So much has changed in 2020 for internal audit teams. The COVID-19 pandemic has forced teams to adopt new ways of working, caused change in the risk profiles of the organizations they serve and, for many, has resulted in pressure on resources that has forced internal audit management to make tough decisions related to audit coverage, training and, unfortunately in some cases, head count.
At the same time, when it comes to the purpose and mission of internal audit, the uncertainty surrounding the pandemic has also presented internal audit teams with tremendous opportunities to demonstrate their skill, agility and value to the organization when it comes to providing assurance and assessing risk.
With all of this happening in a relatively compressed period of time, it intuitively follows that internal audit management may be considering reskilling their teams for both the present and future. In doing so, there are some important things management should consider.
Understand the Organization’s Strategy and Risk Profile
The events surrounding the pandemic have served as a reminder that during disruption, the risk facing the organization (and, therefore, its audit and assurance needs) may change. Hence, the first thing internal audit leaders must consider during a disruption is not how to execute the existing audit plan under new circumstances, but rather how the organization’s risk has changed and what it now needs most from internal audit. Likewise, in any reskilling effort, while it is important to look at what currently needs to be audited, it is just as important to look at what will need to be audited in the future in the context of the organization’s strategy and the changing environment. This requires internal audit leadership to be engaged in two-way communication with the board and senior management to not only understand the organization’s present audit needs, but also to anticipate what those needs may be in various possible future states.
Improve at Identifying Emerging and Atypical Risk
An internal audit function that is reskilling for the future should have an eye toward getting better at identifying emerging and atypical risk and bringing it to the board’s attention. The Institute of Internal Auditors’s (IIA) 2019 Pulse of Internal Audit survey report notes that while chief audit executives (CAEs) are confident in their teams’ ability to identify risk, the board is not nearly as likely to turn to them for emerging risk information as they are to executive management.1 Although monitoring the quality and efficiency of current, day-to-day operations remains core to internal auditing, it is clear that the function must also provide forward-looking insight into risk to continue to deliver value that meets the board’s and C-suite’s expectations.
One way internal audit can improve in this regard is to grow its use of data analytics. Only about 30 percent of CAEs in the 2019 Pulse survey said their teams use advanced data analytics to identify emerging risk.2 Data analytics help many areas of the business monitor themselves so the internal audit team does not have to create a digital revolution on their own. By being a strategic business partner with other functions of the organization, audit can share ownership of analytical tools that help identify risk.
Increase Innovation and Technology Skills
Internal audit teams must get better both at utilizing technology and understanding the technology their organizations are using. As such, no reskilling effort should overlook this aspect. ISACA® members have indicated that auditors are becoming increasingly involved in enterprise technology projects at their organizations and that auditors’ technical skills must increase as audit automation increases.3 At the same time, many of them see a growing need for data scientists working alongside IT experts in the audit field as organizational use of advanced technology grows.
INTERNAL AUDIT TEAMS MUST GET BETTER BOTH AT UTILIZING TECHNOLOGY AND UNDERSTANDING THE TECHNOLOGY THEIR ORGANIZATIONS ARE USING.
The auditor needs to be able to handle tasks such as querying, understanding and manipulating big data for analysis. Beyond that, as audits involve not only understanding human decisions but also interpreting intelligence demonstrated by machines through artificial intelligence (AI), auditors must understand the unique risk (e.g., machine learning bias) and opportunities (e.g., data-first audit approach) present in each audit engagement where AI is involved. The role of the auditor may become more complex than ever before.
Although technology and data analytics know-how is vital, bringing more of those into the internal audit function does not necessarily equate to innovation. Indeed, the desire to innovate should be a key trait that audit management is looking for in any position that it is seeking to fill. Auditors must innovate in their field by increasing automation of audit tasks and presenting real-time views into the audit process to stakeholders. Innovation is not only critical to imparting value to the organization but also to retaining talent. Fostering a culture where innovation is encouraged and rewarded is critical to retaining individuals who consider the opportunity to innovate a key aspect of job satisfaction.
