Assessing Skills Gaps in the Internal Audit Team

Assessing Skills Gaps in the Internal Audit Team: A Complete CIA Part 3 Guide

Introduction
Assessing skills gaps in the internal audit team is a core topic within CIA Part 3, Internal Audit Operations. It deals with how the Chief Audit Executive (CAE) makes sure the internal audit activity, taken as a whole, has the knowledge, skills and other competencies it needs to carry out its mandate and audit plan. This guide explains what skills gap assessment is, why it matters, how it works in practice and how to handle exam questions on it.

What Is a Skills Gap Assessment?
A skills gap assessment compares two things:
1. Required competencies: what the internal audit activity needs to deliver the risk-based audit plan and meet stakeholder expectations.
2. Available competencies: what the current staff actually have.
The difference between the two is the skills gap. Closing that gap through training, hiring, guest auditors, co-sourcing or outsourcing is a central management duty of the CAE.

Under the IIA's Global Internal Audit Standards (effective January 2025), this links directly to Standard 10.2 Human Resources Management. That standard requires the CAE to make sure the internal audit function collectively has the competencies to perform its services. It also connects to Principle 3: Demonstrate Competency (Standards 3.1 Competency and 3.2 Continuing Professional Development) and to Standard 9.4 Internal Audit Plan, which expects the CAE to consider resource needs when building the plan. Under the older IPPF, the comparable references were Standard 1210 Proficiency, 2030 Resource Management and 1230 Continuing Professional Development. Exam questions may use either framework's wording, so recognize both.

Why Is It Important?
1. Conformance with the Standards. The internal audit activity must collectively possess or obtain the competencies it needs. If it lacks them, the CAE must obtain them or decline the engagement. Assessing gaps is how the CAE shows conformance.
2. Alignment with the risk-based plan. Organizations face changing risks such as cybersecurity, ESG, data analytics, AI, fraud and regulatory change. A plan that covers high risks is worthless if nobody on staff can audit them.
3. Audit quality and credibility. Competent auditors produce reliable findings. Gaps lead to missed risks, weak conclusions and lost stakeholder confidence.
4. Efficient resource allocation. Knowing the gaps helps the CAE decide where to invest the budget: training, recruiting or outside providers.
5. Career development and retention. Gap assessments feed individual development plans, which motivate staff and support succession planning.
6. Board and senior management communication. The CAE must tell the board whether resources are sufficient. If limits on resources affect coverage, the CAE should communicate the impact to the board.

How It Works: The Skills Gap Assessment Process
Step 1: Understand the organization's risks and strategy. Start from the risk assessment, the strategic objectives and stakeholder expectations. These drive which competencies are needed.

Step 2: Define required competencies. Build a competency framework or skills matrix. Typical categories include:
- Technical auditing skills (planning, sampling, evidence, documentation)
- Industry and business knowledge
- Specialist areas (IT, cybersecurity, data analytics, fraud, tax, actuarial, environmental, legal or regulatory)
- Interpersonal skills (communication, negotiation, report writing, relationship management)
- Critical thinking and professional skepticism
- Leadership and project management
Frameworks such as the IIA's Internal Audit Competency Framework can be used as a benchmark. Required proficiency levels are usually set by role (staff, senior, manager, CAE).

Step 3: Inventory current competencies. Gather data through:
- Self-assessment surveys
- Supervisor and peer evaluations
- Reviews of certifications, education and experience
- Performance appraisals and engagement feedback
- Results of quality assurance reviews (internal and external assessments)
- Post-engagement client surveys

Step 4: Compare and identify gaps. Map current against required competencies in the skills matrix. Gaps can be:
- Individual: a single auditor lacks a skill needed for their role.
- Collective: the team as a whole lacks a capability, such as no one with cloud security expertise.
- Current or future: gaps for today's plan versus gaps for emerging risks.

Step 5: Prioritize gaps. Rank them by risk significance, urgency in the audit plan, cost to close and time to close.

Step 6: Develop strategies to close gaps. Common options:
- Training and CPD: courses, certifications (CISA, CFE, CRMA), on-the-job coaching and mentoring. Best for long-term, recurring needs.
- Recruitment: hiring staff with the needed skills. Best for permanent, ongoing needs.
- Rotational or guest auditor programs: borrowing staff from operations. These require independence and objectivity safeguards.
- Co-sourcing: partnering with an external provider while internal staff work alongside the experts and transfer knowledge.
- Outsourcing: using external service providers for specialized or one-time engagements.
- Technology: analytics tools that augment capability.
- Adjusting the plan: deferring or rescoping engagements and reporting the limitation to the board if gaps cannot be closed.

