Assessing Internal Audit Skill Gaps

1. Why Assessing Internal Audit Skill Gaps Matters

Internal audit exists to provide independent, objective assurance over governance, risk management, and control. That assurance is only as credible as the people who deliver it. If the internal audit activity lacks the knowledge, skills, and other competencies needed to evaluate the organization's key risks, three things happen: engagements produce shallow or inaccurate conclusions, high-risk areas (such as cybersecurity, data analytics, ESG, model risk, or complex financial instruments) are avoided or under-audited, and the board receives false comfort. For a CRMA candidate, this topic sits at the intersection of two core ideas: the Chief Audit Executive's (CAE) responsibility for resource management and the Standards' requirement for proficiency and due professional care. Assessing skill gaps is therefore not an HR nicety; it is a governance obligation and a risk to the audit activity itself.

The topic also matters because risk management assurance is a specialized form of auditing. Evaluating whether an enterprise risk management (ERM) framework is designed and operating effectively requires auditors who understand risk appetite, risk frameworks (COSO ERM, ISO 31000), quantitative risk techniques, and the business itself. A general-purpose audit team may be fully competent at compliance testing yet completely unprepared to challenge management's risk assessment. Identifying that gap before the engagement is what separates a professional audit function from one that merely goes through the motions.

2. What Is a Skill Gap Assessment?

A skill gap assessment (sometimes called a competency gap analysis or capability assessment) is a structured comparison between:

• The competencies the internal audit activity needs to deliver its approved audit plan and fulfil its charter, and
• The competencies it currently possesses, individually and collectively.

The difference between the two is the gap, and the output of the exercise is a remediation plan to close or manage that gap.

Key Standards references:

• IIA International Standards (2017) – Standard 1210 Proficiency: Internal auditors must possess the knowledge, skills, and other competencies needed to perform their individual responsibilities. The internal audit activity collectively must possess or obtain the knowledge, skills, and other competencies needed to perform its responsibilities. Note the word "obtain" – gaps may be filled from outside.
• Standard 1210.A1: The CAE must obtain competent advice and assistance if the internal auditors lack the knowledge, skills, or other competencies needed to perform all or part of the engagement.
• Standard 1220 Due Professional Care: Auditors must apply the care and skill of a reasonably prudent and competent internal auditor; this is impossible without the underlying competence.
• Standard 2030 Resource Management: The CAE must ensure that internal audit resources are appropriate (the mix of knowledge, skills, and competencies), sufficient (quantity), and effectively deployed.
• Standard 2020 Communication and Approval: The CAE must communicate the impact of resource limitations to senior management and the board.
• Global Internal Audit Standards (2024): Standard 3.1 Competency, Standard 10.2 Human Resources Management (the CAE must establish a program for recruiting, developing, and retaining qualified internal auditors), and Standard 9.2/9.3 on strategy and methodologies all reinforce the same duty. Domain III (Governing the Internal Audit Function) places the board in an oversight role over whether the function has the resources it needs.

Competency frameworks: The IIA Global Internal Audit Competency Framework is the common reference model. It groups competencies into areas such as professionalism, performance (engagement planning, fieldwork, communication), environment (governance, risk, control, business acumen, IT), and leadership and communication, and it describes expected proficiency at different career levels (staff, senior, management, CAE). Many audit functions adopt or tailor this framework as the "required" side of the gap analysis.

3. How a Skill Gap Assessment Works

Think of the process as a five-step cycle that is repeated at least annually, typically alongside the risk-based audit plan.

Step 1 – Define the required competencies.
Start from the audit universe and risk assessment, not from the current staff. Ask: what does the approved audit plan require? If the plan includes cloud security, treasury hedging, third-party risk, or an ERM maturity review, the required competency profile must include those domains. Also factor in the charter's scope (assurance vs. consulting), regulatory expectations, and the organization's strategic direction (for example, a planned digital transformation). Document required competencies by role and by proficiency level (e.g., awareness, working knowledge, expert).

