The IIA’s definition of internal auditing focuses on a broad range of evaluation and improvement activities, namely, “risk management, control and governance processes.” This definition has been viewed by some as ahead of its time, since many internal audit functions still lack the knowledge and skills required to expand the focus of the audit plan to address all of these activities fully. This issue of The Bulletin explores some of the factors that are driving higher expectations for internal audit and outlines how CAEs, with support from management and the audit committee, can respond to the challenge.