The Small Audit Function Playbook: Practical Guidance for Teams Doing More With Less

The Institute of Internal Auditors Presents: All Things Internal Audit In this episode, Connor Gilchrist talks with Lisa Dalrymple about the challenges small internal audit functions face when implementing the Global Internal Audit Standards. They discuss The IIA's new guidance for small functions, drawing on Dalrymple's experience rebuilding an internal audit function and working as a solo auditor. The conversation covers independence, quality assurance, documentation, audit planning, limited resources, and practical ways small teams can simplify Standards conformance while continuing to deliver value. HOST: Connor Gilchrist, CIA, CPA Senior Manager, Standards & Professional Guidance, The IIA GUEST: Lisa Dalrymple, CIA, CPA Executive Director, Internal Audit, Vitruvian Health   KEY POINTS: (00:00) Introduction (00:40) What the Updated Practice Guide Covers (01:14) Restarting a Dormant Function at Hamilton Health (03:17) Difficulty Ratings and a One-Page Charter (04:22) Redefining Small Beyond Headcount (05:09) Choosing the 12 Key Standards (06:09) Growing From One Auditor to Three (09:14) Protecting Independence Through Board Education (12:01) Embedding Quality Into Everyday Work (13:15) Reviewing Your Own Work Without a Peer (15:03) Keeping Strategy and Plans Short and Simple (16:24) Reporting to the Finance and Audit Committee (18:19) Standout Takeaways From the New Guidance (19:31) First Steps Toward Conformance This Week IIA RELATED CONTENT:  Interested in this topic? Visit the links below for more resources: Assisting Small Internal Audit Functions in Implementing the Global Internal Audit Standards Global Internal Audit Standards Quality Assurance and Improvement Program (QAIP) Internal Auditing Competency Framework Global Best Practices: Small Audit Functions, Large Audit Abilities Visit The IIA's website or YouTube channel for related topics and more. Follow All Things Internal Audit: Apple Podcasts Spotify Libsyn Deezer

The Institute of Internal Auditors Presents: All Things Internal Audit In this episode, Andrea Cirillo talks with Antonio Cacciapuoti about how automation and artificial intelligence are transforming internal audit. They discuss moving beyond traditional sampling and manual processes, practical applications of data analytics and generative AI, and how automation can improve audit efficiency, coverage, and quality. The conversation also explores the risks of overreliance on technology, the importance of maintaining professional judgment, and the skills auditors need to navigate increasingly automated environments. CO-HOSTS: Andrea Cirillo, CIA Senior Director, Head of Audit Data, Artificial Intelligence, and Continuous Risk Assessment, Intesa Sanpaolo Banking Group Antonio Cacciapuoti, CIA Head of Internal Audit, Eurizon  Vice President, IIA Luxembourg   KEY POINTS: Introduction [00:00–00:50] Limitations of Traditional Internal Auditing [00:50–04:35] Technologies Transforming Internal Audit [04:35–07:49] Generative AI and Practical Audit Applications [07:49–10:12] GAIA: Integrating AI Into the Audit Process [10:12–13:45] Documenting Tagging and Preliminary Risk Analysis [13:45–16:23] Improving Audit Efficiency While Preserving Human Judgment [16:23–19:45] Risks and Limitations of Audit Automation [19:45–23:15] Automation Bias and AI Hallucinations [23:15–25:42] Essential Skills for the Future Internal Auditor [25:42–29:29] Keeping Auditors at the Center of Automation [29:29–33:08] Designing Automated Workflows and Human Oversight [33:08–34:25] Balancing Automation With Reversibility and Materiality [34:25–37:04] Final Thoughts on AI and the Future of Internal Audit [37:04–38:12] Closing [38:12–38:22] IIA RELATED CONTENT:  Interested in this topic? Visit the links below for more resources: Data Analytics Guidance and Resources for Internal Auditors Knowledge Center: Artificial Intelligence AI, Data Quality, and the Auditor's New Frontier, Internal Auditor (October 2026) AI Output: Responsible Use, Internal Auditor (August 2026) Learning Solutions: What Can IA Do that AI Cannot? Visit The IIA's website or YouTube channel for related topics and more. Follow All Things Internal Audit: Apple Podcasts Spotify Libsyn Deezer

