Recruiting and Staffing the Internal Audit Function

Recruiting and Staffing the Internal Audit Function: A Complete CIA Part 3 Guide

Introduction
Recruiting and staffing the internal audit function is a core topic in CIA Part 3 (Business Knowledge for Internal Auditing). It sits within the Internal Audit Operations domain. The topic covers how the Chief Audit Executive (CAE) builds, maintains and develops a team. That team must have the knowledge, skills and other competencies needed to carry out the internal audit plan. The exam tests whether you understand the principles of sound staffing. It also tests whether you can apply them to realistic scenarios.

Why Recruiting and Staffing Is Important
An internal audit function is only as effective as the people in it. Staffing matters for several reasons:
1. Conformance with the IIA Standards: The IIA's International Professional Practices Framework (IPPF) requires the CAE to ensure that resources are appropriate, sufficient and effectively deployed to achieve the approved plan.

• Under the legacy Standards, this is Standard 2030 (Resource Management) and Standard 1210 (Proficiency).
• Under the 2024 Global Internal Audit Standards, these themes appear in Domain IV (Managing the Internal Audit Function), especially Principle 10 (Manage Resources) and Standard 10.2 (Human Resources Management).
• Proficiency for individual auditors appears in Domain II (Ethics and Professionalism), Principle 3 (Demonstrate Competency).

2. Audit quality and credibility: Competent, objective and well-trained auditors produce reliable findings. These findings earn the trust of the board and senior management.
3. Risk coverage: Organizations face complex risks, such as cybersecurity, ESG, data analytics, fraud and regulatory change. The audit team must have the right mix of skills to address them.
4. Efficiency and cost control: Poor staffing decisions waste resources. They lead to rework, missed deadlines and high turnover costs.
5. Independence and objectivity: Staffing choices affect objectivity. Examples include recruiting from operational areas, rotating staff and using guest auditors.
6. Succession and sustainability: A well-planned staffing strategy keeps the function running when key people leave.

What It Is
Recruiting and staffing covers the full people life cycle of the internal audit activity:

• Workforce planning: Deciding how many people are needed and which competencies the audit plan requires.
• Recruitment and selection: Attracting, assessing and hiring qualified candidates.
• Sourcing strategies: Choosing among in-house staff, co-sourcing, outsourcing, guest auditors and rotational programs.
• Onboarding and orientation: Integrating new hires into the function and the organization.
• Training and continuing professional development (CPD): Maintaining and enhancing competencies.
• Performance management: Evaluating staff performance and giving feedback.
• Retention and career development: Keeping talent through career paths, rewards and engagement.
• Succession planning: Preparing future leaders, including a successor for the CAE.

How It Works

Step 1: Perform a Skills Gap Analysis
The CAE starts with the risk-based internal audit plan. The plan sets out the engagements that will be performed. The CAE then lists the competencies needed to perform them, such as:

• IT audit
• Accounting and financial reporting
• Fraud investigation
• Data analytics
• Industry knowledge
• Regulatory compliance
• Soft skills such as communication, negotiation and critical thinking

These requirements are compared with the current team's skills inventory. The difference is the skills gap. A competency framework, such as the IIA's Internal Audit Competency Framework, is often used as the benchmark.

Step 2: Decide How to Close the Gap
The CAE can choose from several options:

• Hire permanent staff: Best when the skill is needed on an ongoing basis. Builds institutional knowledge and loyalty.
• Train existing staff: Cost-effective for developing skills over time. Improves retention.
• Co-sourcing: In-house staff work alongside an external provider. Useful for specialized or temporary needs, such as complex IT or forensic work. It also allows knowledge transfer.
• Outsourcing: An external service provider performs part or all of the internal audit activity. Responsibility for the internal audit activity, and its oversight, remains with the organization (the CAE and the board).
• Guest auditors and rotational programs: Employees from other departments join audits temporarily. This brings subject-matter expertise and builds management talent. Objectivity must be managed: such staff should not audit areas they recently worked in. The legacy Standards (1130.A1) suggest a cooling-off period of at least one year.
• Using other internal experts: For example, legal or engineering specialists may be used on specific engagements.

Step 3: Recruit and Select
Job descriptions: These should clearly define:

• Responsibilities
• Required qualifications, such as a CIA, CPA, CISA or CFE
• Experience
• Competencies

Recruitment sources:

• Universities (entry-level talent)
• Professional associations, such as IIA chapters
• Recruitment agencies
• Internal transfers
• Referrals
• Online job platforms

Selection methods:

• Structured interviews
• Behavioral and competency-based interviews
• Case studies or technical tests
• Reference checks
• Background checks (essential given auditors' access to sensitive information)

Diversity: A diverse team, in background, experience and thinking, improves professional skepticism and the quality of judgments.

Step 4: Onboard and Develop

• Orientation covers the internal audit charter, methodology, Code of Ethics, organizational structure and key risks.
• Mentoring and coaching programs pair new staff with experienced auditors.
• CPD is a professional obligation. CIA holders must meet annual CPE requirements under the IIA certification requirements.
• Individual development plans should align personal goals with the function's needs.

