Internal Audit Cannot Have an Expiration Date: Protagonism Beyond the Month of May

 

The month of May, globally recognized as Internal Audit Awareness Month, is coming to an end. However, let's be honest: the effort to raise awareness about the value of our profession within organizations cannot have an expiration date.

For Internal Audit to be truly seen as a strategic engine, this awareness must be a continuous, daily effort. This transformation journey requires a profound change that starts from the inside out, directly reflecting on the mindset and competencies of the auditors themselves.

For a long time, the internal auditor carried the stigma of being the "corporate police or inspector", that dreaded figure who arrives with a clipboard merely to point out past mistakes, look for culprits, and bureaucratize processes.

If we want to change the perception of our stakeholders, the first step is to transform our own positioning.

The modern auditor needs to leave that badge in the drawer and assume the role of a strategic and reliable counselor (Trusted Advisor).

This means acting with empathy and collaboration, while maintaining independence, and focusing on the future. It’s about supporting leadership in building the "how to do it safely," rather than simply saying "no."

This shift in posture, however, does not happen by decree; it demands a very high level of competence and proficiency. The new profile of the auditor goes far beyond the compliance checklist. Its non-negotiable foundation is the mastery and rigorous application of the Global Internal Audit Standards, which guarantee the quality, ethics, and technical credibility of our work.

But the standards are the baseline, not the ceiling.

To audit properly and generate real value, a true immersion in the dynamics of the business is essential. We need to deeply understand how the company makes money, what its market pain points are, and how the operational engine works in practice.

A professional with strategic vision spends less time looking only through the rearview mirror and more time looking through the windshield, connecting operational risks to the organization's broader objectives to anticipate trends and shield the company's future.

In the context of an increasingly disruptive market, anyone who thinks innovation and audit are opposing forces is mistaken.

 On the contrary: the internal auditor needs to take a leading role in corporate innovation. Behind closed doors, this means embracing new technologies—such as advanced data analytics, artificial intelligence, and virtual agents—to make our own work more agile, predictive, and effective.

Facing outwards, it means acting as a major facilitator of safe innovation. Audit should not be the handbrake of new projects, but rather the seatbelt that allows the organization to accelerate, create, and dare with confidence.

When the auditor elevates their level of proficiency and positions themselves as an agent of transformation, the perception of the entire company naturally shifts.

Awareness ceases to be a marketing campaign on the calendar and begins to be delivered in every daily interaction, whether by practicing active listening during a walkthrough or by evaluating viable solutions alongside management.

The ultimate value of our profession is consolidated when business leaders proactively seek us out before launching a new product or entering a new market.

May is ending, but our ongoing mission to prove, project after project, that we have stopped being a "necessary evil" to become indispensable strategic partners, remains stronger than ever.

Be happy!

The Illusion of Security: Why Your Internal Control Might Be a House of Cards

 

Once, during a consulting project, a manager told me something that sounded reassuring: "We have control for outgoing goods; it’s done every single day." However, as I dove into the process, I discovered the harsh reality behind those words. That "control" was merely an employee jotting down what left the warehouse in a notebook, no verification, no signature, and no oversight. In the manager's mind, the risk was covered; in practice, he had a hollow procedure, but not an effective control.

Many people confuse control with bureaucracy, and I often hear that "bureaucracy kills business." But that isn't true. 

Bureaucracy, in its essence, is not a bad thing. If we look at Max Weber’s theory, we understand that it was conceived as a form of human organization based on rationality, ensuring impersonality, a clear hierarchy, and meritocracy. It ensures that the process depends on the rule, rather than the mood of whoever is executing it. 

I always say that bureaucracy is simply the formalization of what is already working.

The real problem isn't bureaucracy itself, but "bureaucratic excess", when the ritual becomes more important than the result. 

An internal control system based on best practices, right sized to keep risk factors within acceptable levels, is essential for operational efficiency. It creates order and prevents the "rigidity" that often blinds an operation.

