CAE Survey: Data-Driven Insights to Help You Be a Better Leader — Part 1: Conversation Quality & Quantity

Some CAEs rise above the rest. People seek their counsel and listen to it. Their impact is greater. 

These top-tier CAEs aren’t seen as “compliance police.” They’re seen as partners to the business. 

I want to figure out why, because the answers could help Internal Auditors at every level make progress toward trusted-advisor status. After all, as AI and automation take over more of our core responsibilities, our leadership, judgment, and people skills are becoming more critical. (Just ask EY.)

What specific activities are top-tier CAEs doing differently? 

Because I’ll always be an auditor at heart, I ran a survey and dug into the data. And here’s the great news: My seven key findings all point to actionable recommendations CAEs and non-CAEs alike can use to become better leaders. We’ll share these findings in a series of articles in the coming weeks. 

First up: Two findings that point to specific activities you can use to improve both the quality and the quantity of your conversations with the business. 

CAE Survey Background

Methodology: The Internal Audit Collective’s survey was open to CAE-level Internal Audit Collective members from July 14 to August 3, 2026. We received 114 total responses representing a range of industries and team and company sizes. The 60 questions focused on how CAEs interact with business leaders, their teams, and the profession at large, and on their team’s operational infrastructure.

Analysis: We defined “top-tier CAEs” as those who self-assessed as either 9 or 10 on a 1–10 scale across all domains. We compared top-tier CAE data with all other respondents’ data.

Finding 1: How to Improve the QUALITY of Stakeholder Conversations

Top-tier CAEs have more conversations about the business with the business — and fewer conversations about Internal Audit.

• As the table shows, pretty much everyone is talking about the usual Internal Audit topics: audit results, findings, and remediation status, and upcoming audits and focus areas. 
• However, top-tier CAEs appear more likely to also share their perspectives on risks, business performance, operational effectiveness, industry trends and benchmarking, and how Internal Audit can help the business outside of traditional audit projects. In short, they’re spending more time talking about the business with the business.  

What’s the Difference?

Average CAEs

Put yourself in your stakeholders’ shoes. What does it feel like for them to talk to Internal Audit? 

Whether it’s the CFO herself, a direct report to the General Counsel, an HR exec, or a General Manager in another division, most Internal Audit interactions with the business tend to fall into one of two categories:

• You’re talking about an audit. You’re following up on audits your team has recently completed, asking about the three outstanding issues that still haven’t been remediated, calling out the missing documentation their team still owes you (asking them to move it forward), or telling them about the audits in scope for the coming year.
• You’re interviewing them for your annual risk assessment. You’re asking the tired, old Internal Audit question: “What keeps you up at night?” You’re making them do all the work. 

Is it any wonder business leaders aren’t always eager to talk to Internal Audit? 

In most situations, we’re either (a) talking about ourselves and what we need from them or (b) showing up unprepared for a conversation in which they’re doing the heavy lifting. 

Top-Tier CAEs

How do top-tier CAEs have better-quality stakeholder conversations? 

They still talk about what Internal Audit is doing. But it’s not their sole focus, because they also do three other things more frequently than their peers:

• They bring their own perspectives. They share their own understanding of business operations and performance, their POV on top risks and how they’re evolving, and their hypotheses on the emerging risks that may impact the business — including the potential impact to the specific group they’re talking to. 
• They share business-relevant information. They bring research, insights, and ideas focused on helping the business, whether in the form of investor information, research reports, internal or external benchmarking, analytics, leading practices, technology recommendations, or whatever else.
• They come prepared with better questions. Drawing on their perspectives and research, they’ve developed second- and third-level questions about risk, operations, and performance. They directly ask about how risks, technology implementations, and other business changes are impacting (or could impact) their specific part of the business. 

They’re not making their stakeholders do all the work. And when they are talking about Internal Audit, it’s more often in the context of how Internal Audit can help the business solve its problems. 

Instead of “we’re going to audit your process,” the messaging becomes “let us help you kick the tires on this process and offer some ideas for ways you could strengthen it.” 

They’re building trust, and cementing a reputation for being a partner to the business.

And before you start worrying about potential independence issues, let’s be clear: The business doesn’t care about our independence. They just want help. 

