Requirement
The entity demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.
Points of Focus
Establishes Policies and Practices
Requirement: Policies and practices reflect expectations of competence necessary to support the achievement of objectives.
Evaluates Competence and Addresses Shortcomings
Requirement: The board of directors and management evaluate competence across the entity and in outsourced service providers in relation to established policies and practices and act as necessary to address shortcomings.
Attracts, Develops, and Retains Individuals
Requirement: The entity provides the mentoring and training needed to attract, develop, and retain sufficient and competent personnel and outsourced service providers to support the achievement of objectives.
Plans and Prepares for Succession
Requirement: Senior management and the board of directors develop contingency plans for assignments of responsibility important for internal control.
Considers the Background of Individuals
Requirement: The entity considers the background of potential and existing personnel, contractors, and vendor employees when determining whether to employ and retain the individuals.
Considers the Technical Competency of Individuals
Requirement: The entity considers the technical competency of potential and existing personnel, contractors, and vendor employees when determining whether to employ and retain the individuals.
Provides Training to Maintain Technical Competencies
Requirement: The entity provides training programs, including continuing education and training, to ensure skill sets and technical competency of existing personnel, contractors, and vendor employees are developed and maintained.
Explanation
The organization must hire, train, and retain people — employees, contractors, and vendor staff — with the skills their control responsibilities demand, screen their backgrounds, and plan for succession in key roles. Auditors care because controls are only as reliable as the competence of the people who operate them.
