How Internal Audit Can Leverage Resources to Gain Needed Skills

These days an internal auditor is required to be a jack-of-all-trades. To complete the diverse set of audits that cover every facet of the organization, the internal audit team must collectively possess a vast array of skills that run the gamut from traditional financial talents to marketing, HR, and technology expertise, among others.

New technologies, such as artificial intelligence, machine learning, robotic process automation, and many others are only increasing the need for internal audit to add skills and abilities to its repertoire. Internal auditors must understand what is happening inside these “black boxes” to ensure that the technologies are not subjecting the organization to unknown risks. Chief audit executives, in particular, must be careful to ensure that the use of emerging technologies throughout the organization is being audited and that internal audit departments have the technical abilities to conduct quality audits in such areas.

Yet acquiring these skills can be difficult. Internal audit shops are already stretched thin covering the audits they already have on their audit plans. And with budgets tightening, the department isn’t always at liberty to go out and hire internal auditors with the additional needed skill sets. Even when they do get the resources to hire new auditors, the competition for those with in-demand skills, such as data analytics and cybersecurity acumen, is fierce.

Changing and Emerging Risks
Indeed, it may be unrealistic, especially at smaller internal audit functions, to acquire all the needed skills and abilities in-house. In fact, it may even be unwise to try. According to Jonathan Ngah, a principal at internal audit, governance, and risk advisory firm, Synergy Integration Advisors (SAI), it’s a mistake to try to cover all the needed skill sets and subject matter areas inside the internal audit department to execute all the different audits that must be conducted.

“Risks in the organization are constantly changing and new emerging risks require new areas of expertise to audit them,” says Ngah. “You would end up chasing your tail to trying to ensure all those skills are covered in-house. It makes more sense to ensure a foundation of skills among the internal auditors on the team, and then seek other expertise through co-sourcing or other arrangements.”

To be sure, there are a variety of ways to fill gaps in the skills and expertise contained on the internal audit team. Some include boosting the existing skills on the team, while others include leveraging resources from other areas inside the organization or seeking outside help.

Here are some ways to bolster the capabilities of the internal audit team to ensure the needed expertise is available to conduct audits in new or unfamiliar areas:

Training and Education
One of the best ways to improve the skills of the internal audit team and to add additional abilities is to require existing auditors to attending training sessions. Indeed, MIS Training Institute offers a full array of courses in several areas—including cybersecurity, data governance, data analytics, cloud security, and many more—that can bolster the abilities of any internal auditor. The Institute of Internal Auditors requires practicing certified internal auditors to earn 40 continuing professional education (CPE) credit hours per year. (A recent requirement necessitates that two of those credits each year are focused on the area of ethics.)

Some organizations conduct “training weeks,” where time in the schedule is specifically set aside for training. Packaging Corporation of America, for example, holds training week each March, when all other business is put on hold to ensure internal auditors have time to gain training in needed areas. Through the week, the team looks back over lessons learned from the prior year, reviews the needs of the current audit plan, and holds group training sessions in needed areas. “There’s never enough time, so you really need to put time for training into the schedule,” says Yulia Gurman, executive director of internal audit at PCA.

Lunch and Learns
A cost effective way to get more training and knowledge for internal auditors is to have it provided by experts inside the company. Many internal audit departments hold “lunch and learns,” where an expert at a line of business of function outside of internal audit is invited to speak to the department over lunch. The expert may be from a unit that is soon to be the subject of an audit, is particularly complex, or an expert in a particular technology. The sessions typically allow auditors to ask questions and learn more about that part of the business.

One of the benefits of a lunch and learn is that they facilitate learning and the transfer of knowledge in a very informal setting. Business managers get exposed to internal audit and vice versa in a very supportive setting, which can increase relationship building and build trust across both sides.

Guest Auditor
A step further than a lunch and learn is inviting a manager or subject matter expert from the organization to serve on the internal audit team for a particular audit or period of time. Known as “guest auditor” or rotational audit arrangements, they are among the most cost-effective and efficient ways to bolster the capabilities of the internal audit department. But choosing the right person can be tricky. The best guest auditors will have deep knowledge of the process or function being audited, but not so senior that they compromise the independence of the audit or become defensive when the audit finds deficiencies or problems in their original unit.

While such arrangements can raise independence and objectivity issues, most audit teams are capable of managing around those problems. Guest auditors facilitate audits and leverage their expertise, but they don’t typically lead them. Acting as advisors, the added benefit of the guest auditor is that when they return to their jobs they can see things from an internal audit prospective and become advocates for internal audit.

Some companies rotate operations personnel through internal audit in guest auditor roles so that they gain a better understanding of risk and controls and learn to see things from an assurance perspective. When they return to their jobs out in the business they are more aware of control problems and become better members of the “first-line” of defence.

Co-Sourcing
There may be times when the internal audit department has no choice but to look outside the organization for expertise. An increasingly popular arrangement is to seek a co-sourcing relationship. Co-sourcing is when services from within the organization is combined with those from outside sources, such as the Big Four, advisory firms, specialty firms, and other consultants to achieve a certain goal. Co-sourced experts typically become part of the team for a particular audit or project. Among the best benefits of co-sourcing is that there is knowledge transfer from the outside experts to those on the internal audit team working along with them.

Outsourcing
There may also be times when it makes sense to completely outsource an audit or part of an audit to an outside organization. Outsourced audits have their benefits and limitations and still require oversight from internal audit.

Among the greatest benefits is that they can provide an independent and objective take on a process that internal audit may be too close to. For example, if the CAE is also the head of compliance, he or she may look to an outside firm to audit compliance to ensure an objective audit is completed.

Still, outsourced internal audits can be expensive and finding the right firm can be tricky. Another problem is that there is no transfer of knowledge in an outsourcing arrangement, so the same audit will need to be outsourced again the next time it needs to be conducted.

It’s also important to note that outsourcing portions of internal audit does not absolve the internal audit team, the board of directors, or the organization from the responsibilities of ensuring that controls are in place and functioning and risks are being managed. As Richard Chambers, president and CEO of the IIA, put it in a blog post last year: The IIA believes, “oversight and responsibility for the internal audit activity cannot be outsourced.”

Promoting a Culture of Learning
Perhaps the best way to bolster the internal audit team and improve the skills in the department is to promote a culture of learning. This includes encouraging training and education, including providing time and covering expenses of attending training sessions or academic classes that improve individuals while they upgrade the skills of the team at large. It may also involve providing auditors time to seek learning or to experiment with different approaches, such as data analytics or other technologies.

It is also important to hire the type of internal auditors that continually seek out new challenges, love to learn new things, and demonstrate a curiosity about how things work. “These are life-long learners and that’s what you want on your internal audit team,” says SAI’s Ngah. “The type of person who says they already know everything about internal audit there is to know… you can’t afford to have that person on your team.” 

Joseph McCafferty is editor & publisher of Internal Audit 360°