Staffing an internal audit department capable of meeting the myriad and multiplying mandates imposed by a growing group of stakeholders is like solving a Rubik's Cube. The logistical difficulty of making multiple moving parts on more than one plane match up--at the same time--characterizes the way chief audit executives (CAEs) struggle to line up the right mix of talent with their organizations' evolving technical, analytical, and operational needs. But just as a Rubik's Cube can be solved, there is a solution for internal audit department staffing.
The solutions are unique to each situation, but alignment is key in all cases. "The internal audit function must first align its focus and staffing plans with the organization's broader goals and strategies," says Mike Maali, internal audit, compliance, and risk solutions leader at PwC LLP in Chicago, "then with the specific objectives of the internal audit department, itself."
But aligning staffing isn't simply a matter of hiring expert data analysts. Often, the work ahead requires core audit competencies, the basic capabilities every department is called upon to muster. So, audit leaders may need to add traditional, frontline practitioners to their rosters, too. And everybody in every position must be nimble and quick. Companies often change business models, and some of the new models lack regulatory conventions. Internal auditors must be able to zoom in to see every point in detail, and zoom out to view the matter from a strategic angle.
STAFFING THE RIGHT TALENT
The essence of the CAE's hiring challenge is determining the right mix of IT and business expertise, sharpened interpersonal skills, and audit fundamentals the department requires. "Finding the right people for an internal audit department is extremely hard," says Robert Berry, principal at consulting company That Audit Guy based in Mobile,
Ala. Stakeholders, he adds, hear about the latest tools to use--blockchain, for example--and want internal audit guidance before they know with any clarity what they want from the technology. Do you staff to conduct research that's not going to be very relevant?
The evolution of the profession--and its professionals--can intensify the challenge. "It requires new internal auditors with different backgrounds to evaluate new operational and emerging risk areas," says Yulia Gurman, CAE at Packaging Corporation of America in Lake Forest, Ill. "Schools are producing more ambitious internal audit graduates, and the profession is attracting experienced candidates from other industries from a variety of backgrounds." The profession has evolved beyond evaluating compliance and reporting risks, she adds. A growing number of companies hiring internal auditors now emphasize emotional intelligence and professional skills as much as, if not more than, technical skills.
The CAE's task is to understand the organization's key risks, internal audit standards and requirements, and stakeholder expectations, then assess whether the current staff has sufficient skills and expertise to provide the level of assurance required. "You also need to understand the complexity of the business and the size of internal audit teams at similar organizations," says Stacey Schabel, American audit director at Jackson National Life...