Objectivity is what matters — and objectivity is always in your control.

How to Get to “Great”

• Prepare a meeting “placemat” to do the talking about Internal Audit. The two-page leave-behind can cover the bases while getting you to your better-quality conversation faster. 
  
  • Put audit plan status on the front, and outstanding or closed issues on the back. Include only what’s specifically relevant to the stakeholder you’re speaking with. 
  • Share it when you arrive or beforehand, explaining what’s on it, calling out any critical issues, and inviting any follow-up questions. Use the remaining 95% of your meeting to talk about the business.
• Start out on the right foot. Whether you’re new to your organization or just looking to hit “reset” on your relationships, A CAE’s First 90 Days can help you plan the stakeholder and team meetings to enable better-quality conversations for the long term. 
• Get top-tier data from internal and external resources. We all know about these resources. The key is regularly using them to enable better conversations with the business. Look to:
  
  • Other internal auditors. How are other CAEs tackling similar audit or advisory projects? 
  • Industry peers. What are other Internal Audit teams focused on in your industry? What leading practices could you leverage from other organizations?
  • Industry associations. What were the best presentations at your last industry conference? How can you access insights from associations relevant to the part of the business you’re speaking with (e.g., HR, payroll, fraud)?
  • External resources. What are some relevant insights from recent reports from the Internal Audit Collective, The IIA, the Big Four, Protiviti, Accenture, the World Economic Forum, the Harvard Business Review, or other resources? Can you enlist a SME to help you better understand the problem?
  • Internal resources and SMEs. How can you surface more information and insights from the people within your organization? More frequent stakeholder conversations. Speaking of which….

Finding 2: How to Improve the QUANTITY of Stakeholder Conversations

Top-tier CAEs require all of their direct reports to formally maintain more business relationships on a more frequent basis — not just themselves.

• Top-tier CAEs don’t just spend their time talking about the business with the business. They mandate that their direct reports do the same, regularly meeting with business stakeholders outside the regular audit cadence.
• Other CAEs may require this as well. But we found that CAEs who self-assess as top-tier are more likely to mandate the practice.

What’s the Difference?

Average CAEs

In many cases, the CAE is the only team member regularly meeting with business stakeholders.

It’s basic math. One person = fewer meetings, fewer relationships, and less information.

Plus, the CAE is one person with one personality, working style, and perspective. What’s the likelihood they’re genuinely the best match for building a relationship with every key stakeholder in the business? 

Top-Tier CAEs

By enlisting their direct reports in building and maintaining stakeholder relationships, top-tier CAEs are able to get a stronger pulse on what’s happening across the business. 

More people = more meetings, more relationships, more information — and a better chance of matching the right Internal Auditor with the right business stakeholder. 

But let’s do some actual math featuring CAEs from our survey.

• In a ~100-person Internal Audit team in a global organization, the CAE has 24 total people from the leadership team (including herself) speaking directly to the business. Each of those people manage at least 8 relationships, meeting ≥6 times annually. 24 x 8 x 6 = 1,152 meetings annually! Imagine how well-versed this team is in what’s happening in their business and industry, from pain points and challenges to success stories, leading practices, and strategic priorities.
• They also synthesize this meeting information to make future meetings successful by:
  
  • Using a CRM to document the information and insights gleaned from each meeting.
  • Using a proprietary AI application to scrape not only the CRM’s conversational data, but also business performance data, prior audit results, in-progress audit work, and other business-related information that's being pre-populated into an internal LLM. The AI application draws on all the data to propose a tailored list of potential talking points each individual can use next time they meet with any given stakeholder.

Don’t have a 100-person team and/or the capacity to develop a proprietary AI app? You can still do this on a smaller scale and achieve super-impressive results.

• In Jim Wilson’s 3-person Internal Audit team, the math still works. Each person manages 8 relationships with key stakeholders, meeting with 4 every month. 3 x 8 x 4 = 96 meetings annually. 
• This is a new process for Jim’s team, so they can’t yet arrive at their meetings with amazing context and insights ready to share. But they’re strategically using the rollout to get the needed context/insights and make the process stick. Here’s how: 
  
  • Everyone said yes to the first meeting requests. (They always say yes the first time.)
  • During those first meetings, they’re asking about what’s happening in the business, from challenges and priorities to strategic initiatives and emerging risks. 
    
