The IIA recently launched new Global Internal Audit Standards that, for the first time, requires every internal audit function to have an internal audit strategic plan. It may be the single most important addition to the Standards.

Standard 9.2 mandates that the CAE “develop and implement a strategy for the internal audit function that supports the strategic objectives and success of the organization.” The Standard further specifies that the strategy “include a vision, strategic objectives, and supporting initiatives for the internal audit function.”

It is no secret that most internal audit functions either do not have a strategic plan or not one that would meet these new requirements. In fact, in a recent survey by Hal Garyn, only 24% of respondents indicated that they “absolutely” have a strategic plan that would meet the new standard.

I have long been an advocate for internal audit functions having a strategic plan. One of my first priorities each time I assumed the role of CAE was to lead the internal audit team through a strategic planning process. I found it to be a powerful way to get everyone aligned on the vision for internal audit and what it would take to get there. In the coming months, I plan to share my advice on effective strategic planning techniques.

Over the years, I have encountered those who argue that a strategic plan is not necessary for internal audit success. They say their internal audit department is already highly respected and meeting stakeholder expectations. They believe that strategic planning is a “useless exercise” that diverts time and resources away from the mission.

Sadly, such resistance and complacency often leads to disaster. I once completed an external quality assessment of an internal audit function that I considered one of the best. Three years later, the CAE was fired and the function was outsourced. When I asked why, the CEO candidly observed that internal audit had not been responsive to his or the board’s needs and needed to be “blown up.” My conclusion: complacency is not a good strategy.

Complacency in business, personal growth or any other aspect of life is often likened to standing still beside a moving walkway. The illusion of stability is just that: an illusion. As the world around you moves forward, standing still means you are effectively moving backward. Complacency is not just ineffective, it’s dangerous.

The Illusion of Safety

Complacency often stems from a place of comfort. The CAE of the internal audit function that was “blown up” was confident about the future because of internal audit’s success. He suffered from the “if it ain’t broke, don’t fix it” mentality. However, in a world characterized by rapid technological advancements, economic shifts and evolving societal norms, what isn’t broken today might be obsolete tomorrow.

Kodak, a giant in the photography industry, became a cautionary tale for resting on its laurels; despite inventing the digital camera, it failed to capitalize on the technology, leading to its downfall. That story exemplifies how complacency, disguised as playing it safe, can lead to missed opportunities and, ultimately, irrelevance.

The Peril of Underestimation

Complacency also leads to underestimating both challenges and competitors. After the demise of his internal audit function, the CAE told me he never even considered that the company might outsource internal audit. Blockbuster Video’s failure to recognize the potential of streaming services is another stark example. With a business model rooted in physical video rentals, Blockbuster was slow to adapt to the digital transformation, allowing Netflix to capture the market. Underestimating change and competition out of a complacent mindset can result in business (or an internal audit function) becoming outpaced and outdated.

Stagnation of Growth

Growth, both personal and professional, requires stepping out of one’s comfort zone. In the personal realm, complacency prevents individuals from achieving their full potential. It’s the barrier that stops someone from learning a new skill, improving their health or pursuing a dream. Professionally, it stunts organizational growth and innovation, making it difficult to attract and retain talent and, ultimately, it impacts the bottom line.

False Sense of Security

I know of several instances in which CAEs became very comfortable because of excellent working relationships they had developed with their CEOs or audit committee chairs. But when the CEO or audit committee chair departed, they were subjected to new expectations from executives with whom they had no past. The consequences often play out on a much bigger stage. In financial markets, complacency can lead to the underestimation of risks, resulting in catastrophic losses when market conditions change unexpectedly. The 2008 financial crisis serves as a grim reminder of what can happen when complacency blinds stakeholders to the buildup of risk in the system.

Overcoming complacency requires a mindset shift. Change is the only constant in life. Embracing this reality is essential for survival and growth. Complacency, on the other hand, is the denial of change. It’s a static strategy in a dynamic world. The technological landscape, for instance, evolves at an unprecedented pace. Companies that fail to innovate and adapt, thinking their current products or services will always be in demand, find themselves outpaced by more agile competitors. The same is true for internal audit functions.

Adaptability is the antithesis of complacency. It involves being vigilant, recognizing when change is on the horizon and being prepared to pivot, as necessary. This agility allows individuals and organizations to seize opportunities, mitigate risks and continue on a path of growth and success. Adaptability requires a mindset that values continuous learning, improvement and innovation over any false comfort of the status quo. And a sound strategic plan enables adaptability. It envisions potential risks and uncertainties and positions internal audit to respond.

Being proactive is crucial to avoiding the pitfalls of complacency. This means not just reacting to changes and challenges as they arise, but anticipating them and preparing in advance. For internal audit, this could involve securing talent to address tomorrow’s risks, investing early in technology or deploying new services or methodologies aligned with shifting stakeholder expectations. For individuals, it might mean continually upgrading skills, seeking feedback for improvement or setting new goals. Proactivity ensures that you are always moving forward.

Complacency might feel comfortable in the short term, but it often leads to stagnation, irrelevance and failure in the long term. One of my heroes in the sports world is former University of Alabama football Coach Nick Saban, who was notorious for warning his teams about complacency:

“You get up every day, you’re entitled to nothing,” Saban said. “Nobody owes you nothing. You could have talent, but if you don’t have discipline, if you don’t execute, you don’t focus, you get nothing. If you’re complacent, and not paying attention to detail, what does that get you?”

I welcome your thoughts on this topic. Feel free to contact me at blogs@richardchambers.com or via LinkedIn or X.