The first article in this series explores how internal audit, compliance and risk functions can evolve from risk oversight roles into true strategic partners, help institutions not only safeguard resources but also actively drive transformation. As colleges and universities navigate shrinking budgets, demographic headwinds and intensifying scrutiny, the question of accountability becomes even more critical. Who, exactly, are internal audit, compliance and risk functions serving, and how should that answer shape their role in higher education's future? In this context, institutions must grapple with whether these functions are being positioned too narrowly (i.e., as checkers of compliance or as arms of the board) instead of as enterprise levers that inform decision-making and advance institutional priorities. Raising this question up front is essential, because the way accountability is defined will determine whether these functions remain primarily defensive or become contributors to broader strategic and operational effectiveness.
This article examines how a more expansive view of accountability can frame their purpose more productively and set the conditions for higher-value contributions.
The rules we must follow
At a foundational level, risk oversight functions are grounded in well-established frameworks.
The Institute of Internal Auditor's (IIA) Global Internal Audit Standards (GIAS) defines internal audit's purpose as strengthening the organization's ability to create, protect and sustain value by providing the board and management with independent, risk-based and objective assurance, advice, insight and foresight. These standards, when effectively operationalized (i.e., through a charter that establishes internal audit functionally reporting to the board with administrative reporting to management), anchor internal audit in objectively and independence, ensuring the function remains accountable to the governing board or audit committee while also providing holistic value to the institution.


