What high-performing internal audit functions are doing next
18 months on from implementation of the Global Internal Audit Standards 2024 (GIAS), PKF has been discussing their impact with internal audit leaders, lessons learned from implementation, and key areas for further development including strategy, quality and innovation.
A clear message has emerged: the GIAS have raised expectations, not simply around conformance, but around the value that internal audit delivers. It is also apparent that conversations have shifted from implementation to maturity. So, what have we learned from the first 18 months?
Moving beyond implementation to internal audit effectiveness
The strongest internal audit functions are no longer asking, “Have we implemented the GIAS?”. Instead, they are asking, “How do we demonstrate that the GIAS have made us more effective?”
Heads of Internal Audit are getting better engagement with stakeholders, including audit committees and boards – and closer scrutiny of function effectiveness and value.
Stakeholders expect clearer reporting, stronger engagement and more forward-looking insights into emerging risks. Leading internal audit functions are aligning to organisational strategy, connecting themes, identifying trends, challenging assumptions and helping their organisations prepare for future risks. This represents an important evolution from providing assurance over what has happened to helping understand and prepare for what could happen next.
Demonstrating GIAS Conformance through evidence and professional judgement
The increased emphasis in the GIAS on evidencing conformance is high on the agenda. Whilst the GIAS are principles-based, many Heads of Internal Audit we talk to feel that the greater number of mandatory requirements and Topical Requirements has heightened expectations around documentation. For those running smaller functions, there’s a current concern that EQAs will become more challenging as a result.
The answer is not producing more documentation. The strongest functions are crafting clear evidence trails that demonstrate how governance arrangements, methodology, stakeholder engagement and quality assurance operate in practice. Consequently, effective EQAs should look beyond documentation and consider whether functions can demonstrate their approach is effective, consistently applied and driving the intended outcomes.
At the same time, conformance requires professional judgement in the practical application of the GIAS which can prove challenging, particularly for smaller internal audit functions.
Many internal audit functions have adopted targeted methodology enhancements instead of wholesale redesigns, carefully documenting their judgement over where proportionality has been applied and why.
Conformance should not mean implementing every requirement identically. Instead, it should mean applying the GIAS thoughtfully and transparently in a manner that reflects the organisation’s size, complexity and risk profile, whilst still achieving the intent of the GIAS.
Quality assurance is becoming a continuous process
Another notable shift has been the evolution of quality assurance and improvement programmes. Quality is increasingly becoming embedded within day-to-day function activity and audit delivery.
Leading internal audit functions are strengthening self-assessments, file reviews, stakeholder feedback mechanisms, quality indicators and performance metrics. More importantly, they are tracking improvement actions and measuring whether those actions enhance audit quality and stakeholder outcomes.
Building internal audit capability and maturity
The first 18 months of the GIAS have highlighted differing levels of maturity across the profession. Many functions are moving beyond compliance towards embedding the GIAS within their culture, using the standards to reshape future operating models and strategic direction. This often includes investment in analytics, automation, targeted use of AI, integrated assurance and stronger collaboration with second-line and other assurance functions.
Many Heads of Internal Audit describe taking a phased approach to change, prioritising initiatives that deliver the greatest value whilst recognising that capability development and maturity is an ongoing journey.
AI in internal audit: Enhancing judgement, not replacing it
The role of AI is always a major discussion point among internal audit leaders. Many internal audit teams are increasingly using AI to support research, risk assessment, planning activities and report development.
Whilst the benefits and opportunities are significant, Heads of Internal Audit consistently emphasise that professional scepticism and auditor judgement remains fundamental. AI can improve efficiency and enhance analysis but cannot fully assess organisational culture, observe behaviours, challenge inconsistencies or exercise professional judgement.
AI should enhance internal audit effectiveness, not replace the qualities that make it valuable.
The future of internal audit under GIAS
18 months on, it is evident that implementing the Global Internal Audit Standards was only the beginning. The focus is now on embedding quality, demonstrating effectiveness and ensuring internal audit continues to evolve alongside changing organisational risks.
Success will not be measured by the volume of documentation produced or the number of requirements evidenced. Instead, it will be measured by the confidence internal audit provides to its audit committees and boards; the insight it delivers to management; and the value and improvement it drives across the organisation.
The strongest internal audit functions will balance conformance with pragmatism, embrace innovation whilst retaining professional judgement and view the GIAS not as a compliance exercise, but as an opportunity to strengthen their influence and the profession as a whole.
How can we help
Navigating the evolving expectations of the GIAS can be challenging, particularly for organisations seeking to demonstrate effectiveness, prepare for an External Quality Assessment (EQA) or enhance the strategic value of their internal audit function.
Our suite of Heads of Internal Audit Advisory & Support Services includes External Quality Assessments (EQAs), quality assurance, training and Heads of Internal Audit roundtables.
If you would like advice or support on strengthening your internal audit function or preparing for GIAS requirements, please contact Partner and Head of Governance, Risk & Control Assurance, Jessica Wills or Director, Samiha Shaikh.
