OVERVIEW OF THE FIVE TIER AUDIT COMPETENCY MODEL
OVERVIEW OF THE FIVE TIER AUDIT COMPETENCY MODEL
Unlike other jobs, to be an effective internal auditor you need to be able to tap into and use five distinct competency categories. A competency is the ability to do something effectively. It is based on experience and the skills acquired from that experience. For example, the ability to negotiate effective contracts is a competency, as it is the ability to organize and deliver clear and persuasive messages to allocate scarce or fixed resources between at least two parties.
Competencies are also referred to as skills. When you are able to demonstrate a skill with consistency and mastery—that is, you developed your skill through training and practice to an expert level—you would be described as being proficient.
To be an effective auditor, you will need to develop five tiers of competency. Each tier comprises specific skills and behaviors. To the extent that you perform each of these behaviors effectively and efficiently, you increase the usefulness of your audit results and minimize audit risk, that is, the risk that an audit does not identify an existing weakness and concludes that the controls are operating as intended when they are not. Regardless of the audit’s complexity, the key question you need to ask yourself is, am I doing the right thing? Is my approach the right one or is there a more effective or efficient approach that I can use?
Tier 1: AuditMethodology
The first tier of the Five Tier Audit Competency Model, which forms the foundation for the other four, involves the mastery of the skills needed to execute an audit. If you don’t have this competency, your career in audit will be very short. Some of the Tier 1 competencies are process analysis, risk identification, analysis and assessment, control identification and evaluation, test design and performance, and issue development. This tier encompasses the ability to demonstrate knowledge about sound auditing principles and professional skepticism.
Tier 2: Documenting AuditResults atEach Step in the Methodology
The model’s second tier focuses on the documentation of the results of your thinking at each stage in an audit. The audience for each of these documents is not the same, and this difference in audience informational needs drives differences in writing styles. Following are some examples of the different types of informational needs your writing needs to address during an audit:
- Developing planning memos that describe the audit’s scope, objectives, and resource requirements and include the rationale for these decisions
- Documenting the risk events and their consequences
- Documenting controls in narratives so that the effectiveness of the control design can be determined
- Describing test steps and the results of conducting them
- Compiling the report—the tangible product created at the end of a review or audit—that is read by an executive audience
Tier 2 competencies include the ability to
- Recognize and follow writing formats and styles at different points in the audit
- Write grammatically correct sentences that are grouped in paragraphs
- Satisfy the informational needs of a broad array of readers
- Produce stand-alone documentation that enables someone else to reperform the work and reach the conclusion you did
It is possible to possess the competencies in Tier 1; that is, an auditor may be able to think clearly and accurately when applying auditing principles and methodology but may not be able to document these ideas comprehensively and in a manner that would enable another auditor (or individual) to reperform the work, that is, demonstrate Tier 2 competency. Conversely, it is possible to possess strong writing skills yet lack the ability to apply auditing principles and methodology; that is, the documentation is organized and grammatically correct but omits critical or pertinent information or records the wrong results and conclusions.
Tier 3: ProjectManagement
The model’s third tier relates to project management competencies. Project management is more than a skill. It is a profession that has its own designation from the Project Management Institute, Inc.: the Project Manager Professional (PMP)®. These are people who manage projects for a living—and these projects have nothing to do with internal audit. Tier 3 encompasses the skills associated with project planning, scheduling, time management, contingency planning, and estimating time and human capital resources.
Everyone assigned to the audit needs to be able to demonstrate project management competency—not just the project leader and audit managers. Staff auditors need to be able to estimate time requirements and manage their time to deliver useful results on schedule. Everyone needs to communicate accurate and comprehensive status reports.
Tier 4: Managing AuditTeamMembers
This includes the ability to
- Develop work assignments that optimize the talent of the audit team
- Delegate assignments to others
- Deliver useful and timely performance feedback and coaching
- Transform the auditors assigned to the review from a collection of professionals into a functioning team
- Develop the team members’ competencies
Tier 5: Managing Constituent Relations
The fifth and final tier focuses on the competencies associated with constituent relationship management. The scope of the competencies associated with this tier includes
- Acquiring technical and industry knowledge
- Demonstrating business acumen
- Dealing with critical conversations
- Delivering bad news without engendering bad feelingOVERVIEW OF THE FIVE TIER AUDIT COMPETENCY MODEL
Unlike other jobs, to be an effective internal auditor you need to be able to tap into and use five distinct competency categories. A competency is the ability to do something effectively. It is based on experience and the skills acquired from that experience. For example, the ability to negotiate effective contracts is a competency, as it is the ability to organize and deliver clear and persuasive messages to allocate scarce or fixed resources between at least two parties.
