Future-Ready: An Audit Maturity Model for Shifting Impact With Action

As the digital superstorm of the fifth industrial revolution (5IR) reshapes the business landscape, internal audit must transform to maintain relevance. The reactive audit focused on the past should be replaced by a proactive one that delivers foresight, identifies future risk, and motivates innovation and digital transformation.¹

This shift is supported by the recently updated International Professional Practices Framework (IPPF), which redefines the role of internal audit to enhance an organization’s ability to create and sustain value.² The IPPF extends the scope of audit service portfolios beyond traditional assurance to include the delivery of advice, insight, and foresight. This definition also aligns with ISACA’s IT Audit Framework (ITAF) guidelines, which specify advisory roles for IT auditors.³ By leveraging these concepts and other management methodologies and competencies,⁴ internal audit functions can pursue new strategic approaches and incorporate technology competencies, boosting proactivity and increasing organizational impact.

There are several strategic approaches and technologies that aim to help organizations promote proactivity within the audit function. Adopting these practices involves a departure from theoretical audit recommendations, with the focus instead on actively delivering practical, value-driven solutions. These practices are categorized across proactivity maturity levels and serve as the foundation of the proposed Audit Proactivity Maturity Model (APMM). The model serves as a practical guide for advancing audit proactivity as a key element of transforming audit into an agent of change. Moreover, boards of directors (BoDs) can utilize the APMM to evaluate the internal audit function's level of proactivity.

Notably, while the APMM was developed for the internal audit function, its principles may also be applied by those in roles related to risk management, compliance, and controls.

Internal Audit Redefined

In the IPPF, Domain I: Purpose of Internal Auditing redefines the internal audit as a key contributor to informed decision making and long-term value creation. It emphasizes that internal auditors should go beyond providing traditional assurance by also delivering advice, insight, and foresight to promote the organization’s competency to create and sustain value.⁵

The IPPF defines advisory services (or consulting services) as activities where the internal auditor provides guidance and advice without performing a formal assurance process. These services encompass advising on the design and implementation of new policies, processes, systems, services, or products, and engaging in discussions related to risk and controls.⁶

Moreover, ITAF guidelines 2001.2.3, 2003.5.2, and 2003.8 further delineate the advisory roles of IT audit. IT auditors can serve as ad hoc advisors or reviewers of IT projects and controls. Furthermore, they may also be asked to aid steering, implementation, or evaluation teams.⁷

IPPF Principle 2 Maintain Objectivity, within Domain II: Ethics and Professionalism, and ITAF guideline 2008.3.1 both emphasize that internal auditors must consistently uphold an independent, objective, and unbiased stance when providing audit services and making professional judgments.⁸

Assurance activities have limited influence on new products, processes, or services. As such, they present a lower risk to the independence and objectivity of internal audit. Meanwhile, advisory services are proactive and forward-looking. As such, they influence future decisions and may raise potential issues pertaining to the objectivity of internal audit.

It is essential to maintain a balance between internal audit proactivity and the fundamental principles of independence and objectivity. Therefore, appropriate mitigation strategies to manage risk must be established.

Strategic Approaches for Proactive Audit

Maturity models indicate the extent to which processes, objectives, or competencies are efficient and effective. In addition, these models provide guidance for outlining a roadmap and vision for improvement.⁹

In the context of proactive audit, the APMM offers a structured framework for enhancing audit capabilities. The APMM categorizes strategic approaches based on levels of proactivity maturity, as illustrated in figure 1.

The proposed model introduces five levels of proactivity maturity.

Level 1: Initial—Reactive and Ad Hoc
Internal audit at maturity level 1 primarily responds to existing conditions and occasionally engages in ad hoc proactive activities. The lack of a consistent, systematic, and proactive approach limits audit’s overall influence and impact.

Level 2: Repeatable—Systematic, Real-Time Audit
Internal audit at maturity level 2 is defined by a mindset that emphasizes assurance over ongoing, forward-looking activities. This approach positions internal audit closer to decision-making crossroads and fosters audit proactivity in a systematic and repeatable manner.

