We receive many inquiries from companies that are preparing to go public or that are expanding globally: positions for internal audit staff and cybersecurity personnel remain unfilled for six months or even a year.
However, the essence of this problem is not that it is "difficult to hire" itself. If internal audit departments and security functions remain effectively inactive, companies are exposed to greater risks of scandals and poor governance. In this article, we will explain the structure that causes internal audit and security functions to malfunction, and the measures that companies should take from both the perspectives of recruitment and authority design.
Contents
- 1. What happens when the internal audit department is not functioning?
- 2. Why internal audit/security doesn't work?
- 3. Measures: Fundamental improvement of governance and review of recruitment and authority design
- 4. Cannot be addressed without leadership from management and board of directors
- 5. Companies preparing for an IPO are a topic that cannot be overlooked.
- Summary/Conclusion
- Recommended articles
- Author
1. What happens when the internal audit department is not functioning?
When internal audits and security functions become a mere facade, it becomes a breeding ground for scandals. As the ability to point out and make recommendations from an independent standpoint regarding management decision-making and on-site business processes ceases to function, internal controls as a whole are left in a weak state.
It is still fresh in our minds that from 2025 to 2026, there was a series of reports of corporate scandals involving accounting fraud and false statements and concealment of information. At a major electrical parts manufacturer, fraud related to the accounting treatment of group companies was discovered, and a third-party committee report pointed to multiple structural causes. In addition, the results of an investigation were made public that found that a major electric power company had made false statements and concealed information regarding safety-related materials, and it was pointed out that “heavy pressure to restart operations was justifying fraud.” I will not name the companies, but I'm sure many of you have seen the coverage.
On the security side, the picture is the same. There is no end to reports of ransomware attacks targeting domestic companies and supply chain attacks via business partners and subcontractors. In most cases, after an incident occurs, questions are asked, such as “Why couldn't the abnormality be detected sooner?” “Why wasn't the correct information conveyed to management?” This also shows that the ability to point out and make recommendations from an independent standpoint during normal times was not working.
What all of these have in common is that after a problem occurs, the question is asked, “Why didn't internal audit or the governance function notice it in advance?” Leaving internal audit and security personnel positions unfilled is not just a problem of vacancies, but also means that management continues to be unprepared for such situations.
2. Why internal audit/security doesn't work?
When we look at the companies we actually consult with, we can broadly categorize the causes of malfunction into three categories.
2-1. Cause A: Low position within the company, unable to demonstrate independence and expertise
A common situation – Job postings and internal role definitions are limited to a list of tasks such as “conducting audits based on regulations”, and discretion and influence are not conveyed. – The role of security personnel is limited to the “defensive” side of incident response. – Security personnel are operated with an ambiguous sense of distance from management and business departments (whether they are independent or close to the business side) – The internal audit department is positioned as a "one-time job for general affairs and accounting" and there is no dedicated person assigned.
Points to review Both internal auditing and security are positions that can be involved in decision-making that is directly connected to management. The starting point is to reposition work as “work that provides material for management decision-making and protects and grows the business,” rather than “work that is carried out according to regulations.”
2-2. Cause B: Centered on veterans, young people are not nurtured and cannot be hired in the first place
A common situation – Most of the employees are veteran employees, but young people are not assigned, and the next generation of specialist talent are not being nurtured within the company. – Even if you ask an IT recruitment company, you cannot find a candidate who is “dedicated” to security, and even if you ask a recruitment company for management departments, there are few people with practical experience in internal auditing. – You rely only on recruitment through your own recruitment site, and candidates with experience in side jobs, outsourcing, or concurrent work at other companies are not considered – As there is little experience in hiring positions dedicated to internal auditing and security, and there is no knowledge of compensation rates within the company, the company tends to apply grade charts for general management and IT departments as is, which deviates from market standards. - It has not been determined how certified internal auditors and information security-related qualifications will be reflected in evaluations.