We know that internal control is an action designed to mitigate the cause of a risk before it materializes. It manifests in the "doing": in the review, the verification, the recalculation, and the careful approval. If there is no confrontation between "what should be" and "what is," the risk continues to walk freely through your company’s hallways.

For a control action to be more than just figurative, it requires four non-negotiable attributes:

• First, the Objective, which is the very reason for its existence and must target the risk factor. For example, if the risk is the use of incorrect labor hours, the objective is to ensure that the hours in the payroll system are consistent with the time-tracking system.

• Second, Practical Action, such as a data verification. It is vital to formalize how this action is performed so that a "prudent person" could re-perform it.

• Third, the Evidence, because a control without a trail is invisible. It could be a sign-off, a system log, or an email. To an auditor or an internal controls specialist, a lack of evidence implies the control does not exist. Finally, the Frequency, which must match the speed of the risk, whether it be daily, monthly, or per event.

 

When we talk about Control Modeling, the starting point is knowing the risk factor and the magnitude of what we are mitigating, allowing us to define the necessary attributes to keep the operation within the organization's risk appetite. 

These same attributes allow us to evaluate Design Efficiency, concluding whether the control has the theoretical capacity to mitigate the risk.

 Once we move to Effectiveness Evaluation—the actual control testing—the focus shifts to two crucial points: discipline, observing if the evidence exists within the defined frequency; and quality, re-performing the action to ensure it wasn't just a formality. 

This is why these attributes must be formalized, at the very least, in an Internal Control Matrix.

 It is also fundamental to understand that control is neither absolute nor infallible, as it is designed and executed by people. And where there are humans, there is vulnerability—whether through errors in judgment or, in grave cases, omission, fraud, and collusion. Therefore, the effectiveness of a control does not reside solely on paper, but in the discipline and ethical stance of its execution.

Recently, the market witnessed a testimony that serves as a stark warning. A former bank director admitted to signing documents without reading them. More than a momentary lapse, his confession revealed a void: despite heading the department, he did not perform monitoring or prevention duties.
Here we have the perfect "Window Dressing Control"—the evidence and frequency exist, but the execution of the action is null.

Unfortunately, this is not an isolated case; it is present in many corporations where management still mistakenly views control as mere bureaucracy.

To conclude, I leave you with a thought for reflection:

"The effectiveness of a control depends on action, evidence, and frequency, but it only stops being a house of cards when the integrity of the person executing it is greater than the convenience of simply signing."

Be happy!

Corporate Context and Governance: The Importance of Systemic Alignment in Generating Real Value

 

At the start of this year, I immersed myself in a deep review of the fundamental concepts of management and auditing. Reflecting on what separates resilient companies from those that merely "appear" organized, many still confuse compliance manuals with effective management. 

Many organizations boast robust Governance, Risk, and Compliance structures, yet when crises strike or the market faces disruption, these pillars collapse because they prove irrelevant in practice.

The reason behind this phenomenon is a deep-seated corporate myopia: the inability to view the context in a comprehensive and logically integrated way. The corporate context is not a static scenario; it is a living dynamic composed of culture, market shifts, and interconnected objectives. When management fails to visualize the organization in an aligned manner—connecting Mission-Strategy-Processes-Risks-Controls—it operates in a distracted and disaggregated fashion. Governance is treated as an aesthetic accessory, a "picture on the wall," rather than the central nervous system that should process every environmental stimulus to generate precise responses.

This disconnect begins at the foundation: the Mission. It is not a marketing exercise, but the society's reason for existence and the compass that guides management. When strategy detaches from the mission, the company loses its authenticity and its social license to operate. For strategic objectives to become more than just wishes, an intelligent organizational architecture is required, where limited resources—people, finance, and technology—are not wasted on activities that do not feed the core purpose. This demands clear business cycles and operational processes where every task has logic, and every delivery generates real added value.

