All Things Internal Audit: The Profession at a Crossroads: Reinvent or Risk Irrelevance

00:00:02 The IIA

The Institute of Internal Auditors presents All Things Internal Audit.

00:00:06 The IIA

In this special episode, we brought together 2 bold voices in the profession.

00:00:10 The IIA

Tom McLeod and one of our own leaders at the IIA, EVP Brad Monterio, for an honest, future-focused conversation.

00:00:18 The IIA

They jump into the big questions, like how should the internal audit profession in the IIA evolve?

00:00:25 The IIA

What does intelligent, integrated assurance look like?

00:00:28 The IIA

And how will AI, agile learning, and global influence redefine what the Institute stands for in the years ahead?

00:00:38 Brad Monterio

Tom, nice to see you again.

00:00:39 Brad Monterio

I enjoy engaging with you as always, because I always felt that you have, or I feel that you have big, bold ideas and perspectives about many things, including the future of the global internal audit profession and the value that the internal audit profession can provide to the public and private sectors.

00:00:56 Brad Monterio

And I know you're not shy

00:00:58 Brad Monterio

sharing your thoughts and to some, your ideas may be too bold or too scary.

00:01:04 Brad Monterio

And that's okay.

00:01:05 Brad Monterio

Change is uncomfortable for many.

00:01:06 Brad Monterio

And yet for others, your ideas might seem to be right on target.

00:01:10 Brad Monterio

And regardless of where someone falls on that spectrum, I think, you know, it's, I'm probably somewhat safe in saying that you want the best for the profession and how the IA can best serve their professional needs now and importantly in the future.

00:01:26 Brad Monterio

And so you have said the IAA can lead the next frontier of our profession or become a footnote in its transformation.

00:01:34 Brad Monterio

And I thought this would be a good place for us to begin our chat together and for our listeners to better understand your perspective and also for us to share some insights into how the IAA is approaching some of the challenges that you've raised.

00:01:48 Tom McLeod

One needs to start with any talk at this juncture in our history, not so much about the institution, but about the profession as a whole.

00:01:56 Tom McLeod

Internal audit has been useful, essential and vital to the proper functioning of organisations for hundreds of years, thousands of years.

00:02:07 Tom McLeod

It may have been in different guises and different names, but there's always been that checks and balances need that it's existed.

00:02:14 Tom McLeod

As we progress through the history of technology and the history of time, there has always been junctures where people have looked back and thought or been in those junctures and tried to identify whether we were still relevant, whether there was still a need for checking.

00:02:28 Tom McLeod

And we've always come out on the right side of that ledger.

00:02:30 Tom McLeod

We've always been part of the conversation.

00:02:33 Tom McLeod

AI

00:02:34 Tom McLeod

isn't new, obviously.

00:02:35 Tom McLeod

It's been born out of the code breaking of the Second World War.

00:02:40 Tom McLeod

But what we're starting to see over the last three years or so is the popularization and the scaling at a level that we've never seen before, to the point that esteemed people like the CEO of Alphabet, the owner of Google, calls it as profound an invention as the invention of fire or electricity.

00:02:58 Tom McLeod

And if one looks at it in those terms, then we as

00:03:01 Tom McLeod

And all professions have to ask ourselves the most profound question, which is, how is it impacting us?

00:03:09 Tom McLeod

What would we be doing differently?

00:03:10 Tom McLeod

What should we be doing differently?

00:03:12 Tom McLeod

It's within that guise that I've both been absolutely energized after 30 odd years working in internal audit, to be as energized as I am now has been a real flip and a wonderful flip.

00:03:28 Tom McLeod

I've been really energised about the potential that AI can bring to internal audit.

00:03:33 Tom McLeod

And at the same time, I've been massively concerned about the threat.

00:03:39 Tom McLeod

There is too often in internal audit the need to set up a committee to consider an issue, to develop a position paper, then to have a discussion, to then have another committee to then have a further discussion, and then finally to decide on a policy.

00:03:55 Tom McLeod

That's a time frame and a framework that doesn't help or doesn't exist in a world where 3 weeks ago we couldn't produce realistic videos and now we can.

00:04:06 Tom McLeod

It's something we need to really think things through.

00:04:10 Tom McLeod

So it's in that context that my challenge to the profession is 1 out of deep love and affection for the profession.

00:04:15 Tom McLeod

I wouldn't have dedicated 30 years of my life to it if I didn't have that deep love and affection, but to continue to be relevant, to continue to be part of the conversation,

00:04:25 Tom McLeod

to continue to be out in front of the conversation, to continue to ask ourselves some very hard questions, and to continue to ask ourselves not only things about efficiency, but about effectiveness of what we're doing.

