The disruption created worldwide by COVID-19 requires that organizations adapt to the new normal of a post-pandemic business environment. The pandemic forced new challenges on organizations already dealing with such disruptors as the gig economy and the impact of digitalization.
For organizations generally, and for internal audit specifically, having trained and motivated employees is vital. Indeed, The IIA's OnRisk 2021 report identified talent management — which includes identifying, hiring, and retaining top talent — as one of the most relevant risks facing today's C-suites, boards, and audit executives.
To meet these demands, internal audit leaders should have a comprehensive talent management strategy that addresses recruiting needs and professional development challenges. Hiring managers also need to approach talent with an eye toward cultural fit, and to maintain a positive, supportive environment that keeps employees connected and engaged.
A Different Kind of Recruiting
Dana Lawrence, senior director of Compliance and Internal Control at Azlo, a San Francisco-based online bank for small businesses, says she has a different perspective on recruiting. "I'm an extension of the company," she says. Lawrence promotes the company and her department within the audit and risk community, whether at internal audit events, tech meetups, or other venues. Because she has worked with smaller companies, she sees this as important in building the brand of her organization and for attracting a larger pool of applicants.
Lawrence says she advises internal audit hiring managers to approach qualified candidates they know, even if those individuals have not applied for the job. This is an important consideration in terms of diversity, equity, and inclusion, she says, as it helps reach potential candidates who might not think they're a match for the position.
Citing a 2019 LinkedIn survey, Gender Insights Report: How Women Find Jobs Differently, Lawrence notes that men will apply for a position if they have 60% of the qualifications, while women tend to apply only if they meet 100% of them. "Men will stretch, women might tend to be more self-limiting" she says, adding that she works to bring more women into her recruiting pipeline.
At Huntington National Bank, where IIA Director of Professional Practices Dan Walker formerly served as vice president, audit group manager, internal audit brought diverse candidates into the interview process but kept many of their personal details anonymous. They scrubbed resumes of names, colleges, and other information that could potentially lead to bias against candidates, he says. In addition, the bank worked to include more diversity among interviewers.
Lawrence adds that bias training is important for interviewers, as it helps give them a different perspective. "I've tended to see people typically favor people who are like themselves," she says.
Stacey Schabel, senior vice president and chief audit executive at Jackson Financial Inc. (JFI) in Lansing, Mich., says she takes a balanced approach in structuring her team. When hiring, she looks to maintain a mix of different backgrounds, knowledge, and expertise, which could include someone with external audit experience, or a data scientist who has never worked in internal audit.
For example, she says, a key leader from another department in the company can join the team and learn, hands-on, about internal audit. Importantly, that individual brings his or her technical knowledge to the department and can serve as an advocate for the value internal audit brings to the organization. "We don't just think about hiring auditors, we focus on core knowledge and expertise," she says.
Schabel underscores the importance of having a talent pipeline, which at JFI includes leaders as well as interns and contacts across the industry. She also stresses the need to think ahead, and to be plugged into the organization's strategic objectives, as a means of planning for the expertise that will be needed to support future work.
Banco del Crédito, as the largest bank in Peru, historically did not have a problem attracting talent, and preferred to hire from the Big Four firms. But since shifting focus to data competencies, especially data analytics, it has had problems finding auditors with these competencies through the traditional recruiting process, says Enzo Tolentino, the bank's head of Audit - Data Analytics and Corporate Development.
As a result, interns are an important source of talent, comprising about 10% of the internal audit department's 95 practitioners. The department looks for interns a year away from graduation who have the potential to be trained in auditing and data analytics. The internship gives internal audit time to work with the interns, to get to know them and their abilities.
The Importance of Culture
The cultural fit between new employees and the organization needs to be discussed throughout the talent management process, from recruiting to professional development, Walker says. Hiring managers need to have a thorough conversation with prospective employees during the interview process to determine their compatibility.
Once employees are hired, keeping them engaged and maintaining a positive, supportive culture should be a priority — particularly in the remote work-world of the pandemic. In part, this involves helping the team stay connected. Walker advises creating opportunities for people to talk to each other, such as a virtual coffee, or happy hour activities such as Pictionary or music trivia.
Lawrence points to the value of Gallup's Q12 employee engagement questionnaire, which asks employees to consider basic questions about their workplace — do they have a best friend at work, have they gotten recognition or praise for doing good work? In the current work environment, employees need to know that their manager has an interest in their career and in their goals, she says. And organizations need to review the results and take action where appropriate, Walker adds.