This is where many fail: by attempting to identify risk in isolation and without knowledge of the objectives of the object being evaluated. The reality is simple: risk is any event that impacts the company’s ability to achieve its objectives. If you have an objective, you inherently have risks. Therefore, risk management is not a support function, but a proactive tool that maps what might prevent the fulfillment of the mission. We do not treat risk in the abstract; instead, we address its factors and causes, measuring probability and impact to define whether the response should be to mitigate, transfer, or accept.

When the response involves mitigation, internal control takes the stage. It is only effective when it targets the risk factor with precision, ensuring that the residual risk remains aligned with the organization's appetite. Spending fortunes on complex systems that do not communicate with real risks only generates expensive and fragile bureaucracy.

For the modern internal audit professional and the control specialist, understanding this logical alignment—Mission-Strategy-Process-Risk-Control—is what allows for the delivery of real value. Without this systemic vision, any assessment will be superficial. With it, the professional moves beyond merely validating checklists and begins to evaluate the effectiveness and efficiency of the organization, diagnosing whether the gears are generating value or if the company is simply suffering from analysis paralysis.

Organizational success stems from the understanding that the corporation is a living gear. When the mission guides the strategy, the strategy shapes the processes, and the processes are protected by risk-aligned controls, a dynamic resilience is created that transforms compliance into a competitive advantage.

To conclude, reflect on this:

"Management that ignores corporate dynamics and alignment is the same management that remains ignorant of its risks and negligent of its controls. For such leadership, success is not a strategy; it is merely a matter of luck."

Be happy!

 

Back to Basics: Why AI Won't Save an Audit Without a Solid Foundation

Happy 2026 Everyone!

As we kick off 2026, the buzz in the hallways of every organization is the same: Artificial Intelligence. We are talking about predictive analytics, automated reporting, and real-time monitoring. But as auditors, we need to have a moment of intellectual honesty.

There is no point in talking about Artificial Intelligence if we are still failing at the basics.

Disruptive innovation has indeed changed the way we work, but the pillars of a high-impact internal audit remain unchanged. Whether you are in the public or private sector, the value we provide isn’t just in the tools we use, but in the rigor of our methodology.

The "Shiny Object" Trap

It is easy to get distracted by the latest software, but a sophisticated algorithm applied to a flawed audit plan will only produce "high-tech" errors. High-impact auditing is born long before the first line of code is written; it is born from:

• Respect for Standards: Adhering to professional norms is what gives our work legal and institutional weight.

• Rigorous Planning: Understanding the object of evaluation, defining clear scopes, and setting realistic timelines.

• Quality of Evidence: Collecting evidence that is not just abundant, but sufficient, reliable, relevant, and useful.

Returning to the Foundations

For a truly effective audit, it is essential to "work the basics." This means mastering the core cycle of our profession:

1. Planning with Purpose: Truly knowing the entity and its risks before defining objectives.

2. Execution with Precision: Applying the right techniques—be it physical inspection, circularization, or analytical review—and documenting them in flawless working papers.

3. Communication with Impact: Reporting not just "what happened," but providing a professional opinion that helps management improve through actionable recommendations and consistent follow-up.

Looking Ahead to 2026

My invitation to you this year is to review your foundations. Masterfully executing the basics is, ironically, the greatest competitive advantage an auditor can have in a world obsessed with automation.

AI can process data, but it cannot replace the professional judgment of an auditor who knows how to apply a materiality lens or evaluate the "design and discipline" of an internal control system.

Let’s embrace the future, but let’s keep our feet firmly planted on the bedrock of our profession.

Be happy! 

How to Turn Process Mapping into an Effective Evaluation Tool

 

One of the fundamental activities carried out by internal control specialists and internal auditors is the mapping of operational processes that will be evaluated.

First of all, it is important to understand that an operational process is a set of tasks logically organized with the aim of delivering products or services that add value. It allows management to better allocate resources, actions, and decisions to achieve strategic goals and objectives. Thus, it becomes clear that a process only makes sense if it is connected to the company's strategy.

