Internal Audit 4.

0
Purpose driven,
GO
digitally powered
June 2022 To experience all the interactive elements, please view in Adobe Reader
Internal Audit 4.0
Content

A lot has happened since Deloitte released Internal Audit 3.0 01

Recap
IA 3.0

(IA 3.0), our market leading framework for elevating the

02
role and expanding the remit of internal audit1.
Recap
IA 3.0

03
Incorporate
into IA 4.0

This framework supported the concept that internal audit is responsible for Looking ahead, the breadth of demands on internal audit, and
balancing three core activities: providing assurance, advising management, pace and scale of innovation in the profession point to the need
and anticipating risks and opportunities. Striking that balance challenged for an update, but not an overhaul, of our vision of the internal 04
Future
Function

internal audit functions to increase their impact on their organizations by audit function of the future—hence, Internal Audit 4.0 (IA 4.0).
delivering value through a combination of Assure-Advise-Anticipate. Internal
This publication, directed to internal audit leaders,
05
Future
Function

Audit 3.0 has been a useful and durable framework for many internal audit
professionals, and stakeholders:
functions as they’ve evolved their role and remit, and inspired innovation in
their ways of working.
01 Recaps the elements of Internal Audit 3.0

Few could have predicted the events of the past years since the release of
IA 3.0 or the speed with which new challenges and demands have emerged. 02 Summarizes lessons learned as functions have
adopted the framework; and
We’ve also experienced leading Internal audit functions embracing
innovation throughout the IA lifecycle becoming more resilient, more
valued, and more impactful. 03 Presents a refreshed vision of the future of the internal
audit function, IA 4.0, which incorporates those lessons
and demonstrates why internal audit functions should
be purpose driven and digitally powered.
2
Internal Audit 4.0
Content

IA 3.0, revisited
01
Recap
IA 3.0

Organizations invariably benefit by IA 3.0: Assure-

02
Recap
IA 3.0

elevating the role and expanding Advise-Anticipate

Our IA 3.0 framework
the remit of internal audit. 03
Incorporate
into IA 4.0
encouraged internal
audit functions to:
That’s especially so if they have currently relegated the
04
Future
Function
function to routine compliance and assurance activities and Click to view more
have resourced it accordingly. Those approaches limit the
value and contribution of internal audit to the organization. 05
Future
Function

That is why we championed a broader remit for the function

with IA 3.0, which preserved the central role of assurance
while stretching functions to become more advisory and
anticipatory. We’ve seen great examples of functions
who have embraced this challenge and successfully
supported management in navigating risks that could
have undermined—and opportunities that could have
enhanced—the organization’s performance.

3
Internal Audit 4.0
Content

01
Recap

IA 3.0 summarizes elements within Assure-

IA 3.0

Advise-Anticipate as well as related skills 02

Recap
IA 3.0

and capabilities, enablers, and digital assets.

03
Incorporate
into IA 4.0
Although many internal audit functions have moved into advisory and risk
anticipation activities, the pace at which they have done so has often been
outpaced by the evolving needs of their organizations, and the speed at 04
Future
Function

which risk events have emerged.

Executive teams and audit committees now need internal audit support on a 05
Future
Function

new and dynamic range of matters, including:

• Guidance on decisions, processes, and responses related to the global pandemic and
the resulting supply chain, remote work, security, and regulatory issues;

• Environmental, Social, and Governance (ESG);

• Building and protecting trust between organizations and their stakeholders;

• Diversity, Equity, and Inclusion (DEI) issues, and reputational risks; and

• Decisions and controls around robotic process automation (RPA) and Artificial
Intelligence (AI) applications.

4
Internal Audit 4.0
Content

Lessons learned
01
Recap
IA 3.0

Ongoing disruption is here to stay: We have all moved beyond “change is the only constant” to an
environment of ongoing disruption. Over recent years we’ve observed the following key lessons from 02
Recap
IA 3.0

functions who have successfully embedded a culture of continuous improvement and innovation. Click to view more

03
Incorporate
into IA 4.0

04
Future
Function

05
Future
Function

Speed and agility Big bang approaches Haphazard efforts

are essential tend not to work undermine progress

5
Internal Audit 4.0
Content

What’s new?
01
Recap
IA 3.0

02
Recap
IA 3.0

03
Incorporate

Our updated IA 4.0 framework brings

into IA 4.0

three new features to the forefront. 04

Future
Function

By aligning internal audit’s outcomes with the

05
Future

organization’s purpose, helping accelerate Function

organizational change and learning, and further

embracing digital, we believe internal audit can
upgrade and maximize its impact and the value
it delivers.

