A large, high-performance organization like Citigroup must have top-notch internal auditors, professionals who command both the technical skills to conduct complex audits and manage expansive portfolios — as well as the “soft” skills to present their findings in a professional, respectful, and effective manner. For internal audit to play its important role in maintaining Citi’s global leadership position, the company’s internal auditors must demonstrate skills that translate — seamlessly — across divisions and geographies. While the local market conditions and business practices may vary, we must be functionally the same and execute flawlessly whether in Chile or Taiwan.
Citi currently maintains internal audit teams in roughly 90 locations, based in more than 60 jurisdictions and covering over 100 countries. This deployment model is designed so that Citi’s internal auditors are closer to the businesses and regions they evaluate, enabling them to better understand the local regulatory environment and business context. In the recent past, Citi Internal Audit operated in just over a dozen locations. However, following a board decision to anticipate and meet emerging regulatory expectations, the audit function undertook a far-reaching transformation. In just over three years, Citi Internal Audit has increased its manpower from about 610 practitioners to today’s more than 2,000 on-the-ground personnel. The transformation was characterized not just by growth, but also by dramatic changes to how we operate, and how we develop our people.
To effectively serve Citi’s vast array of stakeholders across the group’s broad geographical reach, internal audit must demonstrate consistency. Global effectiveness in internal audit requires a common taxonomy, a consistently applied methodology, standard management information and reporting, and impactful ways of communicating to stakeholders worldwide.
This year Citi Internal Audit launched the Citi Internal Audit Foundation Academy to reinforce and ensure effective maintenance of these common standards. The Academy is a training program designed to ensure that an internal auditor in Mexico and a colleague in Singapore can cover the same business activity in each of these jurisdictions, and evaluate and report on that business area using a consistent approach, evaluation mechanism, and documentation while operating under dramatically different regulations and business environments. The language, rating, and escalation mechanisms are identical, allowing for standardized reporting and consistent communication to all stakeholders. Just as the military operates boot camp for basic training to get personnel ready for action and to perform in accordance with a standard set of requirements, the Academy is meant to provide basic training from an internal audit perspective — to provide Citi’s internal audit professionals with a foundational understanding of expectations — from interactions with local management and regulators, to how we execute our assurance plan and work together within the internal audit function.
|The IA OPCO Team|
The Citi Internal Audit Operating Committee (IA OpCo) comprises the function’s lead chief auditors by broad product area (Institutional and Consumer), key functions (Risk, Compliance, Technology — the latter including Change and Third-party Management), Treasury and Finance (including other corporate functions), and geography (Asia; Europe, Middle East, Africa; Latin America; North America, as well as Japan and Mexico). A key position in IA OpCo is the chief auditor for Citibank, as is the only practicing lawyer in Citi not reporting to the group’s general counsel — Internal Audit’s own general counsel. Also on the IA OpCo are the internal audit function’s human resources (HR) director — a member of the HR function, the internal audit communications officer, and the function’s chief operating officer (COO). Additionally, the committee includes the quality assurance chief auditor, who owns the methodology and assurance strategy, and who together with the COO, is essential to driving change and innovation.
The Foundation Academy, and several other changes, grew out of the recent financial crisis. In the aftermath of the crisis, many boards and audit committees — including Citi’s — closely examined and raised expectations for the internal audit function. To realize these expectations, we underwent a wide-ranging transformation, including increasing staff and further developing our methodology and training. We called it the Citi Internal Audit Transformation Initiative.
The initiative began in 2012 and formally concluded in December 2014. It involved 10 specific work streams, covering areas such as organizational design, resources, people development, audit methodology, and communications. We also established a Leadership and Development Committee for internal audit that oversees the training program and reports its findings and proposals to my Operating Committee, or IA OpCo (see “The IA OpCo Team” at right).
After establishing the IA OpCo, we then assembled a focus group to evaluate certain topics. For example, we wanted to assess the various types of professional tools, skills, and materials that internal audit professionals need — or could most benefit from — in their first 90 days with the organization, their first 180 days, their first two years, and so on. The focus group then developed specific recommendations, and we endeavored to determine the right kind of training programs to serve as an initial stage foundation for the educational requirements of the Chartered Member of the Institute of Internal Auditors (CMIIA) designation in the U.K. and The IIA’s global Certified Internal Auditor.