Another important point is that each process must have a responsible manager who handles the management functions — that are planning, organizing, directing, executing, and monitoring. This manager is also responsible for risk management and the internal control system of the process.

Process mapping is an essential practice both when modeling new processes and when assessing existing ones, to verify if they are efficient, effective, and economical. Additionally, mapping is indispensable for analyzing whether the internal control system is sufficient to keep risks at acceptable levels, aligned with the organization's risk appetite.

In a performance or operational audit, mapping is part of the planning phase.

Nowadays, it is very common to use the BPM methodology to design processes, but it does not clearly distinguish between a task and an internal control. As a result, the outcome often looks more like a block diagram than a flowchart that is useful for a more precise evaluation.

This article aims to propose a reflection: how can we improve this mapping, making it simpler and, at the same time, more effective for evaluating both the process and the internal control system?

The first point concerns the way the process is mapped. It works better when conducted through planned interviews with those who perform the tasks on a daily basis. In these interviews, the specialist or auditor needs to have the skills to clearly identify what a task is and what is a control.

Put simply:

• An internal control is an action aimed at reducing the probability of a risk materializing. For example: reviewing, checking, recalculating, approving, authorizing, among others.
• A control is a decision point: if everything is correct, the process continues; if not, it returns for correction. In the flowchart, the control should be represented by a diamond shape (also known as a gateway).

On the other hand:

• A task is an execution action, such as recording, demonstrating, archiving, or relating information. In the flowchart, it is represented by a rectangle.

With this, notice how we can simplify: it is enough to use three symbols to create the flowchart:

• A circle to mark the beginning and end of the process,
• A rectangle for the tasks,
• And a diamond for the controls.

This model makes the flowchart clearer, more objective, and easier to use in the evaluation.

I personally like to use the "swimlane" format in the flowchart, where horizontal bands indicate the roles or functions involved in the process. This helps to better visualize whether there is a good segregation of responsibilities, which is essential to avoid failures.

Keep in mind: the flowchart must always represent the process as it is currently carried out, not as we would like it to be. Therefore, after mapping, it is essential to validate it through a "walkthrough", that is, walking through the process together with the person responsible, to confirm that what is described is accurate.

In the end, we will have a clear view of:

• All the tasks of the process,
  
• All the existing internal controls.

These elements are the basis for assessing:

• Whether the process is efficient and effective,
• Whether the internal control system is sufficient and effective.

All internal controls identified must be recorded in the internal control matrix, where they will be organized to facilitate analysis.

I am often asked: “Is it necessary to identify risks in the flowchart?” My answer: it is not mandatory, but there is also no problem in doing so. If you wish, you can include this information, linking it to the process risk matrix.

I hope this article has helped you reflect on the topic and, perhaps, improve your process of mapping operational processes.

I wish you great success and, Be Happy!

Managing the Internal Audit Function: What You Need to Know About Domain IV of the New Global Internal Audit Standards

 

Since January 9, 2025, the Global Internal Audit Standards (GIAS) have officially replaced the 2017 IPPF. 

This transition marks an important evolution in the way internal audit is practiced worldwide,  not a revolution, but an elevation of the profession.

These standards provide an essential technical and ethical framework for internal auditors, ensuring consistency, quality, and credibility in their work. Among the most critical updates is Domain IV: Managing the Internal Audit Function.

While some elements of Domain IV were present in previous frameworks, it now brings a sharper focus on strategic management, resource optimization, effective communication, and continuous quality improvement.

Domain IV clarifies the role of the Chief Audit Executive (CAE) in ensuring that the internal audit function is:

•      Aligned with the organization's strategy
•         Efficient in resource management
•         Transparent and effective in communicating with stakeholders
•          Committed to continuous improvement

Perhaps the most significant new element is Principle 9, emphasizing that internal audit must have a strategic plan as its primary driver.

