I often post my thoughts on Twitter (@RFChambers). Most of the time, my Tweets receive few comments, but last week I heard from a surprising number of auditors after simply posting the thought: “Remember internal auditors: Sometimes you can be right or you can be liked — but you can't be both!”

For almost four years now, I have been advocating that the internal audit profession embrace the challenge of providing assurance on the effectiveness of risk management. I believe it is the most significant opportunity for our profession in a generation. Yet, recent survey data would indicate that we are reluctant to make such assurance an integral part of our portfolios of internal audit coverage. I have but one question: What are we waiting for?

There have been plenty of articles and lectures given on continuous auditing in recent years. There is no question that technology is making continuous auditing a powerful tool for both internal auditors and managers, alike. However, despite the growing popularity of continuous auditing, I believe one of the true challenges in the next decade will be to continuously assess risks.