Become a Creator today!Start creating today - Share your story with the world!
Start for free
00:00:00
00:00:01
Balancing the Future Ep. 36 - Internal Audit Transformation: Building AI Savvy Teams and Smarter Assurance with Justin Van Beek
251 Plays8 days ago
What happens when internal audit has to move at corporate speed—and stay credible across third-party risk, compliance, and cybersecurity in the same day? Justin Van Beek shares a candid, practical look at how internal audit teams are evolving: higher tech expectations for “non-IT” auditors, smarter use of co-sourcing for high-risk or fast-changing areas, and the biggest downside of outsourcing—losing institutional context. He also explains why AI is now central to audit transformation and ROI conversations. If you want a clear view of where internal audit is headed and how to stay relevant, listen in.
Earn CPE by listening to this podcast through a Becker Prime CPE subscription.
Listen to this episode through your Becker LMS platform to complete practice questions, pass the final exam, and earn CPE credit.
Already a Becker Prime CPE customer? Login here.
Have access to Becker CPE through your employer? Earn CPE credit for this podcast however you consume Becker CPE, either through your company’s LMS or via the Becker platform. Not sure where to log in? Check with your CPE admin.
Learn more about CPE Podcasts from Becker: https://www.becker.com/cpe/becker-podcasts
Recommended
Transcript
Introduction and Speaker Backgrounds
00:00:02
Speaker
Music
00:00:09
Speaker
Welcome to another episode of Balancing the Future. My name is Chris Mitchell. I'm here today with Justin Van Beek. And we're going to spend some time talking about internal audit. But Justin and I go way back, way back to professional services.
00:00:22
Speaker
He watched me come up through the ranks. I watch him come up to the ranks. And today we are here ah sharing a message. And I think it's going to be an important message about internal audit and transformation, kind of where things are going.
00:00:33
Speaker
But before I do that, I do not want to steal his thunder. He has been a practice leader. And what I mean by practice leader, when you think about the second and the third lines of defense, he's played some significant roles for a lot of different organizations. So, Justin, welcome.
00:00:50
Speaker
And please, please expand on your background. I know I did not do you justice. So please share more with the audience. Yeah, great. Thanks, Chris. um Great to be here. um and yeah, as you mentioned, we had some overlap in our professional services, professional practices, career.
00:01:06
Speaker
um at Crow and you know since that time I've had the opportunity to work through a couple of roles in the second line as chief risk officer for a bank and for two banks in Michigan here.
00:01:19
Speaker
mean those roles have really helped me build out some of my um um ah practice practice ownership I guess of of the second line right so I think as you worked through mentioned you know with our our time at crow we really focused on internal audit execution of internal audit and related assurance activities and um you know i built through a period of four or five years um in those chief risk officer roles the ability to uh you know uh support that uh support that that that professional practice role that um um
00:01:58
Speaker
you know that i spent 13 years or so at crow learning and then i think uh with a recent acquisition came into a role as the head of professional practices at a mid-sized bank organization um so mid-sized bank organization typically 10 between 10 and 100 billion dollars and there my role focuses on execution um as well as methodology development for internal audit at function, the internal audit function of the organization.
Role Comparisons in Professional Services vs. Corporate
00:02:26
Speaker
So that includes everything from you know corresponding and dialoguing with training activities, with internal audit team members, from staff all the way up to the director, um as well as presenting on this the the quality of the of the function, the internal audit function through a variety of mechanisms, through the internal audit organizational chart, as well as the audit committee itself. um from ah from a performance performance metrics perspective. So excited to be talking through some of the opportunities that that exist in the internal audit assurance spaces with you here today.
00:03:03
Speaker
So you mentioned a lot of interesting roles. And I noticed that it's professional services. And then you jumped into what I consider corporate corporate, which means, you know, performing an executive leadership role.
00:03:15
Speaker
I mean, what's the difference? you We think they're the same as a professional services organization. We deliver a solution. But then when you're working within the confines of that organization, it's a little different.
