-to guidance in a way that reliably turned the spotlight back on attendees’ own problems, questions, and experiences. 

Every attendee went home with specific, actionable ideas they could execute immediately.

For anyone who couldn’t join us, today’s article shares some highlights and inspiration, including three key questions to consider for each. (APEX attendees: Download slides and worksheets here.)

The content at APEX reflected four key priorities Internal Audit teams should be focused on heading into 2027, helping us better align our resources, technology investments, and strategies to stay relevant and provide the value our organizations need. 

Priority 1: Delivering the Value Our Leadership Teams Need

From Mission to Strategy to KPI: A Framework for Internal Audit Success

Are you focused on running the business (operations) or changing the business (strategy)? 

Having a mix is appropriate; what’s important is doing both. That’s exactly why IT Audit VP Rob Snyder — who admits to being "obsessed with the auditor of the future” — kicked things off by helping us get more strategic about how Internal Audit provides value to the business. He talked us through the whys and hows of:

• Creating clear, concise, value-focused mission and vision statements that (1) your team members know and can readily talk about and (2) reflect “your definition of winning”
• Aligning Internal Audit’s strategic goals with the company’s strategic objectives and tracking ongoing alignment with dashboards tracking specific success metrics 
• His team’s “choice strategy,” which pinpoints what they’re prioritizing (e.g., efficiency improvements) and how they “win” (e.g., tracking progress over time, assigning accountability)
• Multi-year strategic planning, creating three- to five-year plans that align with IIA Standards

Three questions from our discussion:

1. If you asked your team to explain your team’s vision and mission, could they do it? 
2. Do your audit results reliably link back to Internal Audit’s strategic objectives?
3. How can you embed strategic objectives in individual performance goals? 

Stay tuned! Rob will share more strategic planning guidance in an upcoming Internal Audit Collective article.

Internal Audit's 2027 Advisory Playbook

Are you providing forward-looking advice to help solve the business’ most pressing problems? 

Internal Audit leader Doug Hardesty’s session reinforced that Internal Audit must “transform or risk irrelevance.” That means shedding our “police” reputations, earning trust, and showing our stakeholders that we can do more. Explained Doug, “The shortest path to momentum is successful delivery of a small number of the right advisory engagements” that:

• Focus on important business needs, including high-stakes situations such as major programs or initiatives, pilots, key decisions, or standing governance (e.g., ERM, AI governance)
• Can be delivered credibly by Internal Audit (i.e., within remit, successful track record for other teams, repeatable, scalable)

Three questions from our discussion:

1. Are you telling stakeholders the full range of what Internal Audit can do?
2. Are you looking beyond the obvious to identify new types of advisory engagements that will deliver value?
3. Is your team positioned to be in the right places at the right times, with “access before the decision is made”?

Doug is working with several other members of the Internal Audit Collective on an Advisory Playbook eBook. We’re excited to share it in the coming months!

From 90 to 30 — Improving Audit Report Timing Lag

Are you giving your leadership team what you think they need — or what they actually need? 

When Internal Audit Executive Director Jan Murry and Internal Audit Director Matthew Kohls realized that their team’s reporting lag averaged 99 days from final findings to final-report issuance, they knew they had to do better. So they used the Kaizen process to break down the problem. As Jan explained, “We walked through every step in the process and asked, was it value-add or non-value-add? And if it was non-value-add, was it necessary or unnecessary?” It was humbling for Jan, who realized, “I was unnecessary waste every single step of the way.” 

Grounding the process in their experience, Jan and Matt helmed a 90-minute working session to lead attendees through a structured process of using Kaizen to break down and identify root causes and actionable solutions for their own problems. 

Three questions from our discussion:

1. Is the problem you’ve identified what actually needs solving? Or is there a root cause you need to address first? In other words, are you focused on the problem or the symptoms?
2. Can you instill the commitment, discipline, and mindset to (in Matt and Jan’s words) “slow your brain down” and avoid immediately jumping to solutioning? 
3. Can an external stakeholder help you see root causes or solutions you wouldn’t come up with on your own? 

Learn more about the process Jan and Matt are using to reduce their audit reporting lag. 

Priority 2: Better Aligning Audit Resources With Top Risks

A Modern Take on the Internal Audit Risk Assessment

Can you afford to let your risk assessment sleep when risk NEVER sleeps? 

Internal Audit Professional Practices Director Emmanual Benton shared how his team’s multi-layered, AI-enabled approach helps them receive and read the signals to continually refresh their assessment. As Emmanual explained, “A leader’s world changes every single day. So our goal becomes: How are we making sure that our risk assessments and audit plans change at the velocity of the business?” To that end, his team’s “living risk assessment” includes:

• An Internal Audit “AI brain” named Jarvis that funnels years of audit data and meeting notes along with news, tweets, competitor and investor insights, earnings reports, and more to continually update the assessment. (My prediction: Teams naming their AI “brains” Priscilla!)
• A risk “gauntlet” that lets any auditor propose a new risk at any time which then passes through various levels of leadership review.
• Monthly, quarterly, and bi-annual meetings to help them see the full risk story, including the multi-year strategy lens, “street story” (what leaders will actually say), stakeholder pulse, and risk views across the three lines. 

