Internal auditors have long known in their gut that they had to take more initiative in identifying and helping to prevent enterprise risks. Now they have some long-awaited affirmation—you might even call it a mandate—to take their companies and their profession down that new path.

The Institute of Internal Auditors last week unveiled the full results of a global study that declared internal auditors are, or at least should be, broadening their focus from internal controls and traditional assurance tasks to the bigger issues of risk and governance. The study polled 13,000 internal auditors in more than 100 countries plus some ...