At its essence, internal audit is a people business. We are people auditing people – how they identify, measure, report and manage risk and how they design and operate controls to mitigate it. This is highly technical and quantitative, but it’s often the soft skills that mark the difference between a good auditor and a great one.
This is one of the questions we asked ourselves when we were developing our learning and development programme as part of the internal audit transformation at Citigroup. What is the optimal training that will take our employees from good to great? What will enable them to excel in their current roles, and also push them to be innovators across the company and sector?
One of my tests is to see how many business leaders within Citi originally came from our internal audit team – they may be hugely regretted losses from our function, but it’s gratifying to be able to provide the business with risk management and control experts with an appetite to drive positive change in the culture of the organisation.
We kicked off our IA transformation programme in 2013 with 610 people in the function, and our authorised headcount is now over 1,800 individuals, making us one of the largest IA functions in the financial services industry.
Our learning and development programme included establishing a Citi Internal Audit Foundation Academy, which ensures that all recruits have the same level of technical internal audit skills and understand our sector and the organisation, including our vision and our goals as well as our structure and systems. This ensures the global consistency and quality standard that our stakeholders expect.
Citigroup operates in over 100 countries – this means we have assurance responsibility over a wide range of products and services in each jurisdiction, while ensuring we meet the constantly evolving requirements of regulators in each country. The Citi IA Foundation Academy trains our staff on how to best engage internal and external stakeholders, including how to work with management to deliver tough messages.
We knew it was vital that the academy aligned with the Chartered IIA Standards and we were delighted that in December last year the IIA accredited the programme so that everyone who completes it gets the IIA Certificate. Nearly 70 people started the course in January this year and we intend to put all new joiners through it this year.
In order to know that I can draw on our people around the world, offer them development opportunities in other regions, and rely on them to produce globally consistent, high quality work, I need to be sure that everyone works to the same standard, no matter what other qualifications they hold or what professional field or country they come from.
Similarly, it’s vital that a report to the Citi subsidiary independent, non-executive board in Shanghai is in the same format, with the same content and completed with the same rigour as one going to the same board in Mexico. The Citi IA Foundation Academy supports this global standard.
We need to equip our people to deal with emerging risks before they arise and take on the new regulatory challenges as they emerge. Traditionally many internal auditors haven’t been ambitious enough. We need to give our staff the development opportunities and flexibility so they can become not only great auditors, but effective change agents.
Before he joined Citi, Mark Carawan was chief internal auditor at Barclays Group after a period as a managing partner at Deloitte. He is also IIA deputy president.