Internal audit departments are integral to the organizations they help safeguard. And to remain being so, continual adaptation is essential to fulfill their key objective of mitigating risk. The changes arising from the COVID-19 pandemic have disrupted the profession substantially, but there are many positives and key lessons that can be drawn from a challenging 20 months.
Flexible working models, automation through data analytics, and auditing technology are at the forefront of discussions regarding the future of internal audit. COVID-19 has certainly accelerated the need for more sophisticated technology platforms for most businesses, and many of these businesses have invested in cutting-edge software to operate optimally. As such, there have been significant expansions of existing IT audit teams, as well as a focus on upskilling business auditors through training and exposure to new technologies adopted by their firms. Ensuring that all members of the department are well-versed on the key risks associated with relevant software and technology has become a priority.
Automation also will become increasingly commonplace, but embedding it into the internal audit workflow will be a challenge. Those auditors with training and experience in data analytics are set to be in high demand.
Adapting to a new world full of technological advancement will be of great importance to internal audit functions looking to recruit and retain talent. They also will need to address the changes that the COVID-19 pandemic has had on working patterns and what employees and job candidates are likely to demand from employers. These and other factors will be challenging for audit functions in an increasingly competitive market for audit talent.
What the New Normal Looks Like
Many businesses have been implementing new technology or are in the process of a digital transformation. This shift is the new normal, and auditors, no matter what their specialty, must become proficient with technology to stay ahead of the curve.
Each piece of software comes with risks, and understanding these risks in depth will be required of all audit teams. Although these demands require internal audit departments to learn new skills, they also are a great opportunity for auditors to invest in themselves and their career trajectory. Obtaining additional knowledge will always be looked upon favorably by prospective employers, as well as by headhunters looking to fill niche roles.
"There's been a significant increase in change audits, risk advisory work, cultural and behavioral reviews, and digital/tech and cyber audits," says Samantha Coggins-Thompson, chief audit executive (CAE) at Computershare in London. "Baseline competencies for audit staff of the future will change. All of us will need to be tech-savvy, data-literate, and change-experienced auditors."
Competing for Talent
The new normal also means greater competition for audit talent. From an employer's perspective, retaining talent should be the top priority, even above a recruitment strategy. Losing talent is expensive both financially and operationally. And filling niche roles, such as those within internal audit, can take talent teams up to six months, even before factoring in notice periods.
It's imperative for each department to regularly review salaries and ensure that highly qualified team members are being compensated accordingly. Salary surveys and benchmarking can help an internal audit function understand if it is competitive in the market. These methods can be as specific or as broad as internal audit would like. An example is understanding how a cybersecurity specialist auditor would get paid in comparison to a generalist auditor.
This salary information is excellent for internal audit functions that want to ensure they are paying a competitive rate, as well as for scoping the market to see what is in demand. For job candidates, such surveys also are incredibly useful for validating whether they will be paid in line with their peers.
Contractors remain in high dem-and, but their cost can be stifling for audit functions. Audit leaders who plan to hire and build out their teams may need external assistance to help mitigate risk and attract the best talent in the market. The cost of a bad internal audit hire can exceed $130,000, so approaching recruitment and retention with a clear strategy is crucial.
One way internal audit can ensure it has access to top talent is through talent pooling, which means recruiters continuously identify and nurture potential candidates. The result of this process is that when the audit function is ready to start hiring and interviewing, it will already have a qualified shortlist of candidates. Talent pooling is an excellent strategy for any firm regardless of size, as it creates a more thoughtful, proactive recruitment process. It can be conducted on an ongoing basis or when there is a specific role that is upcoming.
Equally, audit functions should set up training programs and courses to upskill teams, so they can retain talent and ensure employees are competent with current and future technologies being implemented in the business. For most software, training and development will be offered as part of the onboarding process, so internal auditors should become involved as early in that process as possible.
Auditing Talent Management
Most organizations are aware of the importance of talent management — at least in an abstract sense. But how in-depth is that awareness? Are the risks of poor talent management understood, observed, and contextualized? This is where internal audit can offer a helping hand.
Internal auditors are adept at identifying when a process isn't working and being able to interpret how that issue can affect the business. Perhaps most importantly, auditors are adept at recommending improvements to the status quo.
