An Interview with Josh Keene and Kim Mobley

The Great Resignation is impacting all industries and lines of work. No one is immune, including your internal audit department. The internal audit team provides independent, objective assurance and consulting to add value and improve an organization’s operations. Staffing shortages in this area can create challenges to executing the annual internal audit plan, potentially leaving gaps in the evaluation of processes and controls, delaying special projects, and increasing costs. These gaps could lead to undetected errors, security vulnerabilities or even fraud.

We caught up with two Johnson Lambert Partners and leaders in this space to hear their perspective on the Great Resignation and how these conditions have prompted internal audit leaders to seek new ways to approach their audit plans. Josh Keene specializes in services related to finance and accounting and Kim Mobley focuses on IT-related areas of internal control.

Q: The labor market is competitive right now. How are you seeing companies respond to internal audit staffing needs?

JK: “Companies are getting creative right now. For example, one of our clients lost three team members that they weren’t expecting, and so we were asked to supplement their team to help execute the internal audit plan when they needed resources. For the company, it was a great way to patch and fill the team while gaining the benefit of perspective from outside the company. Many companies we see may not have an internal audit team, and they use our services to build a team and set up the processes. Co-sourcing or outsourcing brings outside thoughts to the table, considering more than what has been traditionally audited or the processes and controls that are reviewed each year.”

KM: “The labor market is especially challenging related to specialized skills, for example, IT security and IT audit skills, or others like specialized reinsurance knowledge. It is important to make sure you have the right team members that can easily step in and do more complex analysis or even train your existing team. You can’t discount the impact of training. Finding candidates with training in general processes, audit  procedures, project management, professionalism and soft skills is difficult, and they can be costly to attract and retain. You may find significant value when you consider hiring consultants with specific skills and training.”

Q: For companies that are contemplating hiring a partner, can you discuss the difference between internal audit co-sourcing and outsourcing?

JK: “Outsourcing the internal audit function involves hiring an external party to complete the internal audit work for your company.

We see this more often when companies are moving into having an internal audit function for the first time. Outsourcing is helpful in this scenario to bring training to the management team. We can educate management on what we are doing, why we are doing it, how we assess risk, what a control owner means, and the expected level of documentation. This education is foundational to the success of a new internal audit department. We especially see this during Model Audit Rule (MAR) implementations for insurance companies where we really focus on training the control owners and management. We also see companies making the strategic decision to fully outsource the internal audit department to focus on other priorities benefiting from cost reduction, accessing different specialists, unbiased appraisal, and gaining more flexibility.

Co-sourcing is where someone inside the company owns the internal audit responsibility and has day-to-day interactions with the management team. They also have the ability to hire external resources where needed to fill gaps, bring in expertise that they don’t have in-house or for special projects.

By bringing in an outside perspective, management can get a fresh look at organizational risk.”

KM: “If you don’t have subject matter expertise in your area or cannot afford it in this labor market, co-sourcing or outsourcing may be a good fit.”

Q: What can an external partner provide that an organization doesn’t already have in-house?

KM: “One of the benefits of hiring an expert is that your company can leverage their experience. An example is system implementations. We see clients implementing common systems, so we have visibility into how they are configured and the options available. We have also developed a proprietary data analytic tool to identify incompatible role based system access.”

JK: “Some organizations may not have enhanced data analytic tools and when looking for a provider, a data analytic offering should be one of the key criteria for consideration. These tools provide a more complete picture of the company’s risks, better identification of anomalies, deeper evaluation and much more. Our firm has developed proprietary analytic tools with interactive visualization to help better analyze data. Analytics can be run monthly, weekly, daily, or even every minute, to provide real-time insights to management. In addition to the internal department using these tools, they can greatly benefit management to help make timely decisions, and monitor activities using the outputs of these advanced analyses.”

Q: What are the top risks your clients and their audit committees are concerned about and how is the internal audit department involved?

JK: “On the finance side of the house, the pandemic threw everyone a curve ball and the shift in controls with working from home and its impact on segregation of duties. Furthermore, the great resignation has impacted workload and work assignments, affecting the controls that are in place. With all these changes occuring, they are concerned about increased risks of fraud and errors and  are asking their management and internal audit to look at processes and assess if the right controls are in place and operating effectively. 

Other risks continually coming up, although external factors, are interest rate movements and market volatility. Audit committees are asking how management is addressing these risks, how they are pricing the risks into their underwriting, and dealing with what may happen with claim costs as a result of inflation. Internal audit may be asked to help the audit committee assess how effectively management addressed these external risks.”

KM: “Cybersecurity and ransomware are at the top of their minds. Audit committees are asking questions like, 

Do we have the right team of experts in place? Does the team have the necessary skills, tools and monitoring processes?

Are we compliant with all the current cybersecurity regulations, and are we aware of and working toward compliance with proposed regulations?

So they task their management teams with finding people that can help them make these assessments and supplement their annual internal audit plans.”

Q: What makes you excited about the future of internal audit?

JK: “One thing about internal audit that doesn’t always get the attention that it should is the people side. Some organizations optimize internal audit by allowing them to bring efficiencies or help with pain points, and to maintain the company’s culture. Internal audit can be a tool to help position employees in the jobs they enjoy and are good at rather than just checking boxes and moving papers. Happier and more engaged employees means less attrition and lower cost of training new staff.”

KM: “We are getting into continuous control monitoring. Ten years ago, this was aspirational. We now live in a world where we can develop and utilize analytic tools to obtain real-time insights. This analysis is helping us detect potential unusual or unauthorized transactions, anomalies, identify trends, provide deeper analysis and much more. Internal audit is dynamic and it’s changing from selecting a random sample to being thoughtful about what you are looking at and why. It’s a huge shift.”

---

From new training opportunities, to control review and data analytics, Josh and Kim touched on a lot of important ways outsourcing and co-sourcing internal audit is helping to address staffing shortages while also adding value to organizations. 

Knowing that every organization needs to constantly adapt and protect their organization, there is no better time to be proactive and learn how Johnson Lambert can supplement your internal audit team. Contact Kim or Josh to discuss your organization’s needs and how a custom internal audit solution can be applied today.