H.5 Internal Audit Core Competencies by Position Reference

Audit  Manager

Thought Leadership

Champions independent thinking and calculated risk taking by challenging the status quo (both in terms of business processes/decisions and the methods audit employs) and accepting occasional setbacks and failures for long-term goals. Steps up to extremely challenging tasks and recognizes mistakes as a learning opportunity. Actions provide catalyst for management/others to view risk and controls in a different light.

• Recommends elimination of a low value or duplicative control activity.

• Stops an audit midway through fieldwork after concluding the area/system is low-risk or well-controlled.

• Recommends a continuous monitoring mechanism to eliminate manual effort; builds a prototype data feed and report to illustrate the benefit to management.

The IIA—Audit Manager Tools and Techniques

Organizational Awareness

Understands and appreciates how audit fits into the fabric of the company. Plans and executes activities with full consideration of stakeholder interests and the multitude of priorities, dependencies, and potential consequences of our work. Carries out audit’s charter/mission in accordance with the Audit Committee’s goals, while respecting management’s viewpoints and priorities.

• Becomes aware that compliance is preparing a related presentation to the audit committee; coordinates efforts to make sure a relevant audit issue gets folded into their presentation.

• Decides, after appropriate confirmation, to not raise an audit observation because the business already presented a similar observation to management and is actively working on a resolution.

Company training courses, self-study materials

Client Relationship Focus

Builds and maintains relationships with others (clients and colleagues) based on mutual respect and trust. Fosters cooperation and collaborative decision making among stakeholders with diverse backgrounds and interests. Resourcefully identifies opportunities to leverage network of contacts that can provide information and assistance and lead to more effective and efficient outcomes.

• Agrees to delay start of an audit of human resources, as key contacts have been tied up with a benefits plan conversion.

• Recommends audit scope reduction after learning that the information security officer recently hired a consultant to perform a similar review.

• Collaborates with business to change objectives from an “audit” to a risk evaluation exercise after learning that the business is struggling with a certain aspect of a process/system implementation.

Courses offered by learning and development department

Team Development

Encourages constructive feedback and a culture that provides opportunities for development. Sets/supports direction based on potential, recognizes opportunities, champions ideas, and leads by example. Pushes others and self to accomplish more than they might think they can.

• Audit plan includes project for which no one is technically qualified. Manager reevaluates risk, establishes audit scope and objectives to focus on elements for which staff does have expertise; sets up other aspects of engagement to serve as a training survey opportunity.

The IIA—Audit Manager Tools and Techniques
Management courses offered by learning and development department

Personal Responsibility

Holds self and team responsible for maintaining the highest possible performance standards and meeting agreed-upon commitments, even under difficult circumstances. When commitments are made, they are made decisively, responsibly, and with appropriate urgency. Not afraid to express disagreement; constructively offers reasons and alternatives.

• Comes in early or works late to meet important deadlines.  Doesn’t wait to be told/asked.

• Doesn’t simply do something because “it’s on the schedule.” Speaks up if something is low value or doesn’t make sense.

• Willing to put in extra hours or rally others to help a team member who is struggling or running behind on something.

• Accepts offers of assistance.

• Never says “I was told to do it that way” or “not my job”.

• Works hard, stays late so that somebody else doesn’t have to.

Various management courses offered by learning and development department

Senior Auditor

Supervision

Implements audit policies and standards, as they relate to the day-to-day activities of the group. Helps to define and implement audit methodology, procedures, tools, etc. Works with the manager and director to align audit and staff activities with internal audit’s strategy, goals, objectives. Develops/reviews engagement scope and objectives; designs/reviews audit work programs, testing strategies, and detailed testing procedures. Performs detailed reviews of electronic working paper files and is first-level reviewer on audit issue and report write-ups.

• Effectively manages audit’s day-to-day operations.

• First line of decision making authority on audits.

• Makes sure auditors follow the process and adhere to policies/procedures but demonstrate the courage and thoughtfulness to know when to deviate from standard.

• Acts as a proxy for the director (and client management) when performing working papers and report reviews.

• Knows when to rigidly follow the “playbook” and when to allow staff the freedom to experiment or try alternative approaches.

The IIA—Auditor-in-Charge Tools and Techniques

Relationships (Client and Team)

Able to clearly articulate internal audit’s strategy, goals, and objectives in interacting with business clients and management. Builds and nurtures key management and business relationships. Helps manage external relationships — external auditors, regulators, consultants.

• Key representative to clients/management.

• Possesses a keen awareness of the business’s processes, goals, and objectives.

• Able to communicate audit’s goals and objectives, as they relate to the area under review and the group overall.

• Evaluates the operation, system, process, control; finds constructive ways to work with individuals; able to navigate personal biases.

The IIA—Auditor-in-Charge Tools and Techniques
Audit manual

Planning and Assessing

Ensures that audit activities and results are aligned to audit committee’s and  Audit Committee’s expectations. Understands and is conversant in the overall corporate and business unit strategies and strategic imperatives. Develops and manages assigned portions of the audit schedule; actively participates in all phases of risk assessment and annual audit planning and execution; produces initial drafts of risk assessment documentation and the annual plan proposal.