Talent management could certainly benefit from being looked at in this way because employees are an organization's most important asset. The difference between getting it right and getting it wrong can significantly impact a company's competitiveness.
Ensuring that talent management is part of the audit universe is the first step. Having it on the agenda and recognized as potentially high-risk is important. Perfecting or improving talent attraction, retention, and performance should be a priority. These issues need to be viewed in a detached, analytical, and data-led manner. That is a perfect job for internal audit.
The Impact of COVID-19
One of the biggest shifts businesses have seen has been around employees who are considering leaving their roles. The COVID-19 pandemic demonstrated how organizations treat their staff in times of adversity, and unfortunately, some of these firms have incited a negative reaction from employees — perhaps unwittingly, perhaps not.
Now that organizations are coming out of the other side of the pandemic, people are reconsidering their options and thinking seriously about how happy they are at work. Do employees feel supported by their organization? Do they feel safe? Do they see a future there?
The pandemic also has revealed skills gaps, within both internal audit teams and individuals. The profession needs to change and adopt an agile, flexible approach; otherwise, retention of talent will falter.
Moreover, the pandemic has demonstrated the effectiveness of remote working. It's evident that many organizations will be embracing either a 100% remote working model, or more commonly, a hybrid remote-office model, moving forward.
"Internal audit will undergo a radical transformation with a new hybrid model combining working from the office and remotely, which will prompt the use of a new audit methodology increasingly turned toward continuous risk monitoring, data analytics, and artificial intelligence," says Patrick Simonnet, CAE at Bank of China in New York. "The auditor will have to complement his or her toolbox in becoming a tech-savvy engineer."
Some businesses are staggering their return-to-office process over time; however, there are still individuals and organizations that believe the role of an auditor should be in an office. There are benefits to both working models, and ultimately, each organization will have a different approach depending on the size of its audit team, the experience level of its staff, and the processes that have to be completed in person.
For example, the ability for internal auditors working at investment banks to sit on a trading desk and talk to department heads in person is crucial for relationship building, as well as being visible across the firm. Although it is feasible for auditors to do this remotely, in some firms it may not have the same effect.
For internal auditors' recommendations to be taken on board and implemented, there needs to be a shared level of respect and trust between clients and practitioners. Ultimately, each firm should look at its working model on a case-by-case basis and ensure that it serves business goals as well as those of the internal audit function. There needs to be compromise to ensure that operations can still run smoothly while being mindful of this new age of working.
Although there is a need for working in an office to train new auditors and keep a sense of company culture, there is a consensus that flexibility has to be the norm moving forward. Organizations may struggle to keep talent if they are unwilling to adapt to new methods of working.
With remote working, the biggest hurdle internal audit must overcome is creating a seamless process that works across teams. Remote working can only be effective if the right actions are in place and communication is clear. The transition hasn't completely happened yet, so it will be interesting to see how some of the larger, more traditional organizations deal with working remotely. It will not be easy.
"The way I maintain and grow stakeholder relationships remotely is similar to how I do it in person," says Prasana Kunapalan, internal audit manager at Sanne in London. "I proactively connect with people for matters beyond core internal audit work. I put effort into introductions, personal chats, sharing insights, and offering a safe space to vent. Instead of waiting to see faces in the office, I contact people wherever I see an opportunity. This means showing an interest in company communications (by volunteering with group initiatives), welcoming new starters (regardless of team or level), sharing ideas (and taking the lead), and providing complimentary feedback (for audit and nonaudit matters)."
The Value Proposition for Candidates
It's going to become even more competitive to find the best internal audit talent, so organizations need to stand out and offer something that is as attractive as possible by asking:
- Is there a clear and genuine path for each team member to progress if his or her performance merits it?
- Has internal audit undertaken a salary benchmarking exercise to ensure that each team member is paid at market rate?
- As far as is practical, does the organization grant flexibility with regard to where and when team members can work?
- Is the internal audit team granted genuine access to converse and consult with the business stakeholders? Or is internal audit seen as a necessary evil rather than a vehicle in which value can be added to the business?
- Does internal audit make genuine attempts to ensure that candidates from all backgrounds are being assessed fairly and made to feel welcome both at the interview and when they begin employment?
- Does the internal audit department have a clear mission and purpose that the whole team strives toward?
If internal audit gets these things right, attracting, onboarding, and retaining the best talent in the market will start to become easier.