Internal audit careers 2020: tools for tomorrow

Internal auditors have always had to adapt to changing circumstances and risks to deliver the levels of assurance required by their organisations. But as we move into a new decade – a period in which there will probably be an even greater shift towards using emerging technologies to help the audit process, and when long-term risks such as climate change and business resilience will move up the board’s agenda – what skills, expertise and experience
will internal auditors need to meet management expectations and keep their profession relevant?

First, we often hear that technology and technological skills are the key to the future. It’s therefore not surprising that auditors with technological experience are a scarce commodity in some industries. Russell Bunker, director of the internal audit team at recruitment agency Barclay Simpson, confirms that subject matter expertise and IT audit skills are currently in high demand among employers. And, because demand outstrips supply, organisations that require auditors with very specific skills – such as niche industry or product knowledge, or technical expertise in areas such as cyber or cloud auditing – may need to be patient when hiring, he warns.

“This year we have seen numerous employers looking for auditors with change or project assurance experience, particularly in digitisation, large-scale IT transformations and migration to cloud,” Bunker says. “In some parts of the country there is a shortage of suitable candidates with these skills and employers have had to wait more than six months to find the right person.”

However, IT proficiency or technical expertise alone is not a golden ticket for a glowing career in internal audit. Heads of internal audit want candidates with a solid grounding in the basics, but who are also comfortable engaging with, and working more closely and more regularly with, management and the rest of the business. “Traditional internal audit skills are highly valued, but employers are looking for people with strong communication and stakeholder management skills as well,” Bunker says.

Building on the basics

Whatever technological developments emerge over the coming decade, the profession’s core skillset is likely to remain the bedrock of any future internal audit function. Alistair Smith, UK internal audit, risk and control director at EDF Energy, says that “the traditional audit skills around understanding business risks, how internal controls work, how to set up a review and report writing are still going to be the mainstay of any auditor’s workload.”

Liz Sandwith, chief professional practice adviser at the Chartered IIA, agrees that “the profession’s traditional core skills will still be the most important aspect of any internal auditor’s job, the foundation on which everything else we do is built”. But she thinks that internal auditors will need to be “faster, sharper and more efficient” to provide the assurance that managers and executives expect in an ever-changing environment. Some of this change will come through technology, she says, but mainly it will require internal audit developing better ways of working.

“The days when internal audit could pencil in a request for an audit review in three months’ time, take four days to do it, and then produce a report a few weeks later are well and truly over,” Sandwith says. “The function needs to be much more flexible and adaptable than that, which means that internal auditors need to be able to react to new events quickly and switch priorities to suit the needs of the business.”

She also believes that internal auditors need to be more forward-looking and innovative. “Internal audit methodologies in some organisations have not changed much in 20 years, but if internal auditors don’t innovate or stay relevant, they will become obsolete. The profession needs to find ways to work faster and to be more alert to what is going on around it.”

In particular, she says, auditors need to be more proactive and take a much wider view of business risk, such as looking at corporate governance failures in other organisations and sectors and asking whether their own organisations could face the same, or similar, problems. “Internal auditors can’t sit back and wait for management to ask them to carry out a review,” she says. “They need to look at what is happening in the wider world and let managers know if the risks, problems or circumstances that occurred at another company could hit them with a similar – or worse – impact.”

In search of personality

This may be why, in addition to looking for highly technical specialists, employers are also willing to pay a premium to find “all-rounders” who can learn quickly and adapt. Helen Dodds, manager at recruitment agency Sellick Partnership, says that “the technical ability of internal audit candidates is now a given. It rarely makes a candidate stand out from the crowd.”

Businesses expect candidates to have excellent reporting knowledge, the ability to manage conflicting deadlines and the ability to understand businesses and identify key risks. What now marks some out is the additional skills and attributes that distinguish them – generally soft skills and “personality”, Dodd says.

“I look for internal audit candidates who exhibit curiosity and scepticism,” she says. “In today’s climate, where anything can happen, auditors need to be on high alert and have the confidence to question something that looks out of place. Curious candidates will question everything and this enables them to highlight any mistakes caused by neglect, fraudulent activity or human error.”