00:04:38 Tom McLeod

And perhaps most importantly, to continue to ask ourselves things such as, does independence still matter?

00:04:45 Tom McLeod

And the reason why I always come down to that as a pillar is that

00:04:50 Tom McLeod

Of those 30 years that I've worked in internal audit more, 99.9% of the time, I never once stopped to think about whether independence mattered.

00:04:57 Tom McLeod

Whereas if we're all diving into the same pool of data, we're all relying on the same indicators, that by definition is not independence, independence of data source.

00:05:08 Tom McLeod

We may still have independence of mind.

00:05:10 Tom McLeod

And so these are the things that are starting to be brought about.

00:05:13 Tom McLeod

Then as it relates to the Institute of Internal Auditors, there is

00:05:17 Tom McLeod

And this is a comment, firstly, about all professional associations.

00:05:21 Tom McLeod

We are agnostic to AI.

00:05:23 Tom McLeod

We are living in a world where we self-educate ourselves through podcasts, through YouTube, through a whole myriad of different mechanisms.

00:05:32 Tom McLeod

We no longer need to be educated by a central authority to be appraised of the current issues.

00:05:40 Tom McLeod

And so any professional association is finding itself at an existential moment in terms of, and rightly that should be a funding source for every professional association.

00:05:49 Tom McLeod

So I don't want to suggest that's sullied or in any way, shape or form.

00:05:53 Tom McLeod

But we are now in this situation where if I can educate myself on the new developments in AI, if I can educate myself on the new developments in business in general, if I can educate myself to use a non-AI example on the impact of tariffs in a global context, and I'm not going to speak partisan in any way, shape or form there, but more broadly, and go outside the normal boundaries, then you have an extraordinary opportunity, an extraordinary threat to the revenue model that then drives

00:06:22 Tom McLeod

a lot of the development of standards and things of that nature.

00:06:25 Tom McLeod

So I get back to that we're in the most important moment in the history, not of, perhaps I'll rephrase it, we're in the most important moment, not of our generation, not of our career, not of our lifetime, but in the history of our profession is right now.

00:06:44 Tom McLeod

And I want us to be having the big debates.

00:06:46 Tom McLeod

I don't know the answers, no one knows the answers, but everyone has the questions we should be asking.

00:06:51 Brad Monterio

I completely agree.

00:06:52 Brad Monterio

I think that we are living history right now.

00:06:55 Brad Monterio

And folks will look back on this moment in time.

00:06:58 Brad Monterio

It's a small blip, right, in an eternity.

00:07:01 Brad Monterio

But they will look back on this moment in time and realize that we were part of history, we were part of something big, and we had an opportunity or we have an opportunity to continue to be part of that and help shape that.

00:07:13 Brad Monterio

I think what you talked about where it's both sort of exciting and a little bit maybe scary in some ways,

00:07:20 Brad Monterio

where we are right now, I often say it's like licking honey off of a knife.

00:07:25 Brad Monterio

It's like, you know, it can taste sweet and where's the reward, right?

00:07:28 Brad Monterio

But there's also the risk of cutting yourself.

00:07:30 Brad Monterio

But you're willing to take the risk because it tastes so sweet.

00:07:32 Brad Monterio

And I think that, you know, we are at an interesting time and it is not just like an incremental business improvement.

00:07:41 Brad Monterio

This is transformational.

00:07:43 Brad Monterio

This is disruptive.

00:07:44 Brad Monterio

This is causing organizations and businesses and governments

00:07:48 Brad Monterio

to relook at almost everything they do and how can they leverage the power of AI and new technologies.

00:07:55 Brad Monterio

And like you said, hopefully not get left behind, right?

00:07:58 Brad Monterio

We want to be out on the, at least keeping pace with change, if not also driving and affecting some of that change.

00:08:04 Brad Monterio

The opportunity is ours to seize or not right now.

00:08:08 Tom McLeod

Yeah, look, without a hesitation of a doubt, and we can observe other professions, the great professions of law and medicine and science, they're racked with the same opportunities and self-doubts that all professions are going through.

00:08:23 Tom McLeod

Some are embracing it, some are trying to put their finger in the **** of the dam.

00:08:28 Tom McLeod

That would be Hollywood in many respects.

00:08:30 Tom McLeod

We're probably about two years away from seeing a genuinely Oscar-worthy AI-generated movie, and will it matter?

