Transcription
The Top 7 Skills CAEs WantBuilding the Right Mix of Talent for Your OrganizationTALENTFast FactJames RoseCIA, CRMA, CPA, CISAExecutive SummaryThe evolution of the internal audit profession towarda more value-added risk assurance function continuesto move forward. While technical skills are needed forday-to-day work, analytical/critical thinking and communication are personal skills that continue to be atthe top of any chief audit executive’s (CAE’s) wish list.Practitioners with these skills have a higher probabilityof overcoming any technical deficiencies and steppingup to meet stakeholders’ value-added expectations. Tofind practitioners with these skills, CAEs need to have adeliberate talent management plan. They should prioritize identifying those candidates with key personal skillsthrough behavioral assessments, looking at diverse academic backgrounds. When it is not feasible to hire staff forparticular skills or needs, they can consider using resourcesin other areas of the organization (co-sourcing) or obtaining support from outside the organization (outsourcing).Finally, CAEs should establish development programsthat further improve on personal skills while augmentingindustry-specific knowledge and other technical skills.This report supports its conclusions with results fromthe CBOK 2015 Global Practitioner Survey, the largestongoing study of internal auditors in the world.Section 1: Personal Skills—High inDemandAnalytical/critical thinking and communication top thelist of skills most sought after when CAEs were asked topick the top five skills they are recruiting or building intotheir internal audit departments (see exhibit 1). In fact,they have consistently chosen analytical/critical thinkingCBOKThe Global Internal AuditCommon Body of KnowledgeSponsored byLarry Harrington, CIA, QIAL, CRMA2015 –16 ChairmanIIA Global Board of Directors
and communication as the top skills they are looking forin several recent IIA surveys.1Analytical/critical thinking and communication arepersonal skills that bring together all the other components of an audit practitioner’s competency set.2 They givethe internal auditor the ability to apply technical knowledge and then communicate what has been applied tostakeholders.Exhibit 1 The 7 Skills CAEs WantPersonal Skills1.Analytical/critical thinking2.CommunicationTechnical Skills3.Accounting4.Risk management assurance5.Information technology (general)6.Industry-specific knowledge7.Data mining and analyticsNote: Q30: What skills are you recruiting or building the most inyour internal audit department? (Choose up to five.) CAEs only.Ranked according to the percentage who chose each option.n 3,304.Riadh Hajjej, CAE at Arab Tunisian Bank, says criticalthinking is the most important skill his bank is lookingfor. It is important to know how to think and analyze, henotes. “Analytics and critical thinking are harder behavioral skills to learn.” Given that, he believes CAEs shouldconsider screening for these personal skills when evaluating candidates at all staff levels—junior to the mostsenior—in part because today’s junior staff will becometomorrow’s senior leaders in the internal audit function orthe organization.The IIA’s 2013 Global Pulse of Internal Audit survey(n 1,907). The IIA’s 2016 North America Pulse of InternalAudit survey (Q27).1For an overview of The IIA Global Internal Audit CompetencyFramework, please see appendix A.22 The Top 7 Skills CAEs WantWritten communication is especially important, saysTomáš Pivoňka, CAE at CEZ, a large electricity companyin the Czech Republic. “Audit summary is an art,” heexplained. If staff have weak writing skills, CAEs spend agreat deal of time with draft reports that need additionalrewrites and changes before they are presented to the client.Writing skills can be harder to assess and develop thantechnical skills. They require a different mix of classroomteaching, on-the-job experience, and coaching to improve.On a broader level, as the profession moves toward anincreasingly higher proportion of risk-based auditing andmore advisory or consultative work geared toward beinga trusted advisor to management, CAEs will need practitioners with greater critical thinking and communicationsskills. “The need for a ‘general’ auditor who is just checking for regulatory compliance or working off a checklistwill decrease,” suggests Tania Stegemann, executive auditmanager at CIMIC Group Limited, an international contracting company located in Melbourne, Australia.Section 2: Technical Skills—ChangingPrioritiesThe next five skills that CAEs rank the highest are technicalskills that are broadly needed for internal audit activities: Accounting—used to assess financial reportingcontrols Risk management assurance—used forrisk-based auditing and to improve risk management processes Information technology (IT) (general)—needed to assess business and IT processes andperform auditing tasks Industry-specific knowledge—used for assurance, consulting, and strategic reviews Data mining and analytics—used to improveefficiency and effectiveness of audit proceduresExhibit 2 shows the percentage of CAEs who selectedeach skill as one of the top five they are recruiting or building into their departments. This exhibit gives the globalaverage.
