Forget the Surveys. These Are the Skills I Look for When I Hire Audit or Risk Practitioners

I was recently contacted by a professional organization that wanted to share the results of its survey of audit and risk executives. The survey focused on the skills they rated highest when they assessed potential new hires. The top two were technical skills and an understanding of the business.

Those are NOT at the top of my list! My list starts with these:

  • Intelligence.
  • Curiosity.
  • Imagination.
  • Active listening skills.
  • An open and flexible mind.
  • A desire to work with the customer to improve the business.
  • The ability to think strategically.
  • Verbal communication skills, including the abilities to explain and to persuade.
  • Courage: the ability to stand up and deliver bad news.
  • Passion.

Technical skills and business understanding can be acquired, and even writing skills can be handled. But native intelligence, a desire to learn, and the imagination to come up with a business-practical way to improve the business are tough to teach.

Do you agree? Do you consciously assess these qualities in candidates, or do you hire based on a resume that shows certifications and such?

Posted on Sep 27, 2011 by Norman Marks

Share This Article:    

  1. wholeheartedly!  Technical skills are impressive on paper and to those easily swayed by jargon.  Someone who is not burdened by the need to impress with jargon often will be willing to ask the simple truth seeking question and will listen with the keen intellect to get to the heart of the issue.  


  1. Agree wholeheartedly!

  1. If you can get somebody strong on the above plus technical skills the better.But either without the other is handicap.

  1.  If not for passion, which I do lack sometimes, I would be your perfect candidate :)

    I share your view in total.

    ps. Patrick, this does not exclude search for a "perfect" candidate, having tecjnical skills, as well

  1. Aha! You’re also describing key skills needed to run a successful business (just add creativity, persistence and self-belief)! I’m a serial entrepreneur, program manager and IT Audit graduate, looking to do more Auditing in my consulting practice.  My technology skills might have clinched my first IT Audit interview, but at the end of the day, Audit is really about improving the business while managing risk. We accomplish this goal through independent assessment of operations, policies and procedures. But often we can best influence change in an organization when we engage the business stakeholder in developing improvement recommendations. An Auditor with the skillset and personality traits you describe will be the most effective. I think you’re dead on, Norman!

  1. I disagree on the matter of writing skills, but I'm interested in what you mean exactly by "handling" it.
  1. Probably I would add, logical thinking skills and thinking out of the box. However these might already have been captured with Intelligence....
  1. Thank you for this...Finally some encouragement. I am very affective in each of the areas described as desirable, along with 15 years technical accounting skills to boot. But transitioning into the audit field has been less than encouraging. Because I lack direct audit experience or certification, I am rarely even considered. Of course I think most organizations are missing out because not only do I have what it takes to be successful; I have found that the change in assignment, locations, and people are what have driven my career so far and will continue to do so in the future. These comments and post have given me some extra incentive to keep trying (even as I prepare to pass the CIA).

  1. First of all, I absolutely agree, as all other above. However I do challenge whether all other would have come up with this too. (Please: I don't know any of you personally, so please don't take it personally) What I want to say is: The bulletpoints on your list a kind of self-evidence, how can anyone say anything against? And even if you ask someone that recently hired a risk / audit / compliance specialist jsut by looking at his "business understanding" skills he will insist that the candidate does fullfill all bulletpoints on your list.

    But I did read your post twice and I believe what you are really saying is that technical skills and business understanding is not only not on TOP of your list, they probably even don't come right after the bulletpoints you listed, maybe they are not on your list at all. And here we see some people start to disagree (e.g. "either one without the other is handicap"). However, they would not be on my list as well. If the candidate does have technical skills / business understanding or not should not make a difference, if at all I probably would prefer the person without such skills against the person with skills! Why? Well, if all other skills from your list are give, then he/she should be able to achieve any technical skills and business understanding in short time and she/he will not build upon any skills achieved before. He/she will ask the right questions, challenge all answers he/she gets and end of the day his/her technical skills / business understanding will match the position.

    Does an executive really wants to hire someone with good skills in the areas on your list? (Curiosity, open mind, ability to stand up) I am afraid at least some executives don't really want someone in the risk management / audit / compliance area working for them and asking the right questions. Am, I too pessimistic?

  1. Norman, I fully quote Neil McIntyre's comment. Could you give us some more detail? Beacuse I don't think that writing skills (and all we know what we are talking about when we say "writing skills"...) can be underestimated and, above all, I cannot wonder how can we handle it in case of serious and critical deficiencies (considering we're not talking about a teenager in scholar age with a significant improvement area).

  1.  Hi,

     The skills  you are quoting would  be  the  first  requirements for  any prospect- risk, audit or business.

     To me   a  risk  practitioner, the  question that  always  haunts  is- Is  the  cost of  managing this  risk witin a  decent limit? If not , how  do I  tell my customer  that this  risk  is   something that would  be   detrimental to his  business and that he  has to hedge  it? So it goes  for   audit- how  many times   does  he  breach a  rule  to stay in business which , cut to bare bones, is  ultimately to make  a  profit? Is  the  auditor ready to work with teh  business  head  to alter any process  which  would  keep him within the  law and  also help his  business? 

  1. There is hardly any option but to agree to the list of attributes ( if I can call it so). However, getting all the desired skills may not be feasible all the time in every one. So roles in audit can be designed on the strenghths and that to me is a team work. What I mean is that there is a possiblity of having a backoffice and front office concept in audit, but it is tagged to the size of the shop as well.  The overall impact is what it counts, as long as we are able to create that.


