Evolving Internal Audit Challenges and Rising Expectations
Internal audit has long been understood as the third line of defense, providing independent assurance over governance, risk management, and control activities. Today, however, the role is evolving.
Heightened regulatory scrutiny, increased reliance by external auditors and regulators, and growing expectations from audit committees have placed new demands on internal audit functions, not only to execute assurance activities but also to do so with greater depth, precision, and credibility.
At the same time, many internal audit functions face persistent constraints that complicate this mandate:
- Expanding risk-based audit plans with limited resources
- Increased exposure to emerging and highly technical risk areas
- A shrinking labor market for experienced internal audit professionals
- Challenges maintaining independence where prior advisory or internal controls consulting services have been performed
Industry data reinforces this reality. According to the Institute of Internal Auditors (IIA) Pulse Report 2025, nearly 73% of internal audit departments leverage outsourcing or co-sourcing arrangements, most often in complex areas such as cybersecurity, information technology, and regulatory compliance.
Collectively, the constraining forces are prompting internal audit leaders to reassess not only what is included in the audit plan but also how internal audit capabilities are structured to deliver assurance that stakeholders can rely on.
IIA’s Call for the Strategic Use of Specialists
The IIA Global Internal Audit Standards (Standards) make a clear and often underappreciated distinction: The requirement for competency applies to the internal audit function as a whole, not to each individual auditor. In other words, internal audit effectiveness is measured collectively, by whether the function possesses, or has access to and the knowledge, skills, and competencies needed to carry out its mandate with due professional care.
The Standards not only define expected competency, but they also reinforce the expectation that internal audit leadership ensure the function is resourced appropriately, aligning skills and capabilities, whether internal or external, with the nature, complexity, and risk of planned audit activities.
When specialized expertise is required and those competencies do not reside within the internal audit department, the Standards explicitly contemplate the use of certified and trained specialists, whether sourced internally or externally. This call for specialists is particularly relevant in risk areas that have grown more technical and more consequential:
- Cybersecurity and technology governance
- Regulatory and compliance risk
- Fraud risk management
- Data privacy and emerging technologies
Yet despite this clarity, many internal audit functions continue to treat the use of specialists as an exception rather than a core design principle of the function. In practice, teams often rely on generalist auditors to cover highly technical areas, sometimes out of budget constraints, sometimes out of a desire to remain self-contained, and sometimes due to uncertainty around when specialist involvement is “required” versus merely “helpful.”
Over time, this dynamic can introduce risks of its own, including uneven audit quality, superficial coverage of complex control environments, reduced confidence from audit committees, and increased scrutiny from regulators and external auditors.
The Case for Specialists: Beyond Resourcing
The strategic use of certified and highly trained specialists is not merely a staffing consideration. It is a governance and quality decision that helps internal audit leaders align audit execution with professional standards and stakeholder expectations.
Further, when integrated thoughtfully, specialists help internal audit functions
- Perform audits with appropriate technical competence
- Maintain consistency and quality across complex engagements
- Preserve independence and objectivity in sensitive or highly regulated areas
- Demonstrate to audit committees and regulators that risk coverage reflects both relevance and depth
Importantly, this approach allows internal audit leadership to remain focused on strategic planning, stakeholder engagement, and assurance coordination, while ensuring that execution keeps pace with the organization’s evolving risk profile.
Internal Audit Operating Models Aligned with Professional Standards
As internal audit functions adapt to the reality of today’s demands, many are moving away from a purely in-sourced model toward more flexible operating structures that combine strong internal leadership with targeted specialist support.
Outsourcing and co-sourcing models, when appropriately governed, can help internal audit functions
- Scale expertise in response to emerging risks
- Supplement internal capacity without permanent headcount increases
- Strengthen independence where conflicts may otherwise arise
- Align internal audit capabilities with professional standards and external expectations
The question is not whether an internal audit function uses external support but how thoughtfully that support is integrated into governance, methodology, and reporting structures.
Operationalizing Internal Audit Standards Through Specialist Support
Successfully operationalizing the Global Internal Audit Standards requires viewing internal audit capability as modular and scalable, not fixed. In practice, this may involve a combination of internal resources with certified external specialists or a fully outsourced internal audit function, depending on an organization’s size, risk profile, and governance structure. Internal audit, management, compliance, or board‑directed oversight provides continuity and direction, while specialists are engaged deliberately to address areas requiring deeper technical expertise or enhanced independence.
Take the Next Step
As internal audit functions adapt to rising expectations and increasingly complex risk environments, many organizations are reconsidering how best to structure internal audit capabilities to align with the IIA Global Internal Audit Standards. Whether through co-sourcing or outsourcing, the strategic use of specialists can help internal audit leaders strengthen audit quality, preserve independence, and better meet stakeholder expectations.
For many organizations, PYA serves in the specialist role, either working alongside internal audit leadership in a co‑sourced model or operating as a fully outsourced internal audit function under the direction of the board, management, or compliance officer. In each case, PYA’s internal audit specialists operate within established internal audit frameworks and oversight structures, bringing experience across financial, operational, compliance, enterprise risk, and technology‑focused audits.
PYA’s professionals hold relevant certifications, including CIA, CPA, CISA, and CFE, and apply methodologies grounded in the IIA Global Internal Audit Standards across a wide range of industries, including highly regulated sectors such as healthcare and financial services.
If your organization is evaluating how specialist or outsourced support may fit within its internal audit operating model, our internal audit professionals are available to discuss considerations, options, and leading practices tailored to your organization’s needs.