Throughout this process, we were looking at the audit skills our professionals need — both for their current roles and as they progress within the organization. We established a proposed curriculum for the Foundation Academy and worked with the Chartered Institute of Internal Auditors (CIIA) — the professional association for internal auditors in the U.K. and Ireland — to refine that curriculum so it met our expectations and theirs. The program has since been accredited by the CIIA. Now, employees who go through the Academy’s training regimen receive the CIIA’s Certificate in Internal Audit and Business Risk designation as well. The process also saw the introduction of a Certified Internal Auditor program, launched at the beginning of 2015, and we are now making plans to adjust the program to embrace The IIA’s Certified Financial Services Auditor program.
The Right Skills
In creating the Academy’s training programs, we emphasized the ability of Citi’s internal auditors to provide effective challenge to senior management and demonstrate evidence in support of that challenge to the Board of Directors. While we focused on sharpening the traditional audit skills, we also placed importance on other areas. Among the key attributes of Academy training are:
- Presentation skills. We must ensure that our people can present their audit findings to senior management and the Board, so we offer training in report writing, among other communication skills.
- Negotiation. Internal auditors must have the ability to work effectively with senior management. If done correctly, management will understand and agree with the facts, the required actions, timeliness, accountability, and risk-based severity in Internal Audit’s conclusions. That is much more effective than delivering a finding and saying, “Fix it.”
- Staff management skills. Our internal audit leaders need to further cultivate skills in managing their staff, particularly as it relates to delivering performance evaluations, but also in how to motivate and develop team members, and drive the right culture. It’s easy to tell someone he or she is doing well; it’s not as easy to tell that person he or she isn’t doing well. Our people managers need to deliver constructive feedback in a way that positively impacts the individual, and provides the right outcome overall — for the individual and for Citi.
Indeed, we have found it is fundamental to train people to deliver tough messages, which is always a part of an internal auditor’s role. The Academy gives our staff the confidence and ability to do this effectively. It is a key part of what we do, and one of the ways we focus on it in the Academy is through role-playing, with senior professionals using firsthand experiences to train Academy students.
While overhauling the training programs and establishing the Academy, our goal was to teach essential skills and identify areas for further engagement and evaluation. We intentionally created programs that allow our auditors to become familiar with Citi’s risk governance framework, including the expectation to establish a high standard for a culture of compliance and control. While it was not designed to be a comprehensive curriculum, we are constantly seeking ways to enhance training for our talented professionals.
At the Academy, internal audit’s Quality Assurance team teaches the internal audit overview and audit methodology coursework, plus additional core elements of the syllabus. That 9-to-5 training is conducted face to face, while we use computer-based training for some supplemental topics outside the classroom sessions, including internal audit data analytics. The in-person elements of the nine-month training regimen are offered at multiple regional locations throughout the world.
Some of the online coursework titles include: “Technology and Systems Processes Audit Coverage — Guidance Training,” “Third Parties Audit Coverage,” and “Introduction to Internal Audit — Finance.” We’re also in the process of developing several online modules into a two-day, face-to-face course for fall 2015, covering topics such as decision making, conflict resolution, problem solving, and building trust. The modules will be interactive, incorporating role-playing case studies.
A Common Language
Of course, no effort as comprehensive as our internal auditor training development is without challenges. The biggest challenge thus far has been the widely deployed and diverse nature of our internal audit staff. While all of Citi’s internal auditors speak English, more than half the staff is composed of practitioners for whom English is not a first language. Accordingly, we are enhancing the program to cover a wide range of topics for our people in nearly 100 locations, in more than 20 languages. Whether an auditor’s first language is Turkish or Mandarin Chinese, for example, the internal audit report needs to be delivered in English — yet local regulations, and the practicalities of follow-up and important local stakeholder communications, will likely demand that our internal auditor’s local interaction will be in a different language.
The results so far are exactly as we envisioned. Academy training begins for new hires within the first 30 to 60 days, and the curriculum and methodology enable our new hires quickly to operate effectively within Citi.
We are pushing ahead to focus on establishing a next-stage Academy to empower our more seasoned internal auditors to continue to progress and flourish. We want to foster the development of our internal auditors so that they can become managers, the head of audit for a particular program or geography, and as soon as they can develop, chief auditors responsible for a broad program of assurance. As people progress, they are offered more comprehensive training to further refine leadership and management skills to become the next generation of leaders — not only for the internal audit function, but for Citi overall.