Staffing an internal audit department capable of meeting the myriad and multiplying mandates imposed by a growing group of stakeholders is like solving a Rubik’s Cube. The logistical difficulty of making multiple moving parts on more than one plane match up — at the same time — characterizes the way chief audit executives (CAEs) struggle to line up the right mix of talent with their organizations’ evolving technical, analytical, and operational needs. But just as a Rubik’s Cube can be solved, there is a solution for internal audit department staffing.
The solutions are unique to each situation, but alignment is key in all cases. “The internal audit function must first align its focus and staffing plans with the organization’s broader goals and strategies,” says Mike Maali, internal audit, compliance, and risk solutions leader at PwC LLP in Chicago, “then with the specific objectives of the internal audit department, itself.”
But aligning staffing isn’t simply a matter of hiring expert data analysts. Often, the work ahead requires core audit competencies, the basic capabilities every department is called upon to muster. So, audit leaders may need to add traditional, frontline practitioners to their rosters, too. And everybody in every position must be nimble and quick. Companies often change business models, and some of the new models lack regulatory conventions. Internal auditors must be able to zoom in to see every point in detail, and zoom out to view the matter from a strategic angle.
Staffing the Right Talent
The essence of the CAE’s hiring challenge is determining the right mix of IT and business expertise, sharpened interpersonal skills, and audit fundamentals the department requires. “Finding the right people for an internal audit department is extremely hard,” says Robert Berry, principal at consulting company That Audit Guy based in Mobile, Ala. Stakeholders, he adds, hear about the latest tools to use — blockchain, for example — and want internal audit guidance before they know with any clarity what they want from the technology. Do you staff to conduct research that’s not going to be very relevant?
The evolution of the profession — and its professionals — can intensify the challenge. “It requires new internal auditors with different backgrounds to evaluate new operational and emerging risk areas,” says Yulia Gurman, CAE at Packaging Corporation of America in Lake Forest, Ill. “Schools are producing more ambitious internal audit graduates, and the profession is attracting experienced candidates from other industries from a variety of backgrounds.” The profession has evolved beyond evaluating compliance and reporting risks, she adds. A growing number of companies hiring internal auditors now emphasize emotional intelligence and professional skills as much as, if not more than, technical skills.
The CAE’s task is to understand the organization’s key risks, internal audit standards and requirements, and stakeholder expectations, then assess whether the current staff has sufficient skills and expertise to provide the level of assurance required. “You also need to understand the complexity of the business and the size of internal audit teams at similar organizations,” says Stacey Schabel, American audit director at Jackson National Life Insurance Co. in Lansing, Mich., “because they directly link to your consideration of the levels, organization, and shape of your team.” She maintains an inventory of team members’ experience in audit and risk management and all critical focus areas, certifications supporting their expertise across focus areas, and professional backgrounds. “Mapping their skills and experience supports audit planning and detailed resourcing, including when to engage external expertise you don’t have on your team,” she says.
Audit Staffing Dos and Don’ts
Competency catalogs like Schabel’s lay the groundwork for more strategic department staffing. Experts offer tips for ensuring internal audit departments have the people they need.
Make sure the basics are in place. “A core set of internal audit skills must be addressed,” Berry stresses. Department staffers must know how to document work, draft reports, and communicate with clients. That’s always been the case for traditional businesses with established internal audit processes, but basic audit skills are even more important, Maali notes, for cutting-edge companies with untested business models and the firms those companies do business with. “Technical and analytic skills sets shouldn’t be overlooked, considering the complexity of some models,” he says. “Unknown things can happen when businesses are ahead of regulations, so foundational capabilities are really important.”
Schabel’s department also performs U.S. Sarbanes-Oxley Act of 2002 testing for the insurer’s Financial Reporting team. “While our risk-based plan focuses extensively on strategic risks and organizational innovation,” she says, “Sarbanes-Oxley testing is valuable as it is good training ground for new auditors and offers additional leadership opportunities for the team.”
