Is internal audit unintentionally diminishing the significance of compliance?

 When internal auditors and risk management professionals emphasize that their role extends beyond compliance, do they risk unintentionally diminishing the perceived importance of compliance itself? I posed this question to Gemini, and here is the perspective it offered:

No. Framing services as "going beyond compliance" elevates compliance rather than undermining it, positioning compliance as the non-negotiable baseline, not the ceiling.
When internal audit (IA) and risk management emphasize value beyond compliance, they are addressing a common perception that risk functions exist solely as check-the-box regulatory police.
Why "Beyond Compliance" Strengthens the Baseline:
* Establishes compliance as table stakes: To provide strategic advisory, operational insights, or performance optimization, a risk or audit function must first assume that regulatory and legal standards are fully met.
* Prevents blind spots: A pure compliance focus often misses strategic, reputational, or emerging operational risks that aren't governed by explicit laws. Moving beyond compliance ensures those gaps are monitored.
* Drives business integration: Leaders rarely engage deeply with audit findings if they only address low-level administrative rules. Linking compliance to business objectives, risk mitigation, and revenue protection increases buy-in across management.

Where the Risk Lies:
The narrative only becomes problematic if internal audit or risk management neglects core compliance duties in pursuit of strategic consulting. If baseline internal controls fail or regulatory mandates are overlooked while chasing "strategic value," then compliance and organizational credibility are undermined.
True value exists in a spectrum: Compliance protects value, while going beyond compliance builds and optimizes value.
hashtag#internalaudit hashtag#compliance hashtag#risk hashtag#GRC

Humans: The Real Risk Factor in AI

 Artificial Intelligence is often seen as the looming risk to society. However, the greatest risk lies not in the algorithms themselves, but in us, the humans who design, deploy, and govern them.

Human-Centric Risks:
* Bias in design: AI reflects the data and assumptions we feed it. When those inputs are biased, the outputs amplify discrimination.
* Governance failures: Weak oversight and profit-driven motives often push unsafe systems into critical domains.
* Overreliance on automation: Blind trust in AI outputs can sideline human judgment, leading to catastrophic errors.
* Weaponization risks: AI becomes dangerous when deliberately misused for surveillance, cyberwarfare, or autonomous weapons.
* Transparency gaps: Corporate secrecy and opaque models prevent accountability, leaving users and regulators in the dark.

Why Humans Are the Core Risk:
AI is a mirror. It reflects our values, decisions, and flaws. Systemic issues, corporate incentives, political agendas, and cultural biases shape whether AI becomes a tool for progress or a weapon of harm.

Key Takeaway:
The narrative that "AI is dangerous" misses the point. Humans are the variable that determines whether AI advances society or undermines it. Stronger governance, transparent design, and ethical foresight are not optional; they are the safeguards against our own misuse.

Instead of fearing AI, we should fear complacency in how we manage it. The question isn’t whether AI will be safe; it’s whether we will be responsible enough to make it so.

#risk #airisk #governance #ai #internalaudit
This post was prepared using AI

Culture Risks within Internal Audit

 In a recent Wolters Kluwer webinar on Talent, Culture, and Workforce Transformation in Internal Audit, Liz Sandwith highlighted the growing expectation for internal audit to provide assurance on organizational culture, ethics, and leadership resilience.

Equally important, she emphasized the need to turn the lens inward, examining the culture within the internal audit function itself. Because how we operate as auditors directly shapes the credibility and value we deliver.

Liz also shared examples of cultural risks within internal audit. One that resonated deeply with me was the “fear culture suppressing professional skepticism.”

In my long consulting career, I have seen firsthand how fear can erode the performance of internal audit teams, silencing voices, weakening challenge, and ultimately diminishing assurance. Sadly, this culture still exists in some functions today.

For over two decades, I have been calling on internal auditors to be courageous. I am relieved that this principle is now emphasized in the Global Internal Audit Standards. Yet, adoption remains uneven, and many functions have yet to embed courage as a defining trait of their culture.

It is time for internal auditors to break free from fear, embrace skepticism, and stand firm as guardians of integrity.

#InternalAudit #Culture #ProfessionalSkepticism #Courage #GlobalStandards

Being an internal auditor doesn’t stop at the office; it shapes who we are.

