Skills for the future – the times they are a-changin'
As IIA Global brings in new Global Internal Audit Standards, which will underpin the function’s professional practice for the foreseeable future, this is a great time to think deeply about how the internal audit function – and internal auditors – are developing. What challenges are emerging and what will they be asked to do more of tomorrow, and the day after, and the day after that?
The world has changed dramatically in recent years and internal audit has had to pivot and adapt as much as the organisations it serves. But the pace of change is not slowing. More is coming and the profession must be ready.
One significant change has been – and continues to be – in the way we work. The pandemic sent office workers online and now practices are diverging. Some employers (and employees) want people back in the office, citing team bonding, creativity, culture and the workplace experience as reasons to bring people together. Others are closing their city-centre offices, pointing to cost and carbon reductions, reduced travelling times, lower stress, individual autonomy and the miracles offered by technology as their vision of the future of corporate life.
Many are sitting on the fence, holding on to their offices, but changing their use and asking people to hybrid work. They may well shift further one way or the other in time.
Such decisions are affected by economics and the availability of talent. Some highly skilled people are refusing to return to full-time office life. At a time when talent is in short supply worldwide, they can choose an employer who allows them to lead the life they want, where they want it.
“Digital nomads” are taking advantage of the fact they can work from anywhere to travel, live better, more cheaply, or locate themselves near ski slopes or beaches. Others are happy to return to the office when necessary, but want to live nearer family, in a small town or in the country, so would strongly resist commuting to a city HQ for more than half their working week.
Older workers, in particular, have been reluctant to come back into the full-time workforce, although financial pressures are forcing some to return. Younger workers may benefit from cheaper houses away from cities and no commuting costs, but could miss out on social, training and development opportunities.
Academic and author on generational dynamics Dr Eliza Filby recently wrote that when it comes to working from home “for most companies, it is the lack of boundaries and confusion that is causing resentment on both sides… One leading retail company in Germany I spoke to is finding it almost impossible to grapple with diverse expectations; firstly, a tech team that aspires to be digital nomads, secondly, shop assistants complaining of unfair inflexibility, and finally, white-collar workers seeking bespoke arrangements.”
Internal audit managers therefore increasingly need the skills to create cohesive and effective teams from scattered individuals or groups. Pressures to operate flexible rolling planning cycles, map sources of assurance and provide real-time audit reports, plus additional consultancy work, are complicated by a need to assess and monitor how constant change is affecting culture and behaviour across their organisation. In addition, they are being asked to spot emerging risks caused by
future change.
Meanwhile, economic uncertainty, energy costs, geopolitical upheavals and changes to trade agreements post-Brexit are affecting supply chains and decisions about where organisations should base factories and stores. Do they need sources closer to home or near alternative transport hubs? Should they form partnerships with local suppliers or start their own subsidiary? Change breeds change – as large organisations scale down offices, the economic dynamic of city centres is shifting, affecting local businesses.
Then there are shifts created by sustainability imperatives. What does a commitment to reducing an organisation’s carbon footprint mean for its offices, logistics, distance from suppliers, and where it looks for staff? Solutions that made sense a few years ago may be catastrophically out of date today.
Such rapid changes in so many areas create challenges that many internal auditors have not seen before, or which have a new dimension – from technology to environmental, social and governance (ESG) and corporate culture. New technology may provide solutions to sustainability, communication, talent and supply chain issues, but it also creates different questions and risks.
Internal audit teams must therefore work with management to identify and mitigate changing risks, while also working in unfamiliar, still evolving ways. This requires them to look ahead to predict further shifts in their organisation’s environment, as well as planning their function’s development and how they upgrade their own skills.
So what do internal audit leaders and educators see as the critical areas for internal audit development? What skills will the profession need to face these challenges?
Technology
One element is technology. The future of the profession will be supported and enabled by technology and even the best internal auditor will not be able to provide the support that is needed without a good working knowledge of technology
and data.
Artificial intelligence (AI) will also become an increasingly important part of the normal internal audit toolkit – and the way the profession uses this is likely to develop fast, so those who ignore it will be left behind.
“When I’m looking to recruit into our team, I’m looking for familiarity with a range of tools, but I would definitely want experience using Power BI,” says Ed Wilton, audit director at Kingfisher, which won an Audit & Risk Outstanding Team award this year. “I would want to know how they have turned data into a story – raw data into information. And what changed as a result in the business – what did they find and what did they do about it?”
“Of course, IT skills will be essential,” agrees John Chesshire, who delivers assurance training and consultancy worldwide for organisations including NATO and the OECD, as well as training courses for the Chartered IIA and several other global IIA chapters. “Many internal auditors are still nervous about IT and we need to think more about how we recruit and train to address this. I am lucky to work in Estonia, Latvia and Lithuania among other places, and internal audit teams in these countries tend to be much more comfortable working with sophisticated IT systems and digitalised processes. Almost all core, customer-facing organisational processes are digitalised and many are cloud-based. We could learn from their example.”
