Cangemi Perspectives: Skills for Internal Audit in 2018
Over the span of my career, I have read and published many research papers based on surveys of internal audit and GRC professionals. In 2015 I authored a paper called Staying a Step Ahead – Internal Audit’s Use of Technology which was led by the IIA’s Global Internal Audit Common Body of Knowledge (CBOK) and included one of the largest surveys with over 14,000 auditors worldwide.
In this paper I concluded that in every business sector, technologies are changing the way businesses operate—from adding productivity to creating disruptions that revolutionize existing business and create new business segments.
I also found that while internal audit use of technology in the audit process continued to grow, there was room for improvement. For example, the use of software tools for data mining had increased by 14% among survey respondents from 2006 to 2015. However, fewer than 4 out of 10 chief audit executives (CAEs) worldwide felt their departments’ use of technology was appropriate or better.
It is now 2018 and while technology skills are still critical to the profession, the 2018 Audit Team Trends Report by CaseWare Analytics shows that auditors must also have a number of other essential skills. The report, which has a finger on the pulse with a timely in-depth global survey of more than 800 auditors, is a must-read publication as it also includes opinions from six senior audit experts from various industries.
I will not recap the report (you should read it yourself!) instead I will share my views on a few key takeaways from the perspective of a former CAE who went into senior management.
The survey recognizes “the ever-changing business landscape is forcing internal audit teams to continuously find ways to stay relevant while adding value.” I can assure you that senior business managers need audit’s help in finding ways to add value and improve business processes.
The first section of the report discusses people and the structure of the “ideal audit team” and their “specific skillsets”. When I became a CAE, I focused on people as the key ingredient and product of internal audit functions. I later wrote the book Managing the Audit Function where I elaborated extensively on this basic building block.
The report has some excellent observations on the size of the function and some metrics on adding a CFE (Certified Fraud Examiner) to the team. I think the more critical ideas come from the skills suggestions. While specific audit, finance and IT related skills are essential (internal and/or outsourced), my experience has me recommending much more business acumen for internal audit and GRC teams.
In an attempt to grow their skills, many have turned to certifications. In my long career I have seen an explosion of certifications. These have great value, but I see too much focus on certifications versus actual business experience to better connect to the rest of the management team. I particularly like the comment made by Lenny Block, Vice-President of Internal Audit at Nasdaq:
“Auditors are like internal consultants, so one of their most important skills is critical thinking—understanding of the root causes, knowing how to connect the dots to the facts to determine what it all means at a high level.”
In your career and in your recruiting, look for people whose careers build on their understanding of business. P&L focus, return on capital and expense control through business process improvements are all components of good business acumen. Other skills I do not see mentioned enough but I think are critical include the ability to take calculated risks and creative thinking.
Skills related to the ability to work with data and analytics and use of new technology approaches are also critical and covered in the survey and discussions. I will bring some focus on this section in another blog.
My final skills recommendation is having the vision and creative drive to change the backwardly looking audit model—move from small samples to looking at entire populations of data. To achieve these objectives, you need a degree of risk-taking and an understanding of how to demonstrate that a share of the annual capital expenditure and/or expense investment budgets towards skills improvements and advanced technologies can be a big benefit to the organization.
Stay tuned to the CaseWare Analytics blog for more of my thoughts on GRC and audit management.
About Michael P. Cangemi
Michael P. Cangemi is a senior fellow at Rutgers University and serves on the Rutgers Continuous Auditing and Reporting Lab Advisory Board. A former CFO and CEO, a prolific writer, active speaker and senior advisor to various companies, Mr. Cangemi now focuses on providing continuous auditing, continuous monitoring and analytics intelligence for GRC, Finance and Business Process Improvements. He also serves on FEI’s Committee on Finance & Technology (CFIT) and their GRC Sub Committee; the EDPACS Editorial Advisory Board; and the ISACA Governance Committee.