00:03:28
Speaker
So help me understand, help the audience understand what that difference looks like, because you felt both of them. You felt you've been a part of both of them. So please share on that. Yeah, I think the the difference, um you know, there was expected differences and unexpected differences. i think the difference that has probably most remained for this conversation that was expected is just the level of detail is just immensely different. And the cadence is immensely different from professional practice or professional services to the to to corporate. So as you reference.
00:04:02
Speaker
um the level of detail that you have to have a handle on and how fast the conversations, um topics shift, topical matter shifts. You know, you're going to talking about a ah third party issue in the morning. You're going be talking about a regulatory compliance issue over lunch. And, you know, in the afternoon, you can spend your time talking about information security.
00:04:27
Speaker
And the amount of of rigor that you're bringing to each of those conversations has to be equal. and It has to be even throughout throughout all of them. And it's not a, gosh, I'm going to take that question back.
Evolving Talent Needs and Technology in Internal Audit
00:04:40
Speaker
um I do a little research, and you're not going to come back at you. and that i Not to say that doesn't happen, um but certainly the the rigor with which and the cadence with which you're expected to have.
00:04:55
Speaker
um knowledge on tap and advanced conversations that was something that was that was expected and desired um and maybe maybe the depth was expected and the the cadence was maybe ah maybe something that was unexpected right so the the um that those would be the big the big pieces that i think um were part of my learning curve as i transitioned for from ah professional services into into corporate as you say awesome awesome you know since we're talking about positions and talent and resources and we think about internal audit and we think about the resources that we onboard to make us successful
00:05:34
Speaker
How do you see that? And how does that mix of talent within that and that environment, within that org structure make sense? Because I know there's so many things changing and being transformative in nature like anything else right now, internal audit is.
00:05:51
Speaker
How does that look? I mean, I know you're in it right now. So how does it work for you and how does it look? Yeah, I mean, it's ah it's changing so fast um that if i told if I talked about you know the experiences I had when I first came into corporate, um so to speak, you know six or seven years ago, you know those are ah yeah that's at that's dinosaur age at this stage, um which is which is interesting. And it's dinosaur age, not necessarily because um because they the need for talent um
00:06:23
Speaker
is less it's just that the need for talent today compared to where it was seven years ago um is just so different right so i think the the the need for talent from an internal audit of perspective um you know there's some core talent expectations right you're personable um you can so you can you can ask questions and do interviews well yeah those are the kind of the things that you can suss out really easily with some interpersonal um interactions with an individual um But I think the piece that is really different from a talent perspective today is it's the topical matter and then it's the depth of the topical matter and the speed in which the topical matter changes.
00:07:02
Speaker
um You know, 2020, you know, everything changed in November 2022 when OpenAI came out with the, you know, the first and iteration of GPT. um And ah you know since then, everything is all about, know,
00:07:20
Speaker
how you can apply and how you understand artificial technology or artificial intelligence, right? The artificial neural networks and the large language models that make up AI, um how you understand them and apply them, right? And you know just like we, you know Chris, you and i when we were together, yeah we there was a joke about you know whether or not you were a digital native, right? Like whether you were you kind of young enough in the professional services realm to be considered a digital native, which was understood to be, at least as I understood at the time, was understood to be, you know, you grew up with kind of the personal computer, right? So around some of you know, you're born between 75 and 85, you really grew up with the, you know, the personal computer and computing power um as as part of the of the realm.
00:08:06
Speaker
So now I think, you know, the new the new metric is, um you know, everyone expects you to have deep knowledge of, you know, you know, the artificial neural network applications within within and within the practices framework.
Balancing Talent Acquisition and Outsourcing
00:08:23
Speaker
I mean, I think, you know, that that's the that's the big piece. You know, there are, you know, pockets of things, particularly within financial services, where you know, as you try to build out a team, um you you have to think about think about it almost like a draft, like the football draft, right? you're are you are you goingnna Are you going to draft the guy who's the highest rated on the board, right? Who's the most highly capable regardless of your need?
00:08:47
Speaker
Or are you going to draft the guy who fills a specific need within your function um And there's a couple of different ways to get after that. I think all organizations today recognize the need to have high caliber high caliber individuals in their in their organization.