Step 2 – Inventory current competencies.
Common tools include:
• Self-assessments against the competency framework
• Manager/peer assessments and performance reviews
• Skills matrices or inventories (a grid of people versus competencies)
• Certifications held (CIA, CRMA, CISA, CFE, CPA, etc.) and continuing professional education records
• Results from quality assurance and improvement program (QAIP) reviews, including external assessments
• Engagement feedback and post-engagement surveys from clients
• Analysis of past engagement issues, re-performance findings, and supervision notes

Step 3 – Analyse the gap.
Compare required versus current. Distinguish between:
• Individual gaps (one auditor needs IT general controls training) and collective gaps (nobody in the function can evaluate model risk)
• Current gaps (needed for this year's plan) and emerging gaps (needed in two to three years)
• Depth gaps (some knowledge but not enough) and breadth gaps (no coverage at all)
Prioritise gaps by the risk significance of the areas affected. A gap in a low-risk administrative area is tolerable; a gap in a top-ten enterprise risk is not.

Step 4 – Decide how to close or manage the gap.
The CAE has a menu of options and the exam often tests which is most appropriate:
• Training and development – formal courses, certifications, on-the-job coaching, mentoring. Best for sustainable, recurring needs.
• Hiring – recruiting specialists. Best when the skill is needed continuously and justifies a permanent position.
• Co-sourcing – bringing in external specialists to work alongside the in-house team, usually with knowledge transfer. Best for episodic or highly technical needs and when the team should build capability over time.
• Outsourcing – contracting the entire engagement to a third party. Best for one-off, highly specialized reviews; the CAE remains accountable for the work and for ensuring the provider is competent and objective.
• Guest auditors / rotational programs – borrowing subject-matter experts from the business, provided independence and objectivity are protected (they should not audit their own area, and the audit activity retains control of the engagement).
• Reliance on other assurance providers – coordinating with second-line functions or external auditors, with appropriate evaluation of their competence and objectivity.
• Re-scoping, deferring, or declining the engagement – when a gap cannot be closed in time, the CAE must not proceed as if the competence existed. The limitation must be communicated to senior management and the board (Standard 2020), and the audit plan adjusted.

Step 5 – Report, monitor, and refresh.
The CAE reports resource adequacy, including skill limitations and their effect on coverage, to the board (typically the audit committee). Progress on development plans is tracked, and the assessment is refreshed when the risk profile, strategy, or audit plan changes. The QAIP should periodically evaluate whether the competency process itself is effective.

4. Special Considerations for Risk Management Assurance (CRMA Focus)

Assessing ERM is a distinct competency set. A CRMA candidate should recognise that auditing risk management requires:
• Understanding of risk management frameworks (COSO ERM, ISO 31000) and risk maturity models
• Ability to evaluate risk appetite, tolerance, and risk culture
• Facilitation skills for control and risk self-assessments (CRSA)
• Quantitative literacy – probability, scenario analysis, key risk indicators, data analytics
• Business acumen to challenge management's risk identification and prioritisation
• Communication skills to report maturity gaps constructively to the board

A classic exam scenario: management asks internal audit to provide assurance over a newly implemented ERM framework, but the team has never evaluated ERM. The correct response is not to decline outright nor to proceed blindly, but to assess the gap, obtain competent assistance (training, co-sourcing, or a specialist), ensure independence is preserved (internal audit must not own or manage the risks), and communicate any remaining limitation to the board.

5. Common Pitfalls Tested in Exams

• Treating the skill assessment as a one-off HR exercise rather than a risk-driven, recurring process linked to the audit plan.
• Building the required-skills profile from current staff rather than from the audit universe and risk assessment (circular reasoning).
• Relying solely on self-assessment, which is subjective and tends to overstate competence.
• Assuming outsourcing transfers accountability; the CAE always retains responsibility for the quality of work performed on behalf of the audit activity.
• Using guest auditors from the business to review their own department (impairment of objectivity).
• Proceeding with an engagement despite a known, unmitigated competence gap, or quietly dropping it from the plan without informing the board.
• Confusing "sufficient" (number of hours or people) with "appropriate" (right mix of skills) – Standard 2030 requires both.

