Internal audit competencies and the gaps that exist

Assessed internal audit competencies are highly relevant and provide practitioners with a firm foundation to support organizations in achieving their strategic objectives.

Survey respondents perceived all 28 competencies within the framework as being more than moderately relevant, with all competencies receiving an average relevance score of 3.3 or greater. Moreover, 75% of the assessed competencies were viewed as being highly relevant. In terms of competency ratings, nearly 40% of the core areas were perceived to be advanced, suggesting that internal audit organizations have built a strong foundation for providing high-quality insights in areas that are essential to the business.

Across all regions, professionalism competencies (individual objectivity and ethical behavior) were rated 4.1 or higher in both relevance and competence. It was also found that the certified respondents reported higher overall competence in each of the four knowledge areas in the framework highlighting the value of obtaining certification in the profession.

Competency levels for critical technologies and emerging risks do not align with the perceived relevance of these areas for adding value to the organization.

Despite the criticality of digital technologies, many auditors do not believe they have the skills needed to provide effective assurance and advisory services in these areas. This misalignment can be quantified as a “competency gap” i.e., the difference between the respondent’s competency level in a specific knowledge area and the perceived relevance of that area to their duties. Survey findings revealed competency gaps in the technology areas of information technology control frameworks, data analytics, security and privacy, agile auditing methodologies, and areas of fraud assessment and investigation and risk management.

As new risks emerge and businesses turn to new technologies and methodologies to help them adapt to a rapidly changing environment, the internal audit function must keep pace. If internal auditors do not continuously evolve their capabilities, the internal audit function risks not being able to fulfill its mission.

Resource allocations need to remain adequate in core knowledge areas where internal auditors already have a high degree of competency.

The survey found that large resource gaps exist in five core knowledge areas that are perceived to be highly relevant to an internal audit function’s ability to add value to the business—risk management, internal control, communications (including soft skills, relationship building, and reporting), organizational independence, and due professional care.

If resource shortages in terms of training, talent development, and staffing continue, an organization risks not being able to evolve. It could reach a plateau or even backsliding in areas that were once viewed as a bedrock of competency and integrity. It should begin by prioritizing resource allocation toward the largest critical competency gaps.

Auditing emerging or innovative knowledge areas should be a priority.

The survey also focused on assessing the profession’s capacity to audit six emerging/ innovative areas—business continuity and crisis management, dynamic risk assessment, cybersecurity, extended enterprise risk management (EERM), cloud and virtual computing environments, and disruptive technologies—that are becoming increasingly important. Survey findings show internal audit functions are least equipped to audit cloud and virtual computing environments and disruptive technologies. Further analysis of responses indicated that only 38% of those leading internal audit functions felt their staff had the skills and capabilities to audit more than three of these innovative and emerging areas.

Organizations should identify competencies that are necessary to perform those audits and assess if the function has those skills or if they need to be acquired through training.

Digital maturation remains slow, allowing internal auditors to advocate for change by articulating the value they could add if adequately enabled by technology.

The survey also explored the state of innovation within internal audit functions by asking respondents to rate the maturity of their methodologies, tools, and processes of agile auditing, analytics, process automation, and cybersecurity. While 15% of respondents reported their functions have no innovation programs, of those that do have programs, 62% indicated their capabilities are foundational or below. This delay in exploring state-of-the-art tools and techniques could affect their ability to keep pace with digitalization in other areas of the business. It also suggests that many functions may not be fully leveraging the skills of their highly trained audit professionals, because they have not made significant strides in digitalization.

It is an opportunity for internal audit professionals to advocate for change by communicating with their CAEs and articulating the value they could add if adequately enabled by digital technology. More tenured audit professionals also have an opportunity to move their functions forward by raising the bar on the digital proficiencies expected among new hires.