00:08:38 Tom McLeod

is the question.

00:08:40 Tom McLeod

If that's what the market for entertainment actually wants, why would we not go down that path?

00:08:47 Tom McLeod

And we could hold on to the beauty of Meryl Streep and Tom Hanks and their greatest supporters and greatest fans.

00:08:54 Tom McLeod

But if the market is wanting something else, and ultimately we're in a market shaping moment here as well, not just with regards to Hollywood, but we're in a market shaping moment where the market is telling us.

00:09:06 Tom McLeod

And so for instance, with internal audit, the market is clearly telling us that retrospective, every three months, annual audit plans are dead.

00:09:16 Tom McLeod

They want real-time, dynamic audit plans that change based on risk indicators that may change on the hour, may change on the day or the week or the month.

00:09:27 Tom McLeod

Those are the things that we need to get our heads around.

00:09:30 Tom McLeod

The market is clearly telling us that we want to be able to have, that sampling is a nice

00:09:38 Tom McLeod

oddity of a bygone era.

00:09:40 Brad Monterio

You can test the whole data set.

00:09:41 Tom McLeod

Yeah, you can test the whole data center, but more than testing the whole data set, you can test the whole data set and against your peers as well.

00:09:50 Tom McLeod

Yeah, we've got to start having a conversation as to why all the banks, for argument's sake, and putting aside the competitive

00:09:57 Tom McLeod

Why are there not indicators that aren't shed across the whole of those essential industries so that you can actually map yourself in terms of a control and a risk perspective?

00:10:06 Tom McLeod

There has never been a more fulsome conversation about risks being had.

00:10:11 Tom McLeod

As a society, risk, if you go back 100 years ago, we would be sitting on a chair in an electric storm in a puddle and holding a microphone and wondering why we're getting electrocuted.

00:10:22 Tom McLeod

All of a sudden, society moves and starts understanding that that's not safe.

00:10:26 Tom McLeod

So we start and appreciate

00:10:28 Tom McLeod

of risk.

00:10:28 Tom McLeod

We're in the risk understanding and awareness generation, and everyone's talking about it from the very top, and I mean that from not politically, but I mean, the top risk, existential risks like nuclear apocalypse.

00:10:41 Tom McLeod

They're talking about where's the human in the loop.

00:10:44 Tom McLeod

We can't just allocate this to AI, through to weather events.

00:10:48 Tom McLeod

How can we make sure that there is subjective and objective analysis being applied to it, through to then credit risk within an organization, which is obviously long since been automated, through to other robotics.

00:11:03 Tom McLeod

And these moments where we as a profession, we've got this wonderful opportunity.

00:11:07 Tom McLeod

Not only are we in the risk era, we're in the trust era.

00:11:11 Tom McLeod

And trust is born not out of, you will trust something.

00:11:16 Tom McLeod

It's born out of comfort.

00:11:19 Tom McLeod

It's born out of assurance.

00:11:20 Tom McLeod

So those two words should be our banner.

00:11:23 Tom McLeod

We are the organizational comfort.

00:11:26 Brad Monterio

Give me those points.

00:11:26 Brad Monterio

I see a lot of parallels.

00:11:27 Brad Monterio

I've done a lot of work with the CPA or accounting profession too, globally.

00:11:31 Brad Monterio

on a number of fronts.

00:11:32 Brad Monterio

And of course, some of these very things that you raise as issues facing the internal audit function and profession are something that the accounting profession has been facing all along as well, and probably a little bit further advanced in their thinking and their doing.

00:11:47 Brad Monterio

around those areas and, trying to maintain their roles as, the most trusted advisors to business, right?

00:11:55 Brad Monterio

Particularly if, they're serving more perhaps external audit roles if they're not in the accounting and finance functions internally or CFO team.

00:12:02 Brad Monterio

But I think I see a lot of parallels.

00:12:04 Brad Monterio

And as you were talking a little bit earlier about, you know, some of the issues that the internal audit

00:12:09 Brad Monterio

profession is facing about not looking at historical information, outdated information, and basing your current and future decision-making on old information.

00:12:20 Brad Monterio

I did a lot of work with this concept of XBRL, Extensible Business Reporting Language, which is a data standard to make information machine readable in fractions of a second, right?

00:12:30 Brad Monterio

So you can picture a 1200 page annual report from Citibank and something equally large from Chase,

00:12:38 Brad Monterio

which would take an analyst, a couple weeks probably realistically to go through under a normal situation.