Three questions from our discussion:

1. What was the last risk signal that should’ve changed your audit plan — but didn’t?
2. Does your risk assessment process involve all the right people at all the right levels? 
3. If you were the leader of your company and had a team of 100 independent assassins, what would you need them to do? Are Internal Audit’s “assassins” focused on the right areas? (Don’t worry — no actual assassinations. Emmanuel’s point was to emphasize how Internal Auditors are an elite force that must be deployed strategically.)

Emmanual wants to help other teams build the AI-enabled “brains” that help them continually refresh their risk assessments. Stay tuned to his LinkedIn!

How to Perform a Cyber Risk Assessment for a More Targeted 2027 Audit Plan

How can your team hone in on the cybersecurity audit areas that really matter?  

Cybersecurity Leader Dave Malcom offered an updated framework to help Internal Audit teams be more specific and relevant in the coming year, including sharing:

• How the cybersecurity landscape has changed in the past year, including attacks happening 65% faster, data breach costs at an all-time high, and a 56% increase in AI-driven attacks
• New and elevated risk areas, including how AI agents and non-human identities are being used to access systems using their own credentials
• How recent guidance from the Big Four and Protiviti all point toward increasing expectations for continuous risk assessment 
• An updated playbook for conducting your cyber risk assessment, including recommendations on layering risk frameworks (e.g., ISO, NIST, COBIT, FAIR), applying a scoring methodology to build your cyber audit universe and audit plan, and surfacing cyber risk insights

Three questions from our discussion:

1. Does your cyber risk assessment look the same as last year? If it does, in Dave’s words, “You’re either a very lucky organization or you didn’t update it.” 
2. Are you using the right risk frameworks to guide your assessment? Said Dave, “Just like you can’t use one tool to fix anything in your house, you can’t use just one framework.”
3. Do you have a clear view on who has system access across your entire supply chain?

Dave often leads webinars and office hours in the Collective — in fact, you can join Dave’s webinar TODAY 10/29/26 on “Adaptive Risk: A framework for Internal Audit to Provide Assurance in Today’s AI-Driven Threat Landscape.” We previously featured his six-step approach for more targeted cybersecurity risk assessments; we’re planning a follow-up with his updated guidance. 

Coordinating with the 2nd Line and Influencing Leadership

Are you adept at coordinating across assurance functions — without blurring accountability? 

Chief Auditor Rachel Tressy and Audit Director Linda Piazzaroli generously shared their first-hand experience and insights on what worked — and what didn’t! — in helping their all-remote organization improve coordination with the second line. In particular, they reinforced that:

• Leadership changes may mean starting over and/or changing your approach  
• Management doesn’t care about defining “lines,” so don’t waste time explaining the nuances 
• Strong relationships do not eliminate the need for independent judgment
• Every level of your team needs strong influencing skills (defined as “the ability to help leaders see risk differently and take appropriate action”), enabling better conversations with the business that produce better outcomes, more trust, and genuine partnership

Three questions from our discussion:

1. What does coordination look like today in your organization? Who’s at the table — and who do you need to invite to the table?
2. How will you help your team cultivate stronger influencing skills (e.g., stakeholder feedback, involvement in more stakeholder conversations, relationship matrix)? 
3. What specific relationship(s) will benefit from a different approach?

Want more insights to help your team make progress on connected risk, combined assurance, or whatever you want to call it? Learn how others move the needle.  

Driving Internal Audit Value with ERM

Is Internal Audit helping to drive more value from the organization’s ERM efforts? 

CAE Beth Womersley gave us a masterclass in doing exactly that, talking through the realities and practicalities of building an ERM program and sharing her own lessons learned and templates. She emphasized the importance of: 

• Developing a vision, including being clear on why you’re building it and what your priorities are
• Roadmapping the journey, from establishing your ERM governance and methodology to operationalizing it (e.g., ownership, KRIs, action plans), integrating it in strategy and decision-making, and scaling and optimizing it over time
• Grounding ERM in corporate strategy/objectives and a clear view on risks’ interconnections
• Translating the ERM risk view to auditable units and applying Internal Audit’s judgment to balance risk, coverage, timing, and available capacity in a defensible, risk-based audit plan

Three questions from our discussion:

1. What is your vision for a mature ERM function? As Beth asserted, “Start with the end in mind.”
2. Who is missing from the process your organization uses to identify its enterprise risks? 
3. What could you gain — and what challenges might you create — from broadening participation?

