Internal audit teams are expanding their work to focus more on operational and strategic risks, after having spent much of their time since Sarbanes-Oxley was enacted 10 years ago looking at financial reporting and compliance risk.

The change shows internal audit groups are responding to the evolving needs of senior executives and boards of directors, says Richard Chambers, president and CEO of the Institute of Internal Auditors. “As we've gone through this global economic crisis, the risk portfolios of most big companies have shifted,” Chambers says. “Today they're dealing with operational risk more so than financial reporting risk, and the whole challenge of effective risk management itself is important for most boards and senior management.”

Internal audit departments used to spend more time on operational risks, but that changed when Sarbanes-Oxley was enacted in 2002. “It's as if everyone put pencils down on operational auditing,” he says. “So much risk was perceived to be in place around accurate financial reporting that that became almost the No. 1 priority of many audit departments.”