Internal audit is no longer just about executing an annual or multi-year audit plan. The CAE must approach audit planning strategically, ensuring that internal audits support the organization's long-term success.

This requires:

•        A deep understanding of the audit mandate
•         Full awareness of the Organization's operational and financial dynamics
•         Knowledge of governance, risk management, and internal controls

In other words, the CAE must understand how the organization operates, makes decisions, and sets its long- and medium-term strategic goals.

How can audit leaders implement this effectively? Here's a simple roadmap:

1. Start with the Organization’s Strategy
   Your internal audit strategy must support the organization’s strategic objectives.
2. Engage Key Stakeholders
3. Align your strategy with the expectations of the Board, senior management, and other key stakeholders.
4. Define the Vision
   While your mission is set by Domain I of the GIAS, your vision articulates the desired future state of internal audit. For example:

“To be a catalyst for change and innovation, driving operational and financial efficiency.”

4. Set Strategic Objectives
   Define specific goals linked to your vision. For instance:
• Ensure auditors have the necessary competencies to address emerging risks
• Secure resources for predictive analytics and innovation-related audits
5. Conduct a SWOT Analysis
   Identify your function’s strengths, weaknesses, opportunities, and threats to develop a practical roadmap for achieving your objectives.
6. Monitor and Adjust
   Continuously monitor action plans and progress toward strategic objectives, adjusting as needed to remain relevant and effective.

Why does this matter more than ever?

• Strategic planning is no longer optional; it’s essential for internal audit to:
• Allocate resources efficiently
• Ensure audit work adds tangible value
•  Anticipate and respond to organizational changes
• Strengthen governance and risk management processes

It transforms internal audit from a compliance-focused activity into a strategic partner within the organization.

Final thoughts for audit leaders:

In my point of view Domain IV is a cornerstone of the new standards, reinforcing the need for internal audit to operate strategically and systematically.

As internal auditors and leaders, embracing this approach will elevate your function’s relevance, impact, and value within the organization.

Let’s make internal audit a true driver of strategic success!

What steps are you taking to align your internal audit function with these new standards? Share your thoughts and experiences in the comments!

I’d like to close with this reflection:

“Always strive for simplicity — it is a competitive advantage. But remember being simple does not mean being superficial.

Be Happy!

This article was written with the help of human intelligence

 

The Critical Role of Artificial Intelligence Governance in a World Undergoing Profound Transformation

 

I have been participating in several working groups where we discuss the impact of artificial intelligence (AI) on organizations and society. And I must confess: the deeper I dive into this subject, the more I realize we are living through a moment of transformation far deeper than it seems at first glance.

In recent years, technology has evolved at an unprecedented speed. Innovations that once seemed distant are now knocking on our doors, radically changing how companies operate and compete. If we once spoke of isolated disruptions, we now live in a state of continuous disruption, spanning all areas and directly challenging corporate strategies.

And who is at the center of this revolution? Artificial intelligence, of course. But not AI alone. Technologies like autonomous agents, quantum computing, and neuromorphic computing are reshaping the fabric of organizations and, consequently, of society itself.

What strikes me most is that, despite all this, many professionals and companies have yet to grasp the depth and speed of these changes. And that’s concerning. It could compromise the sustainability of organizations and even the relevance of many professionals.

This new scenario demands more than enthusiasm for innovation. It demands responsibility, structure, and governance. And this is where AI governance comes in—as a viable, necessary, and urgent path to ensure that all this transformation is sustainable, ethical, and strategic.

We are entering an ecosystem of emerging technologies that, when combined, have the potential to completely reshape the fabric of society. More than just new tools, they represent new paradigms.

Much has been said about generative artificial intelligence, which is undoubtedly a milestone. But it’s only the doorway. We are witnessing the convergence of several emerging technologies that together have the power to radically change how we live, work, and relate to one another.

I want to share some of this reflection with you, starting with understanding what is truly happening around us.

Autonomous Virtual Agents

Autonomous virtual agents are not just smarter chatbots. They are systems capable of understanding objectives, making decisions, and executing tasks without continuous human supervision.