00:12:44 Brad Monterio

And then things like XBRL came along and the software can, find the information you're looking for in milliseconds, leaving you time to analyze and think about it.

00:12:52 Brad Monterio

And I think what's different today is not only can AI enhance that, but AI can also do the thinking about finding the interesting correlations and the research in looking at that information.

00:13:03 Brad Monterio

So now when you think of the internal audit function,

00:13:06 Brad Monterio

And by the way, that allowed them to, the XRL has allowed them to look at more current information, not one-year-old or four-month-old or three-month-old information to make decisions, because it makes it readily accessible.

00:13:19 Brad Monterio

And I think you're seeing a lot of parallels develop with the internal audit function.

00:13:23 Brad Monterio

Why not have the same kind of benefits leveraging technology to make them better at what they do, right?

00:13:29 Brad Monterio

To add value to what they do so that they're no longer just pushing paper and reports to someone else

00:13:36 Brad Monterio

decision making role, but they're actually serving in a strategic role, whether it's taking on more second line functions like you talked about with risk, or they're advising the organization more as a strategic advisor.

00:13:49 Brad Monterio

And I know that those are sort of controversial topics for some in the profession.

00:13:54 Brad Monterio

Certainly when you look at the financial services sector where, you know, second line and third line functions

00:14:00 Brad Monterio

pretty much have to remain separate due to the highly regulated industry.

00:14:05 Brad Monterio

Nevertheless, you were kind of touching on this, is that we're seeing more of the profession and the function take on second line responsibility from a risk management perspective.

00:14:14 Brad Monterio

And of course, what goes hand in hand with managing risk is providing comfort and trust and assurance, like you said.

00:14:20 Tom McLeod

Yeah, and this is where we as a profession need to be very brave about considering things that we would have otherwise laughed out of the room.

00:14:29 Tom McLeod

We would otherwise have said these are long-held truths, like oxygen is essential to life.

00:14:35 Tom McLeod

The separation of second and third line is essential to assurance.

00:14:39 Tom McLeod

I don't pretend to know the answers.

00:14:41 Tom McLeod

I would caution anyone at this juncture of history to say that they're an expert.

00:14:46 Tom McLeod

There is no experts in this field at the moment.

00:14:48 Tom McLeod

We're all just finding our way, in some instances, using the technology for the first time, where you're understanding its implications for the first time.

00:14:57 Tom McLeod

What I would say there is people that are using it more than others, which make them more skilled, but we're all learning about it.

00:15:04 Tom McLeod

So we've got to ask ourselves these profound questions.

00:15:07 Tom McLeod

We've got to ask ourselves about structure, and we've got to ask ourselves about

00:15:12 Tom McLeod

So structure within organizations, we've got to ask ourselves about mandate.

00:15:16 Tom McLeod

We've got to ask ourselves what our stakeholders, not what we want to give them, but what they actually desperately need.

00:15:23 Tom McLeod

And I often when I speak with clients, talk about the CEO 3 minute call.

00:15:28 Tom McLeod

Three minutes that you have between when the CEO calls you and when you've got to stand before his or her desk.

00:15:34 Tom McLeod

And they don't want to have the information from six months ago or three months ago.

00:15:39 Tom McLeod

They want to have a three minute conversation.

00:15:42 Tom McLeod

with you that you've had three minutes to prepare for about, is it a risk?

00:15:47 Tom McLeod

Have we assured it?

00:15:48 Tom McLeod

When did we last assure it?

00:15:50 Tom McLeod

And if you were to say to them, yes, it is a risk, we assured it six months ago.

00:15:54 Tom McLeod

I'm not really sure what's happening now.

00:15:59 Tom McLeod

So that's probably you continue on HR and giving your resignation in this environment.

00:16:05 Tom McLeod

Whereas if you can turn around to the CEO, respectfully say, ma'am or sir, in this particular risk,

00:16:13 Tom McLeod

has trended as a risk for the last five years and continues to do so, but it is not an outlier.

00:16:19 Tom McLeod

It's not being seen as an outlier.

00:16:21 Tom McLeod

Our most recent assurance check on it was 24 hours ago, and we identified the following four issues which were immediately addressed by management.

00:16:32 Tom McLeod

So as a consequence, we can give you a level of comfort with regards to the management of this particular risk, whatever it might be.

00:16:39 Tom McLeod

That's still only a one minute conversation with the CEO or the chair of the audit committee, but the assurance that they're actually taking, the comfort they're actually taking in a world where decisions are being at speed that we can't even fathom.

