Internal Auditing in 2026: Skills That Actually Matter

00:00:02 The IIA

The Institute of Internal Auditors presents all things internal audit in this episode, Mike Levy talks with Dan Cornelius about the skills internal auditors need in 2026 and how to deliver real advice, insight and foresight that leaders of value. They discuss earning a seat at the table, balancing advisory work with independents.

00:00:23 The IIA

Aligning audit work to strategy and how AI and analytics are transforming internal audit. The conversation highlights the shift towards strategic insight driven auditing and what auditors must do to stay relevant.

00:00:39 Mike Levy

Today I think what we want to talk, we're trying to talk about is just how do we deliver value as internal auditors when we think about it in terms of, you know, advice, insight and foresight. So you know, at least for me, when I think about our profession and you, you hear so many people talk about the vision 2035, we have new standards, there's AI risks everywhere we look. I mean our role continues to evolve and change. But I mean like let's define it.

00:00:59 Mike Levy

1st I mean what what do you think internal audits role is?

00:01:02 Mike Levy

We think about advice, insight, foresight, how do.

00:01:05 Mike Levy

We do that.

00:01:07 Dan Fornelius

I think it's a few things. It's at the start, internal audit, right? They should have a seat at the table. Whatever table that is. It could be various tables in an organization, but.

00:01:16 Dan Fornelius

Engaging early right with with management and second line functions on like you know, future events, emerging risks API's you know on every discussion and every, every day, right, it's so it's it's that it's and it's partnering with with the management team it's having that seat partnering with that management team and providing.

00:01:37 Dan Fornelius

That level of.

00:01:39 Dan Fornelius

Consulting and support back to the business aside from just assurance, right, if you if you're you're at the seated table, you're connecting with the business on what matters most in the organization and then that'll allow internal audit to provide that foresight and some ideas on what might happen next.

00:02:00 Mike Levy

I mean, to your point, like I think what's been interesting, like hearing, I'm lucky that I get to talk to a lot of internal audit leaders and people are still trying to define how the how, how to do this and like the seat at the table comment that you made. I mean we all we all desire that and.

00:02:13 Mike Levy

To me, like working through the types of tactical and strategic recommendations you can offer to management and how you do that outside of just the standard auto report. It's a bit of an art and a finesse and I think to your point like it's one of the things that drives the seat at the table. And I think if we figure out how to.

00:02:30 Mike Levy

Do that properly. It's really meaningful, so.

00:02:33 Mike Levy

When we talk about providing advice, give me give us some examples. Like what does that look like in practice? Yeah. How do you do that while you still maintain independence?

00:02:42 Dan Fornelius

Helping the business navigate right how to navigate through uncertainty and risk, not just reporting on issues of course reporting on issues, non compliance, keeping the the business aware of any you know potential failures or risks or fines or or what have you but it all start with aligning on internal audits like strategic objectives.

00:03:02 Dan Fornelius

And what they want to carry out, but aligning that with what's meaningful to the business, right, the business mission, their objectives.

00:03:11 Dan Fornelius

How the business is operating and making sure that internal audit is aligning its work with the organization strategic objectives, that'll really elevate its posture within an organization and the the advice and the level of insight that they could provide if they're aligned with the business.

00:03:33 Dan Fornelius

That maturity level and that trust level elevates even greater.

00:03:37 Mike Levy

To your point about all of those things, I think aligning with company strategy is so important. But also I think aligning with the company's risk, vocabulary and taxonomy that they're using to talk about risk and controls and findings. I found so many times there are ways to have that seat at the table is just I had an organization once where we talked to them about risk.

00:03:58 Mike Levy

And controls, but not in the context of how it impacted their business, just in the broad sense. And it didn't. It didn't drive the value and they they sort of didn't want us part of the conversation because they felt like we were trying to make them do extra work. But then we started talking about it in terms.

00:04:12 Mike Levy

Improvement and efficiency and protecting the company's value and you know, we started to drive a lot more change just by simple vocabulary change. But I agree with you.

