Julia Chirkova
A new report, jointly issued by The Internal Audit Foundation, Baker Tilly, and Wolters Kluwer TeamMate, delves into the dynamic evolution of risk management activities and their profound impact on the roles and boundaries within organizations. The comprehensive study underscores the critical importance of strategic collaboration between internal audit and risk management functions, emphasizing that this synergy can be achieved without compromising the essential independence of internal audit. Drawing on extensive insights from The IIA’s Risk Research survey, the report identifies actionable opportunities to enhance operational efficiency, strengthen enterprise-wide governance, and ultimately bolster organizational resilience in an increasingly complex global landscape.
The report arrives at a pivotal moment for corporate governance. As businesses navigate an ever-expanding array of risks – from cyber threats and geopolitical instability to evolving regulatory landscapes and supply chain disruptions – the demand for robust and integrated risk management frameworks has never been greater. This heightened scrutiny places significant pressure on internal audit and risk management teams to not only identify and assess potential threats but also to provide assurance and strategic guidance to leadership and the board. The traditional, siloed approaches to risk are proving insufficient, necessitating a more collaborative and holistic perspective.
The Expanding Scope of Internal Audit’s Role
A key finding from the research indicates a significant shift in the responsibilities of internal audit departments. Approximately 32% of internal audit leaders report involvement in what is often considered "second-line" activities. The most prevalent areas of this expanded involvement include enterprise risk management (ERM), cited by 57% of respondents, followed by internal control (43%) and compliance (39%). This data aligns with broader trends observed in The IIA’s North American Pulse of Internal Audit research. This pulse survey, which tracks the evolving landscape of the internal audit profession, has shown a consistent increase in the percentage of Chief Audit Executives (CAEs) who are responsible for ERM in addition to their core internal audit duties. Between 2021 and 2025, this figure rose from 27% to 34%, demonstrating a steady year-over-year growth in this integrated responsibility.
Looking ahead, the trend towards greater synergy between risk management and internal audit is projected to accelerate. A substantial 60% of respondents to the Risk Research survey anticipate further integration of these functions within the next five years. This forward-looking perspective suggests a proactive recognition by organizations that a more intertwined approach to risk oversight is not only beneficial but increasingly necessary for effective decision-making and strategic planning.
The Tangible Benefits of Strategic Collaboration
The research provides compelling evidence that intentional collaboration between the second-line (risk management, compliance, legal) and third-line (internal audit) functions yields significant and measurable benefits. An overwhelming 90% of survey respondents reported experiencing positive outcomes as a direct result of enhanced coordination. The most frequently cited advantages include:
- Improved Risk Coverage (28%): A more unified approach allows for a broader and deeper understanding of the organization’s risk profile, identifying potential blind spots and ensuring comprehensive coverage of emerging threats.
- Reduced Duplication of Effort (26%): By streamlining processes and sharing information, organizations can avoid redundant work, freeing up valuable resources and improving overall efficiency.
- Stronger Organizational Alignment (20%): Collaborative efforts foster a shared understanding of risks and objectives across different departments, promoting a more cohesive and strategically aligned organization.
- Enhanced Board Communication (11%): When internal audit and risk management work in tandem, the information presented to the board regarding the organization’s risk posture becomes more integrated, consistent, and actionable.
- More Efficient Reporting (6%): Streamlined processes and better data sharing contribute to more timely and effective reporting to stakeholders, enabling quicker responses to emerging risks.
Despite the clear benefits, the report also sheds light on the practical challenges that can impede effective collaboration. The primary barriers are less about a lack of intent and more about structural and operational constraints. The most commonly cited obstacles include:
- Limited Resources or Competing Priorities (40%): In many organizations, stretched budgets and competing departmental demands can hinder the ability to dedicate sufficient time and resources to cross-functional collaboration.
- Differences in Objectives or Perspectives (34%): While collaboration is desired, differing departmental goals or ingrained perspectives can create friction and make it challenging to find common ground.
- Absence of Unified Platforms / Separate IT Systems (32%): The reliance on disparate IT systems and the lack of integrated platforms can create significant hurdles in data sharing, analysis, and communication.
- Siloed Processes (31%): Deeply ingrained departmental silos, characterized by independent workflows and limited interdepartmental interaction, remain a persistent challenge to seamless collaboration.
