Is Internal Audit Lacking in Leadership Skills? [Compliance Week]

With dramatic changes in the business environment over the past few years, many internal audit departments are caught in a kind of feedback loop- eager to help steer organizations in a new direction, but struggling to demonstrate their ability to be agents of change.

Studies by the Institute of Internal Auditors and PwC suggest that after years of focus on financial reporting controls thanks to the Sarbanes-Oxley Act, internal auditors are still trying to put down their pencils and lift heads so they can take a broader look at organizational risk. To participate in the larger landscape, however, they are finding they still need to improve their skills in some important areas, and then they need to earn a seat at the table to discuss those risks with boards and audit committees.

"This is probably the hottest topic out there in the profession," says Jason Pett, a partner with PwC. "The CEO agenda is getting much more diverse, moving beyond borders and outside of traditional products. If it's going to remain relevant, internal audit needs to keep up with that. Internal audit needs to be part of a much more complex business environment, and it needs the skills to do that."

Internal audit departments aren't blind to the problem, says Dipak Shah, president and CEO of consulting and software firm Reliant Solutions. "The problem right now is internal auditors are puzzled about who is going to step up," he says. Internal audit departments need more "maverick" leadership, he says, to gain more clout with boards and demonstrate more expertise in identifying and addressing risks.

Developing those leadership skills, however, won't be easy. Internal auditors let their critical thinking skills stagnate while they tackled the mountain of SOX internal control issues for several years before the financial crisis hit, says Warren Stippich, a partner with Grant Thornton and national leader of the firm's governance, risk, and compliance services. "We've got auditors who are very good tickers, but they've been so busy putting out the SOX fires, the critical thinking about the business issues is not something that's been indoctrinated," he says.

The most recent studies from both the IIA and PwC say that internal auditors foremost need to develop their "soft skills," such as critical thinking, problem solving, communication, and leadership. The studies also suggest internal auditors need to better develop technical skills, like the ability to approach risk management and to understand security and information systems. They also need to work on gaining more operational knowledge, so they can better comprehend any operational risks. "Clearly this all is a moving target," says Richard Chambers, president and CEO of the IIA. "As the profession continues to mature, the level of skills that individuals need to be able to practice in the profession also evolves."

Internal audit departments should be performing a skills inventory, Chambers says, to take a hard look at what the organization is demanding and how adequately the department is staffed to meet those needs. Where skills may be lacking, companies are (or should be) trying a number of tactics to keep up with the shift, he says.

External service providers are a good place to start. "When you bring in an external service provider to help with the audit, there is a natural transfer of skills that goes on with that," Chambers says. Internal and external training programs also are an important element, he adds, and they're readily available from a wide variety of providers.

An increasing number of companies rely on co-sourcing arrangements, Pett says, where they hire employees through third-party providers to acquire a specific operational or technical skill missing from the internal audit department. That's especially true when companies enter a foreign market where they may not know the culture or language well enough to identify the true risks, especially around those associated with the Foreign Corrupt Practices Act.

Brian Gregory, president and senior managing director for CBIZ risk and advisory services, says he sees more internal audit departments looking within their own companies for people with operational experience to join the internal audit department or to work with the department for specific projects.

Technology is a particular area where internal audit staff have a lot to learn, Gregory says. "It's difficult because things are moving so fast in that area," he says. Issues such as cloud computing and social media are so new and developing so rapidly, predicting how they might evolve is difficult. But internal audit must still get ahead of the curve and be ready to answer those questions as they arise internally.

Perhaps the greatest need, says John McLaughlin, a partner with BDO USA's risk advisory services, is for internal audit departments to gain strong leadership. "Internal auditors are really losing ground right now in being able to demonstrate their value," he says. "Internal auditors are not necessarily sales people. They can do a better job of selling what they do and the value of what they provide. Where internal auditors are not as highly respected as they'd like to be, that's generally because they're not able to tell their constituents what they are doing."

According to Pett, the PwC study supports the notion that internal auditor departments need to develop stronger leadership skills and communication skills to become more effective within organizations. "You need to be viewed as having both the hard and the soft skills to have a seat at the table," he says. "You have to be viewed as a leader in the business to be invited into the discussions that are taking place on new products, new markets, and new systems. If you're not at the table, you can't be proactive. You can only be reactive."

It's a political process, agrees McLaughlin, but budget constraints also contribute to the problem, he says. "Like every department, you've got to do more with the same resources you've always had, so you have to be a lot smarter in how you do your job," he says. Shah agrees that puts quite a pinch on internal audit departments. "You need budget to get ahead of the curve, but if the board doesn't see the internal audit partner ahead of the curve, the board wonders why it should give them the budget," he says.

BRIDGING THE SKILLS GAP

The following excerpt from PwC's internal audit study shows what skills/competencies are expected to remain the same, increase, or decrease for the internal audit staff:

As company leaders seek new approaches to talent management to adapt to a dynamic environment, internal audit leaders must also devise creative approaches to acquiring the skills necessary to align with the diverse expectations of their stakeholders. Our survey indicates a clear recognition of the diverse mix of skills that will be required for internal auditors to succeed.

Participants rated the more technical skills of knowledge of risk management approaches and specific technology expertise as the most important skills needed over the next three years. However, these were closely followed by the softer skills that will be critical for success in this dynamic environment: critical thinking skills, understanding the strategy and business model, communication, and leadership (See Figure 7 below). The relative importance of these skills underscores the notion that the auditor of the future will require agility, flexibility, and sharp business acumen to succeed.

Another striking aspect of the survey results for this question is the breadth and depth of the skills that are deemed necessary for success. For nine of the eleven capabilities surveyed, a majority of respondents said the need for those skills would increase over the next three years. These highly sought-after skills cover a broad range of technical and softer people skills; and therein lies one of the more significant challenges facing internal audit functions. The technical skill needs are becoming more specialized; the risks are more diverse; and management expectations are expanding at a rapid pace. One of the CAEs we interviewed put it this way:

What we need are people in IT who can also be project manager thinkers and challenge what's going on within the company. Do we have some of those people? Yes. Do we have enough of them? No.

Indicate whether the need for the following capabilities and depth of knowledge will increase, stay the same,or decrease over the next 3 years.