Sustainability
Sustainability is an emerging challenge in itself and all organisations will require more skills in this area to meet developing standards and the demands of national net-zero commitments. Internal audit has a huge role to play in adding rigour to this process, according to Richard Brasher, former Vice-President of Audit and now Vice-President of Sustainability at LKQ Corporation.
“Lots of people are, understandably, passionate about sustainability, but not everyone has had the professional training to seek and use fact-based evidence in a way that internal auditors have. That’s what we can bring to sustainability. If your organisation says it’s reduced its carbon footprint by 10%, you need to know this is accurate. Internal auditors should be asking: ‘What was it before?’; ‘Where’s the evidence?’; ‘Where’s the data?’; ‘What are we recording and how are we recording it?’” he says.
“The rules and regulations around sustainability are developing and increasing all the time. Internal auditors need to understand how these are changing and ensure the organisation has identified and is recording the data it will need to report on sustainability issues – and be able to judge whether this data is fact-based, appropriately documented and auditable.”
“Human” skills
Increased use of technology creates ever more need for human skills – from communication and empathy to psychology. As more data analysis and assimilation is done by machines, managers must become better at valuing and nurturing creativity, ideas, questions, emotions and imagination.
Internal auditors have to understand human psychology and its impact on behavioural (and reputational) risks. To interact effectively with stakeholders at every level of the organisation, they must be able to manage human relationships skilfully and understand how to influence.
We need people who can recognise a trend in the distance and react to a hunch that this could become significant. They should ask “what would this mean for…” and “how will people react to…” long before the data exists for the machines to pick up and analyse. And their hunch could inform a decision to look at new sources of data or to ask different questions of the machines.
Katie Timms, Group Audit and Risk Director at Kingfisher, says she values curiosity more than technical experience. “I’m always looking for curious people. Curiosity leads to interest, passion, questioning. It’s less important where their expertise lies.”
Paul Wrafter, Head of Internal Audit at the Central Bank of Ireland, another Outstanding Team winner in this year’s A&R Awards, says that he now views internal audit staff planning through “various lenses”.
“When we hire, I’m looking more at where individuals want to go in future,” he says. “I want to know who I can partner people with to learn the skills they will need in three years’ time for the next stage in their journey. I need individuals who can get along with people and managers who are good at developing themselves and others and are willing to learn. It’s more important that team members have the people skills and personality than specific internal auditing skills. These can be taught if you have the right attitude.”
Systems thinking
Developing a “nose” for emerging risks and the ability to turn a hunch into a reasoned hypothesis requires a good understanding of people, but also a broad knowledge of world events. To gain this, internal auditors need to find and cultivate a network of sources, from contacts within and outside the profession, and news and analysis from across the world.
Technology has made it easier to source information from everywhere, but it has resulted in new risks of misinformation and manipulation, and of being swamped and unable to sift the useful from the irrelevant. Internal auditors must therefore be able to find, assimilate and assess information from a range of sources – and make judgments about its value.
“One of the big skills that we need now and will need even more in the future is ‘systems thinking’. It’s about joining the dots and using imagination to develop hypotheses and then creating tests to see whether these stand up,” says Sandro Boeri, President of the Chartered IIA UK and Ireland.
“We also need to think more about emerging risk management – if we can help internal auditors to become better systems thinkers and to apply these skills to identify emerging risks and what these could mean for our organisations then we will have done a great thing for our profession.”
Courage and scepticism
Forming a hypothesis and making a judgment may expose internal audit to conflict. The ability to navigate hostile reactions and influence people has always been important in internal audit, but it may become more so if internal auditors highlight emerging risks that do not yet appear significant to the board, or have implications that managers find unpalatable.
Chesshire therefore points to courage and scepticism as vital internal audit skills for today, and certainly for the future. “The revised Global Internal Audit Standards include a new Standard on courage, and I think this is vital. I’ve seen many internal auditors who are too nervous about putting their heads above the parapet and calling out things appropriately for fear of ‘rocking the boat’ or upsetting management.”
“There’s also a new Standard on professional scepticism and that’s vital too – just because someone says something, it doesn’t mean it’s true,” Chesshire adds. “That sounds obvious, but it’s easy to let things that we should investigate further slip, particularly if audit engagement budgets and time are tight. Internal auditors must always look for sufficient, reliable evidence and corroboration of what they
are told or shown.”
Development support from the Chartered IIA
Everybody who holds a designation from IIA Global or the Chartered IIA must complete and record 40 hours of continuing professional education each year (including two hours of ethics education).
Chartered IIA training courses
Technical guidance and reports
This article was published in November 2023.