Companies face a “poly-crisis” of risk events that will require an “unwavering focus” on resilience, according to internal auditors.

New research, following a poll of 700 chief internal auditors across Europe, reveals they see a “looming” simultaneous crisis as a result of diverse issues potentially unravelling all at once. These issues include economic uncertainty, the cost-of-living crisis, Ukraine and geopolitical turmoil, labour shortages, cybersecurity and extreme weather events.

Anne Kiem, chief executive of the Chartered Institute of Internal Auditors, authors of the new report, says the sheer velocity and variety of risks presents boards with major challenges.

“In these unique and challenging times, boards and their internal auditors will need to respond rapidly to immediate, fast-moving threats and have an unwavering focus on resilience.”

When asked about the top five risks facing their companies, 84% of internal audit leaders cited cybersecurity. Human capital, diversity and talent management came in second with 57%.

Macroeconomic uncertainty was next, followed by legal and regulatory change and then operational resilience and crisis management. Climate change was seventh among the top ten risks.

Perception of cybersecurity as a risk increased during the pandemic as businesses switched to working from home. However, the report says disruptive technologies, such as AI, could see the issue rise further as a concern.

A storm is building

Climate change has slipped down the rankings but a wave of new regulation means that, by 2027, internal audit chiefs see it rising back up to at least their third biggest concern.

The report says internal auditors are strengthening their efforts to identify risks and potential mitigation, as well as ensuring the right skills and expertise are in place.

Second, audit methodologies may be changing, making them more agile to “better match the increased velocity of risks”.

That could involve participation in “rapid-fire consultancy exercises, advice and brain storming”. And this because boards like early warnings that support strategic aims.

The report says: “Logically, that makes sense. Where risks are not easily predictable, interrelated and swift, the response has to focus on general resilience, cross-functional teamwork and agility.”

The news comes as the UK prepares to introduce new rules that will heighten the profile of internal controls by asking boards to report on their adequacy. That could, in turn, expand the role of internal audit in supporting this new disclosure process.