6
Internal Audit 4.0
Content

Purpose driven, digitally powered

01
Recap
IA 3.0

Purpose Purpose Vision Strategy 02

Recap
IA 3.0

REMIT High impact areas of focus CORE OPER ATING SYSTEM

03
Incorporate
into IA 4.0

Assure Advise
Position & organization
04
Future

Key Design Principles and Building Blocks

Core processes Risk & assurance strategy Function

External & leading practice

Greatest risks

Process & technology

05
Future
Function

Decision governance
Anticipate

Change risk Emerging & dynamic risk

Behaviours
People & knowledge

Accelerate
Second line functions
Organizational learning

Digital technologies Management action Performance & communication

Hover over to
view more

Click to
Agile Mindset Digital view more

7
Internal Audit 4.0
Content

Purpose 01
Every organization has a purpose, although some • Create stronger engagement with stakeholders; Recap
IA 3.0

are more clearly defined than others. These may by creating a better understanding of internal
be to save money for customers, improve health audit’s value through increased collaboration on
and wellbeing, maximize convenience, or create a the development of action plans and coaching
through implementation to address internal audit
02
Recap
IA 3.0
sustainable future. Purpose drives an organization
Whether forced to re-engage observations
and inspires and harmonizes its functions, teams, and
with their purpose in the wake individual roles. • Make smarter choices on where they place
03
Incorporate
into IA 4.0

of the pandemic or by the their investments; ensuring innovation efforts are

By aligning internal audit’s role and remit with the purpose driven
groundswell of ESG and DEI issues, organization’s purpose, a new orientation for many
04
Future

purpose has become increasingly As a profession, IA clearly plays a role in helping Function
functions, internal audit can:
build confidence and trust between organizations
important for organizations and • Create value by designing their role, remit,
and stakeholders (be they investors, employees, or
and ways of working in a more intentional
their stakeholders to strengthen society). Under Internal Audit 4.0, this doesn’t change 05
Future
Function
way to support a specific outcome and
but those functions who deliberately use purpose to
brand and reputation, generate contribution for the organization
shape their role and remit will maximize the impact
market value, and contribute to • Attract top talent who, research has shown,
they bring to their organizations.
would prefer to work for purpose driven
sustainability initiatives. organizations and teams

View case study

Back 8
Internal Audit 4.0
Content

Accelerate 01
Many internal audit functions already work to • Change the culture - Some leading functions are Recap
IA 3.0

accelerate organizational learning and management looking at the concept of psychological safety and
action through root cause analysis, thematic considering how internal audit can influence their
observations, insight reports, issue validation, organizations to help create the conditions for
learning and action. Psychological safety stems
02
Recap
IA 3.0

Organizations who have thrived in challenging assumptions, and follow up on

from mutual trust and respect which enables
remediation. Yet most can do more, while preserving
uncertain times were the ones who their independence and objectivity. Example strategies
people to be candid and open without being
hindered by fear. An organization improves only 03
Incorporate
into IA 4.0

could learn to adapt and act quickly. for Internal Audit include:
by knowing what is and isn’t working. Knowledge
And it’s here where we think internal • Act with speed - Simply delivering audit that comes about only when people feel it is safe
and project results faster will often quicken to report problems and experiment with new 04
Future

audit can stretch its remit further—by

Function

management’s responses—a key outcome for approaches. Internal audit should consider how its
helping to accelerate organizational functions embracing agility as they work in sprints ways of working contribute to helping create this
and issue findings iteratively. environment.
learning and management action. 05
Future
Function

• Go beyond the audit - Too often internal audit

leaves management with a list of issues, only
to follow-up a few months later to report on
whether gaps have been closed. Without owning
remediation, functions could help by sharing
insights on leading and external practices,
encouraging systemic solutions rather than single-
point fixes and advise on building a more robust
and future proofed control environment.

