How to build an effective IT audit team during a time of skilled resourcing shortages

Facing competition for experienced staff in an already tight skilled labor market, organizations across the world are fighting to strengthen their team’s risk management abilities. In this environment, individuals with the right technical certifications, relevant experience or soft skills may be difficult to find, and even harder to retain. In fact, the 2022 (ISC)² Cybersecurity Workforce Study shows that 43% of respondents are unable to find enough qualified talent to meet their goals, and 33% of respondents are struggling to keep up with employee attrition.

What to look for when staffing your IT audit team

Equally important as attracting skilled labor is attracting the proper skilled labor. Employees responsible for an organization’s risk management function should have a balanced mix between technical certifications (e.g., CISSP, CCNP Enterprise) and risk-oriented certifications (e.g., CISA, CISM, CIA, CPA) to provide insight into risks from both cybersecurity depth and enterprise risk perspectives. This technical mix should be balanced with a strong set of soft skills and good cultural fit with the team.  

To further supplement these skilled team members, finding existing employees with the right aptitude for risk management may allow for a better connected and more knowledgeable workforce. In forming an IT audit team, for example, some of the best candidates may sit within security operations, IT administration, infrastructure or other teams within the organization’s Three Lines.  

Even after building a skilled team, it’s vital to define an effective reporting structure – leadership skills are a must! To ensure that skilled labor is used to its full potential, it’s necessary that all supervisors and managers are made aware of their responsibilities to those who report to them, and that they understand how to communicate information up and down. Hiring a technical employee with no managerial experience into a leadership role may harm team morale and result in increased turnover or dissatisfaction. 

Co-sourcing/outsourcing opportunities that bring the right talent

While some organizations may choose to keep most risk management activities in-house, others may prefer to co-source portions of the team, or outsource. Co-sourcing and outsourcing skilled labor may provide more access to an agile, responsive talent pool with more diverse backgrounds, and typically more experience than can be easily found on the open job market. This talent option can be pursued as a means of either augmenting staff abilities or supplementing them. These tasks are often performed on an engagement-by-engagement basis, and may provide more flexibility than hiring a team of full-time employees would in the long term.

Keeping skills sharp

If an organization is able to successfully attract and retain an appropriately staffed IT audit or risk management team, it must still address the ongoing challenge of developing and amplifying that talent. It is critical to balance efficient and effective training programs with timely and impactful on-the-job coaching. Organizations should leverage training content from their existing support channels, whether that be external audit, H, or knowledgeable third-party service providers. When enhancing your IT audit or risk team, be thoughtful about whether your existing resources are better suited in teaching ‘how to audit’ versus teaching technical topics that may provide more valuable assessments within the organization. This determination will inform how to hire and upskill your team. 

More important than training around operational responsibilities, there has been a generational shift in value gained from leadership coaching. Leading a team based on core values of empathy, purpose and belonging enhances the sense of community within teams. Providing employees with mentorship programs, ongoing training and education, upwards mobility and increased flexibility will help hone their skills and increase the effectiveness of their work. Putting soft-skills at the forefront of leadership is critical to establishing high performing teams and retaining exceptional talent.