6. How to Answer Exam Questions on This Topic

CRMA questions are typically scenario-based and ask for the best or most appropriate action. Use this decision logic:

Identify who is responsible. Resource adequacy and competency of the function are the CAE's responsibility; the board provides oversight and must be informed of limitations. Individual auditors are responsible for their own continuing development and for disclosing when they lack needed skills.

Identify what the Standards require. Anchor your answer to the principle that the activity must possess or obtain competence (1210), that the CAE must obtain competent advice and assistance when skills are lacking (1210.A1), and that resource limitations must be communicated (2020).

Match the solution to the nature of the gap.
• Recurring, core need → train or hire
• Episodic or highly technical → co-source or outsource, retaining CAE accountability
• Short-term and immediate → obtain external specialist; consider re-scoping
• Unclosable in time → defer or decline, and tell the board

Check independence and objectivity. Any option that puts the audit activity in a management role, or uses people to review their own work, is wrong.

Prefer the risk-based, documented, communicated answer. Options that mention linking the assessment to the risk assessment and audit plan, using a competency framework, and reporting to the board are usually correct. Options that are informal, one-off, or silent toward the board are usually distractors.

7. Exam Tips: Answering Questions on Assessing Internal Audit Skill Gaps

• Start from risk, not from people. If an answer option derives required skills from the audit universe and risk assessment, it is almost always preferred over one that derives them from the existing team's background.
• Remember the trio in Standard 2030: appropriate, sufficient, effectively deployed. Skill gaps are an "appropriate" problem, not a "sufficient" problem – a team can have plenty of hours and still lack the right skills.
• "Possess or obtain" is the key phrase. The Standards never require every skill to be in-house; they require the CAE to ensure the skill is available when needed.
• The CAE cannot outsource accountability. If an option implies the external provider is responsible for quality or conclusions, eliminate it.
• Guest auditors are acceptable only with safeguards: no self-review, internal audit controls the engagement, and objectivity is assessed and documented.
• When a gap cannot be closed, the answer involves the board. Silently removing an engagement from the plan or proceeding anyway are both wrong; communicating the limitation and its impact on coverage is right.
• Co-sourcing versus outsourcing: co-sourcing implies working together and often knowledge transfer; outsourcing implies handing over the engagement. Questions emphasising "building internal capability" point to co-sourcing or training; questions emphasising "one-off, highly specialised" point to outsourcing or a specialist.
• Multiple data sources beat self-assessment alone. If asked how to make the assessment more reliable, choose options that triangulate: manager review, QAIP results, certifications, client feedback.
• Link to the QAIP. Competency is a quality attribute; external and internal assessments should evaluate it, and findings should feed the development plan.
• Think "individual and collective." A question may describe a perfectly qualified individual while the team as a whole lacks a critical skill – or vice versa. Read carefully to see which level the question is testing.
• Watch the verbs in answer choices. "Document," "assess," "communicate," "obtain assistance," and "align with the audit plan" are strong signals of a correct option. "Assume," "proceed," "rely on management," and "avoid informing" signal distractors.
• For CRMA-specific scenarios, remember that auditing ERM demands framework knowledge, facilitation, and quantitative skills; an answer that recognises this specialised competency need and addresses it is better than one that treats ERM assurance as ordinary compliance testing.

8. Quick Summary

Assessing internal audit skill gaps is the disciplined process of comparing the competencies required by the risk-based audit plan and charter with the competencies the audit activity actually has, then closing or managing the difference through training, hiring, co-sourcing, outsourcing, guest auditors, or re-scoping – always with the CAE accountable, independence protected, and the board informed of any limitations. On the exam, choose the answer that is risk-driven, Standards-anchored, preserves objectivity, keeps accountability with the CAE, and communicates openly with senior management and the board.