The Institute of Internal Auditors Presents: All Things Internal Audit In this episode, PwC's Amanda Herron and Tonya Ugoretz discuss how organizations can move beyond cybersecurity dashboards to turn data into meaningful risk insights and assurance. They explore the importance of aligning cyber metrics with business risks, strengthening collaboration across the Three Lines Model, and using continuous monitoring to identify emerging threats. The conversation also covers cyber resilience, evolving responsibilities for cybersecurity, and how artificial intelligence is reshaping both cyber threats and internal audit's approach to assurance. HOST: Amanda Herron, CPA US Internal Audit Leader, PwC GUEST: Tonya Ugoretz Co-Leader, Cyber & Risk Innovation Institute, Managing Director, PwC   KEY POINTS: Introduction [00:00–01:02] Turning Cyber Data Into Risk Insight [01:02–04:21] Visibility vs. Assurance [04:21–08:29] Choosing Cyber Risks and Metrics That Matter [08:29–12:13] Internal Audit's Role in the Cyber Risk Conversation [12:13–17:06] Moving From Activity Metrics to Outcome Metrics [17:06–20:12] Looking Beyond a "Green" Cyber Dashboard [20:12–22:26] Who Owns Cyber Risk? [22:26–27:27] Applying the Three Lines Model to Cybersecurity [27:27–30:52] Building Cyber Resilience Beyond the Dashboard [30:52–35:14] How AI Is Changing Cybersecurity Risk [35:14–39:45] AI, Automation, and Internal Audit Assurance [39:45–42:28] Rethinking Cyber Reporting [42:28–44:56] IIA RELATED CONTENT:  Interested in this topic? Visit the links below for more resources: Cybersecurity Topical Requirement Global Internal Audit Standards Knowledge Center: Artificial Intelligence Three Lines Model Visit The IIA's website or YouTube channel for related topics and more. Follow All Things Internal Audit: Apple Podcasts Spotify Libsyn Deezer

The Institute of Internal Auditors Presents: All Things Internal Audit In this companion episode to Internal Auditor magazine's "Most Likely to Innovate" article, Adrian Romero talks with Emerging Leaders Ashley Morrone and Nisha Nair about building careers shaped by innovation, curiosity, and continuous improvement. They discuss the importance of mentorship and psychological safety, practical uses of AI in audit work, and why innovation does not always require a major transformation. The conversation also explores starting small with new technology, speaking up at any career level, and turning good ideas into meaningful change. HOST: Adrian Romero, CIA Principal and Practice Leader, Kaufman Rossin 2019 Emerging Leader GUESTS: Ashley Morrone, CIA Financial Services Internal Audit Manager, Crowe 2024 Emerging Leader      Nisha Nair, CIA, FCCA, ACMA, CGMA, CFE Internal Audit Specialist, United Arab Emirates' Federal Authority for Nuclear Regulation 2024 Emerging Leader  KEY POINTS: Introduction and Career Paths in Internal Audit [00:00–03:54] Opportunities, Mentorship, and Psychological Safety [03:55–07:58] What Innovation Really Means in Internal Audit [07:59–10:27] Using AI to Reduce Repetitive Audit Work [10:28–13:42] AI Implementation and Shifting to Higher-Value Work [13:43–15:07] Continuous Improvement and the "What's the Wow?" Mindset [15:08–17:19] Starting Small With AI and Scaling Responsibly [17:20–19:42] Building vs. Buying AI Solutions [19:43–21:06] Why Early-Career Auditors Should Speak Up [21:07–24:16] Creating a Culture Where Ideas Are Heard [24:17–26:00] Advice for Building a Career That Creates Change [26:01–29:12] Final Thoughts [29:13–30:20] IIA RELATED CONTENT:  Interested in this topic? Visit the links below for more resources: Most Likely to Innovate — Internal Auditor magazine (October Issue) Global Internal Audit Standards Internal Auditing Competency Framework Knowledge Center: Artificial Intelligence  Article: 5 Ways to Build Internal Audit's AI Skills Global Knowledge Brief: Innovation and Technology Part 1: Internal Audit's Role in Technology Assurance Internal Audit Foundation Research Visit The IIA's website or YouTube channel for related topics and more. Follow All Things Internal Audit: Apple Podcasts Spotify Libsyn Deezer