Don’t get stuck in yesterday’s definition of the basics. What constitutes fundamental competencies changes over time, Maali says. “There is a redefinition of capabilities grounded in three dimensions: business acumen, analytics acumen, and technology acumen,” he says. “They form the baseline set of capabilities we expect all auditors to exhibit.”
Business acumen generally applies to basic internal audit areas of influence, including operational processes, compliance, and controls. Kamal Uddin Gazi Jishan, internal audit manager at Ali Bin Ali Holdings in Qatar, calls it “a crucial competency because business managers value the advice and services of an internal auditor who ‘speaks their language.’”
Technology acumen applies to the emerging tools being used — blockchain, artificial intelligence, Internet-of-Things — and, Maali notes, “internal audit needs capabilities relevant to their implementation or to ongoing monitoring and evaluation.”
Analytics acumen applies to staff members’ ability to master new audit techniques leveraging different sources of data. “Big data drives the need for a baseline of analytics capabilities,” Maali adds.
More advanced analytic skills may be mandated by stakeholders’ expanding corporate visions. “If it’s a broader set of risks beyond financial and compliance into operations and strategy,” Maali cautions, “you’re going to have a hard time meeting some of those expectations if the team isn’t appropriately skilled.” That expertise may come from inside the company or outside hires, or consulting firms with internal audit capabilities.
Tailor hiring practices to help achieve organizational goals. “First, we need to know what is happening in our company, industry, peer groups, and the macroeconomic environment,” Gurman says. “Any changes or big strategic initiatives may require unique skills that our team members don’t currently possess.” That’s an ongoing evaluation, she emphasizes. In all areas, not just hiring, it’s key to making sure the internal audit department stays relevant to stakeholders’ needs and has the right tools to address risks and provide valuable insights to management and the audit committee.
Maali notes that, to date, existing internal audit competencies have typically been able to meet audit committee needs, and both sides generally have shared an understanding around them. While they’re often still grounded in their fundamental responsibilities, Maali says “boards are getting much more focused on emerging technology risks,” including cybersecurity and data protection concerns, especially operating in the cloud. Berry agrees that most changes to the profession are driven by changes in stakeholder expectations. “We see boards and management asking about technological processes, and everyone is concerned with personal data.”
In some cases, organizational objectives require specialized skills. Many companies, Maali points out, are undergoing digital transformations, for example. “Is your team equipped to operate in that environment?” he asks.
One company he cites is changing its business operating model and will be organized completely differently as a result. “That should cause internal audit to really examine how it’s organized,” he says. “Take your cue from what’s happening with the business and make sure you’re properly aligned.”
Sync hiring strategy to departmental objectives, keeping in mind the changing shape of internal audit’s ambit. Sometimes, the department’s goals also may require specific skills. A department that relies heavily on data analysis to meet its goals, for example, will require specialists in data analytics. There are, Schabel notes, several facets to consider when determining what skills your team needs:
- Business objectives and key risks to accomplishing them.
- Organizational risk appetite and strategy.
- Audit needs assessment requirements, such as ratings and cyclicality.
- Organizational and regulatory changes and focus areas.
- Future vision — if it’s digital advancement, for example, internal audit may need specific new expertise.
“Having a seat at the table so we are aware of the strategic vision and direction of the organization is key,” she adds.
The paradigm hasn’t changed completely, Maali says, but “in the last 12 to 18 months, there’s been a shift toward migrating some of the Sarbanes-Oxley testing activity outside internal audit and into the controllership of the organization.” Citing the three lines of defense refresh, he agrees with The IIA’s focus on efficient testing and achieving the lowest total compliance cost that doesn’t sacrifice effectiveness. “It points out the need for collaboration across the three lines,” he says, “especially as the complexity of risk and the speed of business processes really rise.”
Build a team that can manage risks rather than adjusting your audit plan to match current staff’s skills. “Scope your audit plan to the risk, then get the right capabilities to do it,” Maali says. For example, an internal audit leader with little knowledge of cloud audits might work with a cloud audit expert to “get at the real risks and how to audit them.” Where staffing gaps exist, he adds, companies usually build capabilities with existing people to the extent they can, then “supplement with strategic hires that accelerate the transformation of the skills.”