View case study

Back 9
Internal Audit 4.0
Content

Digital 01
Of course “adopting Digital” is not the end goal. • Mindset - It doesn’t matter if you’re a small or Recap
IA 3.0

The goal is is improved quality, productivity, large function, the mindset and willingness to
insights, innovation, collaboration, and practitioner explore and experiment with digital tools is half the
engagement. This comes about by applying Digital battle. It’s the reason why we’ve elevated digital up
to the mindset level of our model, and something
02
Recap
IA 3.0

Many functions have embraced to audit work and by helping the organization to use
we think the future function needs to cultivate. So,
Digital effectively.
data analytics but have limited their help your teams get tech savvy - enable them to
see the possible applications through education 03
Incorporate

adoption to using analystics for

into IA 4.0
IA 4.0 aims to transform ways of working by embedding
and awareness; promote innovation – make it safe
digital capabilities into internal audit work, for example
data queries or sampling. Few view in workflow management, automated assurance, audit
for experimentation; keep everything on the table
“Digital” broadly enough or leverage management systems, communication interfaces, such
– digital doesn’t just mean analytics, and celebrate 04
Future
Function

desired behaviors to encourage ideas.

capabilities to support the entire as dashboards, and mobile applications such as drones
for site inspection or inventory purposes. Potentially • The second differentiator is approach. More
audit lifecycle or in continuous useful digital technologies include AI, RPA, SaaS, social digital functions have taken a systematic and 05
Future
Function

auditing or predictive analytics. media, and the Internet of Things (IoT). methodical approach to digital innovation, taking
the time to assess their ways of working to
As the title of this publication implies, IA 4.0 is digitally identify and prioritize opportunities to leverage
digital. These functions intentionally pilot proof of
powered as well as purpose driven. Applying digital
concepts and measure Return On Investment (ROI)
entails looking to the art of the possible, while taking
to guide purpose driven investments.
a highly systematic approach to using technology.
Through our experience of delivering External Quality
Assessments (EQAs) and looking in on leading
functions who have made better progress in digitizing
broader aspects of their functions, there are two View case study
differentiators we see in more digital functions.

Back 10
Internal Audit 4.0
Content

Mindset 01
The right mindset is one of continuous learning— Recap
IA 3.0

experimenting and iterating at a faster pace, with

ongoing communication and embedded agile
methods. This mindset enables the function to 02
Recap
IA 3.0

Anticipating risks and opportunities pursue incremental improvements that generate

lasting and relevant change.
and responding rapidly requires
03
Incorporate
into IA 4.0

agile and digital capabilities—and Internal audit can promote that mindset by using
digital tools and agile methods in its work and by
the right mindset. Without that fostering sound use of those tools and methods
04
Future

mindset, those capabilities will within the organization. At its best, this creates
Function

an organizational culture of continuous learning

be unused or underused. For and continuous improvement.
example, some functions adopt 05
Future
Function

terms or practices from agile but

not the mindset; many limit their
use of digital capabilities to (often
rudimentary) analytics.

View case study

Back 11
Internal Audit 4.0
Content

Operating 01
The internal audit operating system considers Recap
IA 3.0

the position, organization, processes, technology,

skills and expertise, and communication strategies

system
that help drive performance. The function should 02
Recap
IA 3.0
enact the mindset of continuous learning and
improvement, updating its operating system by
leveraging digital capabilities and challenging
03
Incorporate
into IA 4.0
ways of working that no longer add value to
For internal audit functions to stakeholders, or are outdated.
embrace purpose, expand their 04
Future
Function

remit and fully utilize digital

technologies, they must embed
05
Future
Function

these concepts in the key design

principles of the function and the
building blocks which support their
day-to-day practices.

