As the market for qualified risk, audit and compliance professionals continues to be short on supply but high on demand, competition for the best resources is intense. Stuart Fagg spoke to two firms to find out how they’ve navigated the issue and got their tips on recruitment.

At the moment, most conversations with risk, audit and compliance professionals inevitably lead back to the issue of resourcing. It doesn’t seem to matter what industry or type of organisation they’re from, the problem is always the same. Too many positions to fill and not enough qualified candidates to fill them.

One senior risk professional said recently that towards the tail end of the recruiting process for a mid-level risk/compliance professional he was stunned to find that the candidate had several other offers, some with five-figure increases on the salary he was offering. This is not unusual. Then there is the time factor several large companies reported recruitments taking up to seven months to complete.

So while regulators such as APRA are at pains to remind boards and senior management not to take their eyes off the ball in terms of risk investment, many are paying premiums to fill necessary positions.

While the largest corporate groups are able to draw on large internal talent pools, for many organisations the current recruitment crisis is a big problem.

It’s also an issue that’s hitting home at the regulators, which find themselves in the unenviable position of not being able to compete on remuneration alone.

“We have no problems recruiting quality graduates; it’s keeping hold of them that’s an issue,” said one senior official at APRA who asked not to be named. “The other problem is that they get great and varied industry experience with us and it’s that kind of experience that the private sector is willing to pay for.”

Gary Anderson, managing director of risk and audit advisory firm Protiviti, has experienced the situation first hand. Protiviti launched just over a year ago and since then has managed to hire 75 risk, compliance and audit professionals to service growing client demand. In this environment, Anderson found himself competing with the big four accounting firms, the corporate market and the regulatory sector.

“Every single person we interviewed and made an offer to also had other offers either from specialist firms or corporates and the big four,” said Anderson. “The market is tight, but there are a range of good quality people out there. It’s tight because of the number of competing parties for the resources. Particularly, the banks and some of the other big corporates are trying to resource up for compliance and Basel II activities.”

Peter Whyntie, head of risk management and compliance at Zurich Financial Services has also recently been wading through the recruitment quagmire, with some success. “Being a mid-sized financial services company, our risk management team is quite small,”he said. “We tend to need to recruit people that can hit the ground running. That tends to mean that possibly we are a little more demanding on our recruiters.”

Both Anderson and Whyntie said it was key to ‘work’ your recruiting firms and if possible, take a portfolio approach using multiple providers and internal networks. It is also key to ensure that your recruiters understand exactly what you are looking for.

“We found that in risk management a lot of the headhunters tend to think ‘risk management is audit’, because risk management is about checking controls,” said Whyntie. “I overcome that issue by having a strong relationship with our own auditors. I don’t think for a moment that auditors don’t make good risk managers, but a traditional internal auditor with a long background of just doing traditional audit ‘ticking and flicking’turned out not to be the right profile.”

Added Anderson: “We have worked with a broad range of sourcing providers probably 10 different agencies as well as our own international networks and internal staff referrals.”

Being very clear about the type of person you’re after is also a key point, and one which is likely to save you time and money.

“We do not have an army of risk management people in the business to do risk management; we require business managers to manage their own risk management,” said Whyntie. “That then means that the risk management professionals that I recruit need to be people that can work very closely with the business managers and influence the business managers and facilitate their taking ownership. They coach, provide the tools and the methodologies and we will go in and coach the business managers to own risk.

“The nature of the professional I am looking for is someone that is able to have a strong knowledge of risk management as a discipline, be able to quickly obtain a fairly deep understanding of the business itself and then have the competencies to be able to facilitate with senior management. It’s starting to look like a pretty rounded person. Then that gets to the question of how deep is the market? It is very difficult to find those people.”

Selling the nature of the role and the support and career development aspects of a risk management, compliance and audit role is also a key issue. While remuneration may be a major consideration for some, for others career development may be more important.

“We have a strong focus on training and we put the dollar value of training to people,” said Anderson. “Last year we spent more than $7,000 per person on training. The completion of personal and professional development also counts towards the incentive payment portion of their compensation as well, so it’s a dual hook. We’ve also been more flexible in hiring people with industry experience than traditionally in the big four and consulting firms.

“Often people that have been out into industry and have maybe eight years of experience are difficult to integrate back into a partnership structure, but our model of placing people out at corporate sites for some time suits those kind of people very well. So we’ve accessed a range of people that others may not have been able to.”

The evolving nature of risk, compliance and audit roles also allows companies looking to fill in-house roles to articulate the opportunities for candidates with one eye on a seat at the top table.

“It is a very new discipline, but one of the things to take note of is that the role of the risk professional is now starting to be enshrined in various guidelines,”said Whyntie. “For example, the recent APRA guidelines for general insurers require an equivalent position of chief risk officer. Seniority of chief risk officers and chief compliance officers in companies today, compared to five to 10 years ago, is much greater. All now have direct reports to the boards. You’re getting at the top table. Whether you come in to risk management as a junior and work your way up to the CRO position, or whether you come into RM and take the opportunity to gain experience elsewhere, and return to a senior position, that depends on the organisation.

“You’re getting exposure as the adviser to executives in the business, but you’re also reporting to the board on how the business is traveling that gives you exposure you wouldn’t get elsewhere.”

There is also the question of risk as a career, or as one element that makes up the DNA of tomorrow’s business leaders. Many senior business figures look favourably upon those with rounded experience of all operational aspects of the business, so it may pay to offer candidates some diversity in their roles and career paths.

“I like to try and position the role as one that will give very broad exposure to the business, and I would expect people to be looking at life after a job with me in risk management,” said Whyntie. “If people want to do risk management for their whole career, I’m glad to have them, but if after two years people are interested in going into other parts of the business, I’m fine with that. That means we are sending people into other roles in the business with a sound understanding of risk and compliance.”

Despite the problems for those attempting to recruit in the current market, the shortage is good news for practitioners themselves, and indeed for their professions. While internal audit has always been a solid career choice, auditor jobs in recent years have evolved into a totally different proposition compared with 10 years ago. Meanwhile, compliance is now a career in its own right, rather than a bolt-on legal role.

Likewise, risk management is now increasingly being seen as a potential career for graduates.

“We have had to compete with a lot of firms, but I’ve been pleasantly surprised by the number of graduates from economics, finance and IT that are looking in a knowledgeable way at careers in the risk and audit field,” said Anderson. They’ve done their homework and have looked around and they know this is a developing area.”

But more structure could be needed in smaller firms looking to attract quality staff.

“It’s really only in the larger corporates and the big four that there are clearly defined career paths available,” said Anderson. “The smaller corporates are struggling to clearly articulate a compelling career path for people in this area.”