These agents are already being tested in financial negotiations, medical diagnostics, and even customer service learning, interacting, and adapting in real time.

Soon we will have our own virtual agent capable of performing simple tasks like receiving our emails, reading, assessing, prioritizing, deciding, and responding as if it were us even carrying out complex operations, such as defining products based on actuarial calculations.

Their ability to operate in complex and dynamic environments raises crucial questions about control, responsibility, and social impact.

Autonomous Robotic Systems

Industrial automation has adopted a new meaning with autonomous robotic systems, where robots not only follow instructions, but they also learn from their environments, correct their paths, collaborate with each other, and make decisions based on data.

Tesla’s Optimus is an example of this, expected to hit the market by 2026, at the price of a vehicle. In sectors such as logistics, healthcare, agriculture, defense, and space, these systems are replacing human labor in critical tasks raising significant questions about employment, ethics, and safety.

Quantum Computing

The promise of quantum computing is simple yet monumental: solving problems that would take a traditional supercomputer millions of years—in just minutes or seconds.

This could transform areas like climate modeling, molecular simulations for new drugs, logistical optimization, and especially cybersecurity.

IBM has already launched the Q System, a commercial quantum computer. Google has achieved “quantum supremacy” by performing a calculation on a quantum computer that would be impossible for classical supercomputers in a reasonable time. Microsoft is advancing in qubit technology, having developed a new quantum chip capable of solving large-scale complex problems.

With this power come significant risks, such as the potential to break encryption systems that underpin the modern internet, exposing sensitive data from governments, companies, and citizens.

Neuromorphic Computing

Although not new—Misha Mahowald and Carver Mead developed the first silicon retina and cochlea, as well as the first silicon neurons and synapses in the 80s neuromorphic computing gain renewed relevance with generative AI.

Inspired by the functioning of the human brain, neuromorphic computing seeks to create systems with learning and adaptation capabilities that closely mirror biological cognition.

This represents a major leap toward the creation of truly autonomous AI, capable of reasoning with context, memory, and emotion.

But it also represents a turning point: how do we regulate machines that think similarly to us?

Observe that what makes this moment unique is not the emergence of one disruptive technology, but the convergence of several.

When autonomous agents operate using neuromorphic neural networks, supported by decisions optimized through quantum algorithms, within robotic ecosystems, we are undoubtedly facing a new form of systemic intelligence—one that, if not properly governed, could surpass our control, with unpredictable consequences.

In 2024, at an AI event, a presenter stated that soon we would have three types of agents operating in companies: human agents, hybrid agents, and android agents.

At the time, I thought, “This speaker is watching too many sci-fi movies.” But today I see how mistaken my view of technological evolution was. Not as an excuse but understand that I’m almost a "time traveler” when I began working half a century ago, the most advanced technology was a manual typewriter, or a communication device called the Telex.

But let’s set aside the nostalgia and continue our reflection. 

Thus, it's clear that beyond the fascination with new technological possibilities, there’s a reality that organizations cannot avoid: the way they operate, protect themselves, and provide accountability is being profoundly reconfigured—so rapidly that it’s difficult to process, adapt to, and integrate innovations into daily operations.

And since companies are made up of people, all this deeply and continuously affects individuals’ lives, requiring them to break paradigms constantly. This contributes significantly to professional burnout and rising depression levels.

Corporate structures are being redefined, and this doesn’t only affect IT it impacts the entire operational ecosystem. Every department is being affected, without exception.

Compliance, risk management, and internal audit—traditionally pillars of corporate governance are directly impacted by this new disruptive ecosystem. Let’s examine:

Compliance

With the rise of autonomous agents and real-time decision-making systems, ensuring legal and ethical compliance is no longer a matter of simply “checking processes.” It now demands continuous monitoring, a deep understanding of the technologies involved, and the ability to respond to unforeseen events.