00:09:05
Speaker
um But from a corporate perspective, or the real key difference is that you know, you, your, your budget constraints really limit you on the amount of effort you can put towards drafting the most highly capable person within it, within a specific function. Right. So I, you know, most internal audit functions, particularly the midsize bank realm.
00:09:29
Speaker
They have a hard time going out and recruiting engineers, right, who can support large language model development for internal audit. and That's something that we outsource so that, you know, that's ah's that's an area where from a capability management perspective, you have to figure out whether you're drafting the best.
00:09:44
Speaker
or you're drafting for a specific need, and you've got to be able to layer in and fill the gaps with outsourcing and co-sourcing. And that's not necessarily a change, but it is the flavor is the flavor profile is completely different just you know in seven years time since I came from from ah professional services into into corporate.
00:10:04
Speaker
So does it change the way you deploy resources? Does it change the roles up at any point? I mean, does it look the same, feel the same, or is that changing as well?
00:10:16
Speaker
Because there's been talk about you don't need everyone to be an AI expert. You just need some of your people to be AI experts. So speak to that. Speak to how the roles are changing and how you mix and mingle the talent that you have on board and who needs to be the expert when it comes to artificial intelligence to spend some time on that.
00:10:38
Speaker
Yeah. Yeah. look at it like this, Chris. I think, um you know, I've got a car in my garage. I drive my car to work every day. Do I know everything about that car? And, you know, could I build it from the tires up?
00:10:51
Speaker
Absolutely not. Right. But I can drive the car to work. And that's a useful tool for me um in in how i you know how I get to work. And I think that's the analogy that I would apply to you to kind of the internal audit role.
00:11:03
Speaker
No, you aren't going to have ah the staff expectation and the role expectation that that this that there will be a role on your team where there will be someone who can build a large language model for you on your behalf.
00:11:17
Speaker
That expectation, I think, is is um yeah you know, that's the 99th percentile type expectation if there if to the extent there is one, which I don't believe there is. think the expectation is that you know understand you have a driver's license to drive the car. In other words, you have to you have the ability to maneuver the car through traffic, sometimes heavy traffic.
00:11:37
Speaker
You have the ability to maneuver the AI model and get the model to to give back results that are repeatable, reliable, um you know, data driven. You have trust that there's some maintenance on the car itself, right? You've got to change your oil. You've got to understand the the data that the large language model is built on.
00:11:55
Speaker
um And all those things, I think, are certainly different, um you know, different capabilities than, you know, seven years ago um from from the perspective of the tools that are driving, tool that is driving internal audit.
00:12:09
Speaker
um And you've got a ton of factors that are that are applying to that too, right? that yeah you know You're driving your car to work and yeah the other the analogy would be that the rules are also changing, right? Data privacy is is is changing. the The computing power is changing. The um the social network and the dynamic with other drivers is changing. So there's a lot of tools that an audit person has to have on their tool belt.
00:12:35
Speaker
um to be able to operate really effectively at all roles, right? Not just, ah you know, the certainly national level roles where you're in learning um learning mode and sponge mode, but also in the contributing roles, right? You have to retool yourself and be able to have those tools on your tool belt in a way that supports staff and ah folks that are looking up to you, as well as other stakeholders who are looking at internal audit as a change agent and trying to support the organization's um you know uh strategic goals and strategic objectives so when i would i think about the past and the engagements that i've worked on and the structure of the team you got the manager the senior associate you've got the staff level person you've got your i.t expert i mean has that changed at all or is that makeup still the same and does it work and is it going to work moving forward
00:13:27
Speaker
I think, that you know, I'm curious, and I guess the audience might be curious as well, because that's what we're familiar with. You know, we're familiar with the manager, we're familiar with the senior associate, we're familiar with the staff of a person, and we know we need an IT person be involved in the equation. Does it look the same going forward?
00:13:45
Speaker
Yeah, i mean, that's an interesting question. I mean, I think um yeah kind of the question is is, in my mind, the question is is whether or not that that technology capability you know, now needs to be an expectation of um of a standard staff role. I think that's kind of where your where where your question's at, right, Chris?