Competencies are also referred to as skills. When you are able to demonstrate a skill with consistency and mastery—that is, you developed your skill through training and practice to an expert level—you would be described as being proficient.
To be an effective auditor, you will need to develop five tiers of competency. Each tier comprises specific skills and behaviors. To the extent that you perform each of these behaviors effectively and efficiently, you increase the usefulness of your audit results and minimize audit risk, that is, the risk that an audit does not identify an existing weakness and concludes that the controls are operating as intended when they are not. Regardless of the audit’s complexity, the key question you need to ask yourself is, am I doing the right thing? Is my approach the right one or is there a more effective or efficient approach that I can use?
Tier 1: AuditMethodology
The first tier of the Five Tier Audit Competency Model, which forms the foundation for the other four, involves the mastery of the skills needed to execute an audit. If you don’t have this competency, your career in audit will be very short. Some of the Tier 1 competencies are process analysis, risk identification, analysis and assessment, control identification and evaluation, test design and performance, and issue development. This tier encompasses the ability to demonstrate knowledge about sound auditing principles and professional skepticism.
Tier 2: Documenting AuditResults atEach Step in the Methodology
The model’s second tier focuses on the documentation of the results of your thinking at each stage in an audit. The audience for each of these documents is not the same, and this difference in audience informational needs drives differences in writing styles. Following are some examples of the different types of informational needs your writing needs to address during an audit:
- Developing planning memos that describe the audit’s scope, objectives, and resource requirements and include the rationale for these decisions
- Documenting the risk events and their consequences
- Documenting controls in narratives so that the effectiveness of the control design can be determined
- Describing test steps and the results of conducting them
- Compiling the report—the tangible product created at the end of a review or audit—that is read by an executive audience
Tier 2 competencies include the ability to
- Recognize and follow writing formats and styles at different points in the audit
- Write grammatically correct sentences that are grouped in paragraphs
- Satisfy the informational needs of a broad array of readers
- Produce stand-alone documentation that enables someone else to reperform the work and reach the conclusion you did
It is possible to possess the competencies in Tier 1; that is, an auditor may be able to think clearly and accurately when applying auditing principles and methodology but may not be able to document these ideas comprehensively and in a manner that would enable another auditor (or individual) to reperform the work, that is, demonstrate Tier 2 competency. Conversely, it is possible to possess strong writing skills yet lack the ability to apply auditing principles and methodology; that is, the documentation is organized and grammatically correct but omits critical or pertinent information or records the wrong results and conclusions.
Tier 3: ProjectManagement
The model’s third tier relates to project management competencies. Project management is more than a skill. It is a profession that has its own designation from the Project Management Institute, Inc.: the Project Manager Professional (PMP)®. These are people who manage projects for a living—and these projects have nothing to do with internal audit. Tier 3 encompasses the skills associated with project planning, scheduling, time management, contingency planning, and estimating time and human capital resources.
Everyone assigned to the audit needs to be able to demonstrate project management competency—not just the project leader and audit managers. Staff auditors need to be able to estimate time requirements and manage their time to deliver useful results on schedule. Everyone needs to communicate accurate and comprehensive status reports.
Tier 4: Managing AuditTeamMembers
This includes the ability to
- Develop work assignments that optimize the talent of the audit team
- Delegate assignments to others
- Deliver useful and timely performance feedback and coaching
- Transform the auditors assigned to the review from a collection of professionals into a functioning team
- Develop the team members’ competencies
Tier 5: Managing Constituent Relations
The fifth and final tier focuses on the competencies associated with constituent relationship management. The scope of the competencies associated with this tier includes
- Acquiring technical and industry knowledge
- Demonstrating business acumen
- Dealing with critical conversations
- Delivering bad news without engendering bad feelings
- Communicating useful status information
- Negotiating useful corrective action plans
Given the array of competencies required to complete useful and value-added audits, you need to make sure that you are using repeatable and sound mental models and engaging in productive habits. The graphic at the beginning of each chapter will tell you in which tier of audit competency the content falls. This will allow you to focus on techniques and strategies targeted to a specific set of competencies. In my experience, auditors who master all or most of these competencies are more effective, become “go-to” people, and enjoy their jobs more.
- Communicating useful status information
- Negotiating useful corrective action plans
Given the array of competencies required to complete useful and value-added audits, you need to make sure that you are using repeatable and sound mental models and engaging in productive habits. The graphic at the beginning of each chapter will tell you in which tier of audit competency the content falls. This will allow you to focus on techniques and strategies targeted to a specific set of competencies. In my experience, auditors who master all or most of these competencies are more effective, become “go-to” people, and enjoy their jobs more.
Source: Ann Buter, CRP. Mastering The Five Tiers of Audit Competency : The Essence of Effective Auditing. 2016. CRC Press
Published at :