We are in a global geopolitical whirlwind – we need internal audit. Anne Kiem, CEO of the Chartered IIA, issues a call to action 

When the going gets tough, internal auditors get going. This message is critical for boards, audit committees and organisations that are battling with wave upon wave of rapidly changing global risks (and opportunities). This disruption is not a cause for despair, but a call to action. Internal audit has an important role to play by asking the right questions at the right time. 

Dealing with the onslaught of change will stretch even the most efficient internal audit teams. For a start, are you up to date with geopolitical developments and all their ramifications for your organisation? If you are, that’s impressive – the past month has been a whirlwind. 

Whether your operations are more likely to be impacted by the prospect of hackers controlling your infrastructure systems, fake bomb alerts disrupting flights, riots on French streets or sensitive data being recorded by Chinese cars, new risks are emerging everywhere.  

Global politics are exceptionally volatile. What are the consequences of the Democrat midterm landslide for the Trump administration? Could a Marine Le Pen victory in the French elections destabilise EU relationships just when the UK is talking about a closer relationship?  

What will happen in the wars in Ukraine and Iran if America changes tack? How will President Putin respond? Who will form a government in Israel, and will this change policies over Palestine and Iran? 

In the financial arena, inflation is rising along with oil prices, and tech stocks are sliding – is this the long-predicted crash or a temporary “correction”? The North Korean hack of Binance demonstrated that cryptocurrencies are less safe than many hoped. Financial hacks will develop further and arrive faster, powered by quantum or AI decryption tools. 

Meanwhile, voters in many countries are alarmed. Governments are telling families to stockpile food and water. Data centres and AI horror stories are generating hostility – who wants a data centre in their back yard that will drain local power and water only to make people redundant? Meanwhile, the rising cost of living puts pressure on governments to be seen to act. 

Developments in operational hacking are perhaps one of the most alarming trends. We have seen the damage caused by ransomware and data attacks. The sabotage of supermarket and blood bank refrigeration systems shows that hackers can now reach inside companies and turn their own digitally controlled processes against them. 

What does this mean for our interconnected “smart” controls, for the future of tech such as driverless cars and for the much-touted internet of things? If hackers can alter freezer settings, what can they do to your factories, power stations, national transport and the NHS? Will people still talk to Alexa if “she” is in the pay of burglars? 

Time to add value 

There will be many solutions and opportunities to improve systems and work differently. But working differently creates new risks and the ripple effects could reach further than we can easily predict. 

Reassuringly, some familiar patterns suggest that the past is still a reliable indicator of the future – no matter how alien that future looks. The famous “It’s the economy, stupid” quip by James Carville, advisor to former US President Clinton, is as true now as it was then. People are motivated by the value and security of the money in their pocket (or their crypto exchange). Human nature has not changed, at least not in this respect. 

Internal audit teams can’t improve the economy, but they can help their organisations protect customers’ and investors’ money and provide assurance over the viability of large employers. They can advise on, and monitor the effectiveness of, resilience and recovery measures, and ensure managers are alert to vulnerabilities and the risk of cyber risks. 

Similarly, the dictum that power corrupts is as evident as it ever was. The conviction of Russell Brand and questions about political insider trading in the US are two of many recent examples. 

Internal audit plays a key role here too – providing assurance that processes and policies work. Since 30 October, UK employers must protect their staff from harassment by clients and customers as well as colleagues – and prevent harassment happening in the first place. Have you spoken to HR? Are your speak-up channels effective? 

Chief Audit Executives (CAEs) must speak truth to power and ensure leaders hear multiple views, not just their own echo chamber. CAEs must assess whether leaders follow the rules – and have courage to challenge if they suspect they do not. Trusted advisers must offer opinion and judgment, not give the “right answer” or repeat what everyone else is saying. 

They must also consider the long term. It’s hard to keep focused in the global whirlwind, but if your organisation is to seize opportunities and pre-empt events, you must watch the weather on the horizon.  

Climate change and cyber decryption are future risks that are already at the door. Other emerging trends are more speculative. For example, in recent years, immigration concerns have fuelled far right politicians and civil unrest across Europe, the UK and the US. However, AI is now emerging as potentially a bigger issue to neighbourhoods and jobs.  

How will that play out in politics? Where will electorates seek solutions? And what will governments do to keep them happy? Unrest in Australia has already led to rules banning data centres from residential areas. 

People are also unhappy about environmental pollution – especially air quality, water contamination and forever chemicals. We have been campaigning for UK water companies to have mandatory internal audit teams since it emerged last year that some of the worst financial performers have no internal audit provision. Now we are told that eight out of the nine English water companies are also failing on environmental measures. 

None of this is wholly new, but internal audit teams must look wider to identify all the ramifications of multiple simultaneous developments. Organisations rely on internal auditors to judge how significant these will be, ask the right questions, discuss whether the board is adequately informed, how events fall within the organisation’s risk appetite, and whether any require additional assurance work.  

Sources of inspiration 

The Chartered IIA will continue to support all our members to deal with these challenges. First and foremost, we are a network. We are in this together and must support each other.  

Our recent Internal Audit Conference hosted inspirational speakers who addressed many of these topics. These included keynote speaker Lord Gavin Barwell, who gave an unmissable insight into geopolitics from the political frontline. If you haven’t seen this, it is available on-demand, along with other sessions. 

This month we have the Scotland Conference and then the Wales Conference in February 2027. We also run regular regional and networking events, and forums on topics such as AI and data analytics.  

Full details are on our website and attendance counts towards your annual continuing professional education, which should be front of mind as annual reporting deadlines approach.  

Last, but certainly not least, challenging times prompt innovative responses, which we need to share. If you have found answers, we want to hear them, so nominate your team for our annual Internal Audit Awards. When times are tough, internal audit must rise to the challenges, but we should also celebrate our successes.  

No one can face today’s headwinds alone. Let’s make the most of what our community can provide to give boards and organisations the internal audit expertise and insights they need. We all stand to benefit.