IN THIS ISSUE

Vol. 7, No. 2 · Second Quarter, 2004

Print Article

Finding the Right Mix: Internal Audit Staffing Strategies

Robert W. Rudloff Jr., CIA, CFE
Vice President of Internal Audit
MGM Mirage
Las Vegas, Nev.

Internal auditors are expected to have a thoughtful audit plan, an excellent working relationship with management, support from the audit committee, and state-of-the-art audit tools. But unless the right people are in place, many internal audit departments won't be able to succeed.

Inadequate staffing can be one of the greatest obstacles to providing high-quality internal audit service and is certainly one of the top challenges faced by most internal audit departments. Among the myriad issues is the ever-growing list of regulatory audit requirements, routine audit projects, management requests, and special projects, as well as the need to help management prepare for compliance with the U.S. Sarbanes-Oxley Act of 2002. Add to this the expectations of the audit committee, management, gaming commissions, and shareholders or other stakeholders, the complexity of tasks that internal auditors need to accomplish expands even more.

The Ever-changing World of Internal Auditing

Internal auditing is clearly not the same as it was several years ago. It has become a high-profile profession with the need for auditors who are properly skilled, have the right aptitude for the work, have relevant experience, and are trainable. Internal auditors must also be licensable in many jurisdictions where they will work. In addition, recently approved legislation also now requires or encourages the use of qualified internal auditors. For example:

State of Nevada's CPA MICS Compliance Reporting Requirements. Revisions were recently included in the Nevada Gaming Commission's Minimum Internal Control Standards (MICS) to the section "Licensee's Election to Utilize Internal Audit to Substitute for CPA Work — Internal Audit Department Criteria," requiring that the individual who is directly responsible for supervising and managing the internal audit function must be a certified internal auditor (CIA) or certified public accountant (CPA) with a minimum of two years of auditing experience. In addition, at least 50 percent of the internal audit staff assigned to perform the required procedures pursuant to Regulation 6.090 (15) must either possess a four-year degree or an advanced degree in accounting, finance, hotel administration, or any other business-related field, or possess any other four-year degree and a CPA, CIA, certified fraud examiner (CFE), or certified management accountant (CMA) designation.

Public Accounting Oversight Board Audit Standard No. 2. Of particular interest to the internal audit profession is the area describing the extent external auditors are allowed to use the work of others. The board recognized the value of an experienced internal audit function, allowing flexibility for external auditors to rely on the work performed by internal auditors — at the external auditors' discretion — stressing the importance of competency and independence as required in The IIA's International Standards for the Professional Practice of Internal Auditing. The board, sensitive to the cost of compliance with the new standard, encouraged companies to invest in competent and objective internal audit functions to help reduce external audit costs.

NYSE Governance Listing Rules. Approved by the U.S. Securities and Exchange Commission, these rules require that all New York Stock Exchange (NYSE)-listed companies must maintain an internal audit function — internal or outsourced — to provide management and the audit committee with an ongoing assessment of the company's risk management processes and system of internal control.

Rules such as these have produced a high demand for internal auditors, causing the pool of available candidates to shrink. In addition, the need for well-rounded, experienced auditors has increased because of the increasing complexity of gaming operations; the development of new gaming technology; the acquisition of new properties, some in international locations; and the emergence of new facilities and services, such as golf courses, retail shopping, and entertainment venues.

Companies that are in the market for internal auditors have to think differently about how to fulfill their staffing needs, which can require using new channels to pull qualified people into the profession to meet the organization's internal audit plan.

Auditor Skills Inventory

When shopping for a car, house, or furniture, conscientious shoppers identify their basic needs, add some wish-list items, and then go shopping. The same thought process should be used in a staffing strategy, first recognizing the department's basic needs and then adding some wish-list qualifications. A good approach to getting started is to prepare a skills inventory — a list of skills that the current internal audit staff possesses. The list should not be an exhaustive list of every conceivable skill set, as that would be unmanageable. Rather, it should include the critical skills that are essential to the specific organization. Because all companies are different and an individual organization's needs may vary over time, the sample inventory list below should be viewed as a flexible tool and not a one-size-fits-all approach. 