Exhibit 2 The Skills CAEs Want, Ranked by Popularity (Respondents Chose Their Top Five Priorities)64%Analytical/critical thinking51%Communication43%Accounting42%Risk management assurance38%Information technology (general)35%Industry-specific knowledge31%Data mining and analytics27%Business acumen23%Fraud auditing22%Finance15%Forensics and investigations14%Cybersecurity and privacy12%Legal knowledge7%Quality controls (Six Sigma; ISO)Other4%0%10%20%30%40%50%60%70%Percentage of respondents selecting the skillNote: Q30: What skills are you recruiting or building the most in your internal audit department? (Choose up to five.) CAEs only.n 3,304.Accounting and Risk Management AssuranceAccounting and risk management assurance are third andfourth on the list of skills CAEs want the most, chosenby about 4 out of 10 survey respondents. Accounting isoften a prerequisite skill because internal audit supportsthe financial reporting controls in most organizations.Risk management assurance—the next most desiredskill—is designed to assess an organization’s overall riskmanagement process across various strategic, financial,operational, and compliance objectives.The emphasis on these two skills appears to shift inimportance to CAEs based on the organization’s level ofrisk management maturity and sophistication. As risksophistication increases, the relative emphasis on findingand developing accounting skills decreases. Given theevolving shift of internal audit to more value-added support of management, this continuing move toward riskmanagement assurance would be expected by strategicallyminded CAEs.www.theiia.org/goto/CBOK 3
Globally for all CAEs who responded to the survey, therelative need for accounting skills diminished compared toother technical skills as the maturity of the risk management process increased. The trend away from accountingand toward risk management assurance is shown inexhibit 3.IT and Data AnalyticsThe need for cybersecurity and data mining will likelyincrease and be “driven by the maturity of the audit shop,”with higher maturity organizations focusing on thesevalue-added areas, says Mike White, CAE at Standard BankGroup in South Africa. Skills to conduct data analytics,including the analysis of data integrity within big datainfrastructures and the analytical analysis to answer complex data-driven questions, will continue to increase anddrive larger proportions of internal audit plans. Given thecomplexity of IT and data analytics skills (and the difficultyin recruiting for them), internal audit functions at smallerorganizations often need to outsource these skills. As notedin exhibit 4, larger internal audit functions are activelyrecruiting and developing IT and data analytics skills.Industry KnowledgeIndustry-specific knowledge, which ranks sixth on thelist of priority skills, is consistently in need regardless ofthe size of the internal audit function. This is shown inexhibit 5, where the priority for industry knowledge varieslittle in relation to the size of the internal audit function.Other findings from the survey also support the overallimportance of industry knowledge. For example, CAEsindicate the risk areas that executive management focusmost on are:Operational risksStrategic business risks Compliance/regulatory risks(Source: Q65, n 2,753) In response to these priorities from management, CAEsfocus a combined total of 51% of their audit plans onthese three areas:Operational risks (25%) Strategic business risks (11%) Compliance/regulatory risks (15%)(Source: Q49, n 2,712) Percentage of Respondents Selecting the SkillExhibit 3 Recruiting for Risk Management and Accounting Skills Compared to Organizational RiskMaturity55%50%48%46%45%43%40%39%39%Informal risk managementFormal risk management35%34%30%25%No risk management processesAccountingRisk management assuranceNote: Q30: What skills are you recruiting or building the most in your internal audit department? (Choose up to five.) CAEs only.Compared to Q58: What is your organization’s level of development for its risk management processes? CAEs only. n 2,709.4 The Top 7 Skills CAEs Want