Need some help and inspiration for getting your organization’s leadership team onboard with ERM’s value? Try Linh Truong’s approach for explaining ERM to executives in 15 minutes or less. 

Priority 3: Leading From the Front on AI

Exploring Internal Audit's "Build and Buy" Strategy for AI

How can you ensure that the AI solutions you build or buy actually solve your team’s problems?

With how fast the AI technology landscape changes, it’s hard to separate the hype from the reality to develop a strategy that can anchor your efforts for the long term. Leveraging his ~25 years of Internal Audit leadership experience, Petual’s Audit Executive David Coloumbe shared practical methods for defining your objectives, matching audit tasks to the right AI tool types, and applying an evergreen decision framework that weighs cost, quality, accountability, skill, and scope to determine the best fit for each use case. Break-out discussions on the different decision dimensions reinforced how the right answers vary for each team — and change over time.

Three questions from our discussion:

1. What specific Internal Audit problems do you want to solve with your AI strategy? 
2. What parts of your work are core to Internal Audit’s value proposition? What parts can you afford to “outsource” to AI?
3. Which of the five decision dimensions (cost, quality, accountability, skill, and scope) is most important for your team?

I had the privilege of partnering with David on the Collective’s new eBook, How to Develop Internal Audit’s Build-or-Buy AI Strategy: A Practical Decision-Making Guide. Download your copy now.

The Emerging Role of the Internal Audit AI Operator

Is your team translating its enthusiasm for AI into actual execution and accountability?

Early in their AI journey, Internal Audit Director Brianna Bazzy’s team realized that their biggest barrier to increasing AI adoption was that “When AI is everyone’s second priority, it is actually no one’s first.” So they elected to dedicate one full-time FTE and changed the game entirely. Whereas the team’s first six months of experimentation yielded only five tools, the AI operator’s next six months’ produced 25 tools with zero external cost. The team is targeting a full AI operating model by 2027. 

Three questions from our discussion:

1. What is the single biggest bottleneck slowing your AI adoption?
2. What would change in your team if you had someone 100% dedicated to thinking about how your audit team can make more effective use of AI in their work? 
3. Who is the person on your team that could become your AI operator? 

Want to learn more about the emerging AI operator role, including what they do, how they measure success, and how they got their roles? We interviewed two pioneering AI operators to find out. 

Change Management Strategies for Teamwide AI Adoption

Are you treating AI adoption as the change-management problem it is?

As Internal Audit Director Joe Earl’s team leaned into AI, they developed several practices that helped the entire team level up. Building upon Joe’s own enthusiasm and experimentation, they learned to:

• Have leaders “show and tell” AI prompts and methods through live working sessions (in fact, Joe’s sessions directly inspired the Internal Audit Collective’s AI Office Hours)
• Build awareness through ongoing exposure, treating AI adoption as continuous learning
• Create learning infrastructure, including usage guidelines, human validation requirements, AI office hours, a prompt library, and embedding AI reflection into routines 
• Shift from AI literacy to work execution, embedding it in department and individual goals, active projects, and audit processes (e.g., RCM development, testing/validation) 
• Position Internal Audit as an advisor supporting responsible AI adoption enterprise-wide

Three questions from our discussion:

1. Where is your team on its AI maturity journey? How does your organization perceive your maturity? 
2. How are you setting expectations for AI adoption at the team and individual level?
3. In what specific areas are AI adoption efforts missing key aspects of change management?

Want to use Joe’s proven approach to help your own team level up? Follow these five simple steps. 

Priority 4: Leading With Courage, Resilience, and Heart

The Heart of the Resilient Internal Audit Leader

What big challenges are on the horizon for your organization? Is your team equipped? 

Closing out the conference, CAE Rebecca Pomerleau shared her deeply personal story of resilience. Twelve years ago, she went from being an ostensibly healthy person on a ski trip to urgently needing a heart transplant. Quoting Mike Tyson, Rebecca said, “Everyone has a plan until they get punched in the face.” 

As Becky’s presentation reinforced, Internal Auditors need to be brave enough to try new things, and resilient enough to keep going when not everything works on the first try. We need to go in expecting the bumps in the road, hard lefts, and hairpin turns — and expecting that we can apply our audit skill set to either stay the course or adapt.

Three questions from our discussion:

1. How do you show up for your team and business leaders in times of crisis or rapid change? 
2. Can you stay grounded in the facts to understand (and accept) what you can and can’t control?
3. Do you cast a “hopeful vision” for your team’s future?

THE LAST WORD: We’re in This Together

None of us should expect to do any of this alone. 

Going it alone is harder and takes longer — both to understand what you’re doing wrong AND how you can do it better. 

Facing these challenges takes the Internal Audit Collective. 

If you’re already a member, are you leaning in to make the most of everything the Collective offers? If you’re not a member yet, what on earth are you waiting for? Join us today. 

‍