00:04:20 Mike Levy

Completely.

00:04:21 Mike Levy

That company strategy and making sure the internal audit program and plan, whether it's advisory projects or assurance projects, is the most important thing. How would you respond? Because one of the things I hear all the time.

00:04:32 Mike Levy

Related to this is.

00:04:34 Mike Levy

We we can't do that and we can't do that while maintaining the lines of independence, right? If we're doing advisory services work, does that cross the line into management decision?

00:04:43 Mike Levy

Making and what?

00:04:44 Mike Levy

What's your response to that in terms of like, you know, advising clients?

00:04:47 Mike Levy

And.

00:04:48 Mike Levy

Driving that seat at the table but not impacting our.

00:04:52 Dan Fornelius

Providing that level of advisory or consulting back to the business really really elevates internal audit as their posture within the organization but elevates their level of trust. I mean, once, once you're advising on leading practices, keeping that line drawn where you're not influencing.

00:05:11 Dan Fornelius

Decisions, but you're providing a level of advice and counsel back to the business and whether that's on a future products that's being rolled out and there needs to be programs or practices or technologies in place and internal or at least having a a voice.

00:05:31 Dan Fornelius

And having that seat at the table throughout, you know, when there are future changes being made to an organization, I mean, internal, what it should be involved to whatever level of voice they have will vary. But there should be some level of influence or advisory or guidance back to the business.

00:05:51 Dan Fornelius

Where I feel it's most important for internally to be involved.

00:05:55 Dan Fornelius

Is really providing that level of guidance back to the business, you know basing their maturity on a different product or program and you're really not influencing decisions, you're really influencing how the business should think about risk and where they stand in an environment, right? And that will then help them evolve their risk management.

00:06:16 Dan Fornelius

Practices and governance practice.

00:06:19 Dan Fornelius

And then in turn, internal audits practices will be much more strengthens because it's assessing a much more mature environment. It's providing that level of advice and that level of guidance without making without influencing any decisions to be made by management, right. But then also one other thing that can be really.

00:06:40 Dan Fornelius

To be done is you know, providing that level of support back to the business, right, benchmarking then to peers or providing that level of.

00:06:48 Dan Fornelius

Current state process documentation or advising them on governance practices so that can be provided back and it really does really does help the stature and posture of of internal or within an organization.

00:07:02 Mike Levy

Everything you just said is spot on and I don't like when people use the concern of independents as a.

00:07:09 Mike Levy

Reason why they can't have a seat at the table and my opinion, my opinion and what I would I always say to management when they ask about this is I'm I tend to focus a lot more on objectivity and I think that's critically important. But I also think that if management's asking for help, yes, we have, we always will have a role and you have to do this in concert with our standards and with the Charter and with your audit committees.

00:07:29 Mike Levy

And your executive management team but.

00:07:31 Mike Levy

I don't want to be the one that says no, I can't help help because I I need to be independent. I think there are ways we always have to minute make sure we manage the conversation and we don't want to cross over and be acting as management. We absolutely have to manage that. But if someone's asking us for help, there are often ways we can find to help them that drive value and all of those things, especially the low hanging fruit.

00:07:52 Mike Levy

Whereas if you find quick wins in that it drives so much value for them that you know the worst thing you can say is I can't do that. I have to remain independent and honestly with so much change happening to your point, then take AI as an example. Are we going to wait until a company fully adopts AI before we?

00:08:08 Mike Levy

Go give them advice on risk and control or help make recommendations on ways that they can use that and adopt it to increase the our our job is to try to protect the organizational value and spotlight issues and and we have a really unique perspective in all of that. So I I just don't like when people use independence as sort of the crutch for why they can't. They get things done and I think it.

00:08:29 Mike Levy

Think it's a blocker in how we develop and deliver some of these pieces of advice and insight.

00:08:35 Dan Fornelius

Yeah, it is the easiest out for internal audit to be outed for.