Jishan’s company’s human resources policies generally encourage internal hiring, but transfers to internal audit are rare. “It’s likely the opposite will occur,” he says, “whereby an internal auditor is found to be the best fit candidate for a finance or management role.”
But employees from other departments often have skills that can be fine-tuned to internal audit through professional education, thus enhancing their candidacy, Berry says. That includes courses in “at least two different industries,” he adds — internal audit and the company’s. “We have to be knowledgeable about audit standards and how to apply them on the job,” he adds, “but also about the industry we operate in.”
University curricula are being redefined, Maali says. “People are coming out of school now with a clearly different level of skills from just two or three years ago,” he explains. “The aptitude level is higher, and that translates into people very ripe for learning new things.”
Look for that to translate into passion for the profession, Jishan advises. “The sense of adding value to the business is the driving factor for a career-centric internal audit professional.”
Don’t be limited by outdated impressions of the profession. The profession moved away from primarily verifying financial statement and activities many years ago, Berry notes, leading to “different flavors of internal auditors.” An engineering firm may hire a former engineer as an internal auditor, he explains, or a hospital may hire a former nurse.
Gurman and her team now search in an expanded pool that includes professionals with engineering and psychology degrees, to name just two. She’s also hired people with no internal audit experience, but a strong interest in joining the profession — adding their own valuable skills to the mix.
The deep expertise needed for specific projects can be found outside the organization, Maali says. “Balance specific needs with how much of the expertise is routinely needed,” he adds. For areas you don’t do much business in, only in an occasional audit, it might be worth it to lean on an external party for expertise. “Build it when it makes sense,” he adds, “and buy it when you have a targeted use.”
People Skills Outweigh Technical Skills
The challenges facing internal audit departments continue to expand as the profession’s influence spreads throughout their organizations; but they can be managed with the growing diversity of talent available for hiring. Indeed, the human side of staffing — how the department functions when the team is complete — should be paramount, Schabel emphasizes. “The most effective, successful, and healthy teams have diverse backgrounds, knowledge and expertise, strengths and weaknesses, and ways of working,” she says. That encourages individuals to hone their teamwork, conflict resolution, and interpersonal skills. So does getting out of the cubicle occasionally, Berry adds. “Cutting-edge tools can’t replace periodic contact with audit clients.”
Faced with two well-qualified candidates for one job opening, one of whom has an edge in technical skills, the other in people skills, Gurman says the hiring decision would be easy. “Technical skills most, if not everyone, can learn if they really want to,” she explains. “People skills are much harder to develop.” Internal audit activities require all kinds of interaction with a variety of departments and people with very different personalities, she points out — and the interaction isn’t always about delivering good news. Hiring decisions need to facilitate developing strong positive relationships with audit clients and colleagues throughout the organization. “Strong emotional intelligence and effective professional skills become even more critical, as internal auditors advance into department manager positions,” Gurman adds.
Lining It Up
Pressures on the profession continue to mount, as internal audit’s role evolves into more strategic planning and operational consulting functions, and as practitioner preference pivots to positions that involve closer contact with colleagues, managers, and C-suite executives. At the same time, advances in technology demand both highly developed analytical skills and command of basic internal audit functions. For CAEs with jobs to fill, “Hire some numbers pros” has been replaced with “Staff to the company’s strategic goals.”
Diverse candidates for the increasingly diverse positions CAEs offer makes that mandate easier to accommodate. Professionals from a variety of fields are drawn to internal audit — some looking for old school “box checking” jobs, others with their eyes on “trusted advisor” responsibilities — and, more often, they’re already skilled at both analytics and politics, moving back and forth with ease between crunching numbers and presenting proposals to board members. CAEs will face staffing challenges again and again. The talent is out there. The trick is finding it — and hiring it.