00:14:04
Speaker
um And, you know, i think I think the level of technology capabilities that you have to have to be a staff person and a manager at this at this stage of the game,
00:14:15
Speaker
It probably looks not dissimilar. You probably have to have the equivalent level of capabilities set um that I would say a senior staff, a technology focused senior staff had to have um um back in the day where they were only focused on on technology.
00:14:31
Speaker
And that's the expectation now for just your normal internal audit person, right? They have to have an understanding of user access roles. They have to have an understanding of the database roles and rights.
00:14:42
Speaker
They have to have an understanding of where the data lives and and bree you know where it lives and is stored, I guess, maybe not where it breathes, but... um you know certainly where it's processed. Those are conversations that you know your standard internal audit, your standard operational internal audit person, um you know staff through manager even ah and even above,
00:15:03
Speaker
you know they I don't know, you know seven, 10 years ago, i don't know that they necessarily had to have that that skill set. But I think now it's absolutely pivotal, critical. And so I don't i don't know that there's necessarily a a need for, you know that it's such, it lives so closely within that staff and manager person that the that technology person isn't needed anymore.
00:15:26
Speaker
I think it's more that, hey, this technology person is still the subject matter expert in technology, but the staff individuals have to have the ability to apply technology related assurance principles in their daily work. And that that that level is way higher than I think it was um you know before.
00:15:45
Speaker
So you had mentioned earlier about outsource, co-sourced, however you want to look at it. I mean, what drives that in your opinion? um Because I know you've been on the professional services front and you've you've been a part of that solution set.
00:15:58
Speaker
um But when you turn on the walls and you make the decision to do that, is it because you need a resource? Is it because the There's a project that's coming up where the competency and the expertise may not exist within your your team. I mean, when do you make that decision to go outside of the organization to find talent?
00:16:18
Speaker
Yeah, I think it's a couple of things. I mean, in my you know my time where I've gone out engaged third parties, third party expertise um or staff, you know, you know I think that that the play is always, you know, are you you're borrowing the expertise or you're borrowing the, you know, the um the legs, so speak, ah the brains on sticks, if you will.
00:16:39
Speaker
um you know So in other words the people who go out execute your methodology, are you getting someone who knows something really has really deep expertise in artificial intelligence or um data governance or some specific regulation or requirement?
00:16:54
Speaker
I think it also i think the third thing is probably the the risk level of a specific audit segment. I would say that, you know, as I've and as I've spent time now on this side of the fence, so to speak, compared to professional services.
00:17:09
Speaker
you know, there are audits where. um where the level of expertise is is so high and is so deep and it's changing so frequently and the level of regulatory expectation and enforcement is you know ratcheting up.
00:17:26
Speaker
um you know Those are instances where you know folks have a really natural incentive to say, hey, you know I could spend all these all of my budget getting these two or three people you know, the capabilities and skill set to do this or um and that and and deal with the risk that one of them or several of them might leave. Right. Which puts you up in a in a bad situation. Or I can, you know, have a have a general set of knowledge. Right. They have the ability to drive the car. Maybe they can't build the car.
00:17:58
Speaker
um And I can go out and get an outside party to execute this this higher risk engagement for me. um And I think those are, you know, all of them are, you know, things you have to have your tool belt. I think there aren't any, or I wouldn't say there's few, not that there's not any, but there's few internal audit functions that I know about or I've been a part of, and certainly not ones that I directly led or interacted with, where they have it in some way, shape or form used, outsourced, co-sourced type of resources.
00:18:32
Speaker
um you know for for one of those three reasons right i don't have the staff i need them um right as i always feast or famine with respect to um staffing sometimes you're light on yeah your your junior lovers level staff that really need to be out uh that are out there you know, pounding the rocks, so to speak, getting the audit work done.
00:18:51
Speaker
um And, you know, sometimes it is just a matter of, um you know, fixing holes in the schedule from the perspective of I've got this commitment to cover this level, this number of audits.