00:08:41 Dan Fornelius

Work stream initiatives activity you say the word independence, it takes some socializing and some trusts between internal audit and other management team members and really corral them or socialize them and explain that no, this is not. And if it's not, it's not an independence.

00:09:01 Dan Fornelius

Issue or OK you feel like it is? Let's adjust our delivery a bit and make it most meaningful to the business without having a perceived conflict.

00:09:12 Mike Levy

What do you think we can do around like real time guidance and monitoring and managing risk so that we are bringing that stuff to the forefront for manager because I, I I see that as another opportunity where we can deliver a lot of value early in early in the process.

00:09:25 Dan Fornelius

Whether it's a new technology or AI, it fits being considered early on and being rolled out to an organization.

00:09:33 Dan Fornelius

How it's impacting production and operations internal that it should at least be tangently there to understand its impact. So it could voice out a key risk or work with second line on appropriate risk management or governance practices.

00:09:50 Dan Fornelius

And really reflects how the business should operate today. You know many times to your point, I mean a technology may be implemented and internal audit or a compliance function may not go in and assess it until over a year later and.

00:10:07 Dan Fornelius

These days, a year ago, we were not using AI like we were a year ago. I mean, it's flying by. So you can't wait a year to look at a new technology and assess its effectiveness. You need, you need to be there today and then really that'll then again elevate the stature of internal audit.

00:10:27 Dan Fornelius

The no function and elevate its value right?

00:10:31 Mike Levy

I'm a firm believer that you know, and when I and I have said this many times to management when we are challenged on that, because sometimes I see your point on the seat at the table and you know we we've talked about this before on podcasts where we all want to see at the table, some some management teams are really opening in terms of allowing us allowing that. Sometimes you have to sort of claw your way in and.

00:10:51 Mike Levy

One of the one of the ways that I always talk about This is why would you not want internal audit there in the sense that you know, we're one of the few teams within an organization that really has the most holistic view.

00:11:03 Mike Levy

Of how an organization works, right, we're looking at risks. We're working at controls across the whole environment and we see everything. So because of that, it puts us in a really unique position to deliver some of that insight. So to your point, like I know you mentioned AI as a, as an example, we'll talk. I definitely want to spend some more time talking about that, but just even the term insight.

00:11:24 Mike Levy

How do you define that?

00:11:26 Mike Levy

With executives and internal audit like how? So? If I'm a new if I'm a, you know, for everybody listening, I'm if I'm a CAE or I'm a man. Even an internal manager on a team or staff person on a team and I want to start building a program that's going to start delivering insights, right? Even outside of the audit reporting process.

00:11:42 Mike Levy

How do I even first like go like just even just like start defining insights within my company? Like, what does that look like? Is it just a external external export of the audit report or is it a something we're seeing out in the media or all the above? I mean, just like, where would you even start? Like, how do I define it and where do you?

00:11:59 Dan Fornelius

Yeah, that's a great question. And you know what I was, we we had a round table a couple weeks ago and that was a topic, of course, AI governance was a topic, but the next was risk. And in terms of going back to your point on a shared risks, risks taxonomy speaking the same language, meaning internal audit should be speaking the same language with its risk peers and with its operations teams.

00:12:21 Dan Fornelius

But in terms of to your question on insight that use of technology, it really becomes paramount to understanding insight back to the organization because.

00:12:33 Dan Fornelius

Being able to fully collect any data point within an organization's ecosystem becomes huge, right? I was talking to someone and they had a really interesting way.

00:12:48 Dan Fornelius

To really understand and organizations taking their strategic objectives.

00:12:55 Dan Fornelius

Taking their KPIs right understanding its what the business is accomplishing, but then also collecting as much data as possible. It was interesting they had a campaign as internal audit shop, right. And we do this day in and day out, right. We try to collect as much data as we can, system reports, KPIs, logs, outputs.

00:13:14 Dan Fornelius

But getting that data and doing something with it and they had an interesting an interesting campaign. They went out to every department at once, but not once, but in certain areas, right. Uh, certain time frames collected as much data as.

