Evaluating Your Organization’s People Risk

Written by: Scott C. Baranowski , CIA , Colleen T. Simonelli ,

All organizations are the sum of their people, processes, and technologies. Well-run organizations have proper controls to mitigate risks in all three areas. Most audits review, assess, and test process and technology risks – typically it’s only biennially that audits are focused on reviewing people or human resources (HR) risks.

As the world around us and our employees change, so must the ways we evaluate HR. Evaluating operational, financial, vendor, IT, and compliance HR risks remains important, but if you stop there you would be missing three critical areas: recruitment, retention, and culture.

Recruitment

Talent acquisition continues to be a critical need in 2022, but will require leaders to rethink mobility, engagement, and how they approach their workforce.

In a recent study by Insights, a consultancy, business leaders were split on what would be a bigger challenge – hiring or retaining talent. 56% cited hiring as being the bigger challenge, and 44% cited retaining. But I think we would agree, in today’s market, the candidates hold all the cards.

Job openings were up 86%, hires were up 45% and job applications were down 11% from pre-pandemic levels (Q12020 vs Q4 2021) – this is the widest gap between openings and applicants we’ve seen.

More than 25% of American workers changed employers, more than ever recorded. Here’s how C-level executives anticipate the impact of missing hiring needs:

Source: Insights 2022 Workforce Report

We have yet to see these trends slow down. What can auditors do to help? Being aware of your organization’s current talent needs, related talent pipeline strategy, and average time needed to fill positions all help mitigate the recruitment risk. If you have identified recruitment gaps, here are five recommendations to offer HR and to improve your organization’s practices:

• Grow your talent pool
• Promote internal sourcing via career paths
• Reconsider job roles and necessary skills
• Utilize social media and highlight your employees

Retention

Once you have good employees, your organization needs to retain them. Helpful ways your HR department can improve retention include:

Assessing how HR keeps these leading retention practices current and relevant improves your organization’s chances of reducing employee burnout and increasing profitability.

Once these recruitment and retention elements are in place, what derailers should auditors be aware of? MIT recently conducted a study to understand the top reasons why 24 million Americans left their jobs between April and September 2021. Their analysis determined the top 5 leading predictors of attrition.

In this graph, each bar indicates the level of importance relative to employee compensation for a different driver behind attrition. A toxic culture is 10.4 times more likely to contribute to attrition than compensation. Leading examples of a toxic culture include failure to promote diversity, equity, and inclusion, workers feeling disrespected, and unethical behavior.

If culture is such an important element to the people side of your organization’s control environment, why did a recent IIA survey find that only 42% of organizations audit it? I believe the reason is because we haven’t been effectively trained to evaluate it.

Culture

“How we do things around here” is the essence of an organization’s culture. That phrase can’t get much more abstract, but culture’s importance can’t be understated. Several surveys show that positive corporate culture improves profitability, public perception, and employee satisfaction. Here’s what auditors can evaluate to see if their organization’s culture is positive:

• Start with ethics and whistleblower hotline reporting. Verify that executives or the board are promptly addressing any activity and use trend analysis to identify any patterns.
• How are standards of conduct communicated and reinforced in your organization?
• Is the CEO/board interacting with employees beyond the executive level?
• Are anonymous employee surveys used and the results acted upon?
• Review prior audit, SOC, SOX exam, or other monitoring report results to see if ratings are favorable or not. If they are unfavorable, are findings consistent across process, business units, or geographies? Are any findings repeats from a prior year?
• Are management remediation activities performed consistently and in a timely fashion?
• How are policies and procedures followed, and when deviations occur, how are modifications, exceptions, and escalations performed?
• What does social media say about your organization?

Human capital is an expensive resource. Not managing it properly will negatively impact your organization. Evaluating your audit results through the corporate culture lens will help you find bigger problems. Partnering with your HR professional to better understand employee recruitment, retention, and overall corporate culture will improve your organization’s future.