Real-time audit enables the internal auditor to deliver value through recommendations that can be implemented before auditees are invested in finalized actions and revisions become costly. As a result, auditees are more receptive to insights, thereby leading to more substantial impact.

Level 3: Defined—Data Analytics POC Competency
Internal audit at maturity level 3 incorporates a systematic application of data analytics and artificial intelligence (AI). These technologies can be used to validate control automation concepts and practically illustrate the use of organizational data in facilitating evidence-based decision making. Working proofs of concept (POCs) effectively demonstrate the value of audit recommendations, improving auditee collaboration and engagement while creating significant impact.

The POC should present a viable solution that is sufficiently complete to operate independently. Otherwise, the auditee may reject the audit POC due to the residual effort required for its implementation within the organization. Such efforts include, for instance, the development of interfaces between organizational information systems, the deployment of new dedicated infrastructure, or a significant upgrade of organizational platforms.

Data analytics, including AI-based practices such as machine learning (ML), can be utilized to illustrate data manipulation and the application of automated controls. The data analytics POC should be performed within a dedicated, audit-controlled data environment. Such an environment should be operated separately from live production systems and based on technologies already used in the organization. After the audit, the data analytics framework can serve as a practical reference, offering auditees a solid foundation for implementation.

To illustrate, consider a scenario where audit findings highlight a control weakness in identifying client errors when filling out digital loan documents. In this case, a data analytics POC may include structured query language (SQL) scripts employed to perform input-validation controls, such as range, format, and data-type checks. In addition, the data can be cross-referenced with both internal and external databases such as records of asset encumbrance. By applying data-driven automation to a sample document set, the auditor can effectively identify additional deficiencies beyond those found with current controls. Incorporating return on investment (ROI) metrics will demonstrate the value of deploying the improved automated controls in a live operational setting.

Level 4: Managed—Technology-Based POC Competency
While data analytics are valuable, some audit recommendations necessarily extend beyond standard data processing and address areas such as functionality, user experience, technology infrastructure, and the assimilation of new technologies. In these cases, additional tools and skills may be needed for internal audit to demonstrate feasibility. This could involve presenting a tangible technological POC to validate practicality and demonstrate value

To meet this objective, internal audit must have the capability to develop, implement, and operate applications and technology components within a controlled environment. To enhance the relevance and realism of the POC in the context of the actual organization, the audit-controlled IT environment should ideally allow internal auditors to interact with existing organizational applications, tools, and data. Recent progress in AI and low-and no-code technologies offers accessible and affordable tools that support these requirements.¹⁰

To illustrate, reconsider the previous example, but assume the forms are paper-based rather than digital, requiring manual review. The internal audit team can leverage advanced AI-driven tools to perform optical character recognition (OCR)¹¹ on unstructured physical documents, encoding them into structured tables while also conducting free-text analysis. Beyond automatic input validation and database cross-referencing, the audit team is now able to uncover discrepancies that emerge during the transition from handwritten documents to operational systems.

Even when auditees recognize a practical audit POC as feasible and valuable, however, its implementation remains subject to organizational prioritization and budget allocation. To enhance impact, internal audit may consider specific mechanisms to promote the initiatives stemming from its recommendations and POCs:

• A dedicated budget allocation (an “audit wallet")—Consists of reserved budget vouchers that the internal audit function can provide to support the implementation of audit recommendations based on POCs. These vouchers may cover either the full or partial costs necessary to carry out the audit recommendations linked to the POC. This mechanism could help reduce resistance from auditees in adopting recommendations due to budget limitations, while improving the impact of audit on the organization.
  
  Given that budgets are always limited, the internal audit function should establish a structured process to prioritize which auditees will receive these resources, based on risk level, organizational impact, and alignment with the organization’s strategic priorities.
• A preprioritized allocation in the organizational project portfolio—Consists of reserved prioritization slots within the organization’s project portfolio that the internal audit function can use to prioritize the implementation of audit recommendations derived from audit POCs. This mechanism has the potential to minimize auditee resistance to adopting recommendations caused by prioritization challenges and enhance the impact of the audit.

