New technologies, cyber threats, and recent rules from the U.S. Securities and Exchange Commission (SEC), such assustainability disclosure requirements, are further complicating the already vast and ambiguous risk environment for CFOs. Take artificial intelligence, for example: more organizations are asking CFOs to decide where to invest in such technologies, how to deploy them across the organization, and how to minimize potential risks.

Anthony Pugliese, President and CEO of the Institute of Internal Auditors (IIA), says that viewing internal audit as a close strategic partner can help CFOs better understand and develop strategies to address these risks, but collaboration between the two teams is crucial.

"CFOs can rely heavily on internal auditors—not to point out all their mistakes, but to tell them what actions they need to take to mitigate identified risks," he said in an interview.

Shared risk

Companies are still focused on AI's potential, and as CFO Dive previously reported, many plan to investmillions of dollars in its developmentover the coming years. However, the focus on technology has also heightened audit teams' concerns—in a recent IIA report, digital disruption (especially driven by AI) ranked fourth among 16 risks internal auditors believe organizations face. Cybersecurity, business continuity, and human capital took the top three spots, according to the report from the Lake Mary, Florida-based professional association.

CFOs are increasingly being asked to drive digital transformation initiatives, and they likely share similar concerns—about AI's promised return on investment, as well asfinding truly valuable use cases, which has risen to the top of finance executives' watchlists in recent months, CFO Dive previously reported.

However, when it comes to mitigating the potential disruption from new technologies, Pugliese says CFOs can view internal audit teams as strategic advisors rather than the organization's "police."

"They share the risk together, and if CFOs trust them, they can almost always gain significant peace of mind at a much lower cost," Pugliese said of the relationship between CFOs and internal auditors.

Pugliese has served as IIA's President and CEO for three years. According to his LinkedIn profile, he previously served as Executive Vice President of Member Competency and Learning at the Association of International Certified Professional Accountants, and spent nearly 20 years at the American Institute of CPAs in various roles, including Chief Operating Officer.

He advises that while trust between audit and finance is essential, maintaining separation is equally important. "We don't encourage direct reporting to the CFO because it compromises independence—they often end up auditing areas overseen by their own superiors," Pugliese said.

However, to ensure the organization continues to run smoothly and best address challenges like new risks related to emerging technologies, the two teams do need to stay aligned.

"The worst-case scenario is when the CFO thinks sustainability reporting is the biggest risk, but it's not mentioned at all in the internal audit plan," Pugliese said. "In that case, we lose significant value to the CFO or CEO, because they're equally worried about it."

Post-pandemic risk management

The close relationship between CFOs and internal audit teams is also critical because how both teams think about and respond to certain risks is beginning to change. For example, although business continuity was ranked by audit leaders as the second-largest risk in IIA's recent report, Pugliese doubts it would have made the top three before the pandemic.

"I think before the pandemic, people thought, 'What if we get hit by a hurricane? Is everyone prepared?'" he said of leaders' views on business continuity. The pandemic and its "pervasive" impact on business operations, supply chains, and everything else have led both auditors and CFOs to look at the issue from a different angle.

"Now the focus is on the entire system that keeps the organization running, and third parties have become the most critical factor," Pugliese said. "I mean, if suppliers don't provide raw materials, you can't produce your products."