00:13:31 Dan Fornelius

Grab the list information, tide this data to whatever Kris are in place. Right? They had a for this to happen. Their second line had to be pretty mature as well to do what they wanted to do. They tied as much data to different KR. I's right to have an understanding right? How the business is operating, where it could drift or underperform.

00:13:51 Dan Fornelius

And then what they did is they enhanced their Kris with second line working with them hand in hand.

00:14:00 Dan Fornelius

And then really understanding like the reliability of those data points, so leadership can you know trust those indicate?

00:14:07 Dan Fornelius

But then again, what to do with it? You need to have a fully functioning second line for this to work, and A and a lot of great resources on your analytics and technology teams. But turn that data into like patterns, trends and like early warning signals, so internal audit will take this data of course. And just like we do in our day-to-day.

00:14:27 Dan Fornelius

We use data to whatever degree we can and provide a level of assurance back run scripts run different tests of that data. Compare that data to different compliance requirements or leading practices. What have you right or the execution of controls.

00:14:43 Dan Fornelius

But what they did was they also highlighted insights to like different cost performance or like different sort of impacts to their customers and what they did was not only do they just hold that data for their assurance, they provided that data back to the business to provide like insights or suggestions to them.

00:15:03 Dan Fornelius

On hey, you have these these reports of.

00:15:05 Dan Fornelius

Available you can use this in your at the frontline and provide early warning signals back to the business, not wait for internal audit to catch it right. Throw it back to the business and they could decide what they want to do with it, right? But it was that it was that level of the business wasn't asking for this right. Internal letter had a campaign and initiative.

00:15:27 Dan Fornelius

To really elevate the organization's attention to data provided advice back to the business. And again they weren't influencing like to your point, there's no independence issue, right? They weren't influencing.

00:15:38 Dan Fornelius

Management decisions they were saying we have these 10 early wording signals that could be available in your system. They just have to be turned on or put into place. Do what you want with them. So it's, it's that it's getting that access to data and it's providing that level of advice back to the business where many even be asking for it. But that just then.

00:16:01 Dan Fornelius

Strengthens that relationship you may have with the business and elevates internal audits you know, role within your organization.

00:16:07 Mike Levy

Well said. So, I mean it's I think this is a perfect segue. So you you've talked about AI.

00:16:12 Mike Levy

Abstractly, and we kind of reference some of the technology solutions, obviously without endorsing any specific products or solutions, how do you view technology analytics, you know how, how can they assist from a storytelling perspective and you know if I'm an auditor trying to build this out and deliver more insights and be more proactive and have technology be part of that.

00:16:32 Mike Levy

What are some of the considerations I would I should think about?

00:16:36 Dan Fornelius

With Dan Technology in terms of storytelling, it's interesting every function, right, whether I guess whatever maturity level and organizations technology is in internally should have that role and tell that story depending on wherever that organization is in terms of how mature they're using their technology.

00:16:57 Dan Fornelius

That would reflect the level of governance and oversight that should be in place, right. And I guess what? What internal what? It should, should evaluate. Like if there's a I incorporated in a in a given technology.

00:17:13 Dan Fornelius

That will result in internal audit having to evaluate its outputs, its reports and its decisions, and at the end of the day, whatever that technology is accomplishing, internal audit should make sure that it's reliable, it's appropriately governed, right, and that there.

00:17:32 Dan Fornelius

There's some validation in place across their models and and the coding of of that technology and internal what it should again they should assess the the reliance and the governance around that technology and providing that insight it's only as strong as like the trustworthiness of those.

00:17:52 Dan Fornelius

Models and data within a techno.

00:17:54 Dan Fornelius

Analogy, right? And I think it's important to understand that because without that internal audits story can change. If if it's not appropriately governed internal of this story can be very narrowly focused. It could be somewhat backward looking. It may have some fixes that.