Percentage of Respondents Selecting the SkillExhibit 4 Recruiting for IT Skills Compared to Internal Audit Department 6%25%1 to 34 to 910 to 2425 to 49Size of internal audit departmentInformation technology (general)50 or moreData mining and analyticsNote: Q30: What skills are you recruiting or building the most in your internal audit department? (Choose up to five.) CAEs only.n 3,184.Percentage of Respondents Selecting the SkillExhibit 5 Recruiting for Industry Knowledge Compared to Internal Audit Department Size55%50%45%40%40%37%35%35%34%35%30%25%1 to 34 to 910 to 2425 to 49Size of internal audit department50 or moreIndustry-specific knowledgeNote: Q30: What skills are you recruiting or building the most in your internal audit department? (Choose up to five.) CAEs only.n 3,184.www.theiia.org/goto/CBOK 5
Industry knowledge is essential to properly addressthese risk areas. These areas require not only specific technical skills but also the communication skills needed toengage and facilitate industry-specific discussions withmanagement. Critical thinking skills are also needed toconnect the dots across an organization’s unique processesto solve governance, risk, and control issues that couldprevent the organization from achieving its objectives.Section 3: Regional Insights—Recognizing DifferencesEach region of the world has unique and interestingdifferences in the skills CAEs say they are recruitingfor or building into their internal audit departments.Exhibit 6 shows how CAEs in each region prioritize theskills. This view is also helpful if an organization worksacross regions. Some of the interesting differences are:1. Analytical/critical thinkingThis skill is in high demand in all areas of the world.2. CommunicationThis skill ranks particularly high in China, Taiwan,& Hong Kong (66%), making it and East Asia theonly regions where communication ranks higher thananalytical/critical thinking.3. AccountingThe responses range broadly with highs above 60%(Southeast Asia and China, Taiwan, & Hong Kong) andlows approaching 30% (North America, Europe, andPacific).4. Risk management assuranceThe highest priority is in Pacific (61%) and Sub-SaharanAfrica (57%) and the lowest is North America (28%).5. Information technology (General)Rankings for IT skills are fairly similar across regions (36%to 47%), with the exception of a particularly low percentage (21%) in China, Taiwan, & Hong Kong.6 The Top 7 Skills CAEs Want6. Industry-specific knowledgeIndustry-specific knowledge is sought out the most inNorth America (43%) and Middle East & North Africa(41%) and the least in Sub-Saharan Africa (20%).7. Data mining and analyticsNorth America puts a substantially higher priority on datamining and analytics than other regions (48% in NorthAmerica compared to most regions at around 30%).Note: Exhibit 6 shows subregions for Asia & Pacific ratherthan the region average due to large variances in thesubregions.Section 4: Personal Perspective froma CAE in the Banking IndustryRestiana Linggadjaya, CIA, CRMA, is the CAE of BankCIMB Niaga, one of the largest banks in Indonesia.Similar to others in her region, she places a high priorityon risk management assurance skills. In addition, she saysbusiness acumen is also a technical skill that is in greaterdemand than accounting, given the need to understandthe business and look at the impact of the global economyon the bank and its clients.IT skills and business understanding must worktogether, she notes. Data mining, analytics, and othertechnical skills are very important, but the staff mustunderstand business and its processes to make the best useof data mining and analytics.IT is another important technical skill for her industry,given the bank’s overwhelming reliance on IT systems. Heraudit plan devotes 16% of the time to IT audits, which isdouble the global average of 8% reported in the CBOK2015 practitioner survey (Q49, n 2,712).Training Current StaffGood auditors are very difficult to find, says Linggadjaya,so most CAEs need to groom staff through managementtraining and exposure to key business managers. She hasa practice of asking business managers to tell audit staffabout their expectations for value-added audit servicesfrom internal audit.