Jim Pelletier, Lead Product Manager at Wolters Kluwer TeamMate, commented on these findings, stating, "When collaboration is thoughtfully designed, it can significantly improve the quality and consistency of information reaching leadership and the board. This research highlights a path forward, where organizations strengthen coordination across the lines while reinforcing the structures and safeguards that protect internal audit’s independence and credibility." This sentiment underscores the dual imperative: foster collaboration while meticulously preserving the integrity of independent assurance functions.
Ensuring Independence in a Collaborative Environment
A critical concern that often arises when discussing increased collaboration between internal audit and other functions is the potential threat to internal audit’s independence. The Risk Research findings, however, suggest that for the majority of organizations, these concerns remain largely theoretical. A substantial 80% of respondents indicated that they do not have shared responsibilities between the second and third lines that pose a risk to internal audit independence. This indicates a general understanding and implementation of measures to safeguard this vital attribute.
However, the report acknowledges that as functional boundaries continue to blur in response to an increasingly complex risk landscape, the need for deliberate and well-structured collaboration becomes paramount. The maintenance of independence is not an insurmountable obstacle to collaboration but rather a critical element that must be intentionally integrated into the operating model.
John Romano, Principal and Internal Audit & ERM Service Leader at Baker Tilly, emphasized this point: "This research highlights that collaboration and independence are not competing priorities when they are intentionally designed into the operating model. With clear role definitions, disciplined governance, and transparency around decision-making, internal audit can engage closely with second-line functions while maintaining the objectivity that underpins stakeholder trust and audit committee confidence. Done well, this model strengthens risk oversight across the organization and allows internal audit to deliver deeper insight to management and the board."
The IIA’s Three Lines Model has long served as a foundational framework for integrating risk management and internal audit activities. As Anthony Pugliese, President and CEO of The IIA, explained, "As risk grows more complex and expectations for strong governance rise, effective coordination between internal audit and risk management is increasingly essential. The IIA’s Three Lines Model has served as a longstanding framework for that integration, reinforcing that independence does not imply isolation. As internal audit responsibilities expand and lines between functions evolve, the model guides organizations in strengthening collaboration while maintaining the safeguards necessary to preserve objectivity." The model, which emphasizes the roles of management (first line), risk management and compliance (second line), and independent assurance (third line), provides a structured approach to achieving this balance.
Broader Implications for Organizational Resilience and Governance
The overarching message of the report is clear: modern risk management is progressing towards a more integrated, enterprise-wide approach. This shift is driven by the imperative to reduce duplication of effort, increase operational efficiency, and more effectively embed risk considerations into the very fabric of organizational strategy. In this rapidly evolving environment, intentional, structured collaboration between internal audit and risk management is no longer a matter of preference but a foundational pillar for robust governance and enduring organizational resilience.
The implications of this evolving paradigm are far-reaching. Organizations that successfully navigate this transition are likely to experience:
- Enhanced Strategic Agility: By having a more integrated understanding of risks, leadership can make more informed strategic decisions, allowing for quicker adaptation to market changes and emerging opportunities.
- Improved Stakeholder Confidence: A well-coordinated risk management and assurance function signals to investors, regulators, and other stakeholders that the organization is proactively managing its risks and operating with strong governance.
- Greater Operational Effectiveness: The reduction of redundant activities and the optimization of processes through collaboration can lead to significant cost savings and improved resource allocation.
- A Stronger Risk Culture: When different functions work together to manage risk, it fosters a pervasive awareness of risk across the organization, encouraging a more proactive and responsible approach at all levels.
The report serves as a valuable roadmap for organizations seeking to optimize their risk management and internal audit functions. It highlights that the path to achieving robust governance and resilience lies in embracing collaboration, not as a compromise to independence, but as a strategic enhancement that, when thoughtfully implemented, strengthens the entire organization.
The Internal Audit Foundation, Baker Tilly, and Wolters Kluwer TeamMate are committed to further exploring these evolving dynamics. They will be hosting a webinar on May 19, 2026, titled "Where the 3 Lines Meet: Collaboration Activities and Responsibilities," which will delve deeper into the practical implementation of the Three Lines Model in this context. Interested parties are encouraged to register for this informative session to gain further insights into navigating the future of risk management and internal audit collaboration.