00:19:02
Speaker
And the only way I'm going to be able to get it done with the with the FTE footprint that I have is to outsource or co-source couple audits. So when I think about that whole model and in having to leverage resources outside the walls of the organization, you know, I know them the p pluses.
00:19:18
Speaker
What's the drawback to going through an exercise like that? Because I know you've been involved. I think we we both have. Yeah. And we've experienced it to some extent. so what what what would you reference?
00:19:30
Speaker
Yeah, i mean, I think that that the easy one um or the one that's most frequently cited and that I've observed myself is, know, there's clearly an agency element, right? You lose some of the agency with with respect to how the audit is executed. um You know, even if you have situations where it's a co-source audit, right? So they're using your audit manual, they're using your sampling guidance, or using your audit template, or your audit report template, um you know, and they're they're basically filling in the staffing footprint for you.
00:19:59
Speaker
um you you still lose some of that institutional knowledge that an internal audit team would be able to have and this be able to execute on. I think that's, you know, so you know your trade off clearly is the the expertise on this specific topic that the're auditing that they're bringing to bear.
00:20:17
Speaker
um But certainly that loss of knowledge of the institution itself is something um something that you that you miss when you outsource COSORCE.
Coordination between Risk Management Lines
00:20:27
Speaker
um or do some other type of of staffing arrangement and you know i think you certainly being aware of those those trade-offs and understanding how you can work through them whether that's through a you know a kind of an integrated approach i've certainly done that in my in my time where hey i've i know that i've outsourced this audit or co-sourced this audit
00:20:49
Speaker
But I'm going put one of my strong managers in the and into the engagement um for a couple of reasons. One is to kind have that institutional sharing, knowledge sharing um with that outside audit team.
00:21:00
Speaker
And the other thing that that that benefits me is is they're also learning as as that audit is being executed around them or with them. And I think those pieces are really, really important as well. So that downside, that agency component, that expertise, that knowledge of the institution, um certainly a significant downside, but there are some some good ah some good frameworks you can have to make sure that um that it doesn't negatively or too negatively affect the the the outcome.
00:21:28
Speaker
You know, I think about once we get the team together and, you know, we want to make sure that we're transformative and how we're delivering excellence to the client, which are those internal laws. And for those in professional services, you know, we we know how that stacks up.
00:21:44
Speaker
But when I started thinking about that new roadmap and I started thinking about internal audit and I started thinking about that process and that approach, you start with the risk assessment, you know, you have your your audit universe and trying to figure out exactly what's important.
00:21:58
Speaker
And yeah you're trying to coordinate with all of those folks that are involved in the equation. I'd like to start with the coordination first um before we dive into the risk assessment and why so what some of those other legs may look like.
00:22:12
Speaker
Because when I think about coordination, I think about your two roles. I think it about the second line of defense and I think about the third line of defense. What's going on there? Where is that where the magic happens? Because I know you're covering the bases and some may know this, but some may not in in the audience.
00:22:28
Speaker
What does that look like when you're working together to be successful in mitigating risk within the business? Yeah, I mean, yeah I think it's ah it is. um it's not an elixir, but it's near one, right? I think everyone aspires to that level of coordination where those second and third lines are really symbiotic, where they're playing off of each other and the organization's really better for it.
00:22:53
Speaker
And I think, the you know, the the the it'll be interesting transformation as we get into um the new professional practice framework that the IA issued um in in um in 2024, right? Because one of the things that they really did there is they really put the onus on internal audit of functions to, um you know, it wasn't, it was no longer voluntary that they coordinated with those second line functions. It was a required. There's a must statement in there now, right? So it, it
00:23:24
Speaker
It was a an expectation of the internal audit professional framework that the internal audit functions really work through the process of coordinating with their their assurance activity with the second line assurance activity.
00:23:38
Speaker
I think that was a reflection of the fact that it probably wasn't happening as well we would have liked, um as well as organization organizations and enterprises really wanted it to. right Because if you think about it from the perspective of the first line,
00:23:51
Speaker
um You know, where the potentially the maturity of an organization is such where there's not a real on it real lot of, ah a lot of differentiation between second and third line. And all they see is I had, you know, staff person A come and talk to me about this. And i had staff person C come and talk to me about this. Seemed like they were talking about the same thing to me. um So, you know, why am I getting bothered by two people now?
