Benito Ybarra, IIA Executive Vice President: Artificial Intelligence is changing risks, internal audit must stay one step ahead

Internal audit is facing a major shift today - moving from a function that retrospectively verifies what has been done to one increasingly expected to identify risks proactively and help companies and institutions prepare for them. At the same time, the rapid development of artificial intelligence, rising cyber risks, and an increasingly complex business environment are transforming the way auditors work.

Benito Ybarra, Executive Vice President of Global Standards, Guidance and Certifications at the Institute of Internal Auditors (IIA), discusses these changes, the implementation of the new Global Internal Audit Standards, the need for better coordination among various stakeholders and the skills that will be crucial for future auditors with eKapija.

Ybarra, who has over 25 years of experience in auditing, compliance, and investigations, is visiting Serbia for the 14th Conference of the Association of Internal Auditors of Serbia (UIRS), an event gathering more than 200 experts from 15 countries on October 8-9.

The new Global Internal Audit Standards have come into effect internationally. From your perspective, where do you see the greatest challenges in their implementation today and what is needed to ensure they are truly applied in the day-to-day operations of companies and institutions? What should be the priority for Serbia in this process?

– The biggest challenge is moving from the adoption of the Standards to their consistent application in practice. They should become an integral part of internal audit work planning, risk assessment, audit execution, communication, and quality monitoring, rather than their application being reduced to a mere formality to meet requirements. For Serbia, the priority should be strengthening the capacity for the practical application of the Standards through education, management support, and continuous monitoring and improvement of work quality.

On the second day of the conference, you will speak with representatives of the Association of Internal Auditors of Serbia (UIRS), the State Audit Institution, the Ministry of Finance, and the Chamber of Authorized Auditors. How important is better coordination among various stakeholders for the quality of internal and external audit systems and would Serbia benefit from a permanent mechanism for exchanging experiences and harmonizing practices?

– Better coordination is crucial. Internal and external audit functions, public sector oversight institutions, regulatory bodies and professional associations have distinct responsibilities, yet they all share a common goal of improved governance, better risk management, more efficient controls and greater accountability. A permanent mechanism for exchanging experiences and best practices could help Serbia reduce fragmentation, strengthen the overall audit and control system and accelerate professional development.

Your presentation is titled “From Cyclical Assurance to Anticipatory Management”. What does this shift specifically mean for internal audit? How can auditors identify and assess risks before they escalate into serious problems for a company or institution, rather than simply reacting after the problem has already occurred?

– This shift means that internal audit, in addition to asking “What went wrong?”, must also ask “What could change, and are we ready for it?”. This entails combining traditional assessment and assurance with continuous risk monitoring, as well as the analysis of data, scenarios and future trends. In this way, internal audit can identify emerging risks earlier and provide governing bodies and management with valuable insights before those risks escalate into serious problems.

Artificial intelligence is rapidly transforming business operations, yet it simultaneously introduces new risks and vulnerabilities within control systems. Are companies today adapting their internal audit systems to the evolution of AI technologies quickly enough and where do you see the greatest weaknesses in risk control?

– Artificial intelligence is evolving faster than many organizations can adapt their management and control frameworks. The primary issue often lies not in the technology itself, but in a lack of clearly defined responsibilities, inadequate data management, insufficient supervision of AI implementation, and controls that fail to keep pace with technological advancements. Consequently, internal audit must possess a sufficient understanding of artificial intelligence to evaluate how it is managed, identify associated risks, determine the adequacy of controls and assess its impact on the organization. However, this does not mean that internal audit should own the technology.

To what extent can the quality of internal audit influence the confidence of investors and business partners? From your perspective, what should an investor today recognize as a sign that a company has a well-established system of internal control and risk management?

– High-quality internal auditing can significantly boost the confidence of investors and business partners, as it demonstrates that the company takes risks, controls and responsibilities seriously. However, internal audit is merely one component of a broader governance system. An investor should look for clearly defined responsibilities, a robust risk management system and effective internal controls, genuine independence within the internal audit function and transparent reporting. It is also crucial that governing bodies do not simply take risk assessments at face value but actively scrutinize how management handles key risks.

How is artificial intelligence altering the risks associated with fraud and cyberattacks and is there a danger that those seeking to misuse the technology are advancing faster than the companies tasked with identifying and preventing such risks? What does this mean for internal auditing and which new skills will be most critical for addressing these challenges?

– Yes, there is a genuine risk that the misuse of artificial intelligence is evolving more rapidly than organizations can detect and prevent. Consequently, the role of internal audit is becoming increasingly vital, particularly in assessing whether governance structures and controls are keeping pace with these changes. Auditors will increasingly need a solid understanding of data and technology, including risks associated with artificial intelligence, as well as developed critical thinking skills, the ability to analyze various scenarios and a strong grasp of cybersecurity. It will be equally important for them to be able to translate complex risks into clear, actionable insights for governing bodies.

Udruženje internih revizora Srbije

Državna revizorska institucija Republike Srbije

Ministarstvo finansija Republike Srbije

Komora ovlašćenih revizora

UIRS

Institute of Internal Auditors

IIA

Benito Ybarra

audit

AI impact on audit

Conference of the Association of Internal Auditors of Serbia