Internal Audit Looks Beyond Finance for New Leadership

The evolution of internal audit from a function primarily concerned with financial risks to one that covers a broader array of risks is compelling companies to look for internal audit leaders with more diverse backgrounds and work experiences, who bring to the post a broader set of skills.

It's not uncommon these days for companies to pluck executives from operational units, IT, or other departments and turn them into audit executives.

In fact, a recent study by the Institute of Internal Auditors finds that 42 percent of chief audit executives in North America entered their current position from outside the internal audit profession. Only 20 percent of CAEs say they held prior management positions in accounting or finance. Of those who said they arrived at their current positions from outside of internal audit, more than half held prior positions in manufacturing, and nearly half had backgrounds in insurance, health services, and educational services. Roughly a third also had experience in the financial services or energy sectors.

As internal audit executives move beyond financial risks, many are finding it increasingly challenging to look at operational risks with the same skills sets and backgrounds, says Brian Christensen, executive vice president at Protiviti. “Boards and management are becoming more knowledgeable and more fluent on the broad topic of addressing risks, so they're looking to the chief audit executive to assist in assessing those risks,” he says. “That expands beyond financial reporting to operational areas.”

The demand for internal audit to examine operational risks drives the need for CAEs who have broader business experiences and can communicate effectively in the boardroom, says Emmett Lange, principal at internal audit services firm Sunera. “They need more highly tuned communication skills so they can provide more meaningful recommendations,” he says. “The chief auditor needs to know what will work and what will not work, so they need operational skills and the gravitas to effect change.”

It's a bit of a return to the days before the Sarbanes-Oxley Act, says Bill Watts, principal and internal audit services leader for Crowe Horwath. Companies back then expected internal audit to mind the bottom line more than the internal control structure, so operational experience was important. “Before Sarbanes-Oxley, you used to have many in the CAE role who were non-auditors,” he says. “When SOX came along, they didn't have the skill set or the understanding to manage that new paradigm.” So companies returned to accounting- and control-oriented individuals to lead internal audit, says Watts.

After clamping down on controls over the past decade, now companies are looking for a more balanced approach, agrees Chris Denver, a director for internal audit advisory firm Sunera. “Generally career auditors need to have more developed analytical skills,” he says. “They need to be able to derive valuable information out of data and communicate it back to the organization in an efficient fashion. Someone who's not a career auditor can really drive a fresh perspective to the organization.”

“The chief auditor needs to know what will work and what will not work, so they need operational skills and the gravitas to effect change.”

—Emmett Lange,

Principal,

Sunera

Been There, Done That

Bailey Jordan, a leader in Grant Thornton's GRC services unit, says someone coming from a functional area of the business is likely to be respected by those who will be audited because the audit leader knows what it's like in the trenches. “Someone coming out of the business is more likely to be able to be consultative,” he says. “They have the street smarts of someone who's been there and done that.”

Another plus, says Charlie Wright, vice president of internal audit at Devon Energy, is experience with the audit from the perspective of the functional managers whose work is being audited. Wright himself has had a dual career in auditing and in information technology, giving him perspective on the demands from both angles. “It helps to understand if you've been on the other side of the table what the business managers' expectations are, and what they're going through,” he says.

That doesn't mean a company is best served by appointing a CAE with no accounting or auditing savvy, says Rob Kastenschmidt, national leader of risk advisory services for McGladrey. “You can't ever have a CAE who lacks accounting familiarity or doesn't understand accounting concepts,” he says. “It's the language by which businesses talk within the company and with outside users. But having strong business function experience can trump a career solely in accounting,” he says.

Acknowledging the benefit, there are risks to beware when bringing in audit leaders from outside the traditional accounting and finance proving grounds, says Richard Chambers, president and CEO of IIA. “A lot of time these individuals don't bring a strong knowledge of risk management or internal controls,” he says. Even more worrisome, they may lack objectivity, he says, especially if they're serving in the CAE role as part of an executive development track where they expect to circulate out into the business in some leadership role in the future. “Just how objective can that individual be in that role if they know their future career assignment depends on the relationships they build?”

SKILLFUL INTERNAL AUDITORS

Below, the Institute of Internal Auditors describes what skills are required of a successful internal auditor:

Top 5 IA Skills Sought by Global Recruiters

The results of the 2012 Global Pulse of the Internal Audit Profession survey conducted

by The IIA's Audit Executive Center deliver dramatic confirmation of how much the

requisite skills for internal auditors have changed. Chief audit executives are no longer

lined up at the doors of their local universities to bid for newly minted accounting graduates.

Instead, today's internal audit job postings are apt to look for people with non-traditional

skills to fill vacant positions. Of the five most sought-after internal auditor skills by global

recruiters, only one covers a technical area:

1. Analytical and critical thinking (selected by 72 percent of respondents)

2. Communication skills (57 percent)

3. IT general skills (49 percent)

4. Risk management (49 percent)

5. Business acumen (43 percent)

Seven Secrets of Success

If internal auditors are to help improve the company, their most important capability may boil down

to understanding (and responding to) the reality that the world, and its companies, are changing

constantly and quickly as new risks can emerge virtually overnight. Given the pace and magnitude of

change, agility and flexibility are far from the only attributes leading audit executives seek. Other highly valued non-technical capabilities include the following:

1.Integrity

2.Relationship Building

3.Partnering

4.Communications

5.Teamwork

6.Diversity

7.Continuous Learning

Source: Institute of Internal Auditors.

Mark Lindig, CEO of GRC services firm Accume Partners, says he's less concerned about independence than auditors who are too rigid. “People coming from audit have a very deep sense that no conflicts of interest are allowable,” he says. “People coming from operations are more concerned with solving problems,” he says. “I don't think it's that black and white.” If either view is taken to its extreme, the internal audit function ultimately will be ineffective, he says. The key, he says, is for an effective audit committee to serve as the watchdog.

Jeff Browning, senior vice president and chief audit executive at Fiserv, says companies choosing someone from operations to run the audit function should be aware of what the audit leader doesn't know. “It's a steep learning curve from the governance perspective,” he says. “There's no wrong or right answer here. It gets back to what the company is looking for in the audit function.”

Jordan says companies choosing a CAE from outside of audit should take care to assure the audit function doesn't move too far into the direction of consultation, recommending improvements to the business to become more efficient or effective. “If you skew the audit plan to consulting versus compliance, there's a risk you might take your eye off the compliance assurance aspect,” he says.

Audit committee oversight is vital to assuring the chief audit executive strikes the right balance, says Stephen Shelton, vice president of internal audit at KBR Inc. Audit committees need to have regular communication, formally and informally, with the CAE to achieve such oversight, he says. “They need to ask probing questions so they can assure they have more than a peripheral understanding of the risks that are included in the internal audit plan, how it was developed, and what might not be in the plan but was considered,” he says.