Smith also believes that soft skills and a broad outlook will become ever more crucial. “IT expertise and technical skills will always be important, but internal audit functions will always need a mix of skills, expertise and experience,” he says. “I am very much in favour of bringing internal auditors into my team with varied backgrounds – from different industry sectors, from large audit firms and from other areas of the business – because it helps to keep the function fresh and dynamic. Audit needs to help the business succeed, so being commercially aware is important, as is the ability to listen, understand, engage and make practical recommendations quickly.”

Spot the difference

While specialist IT audit skills are going to remain in high demand as boards seek assurance around developing cyber and cloud risks, non-specialist internal auditors also need to be confident using technology and to understand its potential and what it can offer auditors, as new technologies – particularly data analytics – become increasingly embedded in the audit function’s work.

  “Emerging technologies will enable us to become more forward-thinking and change the way we work so we can use our time more efficiently and effectively and focus on new areas such as climate change risk and resilience,” Smith says. “We need to think seriously about areas where we can become more active and how we might be able to use our skills, expertise and resources differently to help the business achieve its goals.”

Sandwith agrees. “New technologies such as artificial intelligence and data analytics are going to do a lot of the “down in the weeds” work that internal audit currently does, such as testing, so internal auditors will need to work more closely – and more frequently – with other parts of the business and have more face-time with managers. As a result, they will need good communication skills and to really understand the business they work in, the market sector that the business sits in and the geographical, territorial, legislative and regulatory challenges. They will also need good business acumen, and be prepared to challenge management on the spot and be ready to come up with possible solutions and practical advice.”

Communication also tops Dodds’ list of must-have skills in outstanding candidates. “Internal auditors have to be able to relay very technical information to various stakeholders, so they need to be able to communicate this information effectively,” she says. “Candidates that do not have excellent communication skills are unlikely to progress in practice.”

Beyond the ‘audit perimeter’

The profession also needs to “upskill” – principally by getting more business experience and by developing these soft skills further. Gregory Grocholski, a former chairman of ISACA and currently an adviser to the chief audit executive at Saudi Arabian manufacturer SABIC, cites the need for auditors to have technical dexterity and constantly to enhance their skills and experience.

“Simply put, the essential component to building a successful career in the future is the agility and urgency you apply to enhancing every skill you possess,” he says. One way of doing this is to accumulate more functional and business knowledge through rotational assignments. “It is one thing to speak casually about a process – it is vastly different when internal audit staff can clearly articulate insights gained from their total audit and business/functional experience combined,” he says.

Grocholski believes that auditors should be “data explorers” who can work comfortably with data to find patterns and anomalies and then analyse this data to provide conclusions and critical insights. He adds that auditors need to go beyond the “audit perimeter”.

“You have collected the data, completed the audit assignment, distributed the audit report, and appended tremendous knowledge to your base,” he says. “Now you must take that knowledge and sit with management to talk about the other things you noticed in the process, including data that were not necessarily control-related, but which could provide you with additional insights, such as margin performance, asset life-cycle data points or customer change order patterns. The next skill to possess is the ‘go beyond’ skill that comes from rotational experience and having the digital repertoire that enables you to do more with it.”

The demand for internal auditors and for the support and assurance internal audit provides is currently strong, but internal auditors cannot rest on their laurels. If employers do not find auditors who offer the skills and expertise they need, they will look elsewhere. Internal auditors need a whole box of traditional, soft and technological tools to rise to new challenges and offer the support that is so badly needed. The skills for audit in the 2020s should not be taken for granted. As Grocholski warns, the future of internal audit “really is a case of staying relevant or fading into obscurity”.

For more about Chartered IIA training courses visit charterediia.uk/training

The Chartered IIA resources web pages have been restructured to provide more relevant and accessible information. Visit charterediia.uk/resources for details.

The institute also has a dedicated jobs site where you can search for a new job, scan vacancies and register for alerts.
Visit jobs.iia.org.uk for details.

This article was first published in January 2020.