Step 5: Supervise and Evaluate Performance

• Engagement supervision is required. It ensures objectives are achieved, quality is assured and staff are developed.
• Performance appraisals should use clear, measurable criteria, such as technical quality, timeliness, communication and teamwork.
• Feedback from engagement clients (post-audit surveys) can inform evaluations.
• Performance results feed into training, promotion and compensation decisions.

Step 6: Retain and Plan for Succession

• Offer competitive compensation and clear career paths.
• Provide challenging work and recognition.
• Use internal audit as a management training ground. Many organizations rotate high-potential employees through internal audit.
• Identify and develop successors for key roles, including the CAE.

Key Concepts to Remember

• Collective vs. individual proficiency: Each auditor must have the competencies needed for their responsibilities. The internal audit activity as a whole must collectively have or obtain the necessary competencies. Not every auditor needs every skill.
• Lack of competency: The CAE must obtain competent advice and assistance if staff lack the needed skills for all or part of an engagement. If the gap cannot be closed for a consulting engagement, the CAE should decline it.
• Sufficient resources: The CAE must communicate the impact of resource limitations to senior management and the board.
• Ultimate responsibility: Even when outsourcing, the organization keeps responsibility for maintaining an effective internal audit activity.
• Board involvement: The board approves the internal audit budget and resource plan. It is also involved in appointing and removing the CAE, which protects independence.
• Objectivity in staffing: Staff should not audit activities they were previously responsible for, typically within the past year. Assignments should consider conflicts of interest.
• Using the work of external service providers: The CAE must assess the provider's competence, independence and objectivity before relying on its work.

Exam Tips: Answering Questions on Recruiting and Staffing the Internal Audit Function

1. Anchor your answer in the Standards. Many questions test whether the CAE ensures that resources are appropriate, sufficient and effectively deployed. When in doubt, choose the answer that best supports achieving the risk-based audit plan in line with the IIA Standards.

2. Know when to hire, train, co-source or outsource. Exam scenarios often describe a skills gap and ask for the best or most appropriate response.

• Specialized, short-term need: Co-source or use an external expert.
• Ongoing, long-term need: Hire or develop internally.
• Need for knowledge transfer: Co-sourcing is usually better than full outsourcing.
• Cost-sensitive, gradual development: Training existing staff.

3. Watch for objectivity traps. A common question involves an employee transferred from operations into internal audit. The correct answer usually says the person should not audit their former area for a reasonable period, typically one year. Guest auditors and rotational staff raise similar concerns.

4. Remember collective competency. Watch for answer choices claiming that each auditor must be an expert in every area. These are usually wrong. The function as a whole must possess or obtain the needed competencies.

5. Outsourcing does not transfer responsibility. If a question asks who is responsible for the internal audit activity when it is outsourced, the answer is the organization, through the board and senior management. It is not the service provider.

6. Identify the most important selection criteria. For questions about hiring, prioritize:

• Competencies aligned to the audit plan's needs
• Integrity and ethics
• Communication skills
• Analytical ability

Integrity is foundational, because auditors access confidential information.

7. Distinguish training from supervision from appraisal.

• Supervision occurs during engagements. It ensures quality and develops staff.
• Performance appraisal is periodic and formal.
• Training addresses identified gaps.

Questions may ask which mechanism best addresses a given issue.

8. Resource limitations must be communicated. Suppose the CAE lacks enough staff to complete the plan. The correct action is to communicate the impact to senior management and the board. Silently reducing scope or quality is wrong.

9. Use elimination strategically. Eliminate answers that:

• Compromise independence or objectivity
• Ignore the risk-based plan
• Shift accountability to outsiders
• Focus only on cost while ignoring quality

10. Read for keywords. Words like best, most effective, first and primary matter.

• First step: Usually a skills or needs assessment based on the audit plan.
• Primary purpose of training: Maintaining and enhancing proficiency.
• Most effective retention strategy: Often career development and challenging work, not only pay.

11. Recognize internal audit as a talent pipeline. Some questions describe internal audit as a training ground for future managers. This is a legitimate staffing strategy, provided objectivity safeguards are in place.

12. Consider succession planning for the CAE. The board should be involved in CAE succession and appointment. If a question asks who should approve the hiring or dismissal of the CAE, choose the board (or audit committee), not only management.

Sample Question Walkthrough
Question: The CAE has determined that the upcoming audit plan includes a complex cybersecurity review. No current staff have the necessary expertise. The organization expects to need this expertise only occasionally. What is the most appropriate course of action?
A. Postpone the engagement indefinitely.
B. Hire a full-time cybersecurity specialist.
C. Co-source with an external provider with cybersecurity expertise.
D. Assign the most senior auditor and rely on their general experience.

Answer: C.

• The need is occasional, so a full-time hire (B) may not be cost-effective.
• Postponing (A) leaves a key risk unaddressed.
• Option D violates the proficiency requirement.
• Co-sourcing provides the needed competence and supports knowledge transfer.

Summary
Recruiting and staffing the internal audit function means ensuring the CAE has the right people, with the right skills, at the right time, to deliver a risk-based audit plan. The key elements are:

• Skills gap analysis
• Smart sourcing decisions (hire, train, co-source or outsource)
• Rigorous selection with attention to integrity
• Continuous development
• Effective supervision and appraisal
• Retention and succession planning

On the exam, link every answer back to proficiency, due professional care, objectivity, sufficient resources and the organization's ultimate accountability for its internal audit activity.