All Things Internal Audit: Fraud Podcast "A Full-Court Fraud" Listen to The IIA's Fraud Podcast, brought to you by All Things Internal Audit. The Fraud Podcast provides fictionalized accounts of real-world frauds featured in Internal Auditor magazine's Fraud department.  In this episode, a university's polished image hides a problem that starts with four sheets of paper and a fully booked calendar. What begins as a routine audit of athletic department accounts turns into a trail of redirected checks, lookalike bank accounts, and hesitant answers from a trusted insider. Access the full article here. Read the October issue here. Interested in more fraud-related topics? Earn CPEs by registering for The IIA's Fraud Analytics for Internal Auditors Certificate, available online and in-person. Chapters: Introduction [00:00-00:00:18] Part 1: The Pitch [00:00:19-00:02:03] Part 2: The Employee Who Wasn't [00:02:04-00:04:17] Part 3: The Lawsuit That Pulled the Thread [00:04:18-00:06:08] Fraud Red Flags and Lessons Learned [00:06:09-00:06:46] Closing and Fraud Resources [00:06:47-00:07:18] Follow All Things Internal Audit: Apple PodcastsSpotify Youtube LibsynDeezer

The Institute of Internal Auditors Presents: All Things Internal Audit Tech In this episode, Elizabeth Sullivan talks with Anthony Pugliese and Matt Pearman about Pugliese's experience when he  joined a global cybersecurity audit at Barclays. They discuss how the team planned and scoped an audit of a cloud platform used to build and run artificial intelligence, the value of senior leadership involvement, and the importance of balancing structure with flexibility. The conversation also explores cyber resilience, third-party risk, leadership engagement, and translating complex cybersecurity observations into meaningful information for executives and boards. HOST: Elizabeth Sullivan, CIA, CRMA, CCSA, Senior Vice President and Chief Risk and Audit Officer, Washington Metropolitan Area Transit Authority   GUESTS: Anthony Pugliese, CIA, CPA President and CEO, The Institute of Internal Auditors   Matt Pearman, CIA, CISA, CISM, CISSP Chief Internal Auditor for the Chief Operating Officer, Barclays   KEY POINTS: (00:00) Introduction (00:37) Goals of the Barclays Cloud AI Platform Audit (01:34) How a Chapter Event Led to an Invitation (03:00) Teamwork and Collaboration in Kickoff Sessions (05:02) Balancing Structure With Flexibility (07:18) New Hire Development and Hands-On Management (08:21) Prioritizing Key Controls When Setting Scope (09:28) Gathering and Challenging Evidence (10:43) The Value of Curious, Thoughtful Questions (11:56) Senior Leadership Support Builds Credibility (13:54) Adding Context Without Impairing Independence (16:43) Cyber Resilience, Governance, and Third-Party Risk (19:24) Translating Technical Findings Into Business Implications (22:05) Showing the Discipline Behind Each Engagement (24:24) Lessons in Rigor, Relevance, and Common Sense (27:32) Future IIA Standards, Guidance, and Training IIA RELATED CONTENT:  Interested in this topic? Visit the links below for more resources: Cybersecurity Topical Requirement Third-Party Topical Requirement Artificial Intelligence Knowledge Center Elevating Internal Audit Communication With the Board Vision 2035 Visit The IIA's website or YouTube channel for related topics and more. Follow All Things Internal Audit: Apple Podcasts Spotify Libsyn Deezer