North AmericaSouth AsiaEuropePacific (Australia, NewZealand, & Pacific islands)Southeast AsiaLatin America &CaribbeanSub-Saharan AfricaChina, Taiwan, Hong KongMiddle East & North AfricaEast Asia (Japan & Korea)Exhibit 6 Skills CAEs Want (Respondents Chose Their Top Five Priorities) (Regional 45%4Risk Information 41%39%7Data mining s acumen39%26%20%48%31%28%22%12%28%36%9Fraud 3%32%13%21%24%24%25%30%6%11Forensics rsecurity andprivacy25%16%11%10%5%14%10%12%10%7%13Legal knowledge2%5%15%5%6%13%4%24%10%31%14Quality controls (SixSigma; 6%4%RankSkillsNote: Q30: What skills are you recruiting or building the most in your internal audit department? (Choose up to five.) CAEs only.The exhibit shows the percentage of respondents selecting each skill. The exhibit shows the subregions for Asia & Pacific ratherthan the Asia & Pacific average due to large variances in the subregions. n 3,239.www.theiia.org/goto/CBOK 7
Screening New Hires For recruiting, her human resources (HR) department usesassessment tools to measure analytical skills and then looksclosely at the results. The audit function interviews potential hires with a panel of three to provide a balanced reviewof the interviewee’s responses. There is a 10% passing ratefrom candidate application to hiring offer.When choosing her direct reports, Linggadjaya is generally looking for leadership and management skills. For newstaff, their “learning ability” is important. Interviews areused to see whether candidates are open-minded and willing to learn as demonstrated by their spare-time activities. Service PhilosophySuccessful auditors wear two hats—one as an internalauditor and the other as a partner for the business, lookingat the business and its processes, says Linggadjaya. When itcomes to delivering on the internal audit function’s mandate, she says staff need to challenge the bank’s policiesusing their critical thinking skills, not just checking offcompliance with policies.Internal auditors need to address problems and findsolutions. For IT, they need to be involved early with newprojects to add value before systems are built and rolledout. By being a business partner and not the audit police,audit staff are able to elicit insights and concerns from thebusiness.Internal auditors need to review whether the internalcontrol processes are adequate and operating effectively tomitigate the risks derived in the key processes of the business. Linggadjaya says her organization has a great auditcommittee chair that drives the expectations for a highlyconsultative internal audit function. By developing skillson staff and focusing on service to management and theboard, internal audit at Bank CIMB Niaga is constantlyimproving services to its organization.Section 5: Talent ManagementStrategiesThe best way to recruit and build the skills needed on staffis to have a well-planned talent management strategy. Itshould include the following elements:8 The Top 7 Skills CAEs Want Assessment of needsRecruiting planTraining and development programCo-sourcing and outsourcing (as appropriate)Assessment of NeedsThe assessment of needs should look at skills comparedto the organization’s current or future strategies and risks,not just compared to the existing audit plan. Too oftenauditors assess skills against their existing audit plan andnot against the key risks of the organization. In theorythe audit plan reflects those risks, but many internal auditgroups do not cover strategic risks. In fact, 50% of surveyrespondents describe their level of activity for strategyreviews as “minimal” or “none” (Q72, n 2,554). A consideration of organizational strategy and risks needs to beat the center of all internal audit processes, including thetalent management strategy.An excellent resource for talent management is TheIIA’s new Practice Guide, Talent Management: Recruiting,Developing, Motivating, and Retaining Great TeamMembers (released December 2015).Remember that generational differences should be takeninto consideration for your talent management strategies.A good resource for understanding this from the internalaudit point of view is the CBOK report titled GREATWays to Motivate Your Staff by Bruce Turner of Australia(available for download at www.theiia.org/goto/CBOK).Recruiting Plan—Diverse BackgroundsThe relatively narrow recruiting of accounting, auditing,and finance majors can handicap an organization’s abilityto bring in candidates with the top skills CAEs need. TheCBOK report Mapping Your Career explores differencesbetween respondents with different educational backgrounds. (CBOK reports are available for download atwww.theiia.org/goto/CBOK.) The analysis shows thatrespondents with majors other than accounting, internalauditing, and finance tend to have higher self-assessmentsfor critical thinking and communication than those withother majors. The respondents with the highest averageself-assessment scores majored in business, external auditing, and economics (see exhibit 7).
