FedEx Chief Audit Executive Robert King on what internal audit departments need to do to rise to the occasion
There are several big challenges facing internal audit departments and still more facing the internal audit profession as a whole. Some of them represent opportunities as well as obstacles to overcome. The difficulty in filling internal audit positions with talented candidates, for example, has led to increases in pay for many internal auditors. The need to do a better job leveraging technology has the potential to free internal audit up to do more valuable and higher-level jobs, raising internal audit's profile in the organization.
"It's a great time to be in the internal audit profession," said Robert King, chief audit executive of FedEx, during a keynote speech at the SuperStrategies 2016 conference held last week in Las Vegas. "Executive teams are continually reaching out to us to do more, so it's a great time that we are being asked to be in the game."
While King asserts that internal audit is increasingly playing a bigger role at most companies, there are still many hurdles to overcome, he said. One of the major ones is meeting loftier expectations. "We have to make sure our value proposition is delivering on those expectations," said King.
During the talk, he outlined four major challenges internal audit departments must meet if they are to rise to the occasion and deliver on the increased value that boards and management teams are expecting: managing talent, becoming a trusted advisor, meeting increased stakeholder expectations, and conquering technology demands and threats.
1. Developing a Workforce Strategy
The difficulties around staffing the internal audit department are well known these days: not enough qualified candidates with the unique set of skills required to be successful in the modern internal audit department. Salaries are also rising making it more expensive to find the right people. King says the critical skills and attributes needed in the internal audit department include analytical abilities, business knowledge, ability to communicate well, integrity, courage, conflict management skills, and many others. "You can't be an auditor if you can't handle conflict," he said.
Since it's difficult to find all of these attributes, not to mention IT skills, in one person, King says his department takes a workforce strategy approach, ensuring that the needed skills are represented across the staff. To get there, his team conducts a skills assessment and then a gap analysis to pinpoint what skills are lacking and works to plug those holes, either by providing training and development or through recruiting efforts. "Aligning with the HR group was a key part of our workforce strategy," he said.
2. Becoming a Trusted Advisor
Among the most difficult of the challenges King outlined, he said, was building trust, especially since it can take a long time to build, but can be damaged in the blink of an eye. "We must build trust and credibility," he said. "There are a lot of steps along the way, but that trust has to be earned." According to King, a few of steps along the way to earning trust include being transparent, fair, candid, and personable. He also advised those in the audience do more listening than talking. "You have to be out walking around, asking questions, and then listening."
For King, becoming a trusted advisor includes being able to offer business units more insight and foresight than hindsight. "We have to take a more strategic-driven approach and focus on key initiatives," he said.
3. Delivering Added Value
Along with the mandate to become more of a trusted advisor, there are other increased stakeholder expectations that internal audit must meet, said King. At the top of the list is providing more insight on risk and helping the company to be able to adapt to handle the forever changing nature of risk. "What is your brand? What is your value proposition?" asked King. "Is the board coming to you and asking about risk?"
Among the risks that internal audit needs to be better equipped to provide assurance over, King listed regulatory compliance, third-party relationships, cybersecurity, emerging markets, and IT governance. To meet the challenge of providing more insight on such risks, King stresses the need to understand the business, forge strong relationships with business partners, and drive change. "At the end of the day, we have to provide the insight to get them to that change," said King.
4. Leveraging Technology
The final challenge that King explored was the need to do a better job at leveraging technology in internal audit including using data analytics. He tied technology back into the first challenge of finding the right people with the right skills. Indeed, many internal audit departments admit they are struggling to find good IT auditors. King joked that there are really only 10 IT audit leaders that just keep getting hired away from their companies at a higher salary. One of King's solutions is to hire people with technology backgrounds and then teach them how to be auditors. "Half of our IT audit staff has no prior audit experience," said King. "It's easier to teach that than to develop IT skills."
King says data analytics is becoming an increasingly important tool for internal audit to leverage. After some early stumbles, according to King, the internal audit team at FedEx is using data analytics more effectively. He says the key was to focus more on the data. He enlisted the help of some data scientists and put the focus on the data, rather than the tools. "Now we are taking that data and getting to see things we haven't seen in it before."
King ended his talk with some good advice for all internal auditors on conquering these challenges. "There are three things we need to do to be successful: you have to drive change, you have to have passion, and you have to stay relevant.