00:18:14 Dan Fornelius

It's really just providing assurance that the fixes were made or it may become like caveated it may, they may carve out some scope because the technology is not fully implemented, right? So without that appropriate governance and maturity internal with its story may not be as as strong.

00:18:33 Mike Levy

I also think we're living in a brave new world of technology and what's really nice about this if you're new newly adopting this, we're trying to frankly have some pieces of this stuff in.

00:18:44 Mike Levy

Place.

00:18:45 Mike Levy

And trying to be more forward-looking at advance this.

00:18:48 Mike Levy

It's easier than ever to get started. So many data analytics tools and.

00:18:53 Mike Levy

AI tools, even if you're just using.

00:18:56 Mike Levy

AI assistant type tool. You pick your variety, whether it's AI, assisted tool and so many of them can deliver some of this. I mean try try putting some amount of data in and it'll start creating a Python script automatically for you to analyze it. So one of the nice things I think, yeah, well we try to be more forward-looking at inside driven.

00:19:16 Mike Levy

Is you can start creating these like data models that look at different risk factors that are happening within your organization. And when you start correlating them, putting them together all of a sudden you can look for trends or outliers. That number one are going to help drive your audit plan, but it's really interesting and impactful to the business too. So I just think in this world of generative AI and some of the solutions that are out there now.

00:19:37 Mike Levy

Both from a data analytics as well as from a just a general tool perspective you can do so much even as.

00:19:43 Mike Levy

Staff auditor that doesn't have any IT expertise or or and systems implemented. I just think it's a we're in a.

00:19:46

Yeah.

00:19:49 Mike Levy

Brave new world from that perspective.

00:19:50 Dan Fornelius

That's right. And you know what's interesting? Right, automation or AI period is giving time back to everybody. It's giving time back to everyone to really let them focus on what these insights or recommendations or whatever AI is doing for us, right? It could be.

00:20:09 Dan Fornelius

Mapping our current state notes to a framework. Right? OK. Do that mapping for us. Save us one 2-3 hours in terms of OK mapping it out to NIST or ISO or whatever the the compliance requirement is, but now it's giving us time back to really focus on what it means.

00:20:29 Dan Fornelius

To the business, right? What forward-looking business relevant insights maybe want it, but it also allows us to explain the So what and it allows us to do things that we may not have time to do in the past and that may.

00:20:46 Dan Fornelius

Benchmarking operations right to peers or providing additional service back to the business or using technology a little bit more to like boost our level of assurance. So it it really is allowing us to tell a stronger story and if it's used correctly.

00:21:06 Dan Fornelius

And if the function could speak the business speak, it's it's allowing them to really connect better with with the business.

00:21:15 Mike Levy

Well said. You know, I think about all of these things and I think about the ask of the Chief auditor or even a staff auditor coming into a new.

00:21:22 Mike Levy

Function and it to your point. I mean it's not just backwards looking process, we're looking and you know and doing a traditional assurance based project of looking back in history, there's just so much that we're asking our folks to look at and do and I I get excited about it because I think it really gives us the opportunity to drive more value but.

00:21:41 Mike Levy

When you think about.

00:21:42 Mike Levy

The team structure and you think about the skills or attributes of an internal auditor and what they need to look like in order to be a strategic partner versus just sort of a compliance function.

00:21:54 Mike Levy

What does the you know? The I's got some interesting materials out on this too.

00:21:57 Mike Levy

But what? What do?

00:21:59 Mike Levy

You what? Do you see that as? What does the future auditor look like? What do we need? What do we need to have skills and attributes and behaviors?

00:22:06 Dan Fornelius

Today's auditor really needs to, I mean, soft skills, the ability to connect with its peers in an organization is more meaningful than ever.

00:22:18 Dan Fornelius

Right, there's a lot less time needed on with today's technologies and it's going to be different 6 to 12 months from even today, right? There's going to be a lot more time back to the business to focus on more strategic level, you know activities and value back to the business, but.

