Targeting cyber-fraud: Is your organization secured against Web-based exposures? (Cover story, February 2002)
Internal auditors have always had to play detective to some degree as they sort through data and piece together facts. Today, with threats to computer systems coming from all over the globe instead of from just within organizations, many auditors have to think like federal law enforcement and intelligence agents as well.

Cyber-crime has moved information security way up the priority list for some organizations. For internal auditors, that trend means a growing need to watch for clues that cyber-fraud is taking place, to get creative in tracking down cyber-criminals, and to learn how to stop Internet-based crime before it happens. Auditors might not have famed Hollywood spy James Bond’s high-tech gadgets at their disposal, but there are a few tools they can use in the battle. The first is knowledge.

“Auditors need to understand that there has been a change in the paradigm of how business is being conducted and how information is being stored, and they need to be aware of the cyber-threat,” says Howard Cox, Acting Deputy General Counsel with the U.S. Postal Service who is part of a group that conducts IT audits of postal computer systems. “If you don’t recognize the threat is out there, you can’t protect yourself against it.”

To recognize the threat, auditors must have a firm understanding of the technology used to perpetrate cyber-fraud, says Alan Oliphant, an information security and audit consultant in Edinburgh, Scotland. “This may be the 21st century, but we still have a need for specialist IT auditors rather than expecting all auditors to have knowledge and understanding of the technology which is used to run businesses. The majority of auditors still lag behind the fraudsters when it comes to using technology.”

Training as a Retention Tool (Cover story package, October 2001)
Luis Martinez has always kept his eyes on the carrot. The former internal auditor knew he wanted to be a corporate leader from the time he joined Lockheed Martin six years ago fresh out of Notre Dame with a mechanical engineering degree. Since then, he has methodically planned out each step of his career. Today, as a change management project manager at Lockheed’s Orlando site, Martinez looks back on his one-plus years in auditing as one step that made all the difference.

His scenario is a common one: Auditors stay with the job for approximately three years, learn what they can, and then move on – often taking jobs with other organizations that reap the benefits of their training. But for the past few years, major employers have launched innovative training and development programs to entice their auditors to either stay in auditing or take promotions within the organization so they keep their skills “in the family.”

Wal-Mart, which employs 325 auditors worldwide, was feeling the effects of a trend among today’s workers to migrate to new jobs every two or three years as a way to move up the corporate ladder. So a few years ago, the audit department put together a team of internal auditors and audit supervisors to create an improved training and development plan for high-potential employees.

The effort resulted in a program that rotates workers in and out of the audit department, where they get to see parts of the company and associate with top-level leaders they wouldn’t have been exposed to in other jobs. In exchange, these auditors commit to serve at least two years with the company after their training and take 40 hours of job-related education annually.

The program is aimed at encouraging young, talented workers to remain with the company, even if they don’t stay in auditing, says John Lewis, chief audit executive for the global retail chain. “You really don’t try to keep people in internal auditing,” Lewis says. “Most people look upon internal audit as a grooming ground for something else.”

This new generation’s workers are more aggressive about their career goals than their parents and grandparents were, Lewis says. It’s not even about money. On Wal-Mart’s annual employee surveys, compensation is not at the top of the list. It’s about career growth. “You have to give them opportunity or you’re going to lose them,” Lewis says.