For more than two decades, I have cautioned chief audit executives (CAEs) to remain vigilant to signals from their stakeholders. Expectations can shift overnight, and with them, perceptions of the value internal audit provides. A strong CAE must continuously reassess stakeholder needs and ensure the function remains aligned with the organization’s risks and priorities.

In my experience, there are always warning signs—some subtle, others glaring—that trouble may be brewing. Stakeholders may be quietly questioning whether internal audit is delivering value. Left unaddressed, these signals can erode support for both the CAE and the function itself. The results can be catastrophic!

The Red Flags

I first offered a list of these warning signs back in 2009, and revisited the topic in The Speed of Risk: Lessons Learned on the Audit Trail. Today, the signals are as relevant as ever—perhaps even more so in the emerging era of artificial intelligence (AI), disruption, and heightened scrutiny. Below is an updated list of 10 Signs Trouble May be Brewing for the CAE and Internal Audit along with strategies for avoiding or addressing them.

1. Static Audit Plans: You are still executing an annual plan based on a risk assessment conducted months earlier, with no new or emerging risks added.
   • Strategy: Shift to a dynamic risk assessment model with rolling updates. Continuously monitor emerging risks and revise the audit plan on an ongoing basis to focus on the most critical risks.
2. Stakeholder-Led Risk Identification: Management and the audit committee are surfacing more new risks than you are.
   • Strategy: Increase engagement with external intelligence, risk owners, and industry peers. Proactively leverage AI to identify potential emerging risks that may not even be on management’s radar yet.
3. Comparisons to Peers: Audit committee members increasingly cite “best practices” they observe elsewhere.
   • Strategy: Benchmark regularly against leading practices and adopt innovations that add value. Demonstrate that your function is not just keeping pace but leading.
4. Overdue Quality Assessments: Pressure builds to undergo an external quality assessment that is long past due.
   • Strategy: Treat external quality assessments as opportunities, not burdens. Schedule them proactively and act swiftly on recommendations to reinforce credibility.
5. Unilateral Budget Cuts: Staffing and budget reductions are dictated without your input, and the audit committee raises no objections.
   • Strategy: Build strong relationships with the audit committee and clearly communicate the impact of resource cuts. Quantify risks of under-resourcing and present alternatives.
6. Marginalized in the Boardroom: You find yourself with fewer agenda slots, and when you do present, members are disengaged.
   • Strategy: Make your presentations impactful and focused on strategic risks. Provide insights, not just findings. Demonstrate value through storytelling and relevant metrics.
7. Assurance Sourced Elsewhere: Stakeholders hire outside service providers to perform work your team could deliver.
   • Strategy: Highlight your team’s capabilities and cost-effectiveness. Position internal audit as the “go-to” resource for assurance and advisory services before outsourcing is considered.
8. Succession Overlooked: Leadership bypasses qualified internal audit talent to appoint a non-internal auditor successor.
   • Strategy: Develop a clear succession plan and advocate for internal audit leadership talent. Mentor and spotlight rising stars so stakeholders see the depth of your bench.
9. Controlled Access to the Audit Committee: The CFO or CEO dictates what you can present and monitors your communication with the chair.
   • Strategy: Protect independence by establishing direct, routine communication with the audit committee chair. Clarify protocols that ensure your access cannot be restricted.
10. Existence Questioned: Leadership openly asks whether the organization even needs internal audit.
    • Strategy: Regularly showcase the tangible value internal audit delivers—cost savings, risk mitigation, and strategic insights. Reinforce the function’s role as essential to governance and assurance.

Final Thoughts

These red flags should never be ignored. They are warnings that confidence in internal audit may be waning. By proactively addressing them with the strategies above, CAEs can strengthen their stature, reassert internal audit’s relevance, and protect its independence. Ultimately, the health of your internal audit function—and your own professional reputation—depends on it.

What other warning signs and responses have you observed in your career? I welcome your insights.