Rethink the Definition of “Critical” Skill Sets
In attempting to reskill their teams, internal audit leaders should give thought to what constitutes a critical skill set for their specific audit function. Although it might come naturally to concentrate on so-called “hard” skills when considering a reskilling effort, it is important to think just as carefully about the makeup of current or potential staff members. In a recent survey, CAEs and other internal audit leaders rated analytical/critical thinking (95 percent) and communication (94 percent) to be the two skills most essential to their audit team’s ability to perform its responsibilities.4 Understanding the audit process (85 percent) was third. This partly reflects that the work is changing, and internal audit teams are looking for people who can learn, re-learn, and re-learn again as the organization’s strategy and risk environment evolve. At the same time, as organizations increasingly look to leverage the value of their data, and as internal audit teams themselves use advanced analytics to provide continuous auditing assurance, the role of the auditor is becoming increasingly about understanding and assigning meaning and being able to communicate it to business leadership in a way that is valuable and impactful.
Weigh Various Sourcing Models
There are two basic sourcing approaches that internal audit management can use to reskill its staff. One is to train existing staff and the other is to look outside the department to hire or contract individuals with the desired skills. Internal audit management should carefully weigh the costs and benefits of these approaches. Ongoing professional education is a critical aspect of ensuring auditor competency and growth, and continual education is one of the best ways to maximize the value of each staff member’s contribution to the audit team. However, training for specific new skills can be costly, and many internal audit departments have been forced to scale back training and professional development during the pandemic. There is also risk that if investments in training are not well conceived and coordinated, they may not have the desired impact on day-to-day operations. Therefore, when using training to reskill internal audit staff, it is critical that employees understand how the training they receive fits into the larger internal audit strategy and their individual plan for skills growth.
In terms of looking outside the department for talent, there are two approaches here as well. One is to hire people with internal audit experience and expertise and allow them to learn the business they are auditing. The other is to hire subject matter experts and train them to perform internal audit work. Increasingly, internal audit functions are looking to places such as IT, data science, communications, fraud and security, and operational management to bolster the subject matter expertise on staff.
Prioritize Speed, Agility and Scalability
The business climate during the pandemic has reemphasized the imperative that internal audit functions must become more agile and be able to deliver assurance and risk insight to their organizations more quickly. Speed, agility and scalability should be critical considerations in reskilling an internal audit function. Internal audit management should attempt to gauge how quickly the function could potentially scale up or scale down and refocus its priorities and efforts to keep pace with organizational needs, considering factors such as auditors’:
- Physical locations
- Experience, skills and subject matter expertise
- Role definitions and place in the organizational structure
- Employment status (i.e., full time, contractor)
INCREASINGLY, INTERNAL AUDIT FUNCTIONS ARE LOOKING TO PLACES SUCH AS IT, DATA SCIENCE, COMMUNICATIONS, FRAUD AND SECURITY, AND OPERATIONAL MANAGEMENT TO BOLSTER THE SUBJECT MATTER EXPERTISE ON STAFF.
As organizations move from a traditional waterfall approach, where projects have a distinct beginning and end, to Agile, where projects are continuous iterations and requirements are constantly changing, it is important for the internal audit department to have a seat at the table to keep up with changing priorities. This is a good time to consider how audit teams are structured so they contain an optimal mix of necessary skills that allow them to be beneficial in cross-functional environments. This will ensure speed and scalability as the teams will have the skills necessary for any direction the project takes.
Conclusion
While there is no one-size-fits-all formula for the right mix of skills, abilities and knowledge within the internal audit team, there are some must-have qualities that internal audit management can use as reference points when considering how to reskill its teams for the present and future. Internal audit must understand the strategy of the organization and the risk, and then must deliver timely, relevant forward-looking insight while maintaining the agility to retool as the organization’s risk and strategy change. Internal audit functions that can do this will be well positioned to become, or remain, indispensable assets for organizations navigating uncertain futures.
Endnotes
1 Institute of Internal Auditors (IIA), 2019 North
American Pulse of Internal Audit: Defining
Alignment in a Dynamic Risk Landscape, USA,
2019
2 Ibid.
3 ISACA®, The Future of IT Audit, USA, 2019, https://www.isaca.org/bookstore/bookstore-wht_papers-digital/whpfit
4 Institute of Internal Auditors (IIA), 2018 North
American Pulse of Internal Audit:
Transformation Imperative, USA, 2018
Kevin M. Alvero, CISA, CDPSE, CFE
Is senior vice president of internal audit, compliance and governance at the Nielsen Company. He leads the internal quality audit program and industry compliance initiatives, spanning Nielsen’s Global Media products and company services.
Stefanie Sullivan
Is a manager in internal audit at the Nielsen Company. She is an integrated data science resource within the audit department, focused on providing data and methodology expertise for television audience measurement engagements.