During Internal Audit Awareness Month in May, we reflected on the growing importance of internal audit in strengthening organisational resilience and enabling informed decision-making, supported by our Firm initiatives to promote awareness of its evolving role.
Internal audit is no longer limited to providing assurance on past activities. It has evolved into a trusted advisor that helps organisations navigate uncertainty and respond proactively to emerging risks. Increasingly, internal audit is expected to go beyond assurance and contribute to strategic decision-making.
In today’s environment, risks evolve at an accelerated pace and continue to emerge in new forms. Regulatory changes, technological disruption, and geopolitical developments create challenges that are more complex and less predictable than those faced in the past. As a result, these risks are more difficult to manage using traditional approaches. This requires internal audit to move beyond conventional risk assessments and take a more forward-looking view.
Many organisations are already aware of these emerging risks. However, awareness alone is not sufficient. The challenge lies in translating this awareness into timely, risk-informed decisions. This gap highlights the need for internal audit to take on a more forward-looking role. Traditionally, internal audit focused on reviewing historical transactions and evaluating control effectiveness. These responsibilities remain essential, but they are no longer sufficient in an environment where risks continue to emerge and evolve.
To address this, internal audit must incorporate risk sensing into its approach. Risk sensing involves the continuous identification and monitoring of early signals, trends, and disruptions that may indicate emerging risks. It draws from a broad range of inputs, such as market developments, regulatory updates, operational indicators, and external events. This approach enables earlier detection of shifts in the risk landscape.
Building on this, internal audit must adopt a risk anticipation mindset. This requires moving beyond known risks and considering potential disruptions before they materialise. By combining risk sensing with structured analysis, internal audit gains a clearer view of how and when risks may impact the organisation.
However, anticipation must lead to action. Internal audit creates value when insights translate into strategic foresight. This gives management a clearer view of how emerging risks may shape future scenarios, influence decisions, and affect long-term objectives.
Internal audit delivers the most value when these forward-looking insights are applied to key risk areas that directly affect the organisation. One of these areas is regulatory change, where expectations continue to evolve, particularly in highly regulated sectors such as financial services. Organisations face compressed timelines and evolving guidance from regulators. Key focus areas include assessing readiness for new requirements, identifying gaps in compliance frameworks, and evaluating the effectiveness of monitoring mechanisms. These reviews often take the form of regulatory gap assessments, readiness reviews, and targeted validations. The objective is not only compliance but readiness. Organisations must respond proactively rather than reactively.
Beyond regulatory changes, forward-looking insights also apply to technological disruption. As digital transformation accelerates, risks extend beyond system implementation. They now include the organisation’s ability to govern, secure, and sustain technology over time. In many cases, the pace of implementation outpaces the maturity of governance and control frameworks. Internal audit should focus on aligning technology initiatives with business strategy, identifying risks related to cybersecurity and data governance, and evaluating controls over emerging technologies. This approach supports secure, controlled, and sustainable adoption of technology and strengthens long-term value.
In addition to regulatory and technological risks, geopolitical uncertainty presents another area where forward-looking insight is critical. These risks often originate externally but can have significant operational and strategic implications. Internal Audit plays an important role in challenging management to reassess supply chain dependencies, diversify sourcing and market strategies, and stress test investment and expansion plans. This includes mapping geographic exposure, evaluating disruption scenarios, and assessing whether contingency plans are realistic and actionable. This approach supports a shift from risk awareness to risk-informed strategy.
Environmental, social, and governance (ESG) risks also represent a key area where internal audit can provide forward-looking insight. As regulatory frameworks evolve, particularly in sustainability reporting guidelines and expectations on environmental and social risk management, organisations face increasing pressure to embed ESG considerations into strategy, operations, and governance. Internal audit can help assess whether ESG-related risks are being identified, managed, and monitored effectively across the organisation by evaluating the reliability of ESG data, the alignment of sustainability commitments with actual practices, and the organisation’s readiness to comply with emerging disclosure requirements. By doing so, internal Audit supports more informed decision-making and helps organisations manage ESG risks in a disciplined and credible manner.
Ultimately, the evolution of internal audit does not replace its traditional assurance role. It enhances it. Internal audit remains essential in providing independent assurance over governance, risk management, and internal controls. Its value increases significantly when it integrates risk sensing, anticipates disruption, challenges assumptions, and delivers forward-looking insights.
For internal audit functions willing to evolve, this shift is essential. The ability to identify emerging risks, anticipate their impact, and translate insights into strategic perspective will define internal audit’s relevance in the years ahead. By doing so, internal audit becomes more than a control function. It becomes a strategic partner that contributes directly to organisational resilience, agility, and long-term success.
As published in The Manila Times, dated 01 July 2026
Today, personal information is generated from almost everything we do—from the apps we use and platforms we engage with, to the transactions we make and information we share online; it fuels insights, and shapes business decisions.
Crises have a way of exposing stress points in a nation’s economic and social systems. In the Philippines, where growth is driven as much by communities and MSMEs as by large enterprises, these stress points are felt quickly and deeply.
The most enduring change often happens quietly: through what we repeatedly see, who consistently advocates, and what organisations choose to institutionalise.