00:24:15
Speaker
um Where I could have, ah seems like based on the topical matters of what they were discussing with me, I could have been bothered by one person. And that's the challenge that we're trying to sort through um with this coordinated assurance um activity. And um and in and the IA has really upped the onus on internal audit functions to to to execute on that.
00:24:34
Speaker
Now, where the gap still is, in my mind, just as a you know Justin Van Beek's perspective on on where things will will play out here. know, we have incrementally gone through the process of, you know, coordination reliance was talked about in the 2017 standards.
00:24:49
Speaker
um That wasn't the first time was introduced, but it was certainly introduced that there was an expectation, there was a should statement around um coordination and reliance activity from an internal audit from a third line perspective to the second line.
00:25:01
Speaker
um And then with the 2025 iteration, now there was a must statement on the coordination and a should on reliance, right? So where I think the conversations are going to go to evolve here, Chris, is that you're going to see organizations as they pick up that must piece on the coordination side and they start having those conversations at the boardroom. You're going to see them talking about, well, hang on, we're doing this exact thing over here and we're coordinating with them, but we're not relying on their work.
00:25:30
Speaker
you know, Mr. or Mrs. Audit Director, you know, help me understand what's going on here. Because it seems like there's some opportunities here where I'm not sending ah staff auditor and staff risk management person a and B to the first line to ask the same question, right? I think that's,
00:25:47
Speaker
um That's where the conversation is likely going, whether or not that'll transition in the next ah next iteration of the professional framework that the IA produces and they'll turn in turn reliance into a must as they did um coordination.
00:26:00
Speaker
yeah that's ah That's a TBD.
Maintaining Independence and Advisory Roles in Internal Audit
00:26:02
Speaker
I think there might be some fatigue with respect to um kind of the the the frequency and the rhythm with which the IEA is producing producing new new frameworks as it as it is today with the 2017 only being what seven, eight years old by the time they they replaced it with the 2024. see.
00:26:21
Speaker
You know, when I think about coordination, you know, always comes in the scope would be independent. And you know what it's like to be the third line of defense and you want to be independent. So are you crossing the line at all? Or do you feel like you're working with management in a different way and you're still independent? I mean, obviously,
00:26:41
Speaker
It depends on who you report into. You know, you got influence on the board and so forth and so on. But how do we maintain that quality independence? Because I just think about all that you shared. How am I still independent where I'm delivering the right message to executive leadership?
00:26:56
Speaker
Yeah, and that's that's the resistance, right? That's the resistance to reliance pieces that that I just talked about, where the the director ah the director of internal audit or the chief audit executive, you know, their response to the question I just posed, hey, we're doing it seems like we're doing the same work, their response is going to be something that is going to sync up with, well, I have to independently affirm and confirm um that this that this control activity is is working. And so that that line, that independence line,
00:27:25
Speaker
um absolutely know it's absolutely still there within the standard right i don't think there is a in my mind at least as i read the standards and understand the standards and apply the standards um yeah there's not there's not a blurring of independence. The expectation is that if you're doing the same work, you're going to there's a there's the loose expectation there's going to be reliance. And the way you preserve that independence when you're going through that coordination reliance activity is a couple of things. I mean, there's some practical things from the perspective of you know making sure that um
00:27:58
Speaker
um you things like the the directive and the remit of the second line function that you are coordinating and relying with and on and with um is is in fact, you know, formalized. So to the extent that there's an ability to rely on it, it really depends on the second line to have a formal remit from from a board level or a senior management level committee that orients itself around you know supporting the first line and the control activity that's happening in the first line.
00:28:30
Speaker
um And the level of formalization is the way in which we can affirm and confirm and maintain independence as ah as a third line. um Right now, the expectation is that you're you're evaluating that that charter, right that remit that the board has given to that second line.
