Your organization has decided to take the important step of creating an internal audit function, and you’ve been tasked to build it. Building out teams from scratch is always a challenge, but internal audit departments have an especially important role. They must provide objective investigating and reporting on the company’s practices, and diplomatically suggest ways to improve business operations.
There are many reasons why an organization might decide to build an internal audit function, says Hernan Murdock, MISTI’s vice president of audit. Among them could be regulation changes; responding to complaints or lawsuits; a merger or acquisition is taking place; the company is doing a major system upgrade; etc.
“A lot of organizations are also focused on cybersecurity and making sure there’s a resilient response plan,” he adds.
In other words, the people who comprise an internal audit team must have the perfect mix of being super focused, compliance sensitive, and have a company-first mentality. Not to mention all of the technical and communication skills required to do the actual work.
As you get ready to put together your internal audit team or department, this comprehensive guide will take you through the process step by step.
Audit leaders: Follow These Initial Steps
Before you begin building your team, you need to have a clear understanding of your goals.
Step 1: Know what the role of your internal audit function is.
First, you need to have a clear understanding of who your stakeholders are and what their expectations are for the function, says Nancy Luquette, chief risk and audit executive for S&P Global. “From there, you need a good understanding of the business itself,” she adds.
You want to make sure there’s a clear mission and a brand you’re trying to promote within the department, adds Murdock, and that everybody understands what that direction is. Plus, you should also know what your budget is and how many people you can bring onto your team.
Step 2: Figure out which skills and competencies are needed for team members.
“You want the team to have the right skill set and experience level to audit across the company,” says Luquette. She recommends breaking down your requirements into two types of skill sets: Technical and soft skills. “They’re both equally important,” she says.
Murdock points out that qualifications are getting increasingly technical, such as being strong in data analytics. From a business standpoint, having a working knowledge of industry regulations and compliance requirements is crucial, too.
As for soft skills, those are not as easy to define, says Luquette, but are very important. “For example, negotiation skills, how to deal with conflict, how to persuade and be able to convince the client that they need to do something they may not want to do,” she says.
Audit team members also need to be agile and have excellent verbal and written communication skills. “You’ll be talking to people all the time in executing an audit, and the final product is a written report, where you translate everything you’ve learned – that is your deliverable at the end of your review and it must be well written and convincing,” says Luquette.
Every company is different, so be sure when you’re compiling your list of required skills that it reflects the mission of your audit team.
Step 3: Hire the right people.
Once you know what the internal audit team’s purpose is, and the skills needed to carry out the function, you have to begin finding the right people for your department. “Don’t quickly hire someone just to fill a spot because you feel pressured to get the team built quickly,” says Luquette.
To help you find the right fit, both from a skills and cultural standpoint, the interview process is critical, says Luquette. “Many people will just get resumes and interview to the resume,” she says, but that’s not effective. “When you do scenario-based interview, you have a much better chance of finding the people who are going to fit into your department.” That’s because while people are trained on how to answer common interview questions when you throw scenarios at them, you’re forcing them to really think on their feet.
Another tip: Include some of your business leaders in the interview process – they’ll be thrilled to be included and you can get another perspective on tough hiring decisions. “You want to hire people on your audit team that will get along with people in the business,” says Luquette.
Anatomy of The "Ideal" Internal Audit Department
Now that you have a plan for figuring out the skills you need to run your internal audit department, and how to find the right people, you have to decide what the makeup of your department should be. However, there are many variables that play into how big the dept needs to be. “It really varies by need, complexity, the geographic reach of an organization, if the industry is heavily regulated or not,” Murdock says.
At small organizations, you may have up to five people in a department, and they may break up and do audits, with one or two people doing a review, he explains. But larger organizations, such as financial institutions with multinational locations, could have audit departments with hundreds of auditors.
As for the hierarchy, different organizations also take a variety of approaches. “Typically, you’ll see the layers are staff, senior staff, manager, director, and chief audit executive,” says Murdock. Within each of those, there may be one or more people. “Be mindful of how you want your team to be structured,” says Murdock. Do you want a lot of inexperienced auditors doing the work you’ll assign, or would you prefer more experienced staff who carry higher titles but can perform several of the tasks required in the life cycle of an audit?
Another thing to consider is if your internal audit function will be supplemented by an external auditor, in which case, you might not need as large a team. In other cases, you may have people from the business who come in as subject matter experts to work on one-off audits if they have a particular expertise, says Murdock. “Some organizations have a rotation where people become part of the audit staff for a temporary period and then go back to their original department after some time so they can go back and run their units better,” he says.
These are the details that you want to try to iron out before you bring on your team. But no matter which route you take, you should always aim to bring in different perspectives, says Luquette. “It’s very easy for an audit leader to bring people in that look like them and think like them,” she says. But that’s not the best way to go about it. “You need have to have diverse thinking and experiences to have an effective internal audit function.”
How to Set Expectations with Upstream Management
As you build out your internal audit team, it will be a process that takes time. That’s why it’s important to have a written charter to guide you and keep expectations in check. “Once you have your mandate defined, you can create your short term and long term plans,” she says. Aim to present senior leadership with what you can accomplish in year one, year two, and year three. “It is good to have a three-year strategic plan or roadmap to keep you on track,” she says.
During the build, it’s vital that you keep up the conversation and collaboration with your board and senior management as you develop the audit plan, says Murdock. “It’s not just a once a year type of thing. You need to be having these conversations several times during the year to adjust as conditions change,” he adds.
Luquette agrees, adding that you should give management regular updates, especially if you run into obstacles or budget issues. But always refer back to your master plan. “Follow your roadmap,” she says. “It’s easy to get distracted, but make sure whatever you do, it aligns with your charter.”
Interested in learning more about this topic and others? Be sure to attend the upcoming Audit World Conference & Expo in Orlando, Florida. Here's everything you need to know.
Photo by LinkedIn Sales Navigator on Unsplash