Step 7: Monitor and update. Repeat the assessment periodically, at least annually alongside audit planning, and whenever risks change significantly. Track progress through the Quality Assurance and Improvement Program (QAIP).

Important Considerations
- Responsibility: The CAE is responsible for ensuring collective competency. Individual auditors are responsible for their own competency and CPD.
- Using external service providers: When relying on outside experts, the CAE must assess their competence, independence and objectivity, and keeps overall responsibility for the work.
- Declining or getting help: If the function lacks the competencies for an engagement, the CAE should obtain them, for example through external providers, or decline the engagement. Auditors should never perform work they are not competent to do.
- Guest auditors and rotation: Staff rotated in from operations should not audit areas they recently worked in. Under the older Standards, the benchmark was a period of one year.
- Consulting engagements: The CAE may decline a consulting engagement or obtain advice and assistance if the team lacks the skills.

Example
A bank's risk assessment identifies AI model risk and cloud migration as top risks for next year. The CAE's skills matrix shows that no auditor has data science or cloud security expertise. Short-term, the CAE co-sources the cloud audit with a specialist firm, ensuring knowledge transfer. Long-term, the CAE funds CISA and cloud certifications for two seniors and adds a data analytics specialist to the hiring plan. The CAE reports the resource plan and any remaining coverage limitations to the audit committee.

Exam Tips: Answering Questions on Assessing Skills Gaps in the Internal Audit Team
1. Start with risk and the audit plan. The correct answer usually links competency needs to the risk-based audit plan and organizational strategy, not to staff preferences or past audits.

2. Know who is responsible. The CAE ensures collective competency. Individual auditors maintain their own competency. Watch for distractors that assign this to senior management, HR or the board alone.

3. The first step is usually identifying required competencies. If asked what the CAE should do first, pick defining required skills based on the plan and risks, or performing a skills inventory. Do not jump straight to hiring or training.

4. Match the solution to the nature of the gap.
- One-time or highly specialized need: outsource or co-source.
- Recurring or long-term need: train or hire.
- Need for knowledge transfer: co-source.
- Immediate need with no time to train: external service provider.

5. Never accept performing work without competence. Options like proceeding anyway and noting it in the report, or relying on management's expertise, are usually wrong. The correct choices are to obtain the competencies or decline the engagement.

6. External providers do not shift responsibility. The CAE remains responsible and must evaluate the provider's competence, independence and objectivity.

7. Communicate resource limitations. If gaps cannot be closed and coverage is affected, the CAE should report the impact to senior management and the board.

8. Recognize the tools. Skills matrices, competency frameworks, self-assessments, performance reviews and QAIP results are all legitimate gap assessment inputs.

9. Think collective, not individual. The team does not need every auditor to have every skill. It needs the activity as a whole to have or obtain the needed mix.

10. Watch for objectivity traps with guest auditors. Choosing a rotational auditor to audit the department they just left is typically the wrong answer.

11. Use the best-answer approach. Several options may be partly right. Choose the most comprehensive, Standards-aligned, risk-based and proactive one.

12. Remember periodic reassessment. Skills assessment is ongoing and tied to annual planning and changes in risk, not a one-time event.

Sample Question
The CAE learns that next year's audit plan includes a complex cybersecurity engagement, but no current staff have the required expertise. The engagement is a one-time need. What is the most appropriate action?
A. Remove the engagement from the plan without informing the board.
B. Assign the most experienced generalist auditor.
C. Engage a qualified external service provider after assessing their competence and objectivity.
D. Hire a full-time cybersecurity auditor.
Answer: C. For a one-time specialized need, an external service provider is the most efficient choice, and the CAE must assess the provider's competence and objectivity. A fails to communicate with the board. B violates the competency requirement. D is not cost-effective for a one-time need.

Summary
Assessing skills gaps means identifying the competencies needed for the risk-based plan, inventorying current skills, finding and prioritizing gaps, and closing them through training, hiring, co-sourcing or outsourcing. The CAE remains accountable throughout and reports to the board when limitations affect coverage. In the exam, anchor your answers in risk, the Standards, collective competency and CAE responsibility.