How is this for a grim scenario? As business becomes inexorably more technology-driven, audit and assurance teams need more sophisticated technology, but technology requires talent — and technology talent is growing ever more costly and scarce. Dire enough? There are no easy solutions, but as Leslee McKnight, Gartner’s senior director of research, lets us know: at least audit executives are aware of and working on the challenges.
In Q3 2021, Gartner surveyed 166 audit leaders to identify their top challenges for 2022. What jumps out immediately from the survey is that the top four challenges audit leaders face all relate in one way or another to technology. In ranked order, the top four include:
- Attracting talent with non-traditional audit skills e.g., data science or cybersecurity (57 percent).
- Making the leap to more advanced analytics applications (56 percent).
- Inadequate assurance over cybersecurity (53 percent).
- Inadequate IT auditing practices (53 percent).
The rapid pace of digitalization in organizations presents clear challenges for internal audit in terms of providing adequate assurance over a fast-moving and volatile landscape. However, adoption of technology within the audit department itself is creating further challenges. Audit departments are not only struggling to provide reasonable assurance over the enterprise’s digital expansion but also are struggling with use of technology in audit.
In short, the talent and technology challenges within audit are formidable.
Digital Risks Are Rising
Audit leaders want to move to more advanced applications of analytics to help with the burden of providing assurance over a risk landscape that is increasingly technology infused.
One driver is the exponentially expanding use of advanced technology and digital processes in providing goods and services to consumers. Similarly, with the pandemic-driven surge in remote working practices, organizations have become more distributed and more reliant on information technology to function. As society and commerce digitizes, consequently, cybersecurity risk is surging and becoming more complex to properly oversee.
But Digital Talent Is Hard to Source …
As the survey demonstrates, the biggest challenge is not intrinsically a technology problem. It is a people problem, a supply and demand problem. With the hot job market and demand for digital skills still rising, companies struggle to attract the top digital talent to work in audit and provide needed assurance over the organization’s increasing technology use and the accompanying risks.
The same survey asked respondents which challenges they were least confident in solving. Again, the top four point to technology and talent: adopting advanced analytics in audit (45 percent); cybersecurity (36 percent); IT auditing (34 percent); and attracting talent (31 percent).
Moreover, the challenge is exacerbated by a feedback loop:
- The faster organizations pursue digital transformation initiatives …
- … the more assurance will be required in this area …
- … and the harder audit will have to fight to attract the needed skills.
… and Demand Is Still Growing
Technology presents a dual challenge for audit, both in terms of audit department innovation and adequate risk coverage. And the sheer pace of technology adoption is overwhelming audit departments’ ability to hire and upskill.
One implication is that many audit leaders are dissatisfied with their own department’s progress in adopting technology. Nearly half of audit leaders (45 percent) don’t feel their audit departments are ready to adopt more advanced analytics applications, and nearly a quarter (23 percent) aren’t achieving sufficient ROI from robotic process automation (RPA) investments. This is even as 60 percent of audit departments are planning to increase audit technology spending in the next fiscal year.
Further, more than a third of audit leaders have low confidence in their ability to provide assurance over cybersecurity and in their IT auditing practices. Both areas will become more important and challenging as organizations increase reliance on IT to sustain a remote workforce to power new business models and to deploy a range of new technologies.
Challenges Will Multiply
As organizations accelerate their digital transformations, they will face enhanced cyber and IT risks, with priorities shifting from operational efficiency and security to innovation. Years of underinvestment in the technological, talent and cultural foundations that enable digital strategy execution will amplify these risks.
At the same time, as the complexity and scope of IT projects expands, IT overspend is expected to grow. Consequently, organizations that employ suboptimal IT governance for such projects will likely see increased IT maintenance costs, inefficiencies, complex post-implementation control upgrades and potential operational failures. All these factors require audit to increase its coverage of digital and IT risks, and most audit departments have shifted audit plan coverage in response.
Audit plans also reflect increasingly prevalent and sophisticated ransomware attacks (they rose by 57 percent in 2021, according to Sophos) and other cyber threats that are a top concern for boards and senior management.
But the ability to execute the audit plan is contingent on the extent to which audit can recruit, retain or develop the skills they need for the audit department. Given the challenges all businesses are experiencing in this regard, it’s not hard to see why technology talent is a No. 1 concern for audit leaders in 2022.
Avoid Losing Ground: Develop and Retain
As the struggle to recruit talent grows more challenging, it becomes even more important to focus on retention. Nearly half of respondents (43 percent) reported their staff showing signs of burnout, and only one-third of audit leaders express high confidence this can be addressed. This is not a situation unique to audit; the pandemic has taken its toll on the workforce broadly, a trend referred to as the Great Resignation.
When faced with hiring challenges like this, audit leaders often turn to the business or co-sourced partners to get the expertise they need. Yet just 15 percent of audit leaders were finding it possible to acquire the skills they need from the business, and only 35 percent were successful when trying with co-sourced partners.
The reality is that many co-sourced and business partners are experiencing the same issues around hiring and retaining talent, particularly talent with data science, IT and cybersecurity skills, and the issue is particularly acute for almost everyone in the wake of the pandemic. This explains another distressing finding: Fewer than one-third of audit leaders are confident they will be able to fill their talent needs.
In such a supply-constrained jobs market, audit leaders will need to prioritize retention and upskilling to ensure oversight of key corporate digital transformation initiatives. But therein lie yet two more talent challenges:
- Only 16 percent of audit leaders report being able to rapidly upskill audit staff on targeted knowledge areas needed to execute in-year audit plan changes.
- Only 31 percent report all their auditors can successfully conduct the consulting and advisory activities that are increasingly needed to provide support in less familiar areas such as critical transformation projects, cybersecurity, ESG and HR risks.
Don’t Shoot the Messenger
These are not easy challenges to solve. But finding a way to navigate them will be critical to providing assurance over the risks faced by businesses in 2022 and beyond. Unquestionably, audit leaders face great challenges in terms of attracting and retaining key talent.
But the good news is that the survey data shows audit leaders recognize these challenges and understand they won’t be easy to solve. This means that working to ensure they have the talent, approaches and capacity to provide assurance over risks when and where the business needs it, while adopting new technology to help get it done, become the paramount focuses across governance and audit.
Leslee McKnight is a Research Director with the Audit Leadership Council at Gartner where she provides thought leadership and actionable tools for global heads of audit to address their major pain points. Her prior experience includes working with Blue Cross Blue Shield of Michigan and the Senate Homeland Security and Government Affairs Committee. She holds Ph.D., Political Science and Health Services Policy from the University of Michigan and a B.A., Political Science and Sociology from University of Connecticut.
