Maintaining control: will a boom in internal auditing result in a bust in audit quality?

Internal Auditor, Feb, 2005 by Norman Marks

THE INTERNAL CONTROL audit requirements of Section 404 of the U.S. Sarbanes-Oxley Act of 2002 are driving a head-count increase in public accounting firms, both for the firms' external and internal audit practices. U.S. corporations of all sizes have significantly increased their use of the certified public accountant (CPA) firms to support their Section 404 internal control testing.

In October, Business 2.0 magazine listed the top U.S. organizations in terms of hiring. Numbers six through eight were:

* Ernst & Young hired 7,000 new people in the last 12 months and plans to hire 9,300 more during the next year.

* Deloitte hired 6,000 new employees last year and plans to hire 9,500 in the coming year.

* PricewaterhouseCoopers hired 5,500 last year and plans to hire 7,000 in the next 12 months.

It is not just the large firms that are growing. All sizes of CPA firms are starting or expanding their internal audit co-sourcing practices, as are the "independent" providers like Protiviti and Jefferson Wells. Even organizations that until now have specialized in information technology (IT) consulting (e.g., Taos Mountain Inc. and SAS Institute Inc.) are selling Section 404 audit services.

This tremendous increase in demand for auditors presents several diverse challenges for the leaders of our profession.

DILUTION OF TALENT It is getting more and more difficult to find knowledgeable auditors, whether to hire directly into an internal audit function or indirectly through a co-sourcing partner. The temptation is to hire the best of what is available; however, that practice may result in future personnel and customer service problems. Instead, audit directors need to be very sure of their staffing needs and carefully select employees. For example, audit directors who need staff to perform Section 404 controls testing should ensure that they only hire individuals with solid workpaper preparation skills. This is especially true for IT auditors. Section 404 dramatically increases the requirement to complete quality workpapers, typically doubling the time required to test the average control.

IT auditors who are really only good technicians are flooding the market. They have limited audit skills and no idea how to document their work. This presents the risk that, although quality technical work is performed, when the external auditors review it, it may be found deficient for one of several reasons, including:

* It is not clear what work was performed and what transactions were tested, so the test cannot be reperformed.

* It is not clear how the sample size to test was determined, and therefore was insufficient.

* The auditor did not explain how he or she came to the conclusion that the control was operating effectively.

Once an audit director's needs are well-defined, he or she should test candidates to ensure that they meet current needs or, if not, can develop or be taught required skills.

The same disciplined approach to hiring is critical when using a co-sourcing provider. Do not assume the co-source partner has people with the necessary skills and experience. The staff may lack the specific audit and workpaper skills needed. Practitioners should interview--or at least review the resumes of--the staff the co-source partner is planning to put on the job.

DILUTION OF AUDIT MANAGEMENT Just as finding good employees is difficult, so is managing them. Inexperienced people require more management time, and good management is critical when staff work requires careful review, as with Section 404 testing.

The co-sourcing providers are hiring experienced internal audit directors and managers. However, there are two dangers. First, the managers are working on multiple projects for numerous clients and may not be monitoring the work closely. Second, people may be promoted to management earlier than they ordinarily would.

The answers are clear, but not easy. More time must be allocated to managing junior staff, as well as to supervising less experienced managers. When outsourcing work to a partner firm, organizations should ensure that they understand how much management time is included and how much experience the manager has.

DILUTION OF INTERNAL AUDIT VALUE Increased demand for resources without a corresponding increase in supply inevitably leads to an increase in prices. My own experience is that the prevailing hourly rate from the large CPA firms has nearly doubled in the last year. While the demand to hire internal staff has increased, employers' reluctance to let salaries grow at the same rate means that the cost of hiring new staff has gone up much less.

The implication is obvious: It is increasingly uneconomical to outsource work. I predict that companies will try to limit the work they outsource in 2005. They cannot afford to have internal audit costs spiral out of control while receiving less value from the function. The pressures to cut head-count to limit cost increases are inevitable. Practitioners should seek alternative staffing methods.