00:28:46
Speaker
And you're making sure you have a really ah clear understanding of how they maintain independence. If they have issues, um where do those issues get reported up through? How do they go through the process of documenting issues? Is there a formalized process for making sure that um as they identify issues that they track them to resolution? Right. That's a common um you know early maturity challenge that many risk management and control audit functions have is is just tracking once you identify an issue or a change need, it's just tracking that change need all the way through to its conclusion um and ah and doing remediation work to support it. I think all those pieces help help maintain that independence and the expectation of independence. And it's it's a challenge, right? I think that's um you know that's not a it's not a one and done necessarily type of activity because there's going to be different flavors of risk management throughout an organization.
00:29:40
Speaker
um And some some elements of the risk management function are going to be more formal. um Some are gonna be less formal and some are gonna be maturing. And some are have a target maturity that's higher than where they're at today. i mean, internal audits function, and this goes back to kind of the expertise piece that we were talking about. The internal audits function and and being able to help those risk management functions, those second line functions,
00:30:00
Speaker
do their work um and be effective is going to require them to have a level of expertise that um that helps get them to where they need to be. um Because the initial audit of function, you know if there's anything that we've learned over the last 27 odd years of of assurance work is that internal audit can't be everywhere all at once. um And that is the second line's role is to not necessarily be everywhere at once, but they are certainly there are more interacting with management on day to day basis and have a control minded approach to interact with management on day to day basis.
00:30:33
Speaker
And that's where the magic happens, I think. um yet we were We talked about that you talked about when you introduced the question to me. I think the magic happens when you know internal audit and their point in time review or of an activity You know, they're going through and they're they're helping the ah the risk management function understand its remit and apply its remit in that first line better, right? They're providing feedback because of their specialized knowledge and expertise.
00:31:00
Speaker
um And the second line goes out and executes that on day-to-day basis, right? And I think, um you know, the organization's better off the end of the day because the third line is not, you know, third the third line is not doing a second line activity.
00:31:12
Speaker
In other words, they're not in there every day ah writing an audit report at the end of every day about what's going on and what's what's not going on that supports the organization's business objectives. and I think that's the that's the magic that we're looking for. um And, you know, the the way in which I think the the independence holy grail is um um is is is met.
00:31:32
Speaker
You know, I'm going to ask you a question as it relates to testing. And it's not really about testing. It's about discovery. And we want to make sure that things are running according to plan, that everything is effective.
00:31:45
Speaker
So when I think about effectiveness, there's a lot of different ways to arrive at that. I mean, I've got to select of samples. I've got to be comfortable through interviews. I've just got to understand that the right coverage is in place. How do I get there?
00:31:57
Speaker
Because it's not testing everything anymore. I mean, I i get now ah the advisory component of it. and Okay. And, you know, you can take this however you want to take it.
00:32:08
Speaker
um Because I also see, but so I want to make sure I'm independent because I'm advising, but I also want to make sure I'm more efficient. when it comes to hoping us be successful from a controls perspective. And it's not all about testing everything.
00:32:24
Speaker
It's about being able to sit with management and have that conversation, in my opinion. How do you see that? Yeah, I mean, i think the the the standards give you a ability to give you internal audit functions, the ability to to perform an an advisory role.
00:32:39
Speaker
um yeah There's some good safeguards in the standards around yeah know working with working through the process with management of building out the scope and of advisory function so that it's clear that there's ownership of the end result by management and thus preserving that independence. Holy grails we've talked about.
00:32:58
Speaker
um But I agree that that advisory component um is it's important from the perspective of building relationships in a um in a setting where you know where thatre in a setting where the effectiveness component and the opinion of ah of a business process isn't necessarily the the sole outcome.
00:33:16
Speaker
In other words, you know the so one of the the primary outcomes of an advisory role is hey, yeah we've gone through this implementation process of this system, cost us a lot of money, spent a lot of time on it, um and we wanna know that it works. right I think a lot of people are gonna be having this conversation with respect to AI here this year um when it talk when they speak to or when they talk about, hey, we spent,
00:33:40
Speaker
you know we spent a fair wad getting this AI solution in our doors and implemented. And now I want to see the ah ROI on that. Right. i think that's great. That's a great use case for this advisory role.
