Internal audit teams are expanding their work to focusmore on operational and strategic risks, after having spent much oftheir time since Sarbanes-Oxley was enacted 10 years ago looking atfinancial reporting and compliance risk.

The change shows internal audit groups are responding to theevolving needs of senior executives and boards of directors, saysRichard Chambers, president and CEO of the Institute of InternalAuditors. “As we've gone through this global economic crisis,the risk portfolios of most big companies have shifted,” Chamberssays. “Today they're dealing with operational risk more so thanfinancial reporting risk, and the whole challenge of effective riskmanagement itself is important for most boards and seniormanagement.”

Internal audit departments used to spend more time onoperational risks, but that changed when Sarbanes-Oxley was enactedin 2002. “It's as if everyone put pencils down on operationalauditing,” he says. “So much risk was perceived to be in placearound accurate financial reporting that that became almost the No.1 priority of many audit departments.”