The Institute of Internal Auditors Presents: All Things Internal Audit In this episode, Mike Levy talks with Amy Fread about how AI, automation, and business transformation are reshaping internal audit. They discuss how auditors can become involved earlier in organizational change, communicate more effectively with stakeholders, evaluate third-party risk, and identify opportunities for cosourcing. Amy also shares why the profession is moving toward continuous monitoring, risk sensing, and more data-driven assurance. HOST: Mike Levy, CIA, CRMA CEO, Cherry Hill Advisory GUEST: Amy Fread, CISA  Audit & Assurance Principal, Deloitte & Touche LLP KEY POINTS: Introduction [00:00–00:39] How Internal Audit Is Evolving [00:40–02:46] Getting Involved Earlier in Business Transformation [02:47–04:12] Making Audit Reports More Useful [04:13–05:55] AI Governance and Internal Audit Use Cases [05:56–08:28] Assessing Third-Party Risk and Cost Recovery Opportunities [08:29–10:07] When to Consider Cosourcing [10:08–11:30] Measuring Value Beyond Dollars Recovered [11:31–12:23] Turning Risk Data Into Action [12:24–14:05] The Future of Internal Audit [14:06–15:15] IIA RELATED CONTENT:  Interested in this topic? Visit the links below for more resources: Global Internal Audit Standards Artificial Intelligence Knowledge Center Third-Party Topical Requirement Continuous Auditing and Monitoring Visit The IIA's website or YouTube channel for related topics and more. Follow All Things Internal Audit: Apple Podcasts Spotify Libsyn Deezer

The Institute of Internal Auditors Presents: All Things Internal Audit In this episode, Richard Penfil talks with Cory Missimore about how quantum computing could threaten current encryption, why "harvest now, decrypt later" attacks require organizations to prepare today, and how internal auditors can assess quantum readiness. They also discuss cryptographic inventories, third-party exposure, crypto agility, regulatory developments, and practical steps organizations can take to prepare without overreacting. HOST: Richard Penfil, Founder, AssureSwarm GUEST: Cory Missimore, CISSP, CDPSE, CISM, CIPP Senior Information Security Compliance Analyst, American Institutes for Research KEY POINTS: Introduction [00:00–00:47] Quantum Computers vs. Traditional Computers [00:47–01:44] Why Organizations Should Prepare Now [01:45–03:18] Cryptographic Inventories and Accountability [03:19–05:27] "Harvest Now, Decrypt Later" Attacks [05:28–07:42] The Emerging Regulatory Landscape [07:43–09:33] Three Questions for Assessing Quantum Readiness [09:34–13:11] Third-Party and Vendor Exposure [13:12–15:01] Integrating Quantum Risk Into Existing Audits [15:02–17:49] Warning Signs and Regulatory Developments [17:50–20:27] How Quantum Computing and AI Could Develop Together [20:28–22:13] Practical Steps Organizations Can Take Today [22:14–24:42] Final Thoughts [24:43–25:36] IIA RELATED CONTENT:  Interested in this topic? Visit the links below for more resources: Global Internal Audit Standards Cybersecurity Topical Requirement Cybersecurity Part 3: Cybersecurity Third-Party Risk Management All Things Internal Audit Tech: Quantum Computing All Things Internal Audit Tech: Quantum Is Coming for Your Encryption. Now What? The Big Idea: Quantum Computing Visit The IIA's website or YouTube channel for related topics and more. Follow All Things Internal Audit: Apple Podcasts Spotify Libsyn Deezer

