Why the profession is moving from hindsight to foresight
Last month Littlechild & Haley hosted a roundtable session at Hub Cardiff, bringing together heads of internal audit and senior practitioners from across the public and private sectors.
The format was deliberately simple. Short presentations followed by open discussion around the table. Around fifteen internal audit leaders shared experiences from their organisations and explored a question that is increasingly central to the profession.
How can internal audit help organisations recognise emerging risks before they become operational failures?
The discussion could not have been more timely. The recently introduced Global Internal Audit Standards now explicitly reference foresight as part of the internal audit mandate. This reflects a broader shift within the profession. Internal audit functions are increasingly expected not only to review past performance, but also to help organisations anticipate emerging threats and pressures.
In practice, that means asking different questions. Rather than focusing solely on whether controls worked yesterday, internal auditors are increasingly being asked to consider whether they will still work under tomorrow’s conditions.
Why foresight matters now
Risk environments are becoming more complex and interconnected. The UK National Risk Register, published by the UK Government, identifies dozens of national level risks ranging from cyber incidents and supply chain disruption to extreme weather and infrastructure failure. Many of these risks share a common characteristic. They do not occur in isolation. Instead, they combine and cascade.
Recent global events illustrate this clearly. The COVID-19 pandemic was not simply a health risk. It quickly became a workforce risk, a supply chain risk, a governance risk and a financial resilience challenge all at once. Traditional risk frameworks often treat threats individually. In reality, organisations increasingly face systemic risk, where several pressures interact simultaneously.
For internal audit teams, this raises an important question. How can organisations recognise early signals that these pressures are building?
Weak signals organisations often overlook
One of the strongest themes to emerge from the Cardiff roundtable discussion was the idea of weak signals. These are small operational indicators that something in the system may not be functioning as well as assumed. On their own they often appear minor or isolated. Over time, however, they can reveal underlying fragility in processes, controls or organisational culture.
Weak signals rarely appear in formal risk reports. Instead they tend to surface as operational friction. A process takes slightly longer than expected. Staff quietly develop workarounds to keep things moving. Certain individuals become critical to holding fragile systems together. Small incidents occur but are resolved quickly, so the underlying issue is never fully explored.
Examples discussed during the session included:
- Processes that rely heavily on a small number of experienced staff
- Workarounds that become normalised over time
- Teams absorbing operational pressures rather than escalating them
- Small incidents dismissed as isolated rather than systemic
- Controls that appear effective only because capable staff intervene
Individually, none of these indicators necessarily signals a serious problem. In fact, organisations often view them as evidence of resilience or adaptability. The risk is that these patterns quietly accumulate. Over time they can create hidden dependencies, fragile processes and pressure points within the organisation. When conditions change or multiple pressures occur simultaneously, these same weaknesses can quickly become visible.
This pattern is often described as the normalisation of deviance. When deviations from good practice occur repeatedly without immediate consequences, they can gradually become accepted as the way things are done. Because nothing has failed yet, the behaviour becomes normalised.
By the time something does go wrong, the warning signs have often been present for months or even years. Internal audit teams are often well positioned to notice these signals because they see patterns across multiple functions and processes. However, weak signals rarely come with clear evidence. They often appear first as discomfort rather than data. Recognising those early patterns, and having the confidence to ask questions before failure occurs, is a key part of developing foresight within internal audit.
When risks collide
Another key theme from the roundtable discussion was how organisations often struggle to anticipate compound risk events. The pandemic provided a clear illustration. Scenario planning exercises that once seemed unrealistic, such as modelling a 30 percent workforce absence, suddenly became operational realities.
When risks interact, the impact can grow rapidly.
| Risk category | Example organisational impact |
|---|---|
| Workforce disruption | Sudden staff shortages and capability gaps |
| Supply chain interruption | Delayed production and delivery failures |
| Technology change | Rapid digital adoption creating new vulnerabilities |
| Governance pressure | Accelerated decision making under uncertainty |
| Financial stress | Cashflow pressure and cost restructuring |
Foresight is not prediction
A common misconception is that foresight means predicting the future. In practice it is something more practical and far more valuable.
Foresight is not about forecasting specific events or trying to anticipate exactly what will happen next. Instead, it focuses on understanding how systems behave under pressure and how risks may evolve over time.
This requires organisations to move beyond simply reviewing what has already happened and begin exploring how existing processes and controls might perform under different conditions.
Foresight encourages organisations to challenge assumptions that may otherwise remain untested. For example:
- Would this control still work if operational pressure increased significantly?
- Are certain processes dependent on specific individuals or informal workarounds?
- What happens if two or three pressures occur at the same time?
- Where in the organisation would stress appear first?
In this sense, foresight is less about predicting specific crises and more about developing preparedness. It helps organisations identify fragility before it becomes visible through failure.
Donna Littlechild explained the idea during the roundtable discussion:
Donna Littlechild
“One of the things we see repeatedly in organisations is that the signals were there. The early warning signs existed somewhere in the system, but they were either dismissed as isolated issues or absorbed quietly by capable teams who kept things running.
Foresight in internal audit is not about predicting the future with certainty. It is about stepping back and asking different questions. What assumptions are we making about how this process works? What pressures might expose weaknesses? What would happen if two or three risks collided at the same time?
When internal audit creates space for those conversations, organisations often realise the risks were visible all along.”
In many organisations this shift in perspective is significant. Internal audit has traditionally focused on hindsight, reviewing events and controls after activity has taken place. Foresight introduces a complementary perspective, helping organisations anticipate how current conditions may develop and where emerging risks may appear.
Connecting the dots across the organisation
Emerging risks rarely appear neatly within traditional organisational structures. They often develop at the boundaries between teams, systems and processes. This is where internal audit can provide unique value.
Because internal auditors review activity across multiple functions, they are well placed to identify patterns that individual teams may not see.
Paul Haley
“Traditionally internal audit has been very good at analysing what has already happened. That work remains essential, but the standards are now pushing the profession to contribute earlier in the risk cycle.
The challenge is that emerging risks rarely appear in neat categories. They show up as small operational pressures, fragile processes, or dependencies on a handful of individuals who keep everything moving. On their own those things might not look like risks. But when conditions change, they can quickly combine into something much bigger.
The value internal audit brings is the ability to connect those dots and raise questions before the organisation is forced to react.”
Practical ways internal audit can support foresight
During the roundtable discussion, participants shared several practical approaches already being used to strengthen foresight within their organisations.
Discussion themes from the Cardiff Hub roundtable
- Recognising weak signals before they escalate
- Understanding systemic and compound risk
- Cultural barriers to raising emerging risks
- Scenario testing and stress testing assumptions
A profession evolving in real time
The conversation in Cardiff reflected a broader shift taking place across the internal audit profession. Internal auditors are still responsible for assurance over controls and governance. That work remains critical. But organisations are increasingly looking to internal audit teams to provide insight as well as hindsight.
Events like the Hub Cardiff roundtable form part of Littlechild & Haley’s wider work with internal audit leaders across the UK. By bringing Heads of Internal Audit and practitioners together to share experiences and explore emerging risks collectively, the aim is to strengthen how the profession supports organisations navigating increasingly complex risk environments. As the role of internal audit continues to evolve, foresight is likely to become less of a specialist capability and more of a core expectation.
In many organisations the question internal audit may increasingly help answer is not simply:
What went wrong?
But rather:
What signals were already there and how can we recognise them earlier next time?
– The notes from this Hub, are available to those that attended or those that are interested in this topic by reaching out to: info@littlechildhaley.co.uk.
