As internal audit departments look to confront the difficulties of cybersecurity, the increasing complexity of business processes, and the breakneck pace of innovation, they continue to assess the skills and competencies members possess across the team to meet these challenges, and they are finding some troubling holes.
According to MISTI's 2017 Internal Audit Planning and Staffing Priorities Report, internal auditors say their internal audit seniors and managers most lack data analytic skills, understanding of IT auditing concepts, project management skills, and ability to influence and persuade. Those skills ranked as the top four deficiencies respondents found most lacking, according to the survey.
Tactical audit skills, such as audit report writing, audit planning, and field work ranked at the bottom of the list, along with an understanding of governance, risk and controls, indicating that internal auditors are comfortable with the core skills they have on their teams.
Among internal audit leaders, such as chief audit executives and directors, respondents say they are lacking in understanding of IT auditing concepts (41 percent ranked it in the top three), the ability to influence and persuade (38 percent), and change management (30 percent). This suggests the need for deeper learning and training in specific areas, such as technology, rather than hoping to absorb the necessary information on the job, even for those in the highest levels.
The concern over lack of technology know-how among internal auditors was a common theme throughout the survey responses. Indeed, respondents ranked cybersecurity and IT governance among their top general concerns. So it may come as no surprise that they are also worried about the skill sets they have to meet these technology-centric challenges. Recent cybersecurity attacks, such as the WannaCry ransomware attack, lend credence to these anxieties.
What's on the Wish List?
Interestingly, internal audit survey respondents didn't necessarily cite the same skills they say are lacking as the skills they desire in ideal internal audit hires. As internal audit members work more closely with business leaders, CAEs are looking for the next generation of auditors to build bridges and solve problems rather than just spotting errors. That means so-called soft skills, such as communications, are rising to the top of their wish lists.
Two skills stood well above the others as most desired for internal audit seniors and managers: verbal communications and presentation skills and critical thinking. About 50 percent of auditors ranked these in their top three most desired attributes. Written communications is a close third, cited by 34 percent as an important attribute.
Communications is front and center because effective internal auditors must be able to collaborate with a wide variety of people across the business, audit executives say. "You could be the brightest person in the world, but if you can't communicate your ideas effectively, it doesn't matter, you're irrelevant," says Duaine Smith, chief audit executive of iHeartMedia.
Critical thinking is also essential as internal audit staffers interact with business leaders. "Critical thinking is the ability for people to connect the dots and understand why things are happening. It's thinking beyond the 'what' and looking at the 'why.' For example, was the problem the result of the policy or procedure being inadequate, or was the communication and training ineffective? Does the problem happen often or was it an isolated incident? Is this issue unique to a region or business unit or pervasive across the company? It's really peeling back the onion," says Alec Arons, national practice leader for advisory services at Experis Finance, which jointly produced the survey with MISTI.
While knowledge of the business and technical skills, such as data analytics, fell lower on the list of desirable qualities—even they ranked high on the list of lacking skills—many audit executives say it's because those areas are easier to train people in than top-rated communication and critical thinking. "Healthcare can be taught; it's much harder to teach you the maturity and confidence that allows you to communicate well," says Amjad Ally, chief audit executive of Summa Health System.
Likewise, "we focus on competence, not experience," says one internal audit leader. "We can teach internal auditing; it's not rocket science. It's much harder to teach good communication skills and good customer service skills," says Ally.
Other highly sought-after skills may be easier to acquire. A good way to work on business acumen and industry knowledge is to encourage audit team members to stay apprised of industry concerns by regularly reading top business publications and the company's financial statements. Then, they should use that information to proactively reach out to business leaders with intelligent questions.
A similar dichotomy holds true for chief audit executives and directors. Excellent verbal communications and the ability to think critically top the list of most-desired attributes, yet an understanding of IT audit concepts is considered the most lacking skill among audit executives, even edging out deficiencies in the ability to influence and control. It's also possible, however, that these items are most lacking precisely because audit executives hire (and are hired) for higher-level interpersonal skills and often must catch up on emerging areas such as those related to technology.
Is internal audit focusing its resources on areas that have the greatest impact on the organization's success? Our "2017 Internal Audit Planning and Staffing Priorities Report" answers this question and more.
