Audit plans for 2027 are being signed off, and for many heads of audit the same problem keeps coming up: the plan needs more people than the function has.

It’s not a new complaint. Predictions that the talent squeeze is about to ease have become something of an annual ritual, yet the gap between what internal audit is asked to cover and the resources it is given has, if anything, grown wider this year.

The causes are more varied than a shortage of qualified auditors, and understanding them matters for anyone trying to close the gap. Here are four.

#1 More work, fewer resources

The clearest data comes from the Internal Audit Foundation's 2026 North American Pulse of Internal Audit, published in March. It surveyed 373 chief audit executives (CAEs) at the end of 2025, and the IIA's press release summed it up as internal audit "being asked to do more with less".

The numbers bear that out. The share of functions that saw a budget increase fell from 34% to 23% in a year, while the share facing budget cuts rose from 11% to 19%. Staff cuts climbed from 11% to 18%, which the report says matches levels seen during the Covid-19 crisis. Some 30% of CAEs now describe their funding as not sufficient, up from 22%.

Only one sector bucked the trend. In financial services, 40% of functions grew their budgets and 32% added staff. Elsewhere, sectors such as health care, non-profits and education reported cuts on a scale not seen for several years.

So part of the answer to "why are we still short-staffed?" is not a lack of candidates. Many teams simply have not been given the headcount.

#2 The remit keeps getting wider

At the same time, internal audit's job description keeps growing. The same Pulse survey found that 86% of CAEs oversee at least one area beyond internal audit itself. Fraud investigation is the most common, at 47%, and more than a third also look after ethics and whistleblowing or enterprise risk management.

In the UK, Provision 29 of the Corporate Governance Code now applies to financial years starting on or after 1 January 2026. Boards of companies reporting against the Code must declare whether their material controls are operating effectively, and internal audit is usually the function they turn to for comfort. Add AI, cyber security and ever-closer regulatory scrutiny, and the same small team is being stretched across far more ground.

That last point is easy to overlook. According to the Pulse, 86% of audit leaders work in organisations with the equivalent of between one and 24 full-time auditors. In a team that size, one resignation or one long-running investigation can knock a quarter's plan off course.

#3 Talent is a known risk, but rarely an audit priority

There is an odd contradiction in how the profession views people risk. In the Chartered IIA's Risk in Focus 2026 survey, published in September 2025, 48% of European chief internal auditors ranked human capital, diversity and talent management among their organisation's top five risks. Only cyber security ranked higher.

The latest global edition, Risk in Focus 2026/27, which surveyed 3,285 audit leaders this spring, found something similar. Some 38% placed human capital in their top five risks, but only 25% placed it in their top five priorities for audit time and effort. In Europe the gap was wider still: 39% against 22%.

Internal audit is good at telling the business when a known risk is not getting enough attention. It is worth asking whether the same discipline is being applied to its own workforce planning.

#4 The skills mix has moved faster than the market

Even where budget exists, the profile hiring managers want has changed. The Risk in Focus 2026/27 report notes that some functions lack the competencies to evaluate AI, automation and model risk, and only 23% of audit leaders globally rated their organisation's governance of digital disruption as managed or optimised.

In our conversations with heads of audit, the brief we hear most often is for someone with solid audit judgement who can also work comfortably with data, understand how a model or automated control actually works, and explain it to an audit committee in plain language. Those people exist, but there are not many of them, and the good ones are rarely looking. They are usually well rewarded, often already being courted by their own business, and inclined to stay put unless a move offers a clear step up.

That changes the hiring dynamic. Advertising a role and waiting for applications works less well when most of the strongest candidates are not on the market at all.

Why the gap is proving hard to close

A few factors make this a stubborn problem rather than a temporary blip:

Small teams feel every departure. With most functions below 25 people, a single vacancy has an outsized effect, and the cost of a slow hire falls on everyone else.
Budgets and expectations are moving in opposite directions. Remits are widening just as funding tightens outside financial services.
Competition comes from inside the business. Experienced auditors with data or controls skills are attractive to finance, risk and technology teams, who can often offer a faster route to a senior operational role.
Hybrid profiles take time to build. A team cannot hire its way to AI and data capability overnight, and training takes capacity that a stretched function does not have.

What hiring managers can do about it

None of this has an easy fix, but some approaches work better than others.

Make the business case with evidence.

The Pulse found that 59% of functions fully or almost fully aligned with organisational strategy had sufficient funding, compared with 29% of those only somewhat aligned. Linking the audit plan visibly to the board's priorities, Provision 29 included, is one of the most reliable ways to protect headcount.

Hire for judgement, then build the technical layer.

Professional scepticism and the confidence to challenge senior management are hard to teach. Data skills and tool knowledge can be developed, or brought in for specific reviews.

Use co-sourcing deliberately.

Specialist expertise in areas such as AI, cyber or forensic work can be borrowed for individual engagements, which leaves permanent headcount for the core team.

Move quickly once you find the right person.

Strong candidates in this market tend to have options. A process that stretches over two months, with long gaps between interviews, loses people.

Treat retention as part of the hiring plan.

Clear progression, exposure to the audit committee and a chance to work on new risk areas often do more to keep good auditors than a pay rise alone.

Looking ahead to 2027

There is little sign that the pressure will ease in the new year. Provision 29 will move from first-year implementation to business as usual, AI will continue to appear across audit plans, and budgets outside financial services look unlikely to bounce back quickly.

The functions that cope best will probably not be the ones that find a large, hidden pool of auditors. They will be the ones that are clear about which skills they need, make a well-evidenced case for resources, and plan for talent with the same rigour they bring to every other risk on the register.

If you would like to find out more about the current internal audit hiring market, please contact Adam Bond for a friendly chat.