There’s a strong argument to say that internal audit has never looked stronger on paper.
More automation. More data analytics. More reporting to the board.
Yet many organisations are discovering an uncomfortable truth: The more comprehensive the audit, the less curious it becomes.
Audit plans expand, dashboards mushroom, and assurance outputs grow denser, but insight doesn’t always follow.
Too often, the function built to ask difficult questions becomes absorbed in proving it’s got the answers.
The illusion of assurance is seductive. A thick audit report feels like control. A completed cycle feels like closure. But without curiosity, the process can become a mirror reflecting what management already believes, rather than revealing what it needs to know.
Why Now: The Changing Role of Audit
Across 2024–25, regulators have become increasingly vocal about this shift.
The Financial Reporting Council’s Annual Review of Corporate Governance Reporting 2024 cautions that many boards still rely on narrative statements rather than evidence of behaviour, calling for more concise, outcomes-focused reporting and stronger internal controls disclosure.
Similarly, the Prudential Regulation Authority has emphasised challenge, proportionality, and judgement in assurance – with a risk-based, proportionate approach embedded in its guidance on outsourcing and third-party risk management and reinforced in its current supervisory priorities.
And the Chartered Institute of Internal Auditors (CIIA) – through its Risk in Focus 2024 report and subsequent board briefings – has warned that some internal audit functions are spending more time validating compliance and assurance processes than probing emerging risks, creating false confidence rather than real clarity.
It’s a familiar pattern across sectors.
Automation and assurance tooling have strengthened audit’s reach, but they’ve also distanced it from the business heartbeat.
The risk isn’t that audit is underperforming – it’s that it’s over-performing in the wrong places.
When Assurance Becomes Performance
Audit is meant to provoke. To challenge. To uncover. But over time, it can start to misperform.
Faced with stakeholder demand for evidence and regulators calling for rigour, many teams have become focused on producing reassurance. The process becomes self-referential – full of validation loops and process confidence.
The FRC’s 2024 review found that some audit committees equate assurance volume with effectiveness. That creates a cultural blind spot: activity stands in for impact.
An assurance map with 200 control points may look thorough, but if none relate directly to business behaviour, it’s a catalogue, not a compass.
This is how the confidence trap sets in. The richer the data, the more certain the message and the harder it becomes to challenge it.
The Missing Curiosity Factor
The best auditors aren’t those who know the process by heart. They’re the ones who still ask “what if?” and “why?”.
Curiosity used to be audit’s core instinct. Now it risks being its casualty.
Modern audit teams are under pressure to evidence competence, with every hour accounted for, every finding linked to a framework, every cycle tied to KPIs. The unintended outcome? A discipline optimised for efficiency, not discovery.
The thing is, curiosity doesn’t scale easily. You can’t automate it, and you can’t schedule it. But without it, assurance becomes sterile and a process that validates yesterday’s controls rather than anticipating tomorrow’s risks.
Reclaiming Audit’s Purpose
If audit is to remain a force for insight rather than administration, it needs to re-centre on three disciplines: proximity, purpose, and proportion.
Proximity means getting closer to the business. Not as a participant, but as an observer who understands context.
When assurance happens only in quarterly cycles or through templated questionnaires, it misses the nuances of day-to-day decision-making, where cultural and behavioural risks often originate.
Purpose means remembering that the point of audit isn’t to prove compliance; it’s to improve confidence – grounded in truth, not repetition.
That might mean reducing the number of audits but deepening the analysis of each one.
Proportion means knowing when “enough” is enough. The PRA explicitly calls for proportionate assurance, encouraging firms to scale testing to materiality, not habit.
Curiosity, after all, isn’t a soft skill. It’s a control.
Culture, Courage and Connection
Audit effectiveness isn’t only about frameworks; it’s about culture.
The ability to speak the truth to those in power, to question what’s accepted, and to ask “why” when “what” feels safer.
Courage in audit isn’t dramatic; it’s consistent. It’s the willingness to pause a meeting to ask for context rather than pressing on just to meet an agenda.
It’s taking findings back to management with questions, not just conclusions.
And connection matters. When audit loses contact with the business, it loses empathy, and with that, credibility.
The strongest functions are the ones that are invited back because they add value, not just oversight.
What Comes Next: From Confidence to Curiosity
Audit’s future depends on rediscovering its discomfort zone.
Boards don’t need thicker reports; they need sharper insight. Regulators don’t want more data; they want assurance that questions the right things.
The profession’s next frontier isn’t better analytics, it’s better listening. It’s cultivating the kind of curiosity that can’t be codified, only encouraged.
Because assurance isn’t about having the last word, it’s about asking the next one.
Stay up to date with the latest stories from the world of governance, risk, audit and compliance >>>
