During innovation surges like the one being driven by AI, institutions often fail to keep up – acting more like historians after the event than war correspondents reporting in real time. Another case of auditors bayonetting the wounded? It doesn’t have to be. Here’s why and what to do about it.

A colleague, Tom (often confused with me), has been questioning the relevance of the Institute of Internal Auditors (IIA) in an AI-driven world. His series on AI’s impact on internal audit has sparked important conversations about the profession’s future.

Tom’s articles are filled with ideas—some speculative, others ambitious. The key question isn’t their immediate viability, but rather: if even a handful prove accurate, why isn’t our profession scaling these innovations faster?

That’s where institutions like the IIA could step in: not to judge or codify ideas—but to be present, curious, and genuinely useful.

Instead, the pattern is familiar: codify the practice 10 years after widespread adoption and call it best practice.

This approach serves those catching up, but by then it’s often too late—many have already been downsized or made redundant due to irrelevance.

This recurring pattern during innovation surges isn’t an accident; it’s a design flaw that keeps the profession perpetually behind. It’s a pattern I’ve seen multiple times, and is particularly pronounced during an innovation surge.

Tom is raising two fundamental questions: Why aren’t more people going after these opportunities? And why do we keep expecting institutions to lead innovation – or even keep pace with it?

The second question deserves considering more deeply.

Built to Stabilise, Not Innovate

Institutions like the IIA are built to standardise practice and stabilise the profession. That’s not a design flaw—it’s a feature.

But it comes at a cost.

Gaining influence inside these institutions usually takes decades of service. And by the time you’re in a position to influence, it’s easy to be culturally or structurally captured.

As Keating! The Musical observes, if you should succeed, by the time you get to lead, you’re pretty much exhausted by the climb. It’s a song about politics, but it perfectly describes IIA’s governance processes that cultivate insiders and protect them from outsiders insisting on rapid change. Great for stability. Not great for innovation.

And so the pattern repeats: leaders maintain rather than transform, managing institutionalised legacy rather than reimagining it. Painting inside the lines. Optimising within the boxes. No change to structures or age-old processes. Codifying the past.

The result? The IIA are great at attracting stabilisers—those who preserve established traditions. This has huge value, especially when the environment is steady, but lags during innovation surges like we’re experiencing right now.

It needs a big change.

This transformation won’t happen organically. It needs to be designed in.

A Question of Design, Not Individuals

What would it look like for The IIA to shape innovation and not just react to it?

Auditors are often criticised for coming in too late to “bayonet the wounded”—documenting what happened rather than helping people lead in the moment.

The same could be said about professional bodies.

To do something different requires a shake-up, or at least, some different design.

IIA faces the same challenge, as we all do.
Being reactive doesn’t work.
It requires a different intent and design.

My view is like every customer-serving organisation, IIA must transform. In this case from being a battle historian, documenting wars long concluded, to war correspondent reporting from the front lines in real time. It’s a different capability entirely, and it demands a different system design. And deliberate choices on which parts of the product innovation curve it wants to play in and what role it wants to play in innovation diffusion and adoption.

Don’t get me wrong. This isn’t about individuals. And I’m not proposing a DOGE-style tear down. We owe these institutions, volunteers and staff a great deal, and I’m genuinely grateful for the work they do. This is a system upgrade. It requires a different intervention.

I was lucky enough to be part of one of these during my early involvement with IIA in Australia.

The Australian affiliate created two board positions for leaders in high-stakes roles, at the edge, to join the board. Deliberately outnumbered, but a non-institutionalised voice inside the boardroom.

Doing so helped drive significant progress, sparking business model innovation and stronger alignment with the environment the profession was moving into. It preserved the institution while putting people in the room with their feet to the fire. And for a brief period it was the most interesting body in the country for the big end of town and the boards we ultimately serve.

This is an example of systems change, and not the only one. It involves not painting inside the lines, but redrawing them.

AI presents the next big wave of innovation. The question Tom raises is where IIA plays in all of this. And whether it knows yet, or can do so.

These are great questions for them – as for any professional body.

It also opens the question about ecosystem innovation for the rest of us.

Finding the Right Role

So here’s my take.

Don’t ask big institutions to lead innovation at the edge. That’s not their job. And they can’t do it.

But do ask them to understand how innovation ecosystems work—and define their role clearly in it. And for every part of the innovation diffusion curve. And do those parts well in a way that only they can.

Is it to innovate, capture, and disseminate? Or only to report after the fact?

The IIA needs to be at the metaphorical warfront with camera in hand—telling stories, reporting back so people know what’s happening and can respond. Turning up decades later to admire past battles like a historian is of limited value in a rapidly changing world.

What I’ve seen first hand after 20+ years of assurance innovation at scale is no group can cover the whole curve alone.

And nor should they. It takes a full ecosystem, each part doing what it does best.

That’s the job. And if any institution or provider can do that, or a small part of it, the institution remains relevant.

If not? People will simply go elsewhere.

That rule applies to all of us.

For in-house and practice leaders

This piece was written initially in response to questions on the IIA’s role in an AI-world.

But there’s a more important takeaway on innovation systems and innovation partners.

It is this:

As the old saying goes – it takes a village to raise a child. And with the current changes happening, it will take an entire innovation ecosystem to keep up and scale. Bodies like the IIA play an important role, but they can’t do it all. Nor should they.

You need an innovation strategy that matches the speed and shape of what’s coming. And the right partners to help you build it.

We’ve been in risk and assurance innovation at scale for more than 20 years. If you would like to understand how we can help, book a time for a conversation.

---

Further reading

The Davies Report is the quarterly bulletin that risk and assurance leaders read. It’s our digest for those charged with leading governance, risk, and assurance in their organisations. It’s also where our invitations to special events happen. This content is not available elsewhere. Subscribe and get the latest edition.

Signals is our blog. It’s where we share our thinking between editions, posted on our website and discussed on LinkedIn. It is available to everyone – no gate, no inbox clutter. To get notified when Signals drops and join the conversation in real time, follow Todd on LinkedIn and tap the bell icon 🔔 on his profile. Or use the RSS at the bottom of our page.

Found this article useful or want to discuss it? Join the conversation on LinkedIn.

Looking for more? Explore our Signals collection below.

---

Recent Signals articles