What happens, for instance, when an autonomous AI makes a biased or unethical decision? How can we ensure systems comply with regulations that are still being formulated?

Risk Management

In today’s landscape of exponential innovation, corporate risk management faces one of its greatest challenges: anticipating the unpredictable.

Technologies like autonomous agents, quantum computing, and neuromorphic systems introduce variables that didn’t exist a few years ago—and often aren’t even recognized as risks until they’ve already materialized.

The traditional risk management model—based on static cycles of identification, analysis, response, and monitoring—was already showing signs of exhaustion and now must be completely reimagined. It lacks the agility and adaptability to handle emerging risks that evolve in a matter of weeks, days, or even hours.

Risk is no longer a possibility—it’s a certainty at some point in the journey. The real differentiator now is the speed and intelligence of the response. This demands new organizational capabilities.

Internal Audit

Internal audit, long the guardian of compliance and efficiency, must now also serve as an interpreter of technological complexity.

With increasingly automated processes and decisions made by autonomous systems, auditing the "who did what" requires understanding algorithms, data flows, and machine learning logic.

More than identifying failures, auditing now requires anticipating risks, evaluating efficiency considering new innovations, assessing ethical impacts, and verifying whether digital governance principles are being upheld.

So, the central question is: How will we, and our organizations deal with all this?

In my view, there is no single answer. But one thing is certain: the first step involves a structured approach to effectively manage this technological disruption in a sustainable way, which we can call artificial intelligence governance.

AI governance is not just a control strategy, it is a foundational approach to ensure digital transformation occurs in alignment with corporate, societal, and ethical interests.

In times of rapid and unpredictable innovation, it serves as the backbone for managing disruption sustainably creating a framework that guides organizations not just to innovate, but to innovate with responsibility and long-term vision.

For our reflection, I believe AI governance must address the following key areas:

Defining Responsibilities

AI governance sets clear responsibilities within the organization. Who is accountable for the ethical and safe use of technology? How do we ensure automated or AI-assisted decisions follow company guidelines and legal standards?

Creating an AI governance committee, for instance with executives from IT, compliance, legal, and ethics, ensure decisions are made in a coordinated and informed way, without overwhelming any single department.

Additionally, governance determines how responsibilities align with strategic objectives. Every new AI project should be evaluated not only for its innovative potential, but also for its strategic, ethical, and regulatory impact.

Committing to AI governance means that, while the organization explores new technological frontiers, it also maintains control over the consequences of innovation.

Defining Security Standards

As technologies advance, security becomes a critical issue—not just in terms of data protection, but also regarding the integrity of automated decisions and system reliability.

AI governance establishes the necessary security standards to protect both sensitive data and autonomous systems. This involves implementing advanced cybersecurity mechanisms and protocols to ensure AI makes decisions that are secure and aligned with the organization’s values.

Preventing bias, ensuring algorithm transparency, and auditing automated decisions are all essential governance practices to ensure technologies are not only effective but also safe and fair.

Operational Formats and Monitoring

Governance also defines the operational structure of AI within the organization—creating frameworks for the development, integration, and management of intelligent systems.

AI implementation must be transparent, continuously monitored, and adjusted as technology evolves.

AI monitoring systems are essential to ensure that even when systems make autonomous decisions they remain within established boundaries.

In addition, AI governance demands ongoing monitoring to detect failures, errors, or unwanted behavioral changes, ensuring that unexpected risks don’t arise.

This monitoring must be integrated into strategic corporate management, aligning technological innovation with organizational goals and culture, so that AI contributes effectively to sustainable and ethical growth.

Note that this topic is much broader and far from exhausted here. Organizations through their Boards of Directors and/or Executive Management must address it quickly, seriously, and assertively.

They must take a leading role in structuring robust governance that permeates the entire organization and this is now urgent and non-negotiable.

I leave you with a thought provoking question for reflection:

How are you and your company addressing this issue?