The Institute of Internal Auditors Presents: All Things Internal Audit In this episode, Alex Rusate talks with Ivan Diaz and Mohamed Maiga, two Utah Valley University students whose curiosity led them to build practical AI tools. They explain how AI agents go beyond chatbots to automate repetitive audit work, why understanding the intended output is essential for validating AI-generated results, and how organizations can begin adopting AI without sacrificing security or human judgment. HOST: Alex Rusate, CIA, CISA, CPA, AAIA, CERP, CRMA, CCSA Senior Vice President and Director of Internal Audit, Arrow Financial GUESTS: Ivan Diaz Accounting Student, Utah Valley University Mohamed Maiga Cybersecurity Graduate, Utah Valley University KEY POINTS: Introduction: Students Teaching Auditors About AI Agents [00:00:00–00:00:35] Ivan's Introduction to the Internal Audit Conference [00:00:36–00:01:33] Finding an Audit Process to Automate [00:01:34–00:02:44] Building an AI Agent Without Technical Experience [00:02:45–00:04:13] Improving Results Through Iteration and Multiple AI Tools [00:04:14–00:05:47] The Difference Between Chatbots and AI Agents [00:05:48–00:07:05] Troubleshooting an Agent and Selecting the Right Model [00:07:06–00:08:20] Validating AI-Generated Audit Work [00:08:21–00:10:24] Designing Effective Instructions and Identifying Red Flags [00:10:25–00:11:43] Protecting Confidential Information When Using AI [00:11:44–00:13:12] Using Feedback to Strengthen an AI Agent [00:13:13–00:14:54] Mohamed's Introduction to AI Agents [00:14:55–00:16:38] Using an AI Agent to Navigate Purchasing Policies [00:16:39–00:18:26] Automating Repetitive Work While Preserving Human Judgment [00:18:27–00:19:16] Building an AI Agent for Cybersecurity Exam Preparation [00:19:17–00:20:43] Reducing Hallucination Risk Through Sources and Validation [00:20:44–00:22:26] Advice for Internal Audit Leaders Adopting AI [00:22:27–00:24:24] Starting Small and Applying AI with Purpose [00:24:25–00:25:17] Closing [00:25:18–00:25:29] IIA RELATED CONTENT:  Interested in this topic? Visit the links below for more resources: The NextGen Audit Mentor — Internal Auditor magazine (August Issue) IIA Membership Global Internal Audit Standards Artificial Intelligence Auditing Framework Knowledge Center: Artificial Intelligence   Visit The IIA's website or YouTube channel for related topics and more. Follow All Things Internal Audit: Apple Podcasts Spotify Libsyn Deezer

The Institute of Internal Auditors Presents: All Things Internal Audit In this episode, Sanjay Vadlamani talks with Yvette Adams about how insider threats extend beyond malicious employees. They discuss negligent, malicious, and compromised insiders, along with the ways AI, remote work, cloud applications, and expanding access have increased organizational risk. The conversation also covers behavior monitoring, employee privacy, access management, offboarding, multidisciplinary risk teams, and the importance of connecting information across organizational silos before a threat becomes an incident. HOST: Sanjay Vadlamani, CIA, CISA, CRISC Senior Manager, Internal Audit, PayJoy GUEST: Yvette Adams, CIA, CRMA Director of Enterprise Risk Management, Zions Bancorporation KEY POINTS: Introduction [00:00–00:00:38] The Three Types of Insider Threats [00:00:39–00:03:19] How AI, Remote Work, and Cloud Applications Increase Risk [00:03:20–00:06:52] IIA Membership [00:06:53–00:07:38] Balancing Employee Monitoring, Privacy, and Trust [00:07:39–00:11:13] Indicators of Insider Risk [00:11:14–00:15:16] The FinWise Bank Incident and Offboarding Risk [00:15:17–00:18:48] Connecting Information Across Organizational Silos [00:18:49–00:22:47] Five Elements of a Mature Insider Risk Program [00:22:48–00:26:40] Lessons From the Tesla Insider Threat Case [00:26:41–00:28:56] Understanding the Insider Threat Life Cycle [00:28:57–00:30:07] Employee Self-Reporting and Where Organizations Should Start [00:30:08–00:33:40] Closing [00:33:41–00:33:51] IIA RELATED CONTENT:  Interested in this topic? Visit the links below for more resources: Global Practice Guide: Auditing Insider Threat Programs Insider Threat Leading Practices Insider Threat Assessment Using NIST Cybersecurity Framework All Things Internal Audit Tech: Identity & Access Management Understanding Insider Threats IIA Membership   Visit The IIA's website or YouTube channel for related topics and more. Follow All Things Internal Audit: Apple Podcasts Spotify Libsyn Deezer