Once the list is prepared, it should be evaluated to reveal the gaps in skill sets that need to be filled so the staffing process can begin.

Look For the Right Skill Sets

When looking for qualified internal audit staff, thinking too narrowly can limit the pool of potential resources. As chief audit executives (CAE) review their department's needs for a diverse professional staff, many find that a majority of the staff hired in past years came from the same local or state university undergraduate accounting or auditing program. Recognizing the need for greater educational diversity, many internal audit departments are now looking at students from a variety of university programs, including those out-of-state. Educational diversity is only one piece of the puzzle, however. An internal audit department needs to have people with a variety of backgrounds and experiences. In addition to expanding the search to various universities, audit managers and directors should consider unexpected sources of talent. Internal auditors outside of the gaming industry can add value to the organization and often transition easily into the profession. People with professional backgrounds in insurance, security, banking, law, and information systems can transition into many types of audit services including compliance, fraud investigations, data mining, and cash audits, to name just a few. This broad pool of skills can serve to broaden the capabilities of the department as a whole.

Talent potential need not come just from accounting, auditing, compliance, and finance backgrounds either. Employees from non-traditional sources within the gaming industry, such as dealers, front desk agents, and floor supervisors, can easily adapt to internal auditing with the proper training. These people can bring a distinct perspective on what it's like to work on the floor or in operations, and more importantly, they may know firsthand where the control weaknesses could be hiding. The tips or techniques they bring from their respective backgrounds can help build a more effective and efficient internal audit function.

Understand Internal Auditing's Focus

The next step in the path to smart staffing is to understand where the internal audit department will focus its time to properly balance the available skills. Because each internal audit group has a different mandate, some will focus primarily on gaming compliance, whereas others will have more of an operational audit focus, or be the driver of the organization's Sarbanes-Oxley work. A predominant focus may lead to a different staffing strategy than was used in the past, and adding a new focus — such as operational audits, IT audits, financial audits, or leading the Sarbanes-Oxley testing — will require auditors who are able to wear more than one hat. Auditors who can perform well in more than one area can enable the internal audit department — regardless of its primary area of focus — to be much more flexible and be able to respond effectively when a crisis emerges. This approach should be pursued with caution, however. Although a broad skills base can be advantageous for the department, the auditor may eventually become bored from lack of challenge if these skills are not put to use effectively, causing premature turnover. Hiring only seniors and supervisors and not enough staff auditors can be just as detrimental.

The mandate for qualified internal auditors should also be balanced with independence issues and ethics. Maintaining internal audit independence is a challenge in the gaming industry, particularly in North American Indian gaming, which sometimes restricts employment to North American tribe members only. Because many gaming employees in this environment have relatives or close acquaintances on the board of directors or audit committees, in management, or in operations, it is prudent to review the relationship of the internal audit staff and potential hires to company employees. To avoid nepotism — favoritism based on kinship — internal auditors should not audit an area that a relative supervises or manages, which can put a kink in scheduling an audit with the most qualified person.

The Right Mix

Hiring efforts should consider not only education and experience qualifications, but interpersonal skills, leadership skills, and verbal and writing skills as well. Expectations should be defined and if possible, measurable. Hiring decisions should separate skills from personality traits, while ensuring that an acceptable mix of both is attained.

Hiring the right people is always a challenge. Unlike a car, you can't test drive an employee before hiring. But thinking strategically about what skill sets are needed and determining how much flexibility is needed before the interviewing process starts should result in a positive outcome. Searching for talent in new places can put a favorable twist in the hiring game and pull stale practices out of a rut. By adequately understanding the internal audit department's direction, balancing the skills between present and future staff is easier to accomplish. Although emphasis should be placed on hiring people with multiple skills, this strategy is only effective if it fits the organization's needs. Approaching the hiring process with a staffing strategy should not only make the process easier, but it should also have long-term benefits for the department and the organization as a whole. 

Bob Rudloff is vice president of internal audit for MGM MIRAGE in Las Vegas. He has more than 23 years of internal audit experience, 18 of which are in the gaming industry. He is also a certified internal auditor (CIA) and certified fraud examiner (CFE). 

Copyright © 2004 The Institute of Internal Auditors