• Ensures end-to-end linkages are established between each step of the audit life cycle: risk assessment, audit plan, schedule, risk and control matrix, work program, test plans, test results, issue narratives, reports, etc.

The IIA—Auditor-in-Charge Tools and Techniques
Audit manual guidance

Communication

Effectively expresses ideas verbally and in writing. Able to function effectively in individual and group situations; can get messages across that have the desired effect. Correctly interprets responses and adapts style and method accordingly. Listens attentively and actively. Speaks openly and honestly about issues, and provides constructive solutions. Successfully diffuses (ideally, preemptively mitigates) conflict.

• Uses a simple diagram to illustrate the key points of a complex issue.

• Translates a complicated technical issue into plain language for the owning executive.

• Anticipates how the other person will react to the message and factors this into the presentation.

• Able to influence clients and colleagues to view risks and controls from a different/constructive perspective.

The IIA—Communication Skills for Auditors
The IIA—Effective Writing for Auditors
Various communication courses offered by learning and development department

Initiative

Originates actions to influence events and to achieve goals; sees opportunities and acts on them. Evaluates, selects and employs various methods and strategies for solving problems and meeting objectives before being asked to do so. Doesn’t wait for “things” to happen. Comes to the discussion with solutions and alternatives, not just problems and questions.

• Determines that the current approach will cause the audit to miss a critical deadline because a key client is unavailable. Proposes breaking the audit into two stages and issuing an interim report, as a means of satisfying/meeting the original date.

• Realizes that the director didn’t allocate enough time to complete on-site testing. Before raising the issue with the director, develops a proposal for adjusting the scope and performing some of the work remotely.

Task and project management courses offered by the learning and development department

Results-driven

Demonstrates concern for achieving or surpassing desired results. Able to adjust pace and objectives whether the goal is to achieve a new level of quality or just get the task(s) done. Demonstrates a passion for improving delivery and impact of services. Steadfastly pushes self and others for results, while mindful of individual and organizational limitations.

• Continuously looks for ways to improve and do work more efficiently.

• Steadily and visibly moves assignments through various stages of completion.

• Establishes reputation for getting things done, not just working hard.

• Knows when to bring tasks to conclusion or pull back efforts early; is decisive in doing so.

• Finds creative ways to achieve objectives through alternate methods when clients don’t have time or can’t get access to source information, when mitigating factors may exist elsewhere.

IIA—Auditor-In-Charge Tools and Techniques
Task and project management courses offered by the learning and development department

Individual Development

Staff mentoring/coaching/ supervision; provides input on staff performance reviews, promotions, etc. Develops and manages the internal audit training program; works with staff to establish development goals and pursue appropriate training.

• Coaches less experienced staff.

• Openly shares facts and details of work with team members.

• Provides team members with guidance and input relating to things they may be working on or planning.

• Takes the success of the team and audit’s mission personally.

Audit manual
Various courses offered by learning and development department

Staff Auditor/Internal Auditor/Junior Auditor

Technical Knowledge

Appropriately applies academic knowledge and past work experiences to navigate unfamiliar territory or complex situations. Develops/possesses a good command of the facts and circumstances; able to construct walkthroughs, process flows, narratives that convey a solid technical understanding of the operations, processes, systems being reviewed.

• Able to identify key control activities.

• Able to familiarize self with and interpret applicable laws, regulations, policies and procedures.

The IIA—Beginning Auditor Tools and Techniques
Various other IIA, MIS, and ACL training classes

Standards and Practices

Creates work product in accordance with The IIA International Professional Practices Framework and applicable industry/ professional guidance. Understands and complies with evidence and working paper requirements.

The IIA—Beginning Auditor Tools and Techniques

Tools and Techniques

Applies fundamental auditing techniques appropriately. Understands the various types of controls and relative strength/reliability of different methods of testing; applies the appropriate test strategy to the situation. Constantly on the lookout for best practice tools, work programs, and auditing techniques. Leverages technology to improve the effectiveness and efficiency of work.

• Selects and utilizes appropriate tools and techniques to accomplish assigned objective.

The IIA—Beginning Auditor Tools and Techniques
Various MIS and ACL training classes

Productivity

Creates work product in an appropriate amount of time. Work requires minimal time to review and only some rework. Work is clear, concise, convincing, and easy to follow.

The IIA—Effective Writing for Auditors
Internal working paper training

Problem Solving/Logic and Analysis

Grasps the difference between significant and insignificant issues; usually differentiates between symptoms and causes. Uses sound logic to construct/develop even the most straightforward of audit observations. Supports assertions with data and describes observations in a way that business decision makers can understand (without having to decipher) key points. Provides practical, well-thought-out recommendations and alternatives.

Audit issue guidelines in the audit manual
Guidance from senior auditors, managers, and audit director

Professionalism

Consistently maintains professional appearance and demeanor. Always behaves in a professional manner. The department is highly visible and is constantly watched by the rest of the company. Therefore, the entire company expects a very high level of professionalism from internal audit.

The IIA—Communication Skills for Auditors