  1. A couple have asked about writing skills. Certainly, these are important and if a candidate could hardly move the pen on paper would be a deal-breaker. However:

    1. If they are able organize their thoughts and express them clearly verbally, they can be taught to do the same in writing. After all, the best way to say something in writing is to say it the same way you would verbally.

    2. The interview will determine whether they can communicate clearly and organize their thought processes.

    3. I find almost everybody I have hired has had to be 'helped' with their writing skills: to be concise, but especially to understand and then convey what matters to the reader. So I start with the expectation that they will need some measure of training.

    4. There is some excellent training in writing and communicating.

    5. Finally, I am responsible for the final report and will 'help' with the wording and in the process 'help' the employee develop.

    If any of my former teams read this, perhaps ythey can comment. 

    I hope this helps.

  1. Why did technical skills and business knowledge come top of the list for these executives?  That's the question I've find myself asking. 

    - Is it a resource issue (not enough time to train, and need people who can seemingly hit the ground running)?

    - Is it a cultural thing (risk management must be managed by risk managers, rather than by every member of staff)? 

    - Is it become an assumption of the hiring process (we're not hiring someone unless they've proven themselves in the field)?

    - or is it something else

    Karl, your final paragraph put a smile on my face.  To put a slightly different slant on it, how many parent companies force the hand of the child to have it's own risk management function in place, which they do so begrudgingly and without proper engagement and appreciation of benefits that it can bring? 

  1. When I surveyed a group of Chief Audit Exectuives in the Fall of 2010 and asked for their thoughts on the Top 3 characteristics sought in an Internal Auditor here are the most popular results summarized.
    1.   Communication skills
    2.   Technical skills and expertise
    3.   Integrity and character
    4.   Intelligence
    5.   Business acumen
    6.   Professional skepticism
    7.   Inquisitive
    8.   Self-starter
    9.   IT Knowledge
    10. Personality
    Some of the survey's less popular characteristics that did not make the top 10 list, which I thought were important considerations included:  Ability to collaborate, Entreprenurial, Innovative, Creative, Energetic, and Willingness to Learn.  
  1. I'm glad I came upon this discussion. Mr. Mark's answer is very much what I would have hoped an executive would want for the company. I am a CPA candidate and earned a Liberal Arts degree(philosophy major).

    The technical skills, regardless of the initial state, aside from general development, will be honed to the company's methods and focus.  As a student of education everything listed applies. Bringing them to a disciplined focus is the key.  When 'this" person asks to work in the particular field I'd imagine that he or she would immediately be a top candidate.

    • Intelligence.
    • Curiosity.
    • Imagination.
    • Active listening skills.
    • An open and flexible mind.
    • A desire to work with the customer to improve the business.
    • The ability to think strategically.
    • Verbal communication skills, including the abilities to explain and to persuade.
    • Courage: the ability to stand up and deliver bad news.
    • Passion


    Chris (new member)

  1. Norman, whilst my initial reaction is to agree with what you've said word for word, experience has taught me that a good indicator of work ethic is someone's academic achievements. I've known many intelligent, passionate, imaginative etc. people who, when it comes to crunch time, simply don't deliver because some of the fundamental skills needed to be successful (i.e. a strong work ethic and technical ability) simply haven't been developed fully. I've also known technical "gurus" who can't have a normal discussion with other people. Ideally I'd want someone who has a strong base of academic and technical achievement in addition to the other points mentioned, especially integrity and passion. I believe the ability to be a good listener is not something most people are born with, it's something that usually gets learnt the hard way. That's where leadership plays an important role.

  1. In my last role we spent a considerable amount of time regarding skills and competencies for internal auditors.  While I won't disagree with your blog or the comments, what I will say is that the evaluation of skills when hiring an auditor is highly dependent upon the specific role they are playing within audit.  Some skills are more important at more senior levels than they are for less experienced positions.

    With that in mind, we created a set of skills and competencies, both technical and those based on emotional intelligence concepts (soft skills), that reflect a continuum of development of these skills and competencies over one's career in audit.  The technical skills categories we chose are: business knowledge and acumen; audit knowledge; project and resource management; analytics and problem solving; and specialty and technical knowledge.  The emotional competencies we chose are: self-awareness; adaptability and innovation; motivation; understanding and developing others; and communication and influence. 

    Each position carries certain minimum expectations for each role, and the expectations build with each step on the career progression.  Education and certifications factor into certain of the competencies as means for measuring the level of expertise on that competency.

    In particular, I point out that we included competencies that are often not considered, but are deeply important to an audit function, particularly when the audit function is a key developer of talent for the organization.  These skills are project and resource management and understanding/developing others.

  1. I totally agree with you Norman, technical skills and business understanding  can be taught. Whats important is Intelligence, creative and logical thinking, curiosity ( you shouldn't get tired of asking), has a good listening ear which also makes the candidate 'keen with details'. Lastly someone who could tand up to his/her words and can definitely deliver 'bad' news in the most creative way (its like delivering bad news in a good way).


    These are things I look for in an IA staff.

  1. Finally someone to put on paper what I have thought for years. When I was looking for an internal auditor to join my team a few years ago, I had to write a description of the function trying to justify the importance of the function. What I was really looking for was someone with all of the "soft skills" mentioned above. The technical skills and understanding of the business are a "nice to have".

Leave a Reply