    • They’re also securing a second meeting, explaining that in meeting #2, Internal Audit will summarize the results from ALL the meetings, provide the anonymized raw survey data, and share Internal Audit’s insights and hypotheses about all of the above, asking for the stakeholder’s perspectives.
    • Nobody is going to say no to the second meeting, either, because everyone in the business wants to hear what other parts of the business are doing, worrying about, and planning. That knowledge helps them be more successful.

Why is getting more meetings — and thereby more information and more business relationships — so important? To start…

Better Audit Planning and Scoping

This is our opportunity to change what we’re auditing. 

Instead of only doing the usual (e.g., general audits of payroll, procurement, supply chain, compliance, or cybersecurity), you’re auditing specific and real business problems that actually matter to the business (e.g., go-to-market, user access review, AI governance review, targeted cybersecurity audits). 

Conversations with the business are Internal Audit’s best source of identifying the specific business problems that need solving. They give us the granular detail and on-the-ground insights to target planning/scoping on the audits that matter. They can even help us get ahead of the game, providing independent assurance that planned initiatives are set up for success. 

It’s not about the risk assessment. It’s about the conversations. 

If we do it right, we may not even need an Internal Audit risk assessment to figure out what to audit. We’ll already be aligned to the right business problems. 

Connecting the Dots for the Organization

Meeting regularly with all of these business leaders, being the information gatherer/sharer, analyzing results, formulating hypotheses and then validating those hypotheses with the business to better understand the problem — that’s how Internal Audit connects the dots on risk management. 

You won’t do it by asking “what keeps you up at night,” or spending most of your stakeholder meetings talking about audit results and outstanding issues. 

You’ll do it by having a point of view, sharing information they care about, and asking better questions. Even if they disagree with your point of view, they’ll still want your information. And as you become known as organizational stewards of all of this awesome information, it’s more likely they’ll accept your help when offered — and that they’ll ask for your help even when you don’t know to offer it. 

How to Get to “Great”

• Make a plan to expand relationship coverage across your team. Map which business relationships can be owned by a CAE direct report. Determine frequency. Find a relevant business topic to start the conversation. Meet, document, and share notes. Ask to come back — delivering insights, sharing hypotheses, and getting their take.
• If you’re the CAE, assess how you allot your time. Are you spending enough time talking with the business about the business? The CAE survey also found that top-tier CAEs generally spend 25–50% of their time meeting with the business (vs. overseeing Internal Audit work).
• Socialize the idea: Simple conversations matter. Talking more often with more people across the business (whether formally or informally) makes a big difference. How Simple Conversations Can Revolutionize Internal Audit offers a primer on who to talk to and how to begin. 

THE LAST WORD: What Will You Do to Become a Stronger Leader? 

In a couple years, after AI takes on even more of Internal Audit’s traditional work, how will you have honed your leadership and people skills to move past the “compliance police” reputation and toward trusted-advisor status?

It’s a big question.

Why not break it into smaller components? 

The CAE survey findings point to simple changes CAEs and non-CAEs can start making now. Here are four to consider:

• Share this article with your team. Use it to jumpstart the conversation and help you build a roadmap for improving the quality and quantity of your stakeholder relationships.
• Spend 30 minutes today finding relevant business insight. During your next stakeholder meeting, what business-relevant information will you share as a springboard for a better conversation? 
• Join the Internal Audit Collective. Want to know how other teams tackle similar problems? As a secure, private, dedicated community of Internal Audit practitioners, we’re a fantastic place to ask questions, share challenges and leading practices, and connect with others in your role or industry. Members can also sign up for IAC Connect, our 1:1 networking match program. 
• If you’re a CAE or CAE direct report, join us at APEX. APEX is a leadership retreat bringing together peak-performing leaders to build connections while sharing practical ideas for leveling up leadership. APEX happens October 20-21, 2026, in beautiful Stowe, Vermont. Only limited tickets are available, so secure your spot today; the event is capped at 80 attendees. Plus, TODAY (9/17/26) is the last day to secure the discounted group rate at the Lodge at Spruce Peak!

‍