Boards still need assurance over risk, control and compliance. Increasingly, they also need an honest view of whether the organisation is equipped to achieve what it has set out to achieve.
We spend a great deal of time with chief executives, Boards, non-executive directors, Audit Committees and Heads of Internal Audit. The organisations are different, as are their sectors and immediate pressures, but the conversation often arrives at the same underlying question:
How confident should we be that we will achieve what we have set out to achieve?
It is a harder question than whether a particular control operated as intended during the past 12 months. Leaders are looking ahead at strategies, transformation programmes, new technology, changing customer needs and an increasingly uncertain operating environment. They want to know whether the organisation has the capability, resilience, leadership and evidence needed to deliver.
Historical assurance remains essential. It can expose weak controls, unmanaged risks, unclear responsibilities and gaps between what is being reported and what the evidence supports. Yet it represents only part of the confidence picture – A well-controlled organisation can still pursue the wrong outcome, rely on fragile assumptions or discover too late that it lacks the capacity to deliver its plans.
The profession is already moving
This is not simply our view of where internal audit ought to go, the profession’s own standards and research point in a similar direction.
The Global Internal Audit Standards describe the purpose of internal auditing as strengthening an organisation’s ability to create, protect and sustain value by providing independent, risk-based and objective assurance, advice, insight and foresight. That final word matters. Foresight asks internal audit to contribute to decisions that are still capable of being changed, rather than only explaining events after they have happened.
The Internal Audit Foundation’s Vision 2035 research involved more than 7,000 participants. It found that 56% expect the role of the internal auditor to be substantially or very different by 2035. Respondents also expect the balance of internal audit’s work to change, with time spent on advisory services rising from 24% to 41%.
Those findings do not prescribe one model for every organisation, and independence must remain clear. They do, however, reflect a growing expectation that internal audit will engage more closely with strategy, emerging risk and organisational value.
“For years, internal audit has been good at telling Boards whether controls are working. That still matters. But the bigger question is whether the organisation is actually set up to deliver what it has promised.”
Paul Haley, Co-founder, Littlechild & Haley
Starting with the outcome
This thinking sits behind our approach to Success-centred Assurance™. The practical change is the starting point.
An audit will often begin with an auditable entity, process, risk or control framework. Success-centred Assurance™ begins with the outcome the organisation is trying to achieve, then works backwards. It asks what success would look like, which conditions need to be present, what assumptions are being relied upon, what could prevent delivery and what evidence justifies the confidence being expressed.
| Assurance lens | Questions worth asking | Evidence to examine |
|---|---|---|
| Intended outcome | What are we trying to achieve, by when and for whom? | Clear outcomes, measures, ownership and timescales |
| Conditions for success | What needs to be in place for delivery to remain credible? | Capability, capacity, funding, leadership, systems and partnerships |
| Critical assumptions | What are we taking for granted? | Forecasts, dependencies, customer or user behaviour and delivery assumptions |
| Risks and controls | What could prevent success, and how is that being managed? | Controls, mitigations, decisions, escalation routes and risk ownership |
| Basis for confidence | What evidence tells us the plan is working? | Management information, milestones, independent testing and early warning indicators |
This approach does not make internal audit responsible for delivering the strategy. Nor does it dilute challenge or independence. It gives risk and control work a clearer organisational context and helps the Board see where confidence is well supported, where it depends on judgement, and where it may be overstated.
“Starting with success gives risk a context.
A control matters because something important depends on it.
…And assurance should help people see that connection.”
Donna Littlechild, Co-founder, Littlechild & Haley
We have seen the value of this wider lens when working with newly established organisations and arm’s-length bodies. In those environments, the issue is rarely one missing control in isolation. Governance, risk management, leadership, skills, decision-making and management information all need to develop around a new mission. Reviewing each element separately may produce several accurate findings while still missing the larger question of whether the organisation is ready to succeed.
A more useful assurance conversation
The result should be a more useful conversation with senior leaders. Instead of ending with an assurance label that requires further interpretation, internal audit can help a Board understand the basis and limits of its confidence.
That may mean confirming that the essential conditions for delivery are present. It may reveal that an apparently strong plan rests on an untested assumption. It may show that controls work individually but fail to provide an early warning when performance begins to drift. Sometimes the conclusion will be that confidence is justified. Sometimes it will be that the organisation is moving faster than its capability, evidence or governance can support.
Traditional assurance will continue to matter. Organisations still need to know whether controls are effective, obligations are being met and risks are being managed. The opportunity is to connect that work more directly to the outcomes that matter to the Board, the organisation and the people it serves.
For us, that is the new paradigm: assurance that learns from the past, engages with the present and helps leaders judge the future with greater confidence. If your Board or Audit Committee is beginning to ask different questions about resilience, delivery and future success, we would be pleased to compare notes.
References
- The Institute of Internal Auditors, Global Internal Audit Standards™, 2024.
- Internal Audit Foundation, Internal Audit: Vision 2035.