00:22:38 Dan Fornelius

In today's professional, it's being able to fully grasp technology, right and all kids out of school and younger professionals, they have that. But it's also the ability to rationalize.

00:22:54 Dan Fornelius

The outputs of these technologies need back to the business and being able to articulate messaging value insights if you're if you're performing an assessment of a of a functional area, what what does that data mean right and being able to articulate that back back to management.

00:23:13 Dan Fornelius

Right. So it's that it's those soft skills that I think they're always valuable, but I think they're paramount now and and unnecessary skill for everyone to.

00:23:25 Dan Fornelius

Has and and you know, I mean everyone has different, you know ways of working and personalities. But if you can effectively communicate, I mean that is like he skill that everyone should really focus and and and work on and again it could it could you know people communicate differently and strongly people communicate.

00:23:45 Dan Fornelius

Stronger in different ways, and that's fine, but being able to be an effective communicator is totally, totally paramount.

00:23:54 Mike Levy

Yeah. You hit on something that I think is really important. I want to highlight, which is one of the reasons I get so excited about.

00:24:02 Mike Levy

The advent of AI in this space and our ability to do more. One of the things that makes auditors so powerful within the organization and so impactful is by design. We have to be good at asking questions, right. And we have to have an inquiring mind and I think to your point now more than ever that is so critically important.

00:24:20 Mike Levy

I I would argue that asking the right question. I know, I know. When we hire and.

00:24:24 Mike Levy

When we interact.

00:24:24 Mike Levy

With our our clients like sometimes that's the thing they look for.

00:24:28 Mike Levy

Most is like can we have the right interface and interaction with the customer and you know, I'd argue to say that also drives really good, prompting an AI tools and things like that too. So I mean they the new, the new world and the new skill set, I mean it's all based on like do you have the ability to ask the right questions, whether that's a engineering, the perfect prompt. So hey, I can assist you to teasing out.

00:24:48 Mike Levy

Data from management to looking at a set of risks and.

00:24:52 Mike Levy

Saying what are some of these like high velocity risks that are changing really rapidly that we have to help evaluate the business on. So Dan, you're you're spot on. I could. I can't.

00:25:01 Dan Fornelius

Can't even more, I think one point to that. Mike also is when you can connect to the business, you can relate to them doing your job and you know providing assurance over a process or.

00:25:12 Dan Fornelius

You know law or or or whatever it is technology providing that level of assurance back and making sure that you know policies are incorporated. Risk is mitigated. OK, great cool.

00:25:22 Dan Fornelius

But your insight back and and I guess the still one should have is make sure that you can you know the business you can relate to it and then you can connect the So what of different issues so you can connect the value of putting a recommendation in place you tie it to any cost?

00:25:42 Dan Fornelius

Savings or?

00:25:43 Dan Fornelius

Their performance or how it's going to really like impact its customers that that's a key thing, right. You your management team and as as they should management like. So what So what? But if you relate to it ohh it could impact your customers because if this isn't in place you may have whatever it is you may have a breach or you may have this or this or whatever that is if you tie that and you speak.

00:26:04 Dan Fornelius

They speak and tie it to their strategic objectives.

00:26:07 Dan Fornelius

Then you you're more relatable and your value to the department and to the organization is just elevated and can speak there speak.

00:26:16 Mike Levy

100% agree that then that's really well said. Well, we're just about out of time. I really appreciate you. You coming on today and sharing your your perspective with with this group, but I think it really delivered a lot of value.

00:26:27 Dan Fornelius

But you having me on Mike, I really appreciated this and look forward to doing it.

00:26:32 The IIA

Fraud is getting trickier, but you can stay ahead. Join US online for the 2026 fraud on Massed Virtual Conference on February 17th. It's one pack day of practical tips, expert insights, and 13 plus CP's. So save your spot today and register at theia.org.

00:26:53 The IIA

If you like this podcast, please subscribe and rate US. You can subscribe wherever you get your podcasts. You can also catch other episodes on YouTube or at theia.org. That's theia.org.