View case study

Back 12
Internal Audit 4.0
Content

How Deloitte helps Purpose,

Function 01
Recap
IA 3.0
vision and
set-up
strategy labs

IA 4.0 aims to deliver assurance, advice, 02

Recap
IA 3.0

and anticipation of risk to accelerate

Methodology
External quality 01 02 design and
assessment
organizational learning and action rapidly.
build
08 03 03
Incorporate
into IA 4.0

Click services
to view more
The framework informs our differentiated approach to providing outsource
07 04 04
Future
Function
and co-source internal audit support. For in-house functions looking to set Agile
Benchmarking
their future vision, elevate their impact and enhance their performance, Internal Audit
06 05
Deloitte offers a comprehensive suite of Internal Audit Advisory services
05
Future
Function
for functions to draw upon regardless of where they are on their journey
to internal audit excellence. Learning &
Digitalization
development
These services enable adoption of IA 4.0 by supporting internal audit
functions from initial design, build of functional processes, assessment
of performance and improvement through strategies such as digital, agile,
and learning and development. Individually or collectively, these services
enable functions to take coherent steps to enhancing their performance,
relevance, and impact, designing their own version of a purpose driven and Design and build
digitally powered function. Improve
Assess

13
Internal Audit 4.0
Content

Let’s talk
01
Recap
IA 3.0

Key contacts 02
Recap
IA 3.0

Peter Astley Sarah Fedele Mike Schor 03

Incorporate
into IA 4.0

Global Internal Audit Leader Global Transformation and US Lead Global IA Innovation Lead
pastley@deloitte.co.uk sarahfedele@deloitte.com mschor@deloitte.com
04
Future
Function

Neil White Chris Dicks

Global IA Digital Lead Global IA Growth and AsiaPac Lead 05
Future
Function

nwhite@deloitte.com chdicks@deloitte.com.cn

Authors

David Tiernan Owen Jackson

Global Internal Audit Global Internal Audit
datiernan@deloitte.co.uk ojackson@deloitte.co.uk

14
Internal Audit 4.0
Content

Let’s talk
01
Recap
IA 3.0

Key contacts in France 02

Recap
IA 3.0

Sonia Cabanis Estelle Carrier 03

Incorporate
into IA 4.0

Associée Deloitte Risk Advisory Directrice Deloitte Risk Advisory

+33 1 58 37 03 04 +33 1 55 61 46 97
scabanis@deloitte.fr ecarrier@deloitte.fr 04
Future
Function

Nicolas Fleuret
Associé Deloitte Risk Advisory 05
Future
Function

+33 1 55 61 61 89
nfleuret@deloitte.fr

15
 Content

01
Recap
IA 3.0

Endnotes
02
Recap
IA 3.0

1 Internal Audit 3.0: The future of Internal Audit is now, 2018 Deloitte Touche Tohmatsu Limited
2 Becoming agile: A guide to elevating internal audit’s performance and value – Part 1: Understanding agile internal audit, Deloitte, 2017
03
Incorporate
into IA 4.0

04
Future
Function

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited (“DTTL”), its global network of member firms, and their related entities (collectively, the “Deloitte
organization”). DTTL (also referred to as “Deloitte Global”) and each of its member firms and related entities are legally separate and independent entities, which cannot
obligate or bind each other in respect of third parties. DTTL and each DTTL member firm and related entity is liable only for its own acts and omissions, and not those of 05
Future
Function
each other. DTTL does not provide services to clients. Please see www.deloitte.com/about to learn more.

Deloitte is a leading global provider of audit and assurance, consulting, financial advisory, risk advisory, tax and related services. Our global network of member firms
and related entities in more than 150 countries and territories (collectively, the “Deloitte organization”) serves four out of five Fortune Global 500® companies. Learn
how Deloitte’s approximately 330,000 people make an impact that matters at www.deloitte.com.

This communication contains general information only, and none of Deloitte Touche Tohmatsu Limited (“DTTL”), its global network of member firms or their related
entities (collectively, the “Deloitte organization”) is, by means of this communication, rendering professional advice or services. Before making any decision or taking
any action that may affect your finances or your business, you should consult a qualified professional adviser. No representations, warranties or undertakings (express
or implied) are given as to the accuracy or completeness of the information in this communication, and none of DTTL, its member firms, related entities, employees or
agents shall be liable or responsible for any loss or damage whatsoever arising directly or indirectly in connection with any person relying on this communication. DTTL
and each of its member firms, and their related entities, are legally separate and independent entities.

© 2022. For information, contact Deloitte Global.

16