 As we conclude Internal Audit Awareness Month and celebrate our pride in being internal auditors, it is important to remember that every profession leaves its mark not only on our careers, but also on our personalities and personal lives.

Being an internal auditor doesn’t stop at the office; it shapes who we are.

The positives?
We bring integrity, reliability, and critical thinking into every relationship.
The challenges?
Sometimes our vigilance makes us overly cautious or skeptical with family and friends.

The key is balance: carrying our strengths proudly while softening the edges in personal spaces. Internal audit isn’t just a profession; it’s a way of living with trust and accountability.

Internal Audit Month

 

Is SOC audits a substitute for third‑party risk assessments?

Could SOC audits serve as a practical substitute for third‑party risk management practices, particularly in smaller organizations? We posed the question to AI, and here’s what it had to say:

SOC audits are not a substitute for third‑party risk assessments.

They are a piece of the puzzle, not the whole picture.

A SOC report provides independent assurance that a vendor’s controls have been tested. It’s a valuable trust signal, but it doesn’t tell the full story.

Third‑party risk assessment goes further:

• 🌐 Evaluates financial stability, compliance posture, and resilience

• 🔍 Considers governance, subcontractors, and reputational exposure

• 📊 Provides a holistic view across people, processes, and technology

👉 Best practice: Use SOC reports within your risk assessment program, not instead of it. True resilience requires layered assurance.

What’s your perspective?

Internal Auditors' 2026 Horoscope

 I have asked AI (Copilot) to create a humorous 2026 horoscope for Internal Auditors. Here are the results:

• January: You’ll resolve to “close findings faster.” Stars say… you’ll just open new ones.

• February: Love is in the air, but so are overdue audit reports. Cupid prefers compliance.

• March: Spring cleaning? More like “control testing.” Dust off that risk matrix.

• April: Beware of April Fools—especially in expense claims. Fraud hides in jokes.

• May: Flowers bloom, and so do audit issues. Document them before they wilt.

• June: Mid‑year reviews reveal… you’re still waiting for management responses.

• July: Independence Day (US) inspires you: you’ll declare independence from Excel macros.

• August: Hot weather, hotter findings. Your audit committee wants ice‑cold assurance.

• September: Back-to-school vibes: you’ll lecture managers on segregation of duties.

• October: Spooky season. Ghost entries haunt the ledger. Boo! Material weakness!

• November: Gratitude month. Be thankful for strong controls… and coffee.

• December: Year‑end close. Stars say: Your gift is 'one more follow‑up.

Is there still a role for thought leaders in the age of AI?

 With AI tools at our fingertips, anyone can now create and publish content on virtually any topic, often with the polish and authority of a seasoned thought leader.

This evolution led us to ask a deeper question: Is thought leadership still relevant in the age of AI? Here is what AI thinks:

Thought leaders remain essential in the age of AI, precisely because they help bridge the gap between technological capability and human insight. Their role is evolving, not disappearing.

Why Thought Leaders Still Matter:
In an AI-driven world, thought leadership is no longer just about expertise; it's about vision, ethics, and strategic foresight. Here’s how their role is being redefined:
1. Navigating Complexity
AI is transforming industries, but many organizations feel unprepared to scale it responsibly.
Thought leaders help interpret the implications of AI, not just what it can do, but what it should do.
2. Human-Centered Strategy
According to Berkeley Executive Education, AI is reshaping the fabric of society. Thought leaders are needed to guide ethical, inclusive, and human-centric adoption.
They ask the hard questions: How do we preserve trust, creativity, and accountability in automated systems?
3. Cross-Domain Integration
Forbes notes that AI thought leadership involves connecting technology, ethics, and creativity.
This means thought leaders must be fluent across disciplines, from data science to governance to public policy.
4. Empowering Others
In the workplace, leaders must now cultivate AI fluency while preserving critical thinking and interpersonal skills.
Thought leaders shape how future professionals engage with AI, not as a shortcut, but as a tool for deeper understanding.
5. Driving Responsible Innovation
AI-first leadership requires reimagining collaboration between humans and machines.

Thought leaders play a key role in ensuring that innovation aligns with long-term societal and organizational goals.

The New Mandate for Thought Leaders:
Rather than being displaced by AI, thought leaders are being called to:
*Curate meaningful dialogue across sectors and cultures.
*Champion ethical frameworks for AI governance.
*Translate complexity into clarity for boards, teams, and the public.