Exhibit 7 Academic Majors Compared to Competency Self-AssessmentsAverage RatingCritical .04Auditing - 73.804.00Computer science3.743.803.95Other science 653.88Arts or humanities3.673.684.05Auditing - c Majors or Fields of StudyNote: Q79-Q88: Estimate your proficiency for each competency using the following scale: 1-Novice; 2-Trained; 3-Competent;4-Advanced; 5-Expert. Compared to Q5a: What were your academic major(s) or your most significant fields of study? (Choose allthat apply.) This exhibit was originally published in the CBOK 2015 report Mapping Your Career by James Rose, available at www.theiia/goto/CBOK. n 10,176 to 11,130.Recruiting Plan—Behavioral InterviewsCAEs can improve their hiring choices by implementingbehavioral interviews and being open-minded to applicants with diverse backgrounds. Behavioral interviewsare a good way to improve the chances of identifying keytalent with a critical skillset.CAEs should ensure that interviewers are trained inconducting behavioral or competency-based interviews, asappropriate. Such interviews use questions that ask aboutexperiences resembling real-life situations that a potentialauditor will face in his or her role.For example, to evaluate analytical/critical thinkingskills, an interviewer may ask: Describe a situation where you had to analyze acomplex business process you had not encountered before, identify the key risks, and evaluatethe control points. Describe the most complex root cause analysisyou have conducted. What was your role andwhat was the outcome?To evaluate communication skills, an interviewer mayask: Describe a situation where you had to write aone- to three-page memo on a complex subject. Describe a situation where you had to deliver adifficult message. What occurred and what wasthe outcome?In some organizations, the HR department or external HR consultancies can supply behavioral assessmentsthat help identify candidates’ strengths and weaknessesas part of the interview and selection process. Some ofthese assessments evaluate areas such as assertiveness andself-confidence, persuasiveness and an outgoing nature,www.theiia.org/goto/CBOK 9
urgency and intensity, and precision and self-discipline.Given that these types of assessments focus on the evaluation of personal versus technical skills, they can greatlyenhance a CAE’s ability to find the critical thinking andcommunication skills needed.If a candidate lacks technical or personal skills, the CAEshould be able to fill in the gaps with development andtraining for internal audit staff. However, survey resultsindicate this is an area that is not fully developed in manyinternal audit functions.Globally, only a little more than half of CAEs surveyedsay that the training program for internal auditors attheir organization is “structured and documented.” Therest say their programs are “ad hoc or not developed” (seeexhibit 8). The responses are fairly similar across regionsexcept for North America, which is significantly lower forhaving a structured and documented training program(only 40%).Of those functions with training programs, only 30%include training on critical thinking skills (see exhibit 9).Given the difficulty in finding quality audit staff, CAEsmust invest in the development programs necessary toenhance critical personal and technical skills. While CAEscan encourage each staff member to “invest in yourself,”CAEs cannot depend on staff to fill the skills gap on theirown. CAE leadership requires a mix of coaching and support for formal training.CAEs can obtain resources for training through IIAGlobal or their local institutes. Opportunities are availablethrough online webinars, chapter meetings, conferences,and seminars where the key personal and technical skills indemand by CAEs are addressed. Some IIA organizationsoffer courses in analytical/critical thinking and communication that are especially geared toward internal audit.Exhibit 8 Structured and Documented InternalAudit Training Programs in PlaceExhibit 9 Elements Included in Internal AuditTraining ProgramsTraining and Development Program80%South Asia55%Middle East& North Africa53%East Asia& age0%47%10%20%30%40%50%60%Note: Q45: What is the level of formalization for the trainingprogram for internal audit at your organization? CAEs only.Response options were “structured and documented” or “notdeveloped or ad hoc.” n 2,866. 53%40%47%Latin America& pe0%70%The Top 7 Skills CAEs WantInternalauditskillsOrientation Businessfor new skillsNote: Q46: What is included in the training program for internalaudit? (Choose all that apply.) CAEs only. n 3,134.
