About the SCIIA


What are the skill sets and staffing needs of an internal audit activity?

A broad range of skills and expertise, and ongoing professional development are critical to the formation and maintenance of an effective internal audit activity. Essential elements include in-depth knowledge of the organization's industry and internal audit Standards and best practices; technical understanding and expertise; knowledge on, skills for implementing and improving processes in both financial and operational areas; strong communication and presentation skills, and professional certification, e.g. CIA.

Although some co-sourcing and outsourcing might be necessary when unique competencies and specialty skills are not affordable or available, the oversight and responsibility for the internal audit activity cannot be outsourced.

Today's internal auditors must provide to their audit committees explicit assurance on organizational governance, as well as meet ever-increasing demands of management and other stakeholders. They must excel as internal control and risk management experts to ensure the controls over key systems and business processes are robust and effective. To meet these high expectations, a solid staffing strategy is essential. It is the responsibility of the Chief Audit Executive (CAE) to establish an effective program for selecting and developing the internal audit team.

The skill mix, depth, and size of the audit team should be determined by the services expected by the audit committee and management in order to meet organizational needs. The resulting audit plan should be based on an assessment and ranking of risks, critical systems, and processes across the organization, and should consider the organization's long-term business objectives, expansion plans, and growth strategies; as well as short-term changes in the control environment such as M&A activities, major system implementations, and reengineering of business processes.

The maturity of the control environment, level of management accountability, and extent to which the organization depends on internal auditing to drive improvements will affect the resourcing outcome. Benchmarking against comparable organizations can provide useful insights into appropriate staffing.

When staffing an internal audit activity, management s options include:

  • Establishing a dedicated audit team with requisite resources.
  • Cosourcing, by which an external provider supports the CAE and the dedicated audit team with supplementary specialist skills that might be too costly to maintain in-house. This option affords flexibility that enables the team to upsize or downsize according to the needs of the business.
  • Maintaining a dedicated audit team. supported by rotations that provide the opportunity for business-unit personnel to gain valuable, broad-based knowledge of the business as well as education on issues regarding internal control and risk management. In some Fortune 1000 companies, an internal audit assignment is a pre-requisite for senior financial or general management positions.
  • Outsourcing the internal audit activity to an external provider. This option may be cost-effective for smaller organizations, geographically dispersed entities, or organizations with specific technical expertise. NOTE: The IIA believes the internal audit activity should never be fully outsourced, but should be managed from within the organization, preferably by a competent CAE.

The staffing option taken should result in an internal audit team that possesses the skills necessary to meet the group s objectives. Ideally, the audit activity should comprise individuals with diverse backgrounds, skill sets, and experience to provide adequate control assurance to support the business on a broad range of risk and internal control matters.

Increasingly internal audit activities are performed by multi-disciplinary teams that include engineers, accountants, management graduates, and even environmental specialists who reflect a broad range of today s assurance needs. Also, information technology audit experts are a core component of modern-day internal audit activities. It very well might not be possible to accommodate all the requisite technical skills in-house. Therefore, the CAE should be empowered to obtain assistance and support from experts outside the organization as needed.

Control self assessment, facilitation, and risk and internal-control training are increasingly falling under the purview of internal auditors. As such, to be their most effective, they must demonstrate:

  • Strong interpersonal skills.
  • Effective oral and written communications skills.
  • Good coaching and group leadership skills.
  • The ability to influence at all levels.

An annual review of the staffing strategy by the CAE should be based on defined parameters such as the audit committee's assurance needs, management's expectations, business growth and strategies, dispersion of operations, achievement of audit objectives, compliance to regulations, and staff turnover. The CAE should assess the skills and requirements of team members and promote continuing professional development to maintain professional designations and enhance knowledge, skills, and competencies in all relevant areas.

Not having adequate and competent staff in the internal audit activity is a risk that exposes the organization to inadequate evaluation of the effectiveness of risk management, control, and governance processes.

Finally, The IIA's Certified Internal Auditor® (CIA) is the only globally accepted certification for internal auditors and remains the standard by which individuals demonstrate their competence and professionalism in the internal audit field. The IIA also offers several specialty certification programs, including the Certification in Control Self Assessment (CCSA); the Certified Government Auditing Professional (CGAP); and the Certified Financial Services Auditor (CFSA). ISACA offers the Certified Information Systems Auditor (CISA) certification; the Association of Certified Fraud Examiners offers the Certified Fraud Examiner (CFE) certification; and the Board of Environmental, Health and Safety Auditor Certifications (BEAC) offer the Certified Professional Environmental Auditor (CPEA).

References:

  1. 20 Questions Directors should ask about Internal Audit. The IIA Research Foundation.
  2. Internal Auditor, Oct 03. Staffing today's internal audit function: audit executives need a realistic strategy for obtaining top talent to handle growing demands. Paul McDonald.
  3. The Professional Practices Framework January 2004: The IIA Research Foundation.
  4. Guide to Internal Audit - Frequently Asked Questions about the NYSE Requirements and Developing an Effective Internal Audit Function" Protiviti 2004

Source: http://www.theiia.org/theiia/about-the-profession/internal-audit-faqs/?i=1087

- back to About the SCIIA