Post-pandemic, a supermajority of skilled knowledge workers demand two things:

  1. Flexible hours.
  2. Flexible work locations.

That’s a key finding from a recent survey from Slack, making it clear that high-value, in-demand workers have no intention of returning to the traditional full-time, in-office 9-5. And what happens when employees remain frustrated with inflexible employers and work arrangements?

More than 70% will seek a new job within the year.

So what does this mean for the Internal Audit (IA) function?

Getting ahead of the talent curve to stay ahead of the risk curve.

Internal Audit by the Numbers

New research from The Institute for Internal Auditors (IIA) finds that IA budgets are stabilizing since sharp pandemic-induced budget cuts. That said, just 24% of surveyed companies were increasing their IA budgets, the lowest level since the IIA began collecting data in 2008.

Additionally, just 21% of companies are increasing headcount, potentially indicating a tough job market or opacity around the organization’s future goals and capabilities.

internal audit challenges

On both fronts – budgets and staffing – publicly traded firms have shown a higher rate of IA investments relative to privately held companies.

As might be expected, the biggest challenges to IA staffing have been:

  1. Voluntary resignations.
  2. Budget cuts (related and non-related to the pandemic).
  3. Terminations due to poor performance.
  4. Inability to attract qualified applicants.

On the other hand, firms that have opted to increase IA investments have done so to:

  1. Ensure adequate staffing.
  2. Add necessary skillsets to existing teams.
  3. Comply with heightened assurance and consulting needs.
  4. Facilitate a merger and acquisition (M&A).

If budgets allowed, companies would prefer to increase staff versus buying new audit technology (nearly two to one).


The data illustrates that IA teams are hamstrung in similar ways to other business functions. More higher-skilled staff is required, and technology that can support staff is necessary to fill risk gaps, automate key tasks and controls, enhance audit readiness, and increase preparation for compliance requirements – but it all comes at a cost, one that’s lower than the cost of inaction or underinvestment.

New paradigms resulting from the pandemic – The Great Resignation, asynchronous schedules, distributed workforces – have run headfirst into prevailing technological shifts, such as robotics and automation. An inefficient IA function can make or break SOX or other regulatory compliance requisites and lead to impacts on public filings, market transactions, and operational efficiencies.

All of these changes have forced organizations to reconsider the types of skill sets, reporting structures, leaders, human capital, and controls needed to succeed in a new normal.

Internal Audit (IA) has not escaped these trends. And turnover, inexpertise, and organizational dysfunction within IA have dire consequences.

Talent Impacts Controls and Reporting

Younger workers take the adage “At every job you must be earning or learning” to heart.


This means that if there are higher-paying, more-flexible positions in the market, retention will be challenging. Similarly, if they’ve stopped learning in their current roles, retention, again, will be challenging.

Today’s workers are more technologically adaptive and educated than ever before, so it’s not impossible that someone could feel they have learned everything they need to know after just a few months on the job – and then begin looking for opportunities elsewhere.

Building agile and enforceable controls and reporting protocols during a talent war of this kind is difficult without strategic external support.

And when churn hits departments especially hard and at precarious points in the reporting cycle, business operations can grind to a halt. Compliance, corporate governance, company culture, and even long-term financial viability are now seriously at risk.

Mapping Emerging Focus Areas to Current Capabilities

While regulatory and operational compliance, financial reporting, and cybersecurity are the primary motivating factors for IA, human capital throughout the organization is helping to generate increased awareness and focus on other areas of the business with which IA can support.

For instance, environmental, social, and corporate governance (ESG) initiatives are under the microscope during recruitment.

Reuters declared 2021 “The Year of ESG Investing,” with approximately $650 billion flowing into funds dedicated to ESG. By 2029, more than 70% of the total workforce will comprise Gen Z and Millennial workers, cohorts that place great emphasis on ESG relative to other generations. ESG performance is thus a competitive advantage in the talent war and better aligns with current and future talent pipelines.

In IIA’s report, 51% of organizations viewed sustainability as an emerging “moderate,” “high risk,” or “very high risk” focus area.

internal audit challenges 2022

Unfortunately, sustainability is allocated just 1% of audit budgets, creating a disparity between what employees and applicants find important and what companies actually devote dollars to.

As the number of risk vectors rises – due to supply chain crises, geopolitics, cyber threats, etc. – IA functions are forced to prioritize what they can and what they legally must do. But bare minimum compliance is not a sufficient enterprise risk management (ERM) strategy for modern threats and the types of firms at which employees want to work.

Expanding IA’s role into emerging focus areas like ESG can help evolve the organization from both a compliance and a human capital perspective.

Leveling-Up Operational Expertise

To round out the capacity, function, and skill sets of a future-ready IA team, a fair amount of upskilling, external support, and restrategizing may be required.

As intelligent automation programs permeate all areas of the business, the IA function must now work collaboratively and intuitively with data scientists, IT, centers of excellence (COE), digital project managers, and more. This type of talent is a departure from the traditional CPA background.

Technologically agile workers may need to be acquired from outside the organization, or current talent be redeployed internally to IA. Not all firms will be open to or capable of talent optimization on a tight timeline or unless forced to.

Optimizing talent can be done rotationally by department, employee type, or skill set, for instance, so that it’s not overly disruptive. The key is to make the commitment to do so as an organization and to start early if there’s a key compliance deadline or company objective to meet.

IA offers a great opportunity for employees from other departments, whether at front of the house or back of the house, to learn and appreciate the inner workings of the company. Having a rotation into the IA function will also allow a continuous influx of different talents and skill sets to complement the core expertise of IA.

With an influx of rotational talents at certain intervals, the internal audit function at large can be more independent and objective, and the employees involved can benefit from a melting pot of new skill sets and experiences to carry out objectives successfully.

As the capabilities of IA evolve, so too might reporting structures and segregation of duties, especially for newly public companies or bootstrapped firms. Advisory boards must be created potentially from scratch, chief auditors should have functional independence from CIOs or CFOs, and the entire risk calculus of the organization must be reconsidered. And it’d be just as important for chief auditors to be open to the different perspectives and insights that external experts may be able to bring.

Transformation of this kind can be incredibly challenging internally, and without proper expertise in the fields of compliance, risk, technology, and accounting, the IA function may be in a more compromised state than before. Partnering with a firm that can fill risk gaps and design audit-readiness programs (whether for operational, financial, IT, or other risk and compliance objectives) can ensure that current and future compliance requirements can be met on time and on budget.

For expert guidance on optimizing the IA function, contact CrossCountry Consulting today.