Skill needs challenge internal audit

Keeping up with a dizzying pace of change has proved to be a significant problem for the internal audit function.

Many internal auditors already are taking on more extensive duties in their organisations as they expand on their traditional assurance roles. They often have opportunities to drive enterprise risk management and provide higher levels of service as their insight can be used to predict future risks and contribute to strategy.

As they pour energy into expanding their roles—while still performing their traditional functions—internal auditors have to keep up with a rapidly changing list of competencies required by their jobs.

“With the rapid pace of change, and so much of it technology-driven, it’s just not realistic that one group of people would have the right skills,” Trish Oelrich, CPA, audit committee chair at Pepco Holdings, said during a PwC webcast. “And an internal audit department that doesn’t constantly refresh with bringing new people in and rotating people out is going to have a bigger challenge with keeping that skill base up.”

Keeping up with the necessary skills has been difficult for the internal audit function. In a global survey, less than 40% of internal audit stakeholders said the function is performing well or very well with regard to obtaining, training, and sourcing the right level of talent for audit needs, according to a PwC report on the state of the internal audit profession.

Less than 30% of stakeholders said internal audit is performing well or very well in leveraging technology. Arthur Rothkopf, a director with audit committee chair experience, said during the PwC webcast that internal audit staff has had difficulty attracting skilled IT professionals at the technology-oriented companies he has been involved with.

He said the audit committee and board of directors at one company he serves decided to outsource the internal audit function because of concerns about technology, cybersecurity, and a need to deal with international questions as the company expanded.

“Technology and international are critical issues and require a very high level of sophistication,” Rothkopf said.

Oelrich said companies have three options as they seek to keep internal audit skills current:

• Training. This keeps the function in-house but can require a significant time commitment.
• Outsourcing. This relieves companies of the burden of training but places important functions in the hands of an outside vendor.
• Co-sourcing. This tactic uses external help for issues the company’s staff is not prepared to handle.

Oelrich said she had success using co-sourcing when she was working in internal audit, because it allowed easy access to a specific skill. She said that in an environment of complex partnerships and alliances, very large global companies with hundreds of internal auditors might be the only organisations with all the skills they need on staff.

“In today’s world, with the amount of change, it would be hard to imagine an internal audit group that could have expertise in everything from A to Z,” she said.

Alice Richter, whose audit committee chair service includes West Marine and G&K Services, said on the webcast that internal audit departments no longer can make the mistake of auditing to their capabilities rather than to the risk profile of the company.

“That has to change,” she said. “You need to understand where the risks are. You need to take a good look at your capabilities. And where there are gaps, you need to do something to fill those gaps.”

—Ken Tysiac (ktysiac@aicpa.org) is a CGMA Magazine senior editor.