To ensure continuous improvement and maximum effectiveness, the internal audit function should consistently monitor and update these mechanisms using ongoing key performance indicator (KPI) tracking. However, these mechanisms require careful consideration of their potential implications for internal audit's independence and objectivity.¹² Key risk indicators (KRIs) may be used as early warning controls to mitigate that risk. For instance, KRIs may include the proportion of the audit support budget relative to total organizational initiatives, or the share of audit priority slots compared to the organization’s overall prioritized initiatives.

Internal audit at maturity level 4 introduces an additional layer of demonstration. This extends beyond data analytics to encompass realistic workflows, comprehensive use cases, and technology-driven processes. At this stage, internal audit is equipped to function as a pseudo-IT driver. It serves as a practical testing playground, effectively validating and showcasing proposed concepts and solutions within a realistic operational context.

By extending capabilities to encompass technology-based POCs, a wider spectrum of value demonstration becomes available. As a result, audit proactivity is improved, auditee engagement and collaboration are enhanced, and impact is amplified.

Level 5: Strategic and Optimized—Mindset Shaping and Strategic Impact With Continuous Improvement
Internal audit at maturity level 5 formalizes consistent strategic involvement in actively shaping the organizational mindset. This engagement is significant and expected to achieve a dual benefit: It will enhance the quality of organizational decision making and simultaneously increase auditees' receptiveness to insights, recommendations, and concepts that internal audit practically demonstrates. In addition, internal audit is expected to continuously seek opportunities to drive change and expand its influence across the organization. This continuous improvement effort ensures that overall impact is maximized.

The comprehensive, demonstrable capabilities inherent in maturity levels 4 and 5 allow internal auditors to practically validate and demonstrate complete data-and technology-driven concepts. This is especially important as auditees who realize the value of audit recommendations and POCs may encounter implementation challenges due to inflexible and outdated organizational mindsets and paradigms. These are frequently shaped by established operational configurations, workflows, and decision-making processes within the organization. For example, executive management boards or project committees can foster dynamics such as groupthink and overshadowing. Groupthink occurs when a group values consensus over informed decision making, resulting in flawed decisions. Overshadowing occurs when a dominant individual sets a tone, discouraging others from sharing their views. Moreover, team members whose perspectives consistently deviate from organizational viewpoints may be perceived as obstructive. As a result, team members may refrain from proposing new ideas and opinions, tending instead to adopt the most dominant perspective (often coming from a senior employee). This disrupts the balance of member contributions and compromises psychological safety, ultimately inhibiting novel viewpoints and hindering knowledge integration and creation. As a result, innovation and digital transformation are impaired.¹³

Internal audit can only fully realize its value by engaging proactively where and when decisions are made. This requires a consistent presence at the crossroads where the organization defines its future. For example, internal audit may be appointed as a permanent observer of forums where culture and strategy are shaped and critical decisions are determined. This may include project and process steering committees, executive management meetings, and BoD sessions.

To aid this integration, the internal audit role can be formalized through a charter. Such a charter would empower internal audit to proactively challenge prevailing mindsets and introduce alternative perspectives. This may include red teams or devil's advocate teams, whose role is to challenge plans, strategies, and decisions by presenting opposing perspectives and alternative approaches. It is recommended that audit red team insights be shared during a designated time slot, enabling the audit to effectively present its insights and recommendations along with the underlying rationale. This should align with a structured process where management listens to the audit red team, then poses questions and offers opinions, after which auditors provide responses. By doing so, internal audit enriches the informed decision-making process with additional knowledge, viewpoints, and insights. In addition, it helps build a positive organizational culture that values objective consideration of all viewpoints and alternatives while promoting openness to paradigm shifts. This culture would, in turn, encourage the first and second lines to safely voice diverse opinions.