Key Points for Review Both internal audit and security personnel fall into the “niche” of general job categories. Using specialized channels, which are strong for candidates with experience across multiple fields such as IT and governance, accounting and technology, etc., and deepening your involvement through outsourcing and advisory contracts, rather than insisting on hiring full-time employees, is also a realistic way to expand your population. It is also important to understand external market prices at an early stage and not simply apply your own grading system.
2-3. Cause C: Audit manager/security officer cannot speak to upper management
Common situations - The internal audit department's reporting line is placed lower than the person in charge of the department being audited - The design is such that the security officer cannot exercise incident response authority without the consent of the on-site staff - Management themselves cannot verbalize what they expect from the internal audit and security functions and are left entirely to the on-site staff - There is an internal dynamic in which matters pointed out in an audit can be watered down by a single pushback from the target department.
Key Points for Review In the case of internal auditing, a direct reporting line to management, and in the case of security, a position that can be involved in decision-making needs to be designed not only as an explanation at the time of recruitment, but also as actual authority. If this is not followed, the more specialized personnel will give up at an early stage.
3. Measures: Fundamental improvement of governance and review of recruitment and authority design
None of the above three causes can be resolved by taking simple measures. This is because simply improving recruitment, such as changing the wording on job postings or increasing the number of agents, will not solve the "positioning" and "authority" issues raised in Causes A and C.
When redesigning job postings, we recommend that you verbalize three perspectives before you start recruiting: “How will this position be involved in management decisions?” “How is the balance between expertise and the discretion to express opinions independent?” and “What career paths are available after joining (such as a path to becoming a CISO or a governance officer).” Even if the hiring process goes well, if the privileges handed over after joining don't match the description given at the time of hiring, the same problem will just happen again.
4. Cannot be addressed without leadership from management and board of directors
In practice, human resources is often the point of contact for reviewing internal audit and security functions, but decisions about the level of expertise required and how much authority should be delegated within the company can only be made by management and the board of corporate auditors. If you decide on requirements and conditions based solely on human resources, at the final stage you may hear someone say, “That's not the level I was looking for,” and the selection process may go back to square one.
Before you start recruiting, discuss with management and the board of auditors how much independence and authority you want this position to have. This is the starting point not only for smooth hiring, but also for radically improving governance.
5. Companies preparing for an IPO are a topic that cannot be overlooked.
This theme becomes especially important for companies preparing to go public. In the IPO preparation process, the construction of internal controls itself is subject to review, and the effectiveness of the internal audit function is strictly questioned. However, if an internal audit department is established with the idea that “just the formalities need to be in place before the company goes public,” the reality of governance may not catch up after the company goes public, and problems may surface later.
When recruiting, highlighting the dynamic role of building internal controls in the IPO preparation process, which is unique to the growth phase, will greatly change the appeal to highly specialized candidates.
Summary/Conclusion
If the internal audit department and security functions are left unfunctioning, it can lead to risks that shake up management itself in the form of scandals and failures in internal controls. In addition to the scarcity of the market, there are many cases where there is room for companies to review their internal positioning, selection of recruitment channels, understanding of compensation rates, reporting lines, and authority design.
At Global Career Incubator (GCI), we provide support focused on management, organization, and human resources, in addition to introducing specialist talent in the internal audit and security fields, as well as offering advice on redesigning job postings, consulting on compensation rates, and advice on authority design. If you are having trouble recruiting for niche positions or strengthening governance, please feel free to contact us.
Recommended articles
Author
Global Career Incubator Co., Ltd. CEO Shinichi Ikawa
Biography: Entered the business world after working for the Ministry of Defense (National Class I) and the Australian Ministry of Defence. After working at a major real estate company, he started a real estate venture and experienced management and recruitment at a domestic fund, domestic business company, and overseas tech company before founding our company.
Based on my experience as a corporate management and recruitment manager, I support corporate management, organization, recruitment, and training, as well as individual career selection and ability development. At the point of contact between Japan and the world, we face the challenges faced by companies and individuals alike.