The journey is just beginning. And despite all the challenges, what truly matters in the end is that we continue to find meaning, build together, and be happy
with ethics, awareness, and purpose.

Comments are welcome! Be happy.

This article was written with the help of human intelligence!

Domain III: Governing the Internal Audit Function, Evolution from the IPPF 2017

Domain III of the Global Internal Audit Standards defines the necessary attributes to ensure that the chief audit executive, together with the board and senior management, maintains the independence of the internal audit function, ensuring its effectiveness.

In the IPPF 2017, the attribute standards already emphasized the need for a solid relationship between internal audit and the board to ensure independence. The new standards expand and strengthen this concept, consolidating essential principles.

This domain is structured into three principles and nine standards, providing the foundation for meeting normative requirements. Below, we highlight the key advancements compared to the previous model.

1. Formalization of Internal Audit Function Authorization

Principle 6 reinforces the need for the board’s formal authorization of the internal audit function, supported by the following standards:

• Standard 6.1 - Audit Mandate
• Standard 6.2 - Audit Charter
• Standard 6.3 - Board and Senior Management Support

The mandate defines the authority, role, and responsibilities of internal audit, which, through a systematic and disciplined approach, aims to enhance governance, risk management, and internal controls.

The Internal Audit Charter becomes an essential document, formalizing the purpose, scope of activities, organizational positioning, responsibilities, and authority of internal audit.

Senior management and the board play a fundamental role in supporting internal audit by ensuring unrestricted access to data, information, and assets, enabling the effective execution of its work.

2. Strengthening Organizational Independence

Principle 7 addresses the independent positioning of internal audit, supported by two standards:

• Standard 7.1 - Organizational Independence
• Standard 7.2 - Chief Audit Executive Qualifications

Independence is ensured through the direct reporting line of the chief audit executive to the board, without interference from senior management. This communication channel must allow open discussions, including without the presence of management.

A new addition is Standard 7.2, which details the desired competencies for the chief audit executive, previously addressed in a general manner under the ethical principle of competence in the IPPF 2017. Now, five essential competencies are explicitly defined:

• Deep understanding of the Global Internal Audit Standards and best practices;
• Experience in establishing and managing an effective internal audit function;
• Certified Internal Auditor® (CIA) designation or equivalent credentials;
• Leadership experience;
• Industry-specific expertise.

This clearer definition strengthens the relevance of internal audit and its ability to add value to corporate governance.

3. Board Oversight of Internal Audit

Principle 8 establishes the board’s responsibility for overseeing internal audit, ensuring its effectiveness. The related standards are:

• Standard 8.1 - Interaction with the Board
• Standard 8.2 - Resources
• Standard 8.3 - Quality
• Standard 8.4 - External Quality Assessment

The board must ensure that internal audit has adequate resources, enabling it to fulfill its mandate efficiently. The chief audit executive must transparently communicate any resource limitations and their impact on the audit plan’s execution.

Quality management is also reinforced, requiring an internal and external quality assessment program, with periodic review by the board.

4. Challenges for Organizations Without a Formal Governance Structure

In organizations lacking a formal board, the concept of independence may be compromised. The definition of a board, according to the global standards glossary, includes any high-level governing body responsible for oversight, such as audit committees or advisory boards.

To ensure compliance in these cases, a more robust external assessment program with documented evidence is recommended, including:

• Board meeting minutes discussing audit-related topics;
• Approved audit charter;
• Validated audit plan and budget;
• Audit manual;
• Continuing education plan for the chief audit executive;
• Records of participation in professional events.

Conclusion

Domain III of the Global Internal Audit Standards enhances concepts already present in the IPPF 2017, emphasizing internal audit independence, qualifications, and board oversight. The board’s role is strengthened in ensuring resources and quality supervision, guaranteeing that internal audit has a strategic impact within the organization.

My recommendation is to conduct a compliance assessment against the standards in this domain and, for any identified gaps, define the necessary actions to ensure adherence.

Be happy!

Produced with the help of human intelligence