Over recent years, European banks subject to supervision by the European Central Bank (ECB) have been faced with the need to adjust their risk governance models to ensure they are deriving appropriate value from their internal control functions. Internal Audit (IA) plays a fundamental role in this drive for added value. Regulatory developments, stakeholder expectations, and increasing business and operational risks have all contributed to a broader and more complex mandate for IA functions.

To better understand how banks are responding to these demands, KPMG Ireland conducted a survey with the support of KPMG's ECB Office on DG1 and DG2 banks in 11 European countries subject to SSM Supervision. We surveyed 22 Heads of Internal Audit about the evolving role that their functions now play within banks. The survey included questions on the positioning of IA functions within their organisation, their mandate, reporting methods, the breakdown of headcount and how they structure their teams.

Apart from regulation and supervision, our survey shows that IA functions face two other major challenges. The first is technology. The rapid advance of digitalisation, data analytics, artificial intelligence and other technologies poses a number of problems for IA teams. The second major challenge is resourcing. Banks are finding it increasingly difficult to attract and retain suitably qualified and experienced IA staff.

The findings shed light on the key strategic priorities of IA functions for the next three years, as they balance between supporting supervision, retaining their independence, and adding value to the business.