Maintaining camaraderie and morale during the pandemic and the shift to remote work has been a focus at JFI, Schabel says. When work first went remote, her team continued with the same number of formal meetings, but realized they were missing the spontaneous chats and quick phone calls that take place in an office.
After informal surveys to gather the team's feedback, meetings were added to build in unstructured time. That way, areas that needed to be addressed could be covered, while also allowing time for more chats. The most important and effective step has been keeping in touch with all of her team members, Schabel says. This ensures that she understands what her team members need and makes them feel valued and connected.
Schabel sees her job as a leader supporting JFI's success as a company, she says, but also as supporting her team members as people. She seeks to understand their goals and help them grow and develop into leaders who can build on their knowledge of internal audit and serve JFI, and the internal audit profession, in many ways.
Training and Development
Everybody on JFI's audit team is expected to become a Certified Internal Auditor (CIA), as well as earn specialty certifications related to their areas of focus, Schabel says. "It supports the necessary training we need to perform our role well and shows the level and knowledge and expertise we have," she says, adding that this is especially important for team members who are not auditors by background.
Lawrence says she expects potential hires to have appropriate technical skills, and she looks for candidates who are open to feedback, can accept criticism, and have resilience coupled with curiosity. "This is not a job for everyone," she says, "but if you genuinely are curious, and you can be comfortable with being uncomfortable for quite a while, it can be a pretty cool career path."
Lawrence says her training program is not structured, partly due to the nature of working in a startup organization. Even so, she has a training budget, and she is a big believer in certifications. Every member of her team is either a CIA or working toward becoming one. She also gives her employees stretch assignments, depending on their career goals.
Lawrence says she holds weekly one-on-one meetings with her team members, and managers are expected to do the same with their employees. Short-term, one-to five-year goals are discussed in quarterly meetings. "I totally believe in supporting people in their career path and in the direction that they want to go," Lawrence says.
Managers and employees need have conversations about their performance and their plans for growth, Walker says, and this is true regardless of whether the organization has a skills assessment or formal training plan. Lawrence agrees, emphasizing the importance of investing in employees. "I think engaging people, genuinely listening to them, genuinely showing support, and trying to challenge them appropriately is the key to retaining talent," she says.
Walker also points to the importance of tailoring skills assessments toward individual training needs.. At Huntington, his group built its own competency model with 50 core audit skills and 94 financial services competency areas. This model was mapped to the audit plan, which allowed the group to look at upcoming audits and see the potential skills gaps. Employees also completed a skills assessment that included both a self-assessment and a manager assessment to identify gaps in competency levels. Significant gaps were evaluated to develop individual and department training plans. Any remaining gaps were addressed through co-sourcing or recruiting efforts (see "Talent Development Cycle" at right for a high-level depiction of the process).
Such an integrated framework is important for capturing and evaluating professional skills based on competencies, Tolentino says. Currently, his organization is aligning standards for the recruiting process with competency development. In addition, Tolentino is working to include the specific needs of internal audit in the evaluation model. The organization's goal is to have the same standards in recruiting, competency development, and performance evaluation.
The bank's training curriculum has three levels — basic, intermediate, and advanced specialty — totaling 160 hours of coursework. The basic level reinforces areas of knowledge the new employees already should have, such as internal controls, risk management, and The IIA's International Professional Practices Framework. The intermediate level covers emerging needs like data analytics and Agile methodologies, while the third level includes specialized areas such as cybersecurity and market or credit risk.
What has the bank learned? First, required competencies and learning outcomes need to be linked; and second, the curriculum needs to be responsive to changing circumstances. Finally, the department needs to be creative to deal with reduced budgets, for example, by using employees who have training experience, Tolentino says.
Talent Management in the New Normal
Hiring managers, including those in internal audit, will face challenges recruiting workers in the post-COVID-19 work environment, making it imperative for them to have a comprehensive talent management strategy. They will need to look for a mix of skills and backgrounds in their recruits, and importantly, will need to look for recruits with curiosity and a desire to learn — traits that will be a necessity as organizations navigate the new work landscape.
And just as importantly, managers will need to maintain a positive, supportive culture. They also will need to be flexible in the changing environment, supporting their employees and at the same time challenging them to develop their career, even if it means those employees eventually leave the organization.