00:33:54
Speaker
The internal law is going to go in there. Hey, how we proved out our investment, our return on investment for this AI type of um a solution that we've implemented or tried to implement in the in the business.
Future of Internal Audit: AI and Technology Transformation
00:34:07
Speaker
that is um you know that's gonna be a critical critical use case for for that advisory role, um you know from that from from that perspective. And I think that's gonna be, um You know, you're going have a lot of real keen in conversation, I think, in boardrooms here in the near term as internal audit functions start to pick that up and start to work through.
00:34:29
Speaker
hey yeah you know, maybe our, um you know, our our our appetite was a little bit bigger than we thought it was with respect to investment in AI compared to the actual um return on investment.
00:34:41
Speaker
You know, I think about transformation being key for a lot of businesses and in your because I know we're we're almost out of time here. But when when it applies to our profession, I mean, what's that takeaway? What's transformative in your mind that's really going to make a difference?
00:35:00
Speaker
We spend time today talking about people. We spend time today talking about risk, independence. you know, how the second and the third line are working together. We also spent time talking about how we organize our people for success when we go out on engagements. What's that takeaway? What's that? What's that thing that's going to really transform internal audience, in your opinion, as we move forward into the coming years?
00:35:25
Speaker
Yeah, I mean, I think transformation and and audit transformation, it's um you know it's hard to pick out a single thread um that is that, you know, from yeah the macroeconomic environment, from the policy setting environment, from a technology um that's available and that's evolving, just from a ah cultures and mores type of viewpoint.
00:35:51
Speaker
You know, if I were you know to pick one of those threads out and say, hey, this is the one that's going to transform you know how internal audit executes its role um in the in the near term.
00:36:03
Speaker
you know, clearly there is a yeah it's a it's a bimodal monster in my mind of, hey, I need to have ah the capabilities skill set that matches where the business is going um and where the business is going is likely an AI focused.
00:36:21
Speaker
Some type of Ai supported um activity right, so I need to have people who can support that support that mindset support that transformation of the business itself. And I have to have my own technology tool belt tool sets that that support that and I think that's the transformation that's happening right now and internal audit it is, or um you know, from a GRC platform perspective.
00:36:44
Speaker
um you know, understanding where you're great at getting the bang for the buck from the perspective of time and resources and the, you know, really having the data to support res, support and audit plan allocation.
00:37:00
Speaker
That's, that's going to be transformative, right? We can no longer say hey, this is, we're going to do this audit, even though it's a low risk area, because we audit every low risk area every three years.
00:37:12
Speaker
can't I think that's going to be the transformation piece that's going to be affected by having so you know having better staff pay having better staff capabilities, having better technology, is now we can support, hey, this this low risk area, we we are we're going to allocate our resources and we can prove that we can allocate our resources better to these other areas that are going to support the business in um in a more meaningful way.
00:37:36
Speaker
i think that's going to transformative for internal audit functions here in the in the future. Fantastic. We have had a really, really sound conversation. I do appreciate your time. I know that you are a very busy man.
00:37:50
Speaker
appreciate you. Do not let this be the last time you come back and share these nuggets because ah it was very valuable for the audience, I believe. And um I think you're spot on in a lot of areas. But I do thank you because, again, i know time is precious.
00:38:06
Speaker
Yeah, no, I appreciate it I'd be glad to be on. You know, there's a lot of topics to talk about when it comes to internal audit and assurance work. And, um in you know this stage and in my career. It's great to be able to share some of the experiences to the extent that they can help folks as they're developing their own careers in in this line of work.
00:38:25
Speaker
All right. As I close this out, I'll look into the camera and I'll say this. Internal audit is going through a transformation. They're looking for different people that get the job done. they're trying to use tools that are going to make us more successful, more efficient, and probably just make logical decisions from an advisory perspective as we continue to figure out how effective we should be, you know, at the end of the day as an organization. And I think there are a lot of things we can point to, and it won't be just how much we test, but it's going to be how we collaborate and using the tools and being successful at the end of the day. So I thank you for chiming in and being a part of another episode of Balancing the Future. And I look forward to the next conversation.