Rotational ProgramsCo-Sourcing and OutsourcingRotational programs are another way to expand audit staffabilities—essentially stretching and building new skills innew areas. While broader business acumen and technicalskills are an obvious benefit, the required analysis andcommunication in the new role is just as essential andvaluable. CAEs should consider rotating career auditorsout to line assignments and accepting line staff into theinternal audit function for equivalent periods to helpbroaden business acumen, risk management assurance,and critical thinking.These are just some of the examples of skills developedduring such rotations. CAEs should be looking to maximize every team member’s communication and analytical/critical thinking skills through a mix of deliberate trainingprograms and on-the-job feedback and coaching.A good talent management strategy may also includeco-sourcing or outsourcing some skills. For example,co-sourcing or outsourcing can be the best choice to fillshort-term skill gaps or long-term, highly specialized,limited-need skills. An average of 38% of respondentsworldwide say they use third parties for some of theirinternal audit activities, according to the CBOK reporttitled Engaging Third Parties for Internal Audit Activities(see exhibit 10). On average, these organizations use thirdparties for about 23% of their activity (see exhibit 11).Third-party services can be used to: Exhibit 10 Use of Third Parties for Internal AuditActivityNorthAmerica56%Middle East& North Africa39%Middle East& North Africa36%East Asia& Pacific40%38%EuropeExhibit 11 Average Percentage of ActivityPerformed by Third Parties (Among Those WhoUse Third Parties)South Asia43%South AsiaProvide specialty skills not available in theinternal audit departmentSolve staff shortagesSupplement staff on an ongoing basisCover remote business locationsPerform special projects30%NorthAmerica21%East Asia& Pacific30%Sub-SaharanAfrica21%Latin America& Caribbean29%Latin America& balAverage38%10%20%17%Europe30%40%50%60%Note: Q31: In the previous calendar year, were some of yourorganization’s internal audit activities provided by a third party(either internal or external to your organization)? CAEs only.n 3,125.0%23%10%20%30%40%Note: Q31a: What percentage of your organization’s internalaudit activities were performed by a third party in thepast calendar year? This question was only answered byrespondents who indicated earlier that they use third-partyservices for internal audit activity. n 1,122.www.theiia.org/goto/CBOK 11
ConclusionAnalytical/critical thinking and communication are thetwo skills CAEs put at the top of their search list. Theseare important skills that improve with age and experience(see exhibit 12), but they can often be harder to teach thanto hire. Therefore, behavioral interviewing and other formsof assessment should take precedence over technical skillsassessment to ensure the long-term success of internalaudit functions.In addition, CAEs need to cast a wide net when hiringand look at diverse academic backgrounds and experiencesto find entrants to the profession who can deliver value onday one. Finally, deliberate talent management plans needto be developed and executed to balance recruiting withongoing staff development and co-sourcing/outsourcingstrategies.Exhibit 12 Critical Thinking and CommunicationSkills (Self-Assessed as Expert)40%35%30% 29%30%20%36%21% 20%10%0%Millenials(ages 19-34)Generation X(ages 35-50)CommunicationBaby Boomers(ages 51-69)Critical ThinkingNote: Q84, Q86: Estimate your proficiency for eachcompetency using the following scale: 1-Novice; 2-Trained;3-Competent; 4-Advanced; 5-Expert. Q84 (communication)components were: verbal, written, and listeningcommunication. Q86 (critical thinking) components were: datatools, data analysis, problem-solving, and understanding ofbusiness. n 10,069.12 The Top 7 Skills CAEs Want
Appendix AExhibit A1 The IIA Global Internal Audit Competency Framework (Structure Overview)IMPROVEMENT AND INNOVATIONINTERNAL AUDIT DELIVERYPERSONAL SKILLSCommunicationPersuasion and CollaborationCritical ThinkingTECHNICAL EXPERTISEIPPFGovernance, Risk, and ControlBusiness AcumenINTERNAL AUDIT MANAGEMENTPROFESSIONAL ETHICSSource: The Institute of Internal Auditors, 2013. Used by permission. For more information, visit iting/Pages/Competency-Framework.aspx. IPPF refers to The IIA’s InternationalProfessional Practices Framework.Competency ResourcesThe IIA offers a variety of free resources to help practitioners and managers assess and improve internal auditcompetencies for themselves and their staffs. Theseresources include:The Global Internal Audit Competency Framework.The complete framework is available as a free e IIA’s Career Map Tool. This interactive programprovides IIA members with a free self-assessment of theirpersonal competencies along with a customized listing ofresources they can use to target areas for /Career-Map.aspx)Mapping Your Career, a CBOK 2015 PractitionerReport (by James Rose). Using data from a global surveyof internal audit practitioners, this report gives perspectiveon the impact of education, training, and experience oncompetency confidence. esource-Library.aspx)www.theiia.org/goto/CBOK 13
About the Project TeamAbout the AuthorJames Rose, CIA, CRMA, CPA, CISA, CHC, has held audit and consulting roles inthe federal government as a foreign serv
1 The IIA's 2013 Global Pulse of Internal Audit survey (n 1,907). The IIA's 2016 North America Pulse of Internal Audit survey (Q27). 2 For an overview of The IIA Global Internal Audit Competency Framework, please see appendix A. Exhibit 1 The 7 Skills CAEs Want Personal Skills 1. Analytical/critical thinking 2. Communication