Conclusion

Applying the APMM can transform the internal audit function beyond traditional roles of retrospective review and reporting. As internal auditors progress through each of the levels of APMM, they move closer to where decisions are made and impact is generated. Thus, the APPM fosters deeper involvement in decision-making processes, mindset shaping, and driving organizational change. Ultimately, when organizations utilize the APMM, internal audit has the potential to have greater relevance, influence, and impact.

Endnotes

¹ Koriat, N.; “Internal Audit as a Driver of Innovation,” ISACA^® Journal, vol. 4, 2023; Chambers, R. F.; Perez, R.; Agents of Change: Internal Auditors in an Era of Disruption, Internal Audit Foundation, USA, 2021
² The Institute of Internal Auditors, The International Professional Practices Framework, 2024
³ ISACA^®, IT Audit Framework (ITAF): A Professional Practices Framework For IT Audit, 4^th Edition, USA, 2020; The Institute of Internal Auditors, Complete Global Internal Audit Standards, 7 May 2024
⁴ Koriat, N.; “Future Ready: Toward a Sound Agile Audit Framework,” ISACA Journal, vol. 6, 2023,; Koriat, N.; “Future Ready: Utilizing OKR for Audit Engagement Planning,” ISACA Journal, vol. 3, 2024, ; Koriat, N.; "Future Ready: Exploring (Artificial) Intelligence, GPT, and Audit," The Internal Auditor Journal (IIA Israel – Institute of Internal Auditors), vol. 18, 2024, p. 16–19
⁵ The Institute of Internal Auditors, The International Professional
⁶ The Institute of Internal Auditors, The International Professional
⁷ ISACA, IT Audit Framework
⁸ The Institute of Internal Auditors, The International Professional; ISACA, IT Audit Framework
⁹ Mettler, T.; “Maturity Assessment Models: A Design Science Research Approach," International Journal of Society Systems Science, vol. 3, 2011, p. 81–98, .; Heller, A.; Varney, J.; "Using Process Management Maturity Models," American Productivity and Quality Center (APQC), 2013; Merkus, J.; Helms, R.; et al.; "Reference Model for Generic Capabilities in Maturity Models,” Proceedings of the 2020 12^th International Conference on Information Management and Engineering, 2020, p. 10–17 
¹⁰ Khankhoje, R.; "Beyond Coding: A Comprehensive Study of Low-Code, No-Code and Traditional Automation," Journal of Artificial Intelligence & Cloud Computing, vol. 1, iss. 148, 2022, p. 2–5; Yan, Z.; “The Impacts of Low/No-Code Development on Digital Transformation and Software Development,” 2021
¹¹ Singh, A.; Bacchuwar, K.; et al.; “A Survey of OCR Applications,” International Journal of Machine Learning and Computing, vol. 2, iss. 3, 2012
¹² ISACA, IT Audit Framework; The Institute of Internal Auditors, “Complete Global Internal Audit”
¹³ Google, “Understand Team Effectiveness,” ; Hoegl, M.; Gemuenden, H. G.; "Teamwork Quality and the Success of Innovative Projects: A Theoretical Concept and Empirical Evidence,” Organization Science, vol 12, iss. 4, 2001, p. 435–449; Elliott, H. S.; The Process of Group Thinking, Association Press, USA, 1928; Rabenu, E.; Twenty-First Century Workplace Challenges: Perspectives and Implications for Relationships in New Era Organizations, Bloomsbury Publishing, United Kingdom, 2021; Koriat, N.; Gelbard, R.; "Knowledge Sharing Motivation Among IT Personnel: Integrated Model and Implications of Employment Contracts," International Journal of Information Management, vol. 34, iss. 5, p.577–591

NOAM KORIAT | PH.D., CISA, CRISC

Is the director of information systems audit at Discount Bank. Previously, he served as global chief information officer (CIO) of the Israeli Ministry of Tourism. Koriat also serves as an adjunct professor at the Graduate School of Business Administration at Bar Ilan University (Ramat Gan, Israel), where he teaches digital transformation and innovation, knowledge management, and information systems practicum courses. Koriat can be contacted on LinkedIn at https://www.linkedin.com/in/noamkor/.