Lessons from 2025, Directions for Tomorrow

The roll-out of the new Global Internal Audit Standards has made the role of the Chief Audit Executive (CAE) more prominent than ever. The CAE leads the internal audit function in providing independent and objective assurance and advisory services to enhance governance, risk management, and internal controls, while preserving independence and objectivity. This has urged CAEs to think deeply and to find innovative ways to manages the internal audit activity, provide assurance and advise management on risk and control improvements while preserving independence.

Leading a Business Risk Advisory team in South Africa where we support CAEs, Chief risk officers and Boards has thus never felt more substantial. As threats grow more sophisticated and regulation becomes increasingly complex, boards and clients are raising the bar on what they expect from risk and assurance functions.

At the same time, I’ve been reminded that truly impactful internal audit work is practical, people-centred, and firmly rooted in ethical conduct.

Professional highlights in 2025: Moving from advice to measurable outcomes.

• We doubled down on outcome-based engagements — not just “things to do” or lists of audit findings, but prioritized actions that will improve control environments.
• We assisted our clients implement new systems successfully with embedded controls through continuous reviews - from design to post implementation.
• The cyber maturity assessments results helped our clients to clearly identified processes that require attention and not only the need for more tools to monitor.
• We supported our clients by objectively assessing third party risks as well as defining actionable road maps for improvement.
• We assessed service organisations and providedISAE3402 reports to build confidence in their ability to service their clients in a well-controlled manner.
• We assisted clients to improve their resilience against fraud and implemented controls that detect fraud quicker, improving recovery of losses significantly as well as preventing fraud.
• As a firm we have increased our team by adding more specialist skills in SOC, system implementation, data analysis and financial control experts.
• We refined our performance feedback approach to ensure it is more specific, practical, and actionable for our team members

Key observations over the year:

• Fraud is increasingly hybrid. Digital-first scams amplified by social engineering and, at times, augmented by AI tools (deepfakes, synthetic identities).
• Weak ethical cultures and unclear escalation paths remain the root causes of many internal frauds. Controls matter, but culture determines whether they work.
• Fraud management readiness and analytics are a must. Continuous transaction monitoring, anomaly detection, and robust audit trails help detect and deter fraud faster.

Looking Beyond the Scorecard: A Personal Perspective

• Presence over perfection. I committed to protecting weekends and being more deliberate with travel. It improved focus and helped me recharge.
• Mentorship is energising. Investing time in developing others reminded me that leadership is multiplying capability, not just delivering outcomes.
• Continuous learning paid off. Daily reading and staying abreast of developments improved the practical advice I could give clients.
• Health and perspective. Moving more, short walks and breaks and time away from screens helped me to maintain clarity for focus work.

Looking Ahead to 2026: Key Focus Areas

• AI governance.
• Higher Board scrutiny.
• Maturity of fraud and ethics programmes.
• Cyber resilience is a board-level priority. Boards will increasingly expect measurable resilience metrics, moving beyond simple checklists
• Supply-chain visibility and third-party assurance: firms will invest in deeper supplier due diligence and contingency planning.

In 2026, internal auditors will play an increasingly pivotal role in driving assurance, risk management, and organisational resilience because organizations face faster, more complex risks for example AI and cyber threats to ESG, data privacy, supply-chain disruption and intensified regulatory scrutiny, while operating in hybrid, digitized environments. Internal auditors will, therefore, be expected provide real-time independent assurance and insights into whether controls, governance and ethical practices keep pace with change. They will also be expected to help embed robust AI and data governance, and

advise management on risk-informed innovation. Their role in detecting fraud, validating third-party and sustainability reporting, and guiding continuous monitoring and resilience efforts protects assets, reputation and long-term value for stakeholders.

Thank you to our clients, partners, and the entire team at SNG Grant Thornton for a challenging and rewarding 2025. A special thank you to my SHEroes team, who continually keep me inspired, challenged, and humble. Wishing everyone a restorative break and a focused, resilient start to 2026. I’d love to hear your reflections on the year.