00:16:52 Tom McLeod

We literally can't fathom the speed of some of these decisions that are being made by algorithmic adventure, let alone us understanding how those algorithmic adventures is actually being undertaken.

00:17:03 Tom McLeod

And that's the other thing I'd call out is that we also not only have to be

00:17:08 Tom McLeod

working at speed of the decisions, but we also have to be brave enough to call out that which we can't provide assurance over.

00:17:15 Tom McLeod

There is an enormous amount of black box magic happening at the moment, and that's not a doomster look at it.

00:17:22 Tom McLeod

AI, it is how AI talks about itself.

00:17:24 Tom McLeod

It's how Sam Malcolm will talk about, you know, there's some things we don't know how it's generated.

00:17:29 Tom McLeod

And so we need to be able to stand for our governance forums and stand before ourselves and say, we have not got any assurance over how this particular AI was generated this information.

00:17:42 Tom McLeod

We don't know how it was produced.

00:17:44 Tom McLeod

We can't replicate it.

00:17:46 Tom McLeod

We have no transparency.

00:17:47 Tom McLeod

And as a consequence,

00:17:49 Tom McLeod

To use a phrase that has been used in many other environments, but is extraordinarily relevant now, you may trust the system, but we can't verify it.

00:17:58 Tom McLeod

The phrase of the new era for internal audit for me is the wonderful Reagan Gorbachev trust but verify phrase.

00:18:04 Tom McLeod

We will trust the system, but at the same time, we're openly going to tell you that we're verifying it.

00:18:09 Tom McLeod

If we can't verify it, we're openly going to tell you that we haven't verified it.

00:18:13 Tom McLeod

And it's these concepts that I want everyone to be thinking about.

00:18:17 Tom McLeod

And it's not just

00:18:21 Tom McLeod

a wise old soul, to perhaps only an old soul sitting in Australia saying it, it's more so every jurisdiction.

00:18:28 Tom McLeod

It's an issue that's jurisdictionally agnostic, whether it's from the hot streets of Riyadh through to the noisy streets of Bangkok, through to the beautifully structured streets of Stockholm, through to the humidity of Orlando, everyone has to have these conversations.

00:18:48 Tom McLeod

We all have to

00:18:49 Tom McLeod

bring to it our experience.

00:18:50 Tom McLeod

We all have to bring to it our nuances.

00:18:53 Tom McLeod

We all have to bring to it our jurisdictionally specific regulatory considerations.

00:18:59 Tom McLeod

And we also have to bring to it a desire to move the profession forward.

00:19:04 Tom McLeod

And with it, then the Institute has to be prepared, if I may say respectfully so, to be both on that journey and to lead that journey.

00:19:13 Brad Monterio

You raise a lot of good points.

00:19:15 Brad Monterio

Two things.

00:19:16 Brad Monterio

I think what, inside the black box, that mystery of what's going on in there, has also raised very quickly the need for and the development of, or the emergence of, the algorithm auditor, right?

00:19:31 Brad Monterio

And I can remember, gosh, 6, seven years ago, I was on the board of directors for the Casualty Actuarial Society.

00:19:38 Brad Monterio

And so one of the gentlemen on that board, super intelligent,

00:19:42 Brad Monterio

he was a data scientist, an actuary, and a senior member of Deloitte Innovations' consulting team.

00:19:52 Brad Monterio

And he said to me, look, he had a close friend who was at a Big Four.

00:19:57 Brad Monterio

She decided to go out on her own at this time.

00:19:59 Brad Monterio

So this is before most of all the hype and the launch of, you know, ChatGPT and LLMs, right?

00:20:04 Brad Monterio

But she had an inside track and she recognized there's going to be a need for algorithm monitors.

00:20:10 Brad Monterio

And she hung out her shingle

00:20:12 Brad Monterio

to start her own consulting practice. And I remember thinking, wow, that's fascinating. I was looking at it from a DE&I perspective, and was there going to be machine bias? Because you move from the old systems of like, you had redlining and sort of the credit and mortgage industry discriminating against people, and now you had algorithms inside a black box that are potentially discriminating against people. And I was really intrigued by that angle, but I also realized that, wow,

00:20:39 Brad Monterio

this profession is going from no one's doing it to now you look at it, 6, seven years later, there's a growing profession of auditors specializing just in analyzing algorithms and what is happening inside the black box to bring some clarity to that, right? And ultimately build trust and assurance, as you said. But that's not the only opportunity, I think. And then you also talked about what's the IAA's role in this?

00:21:07 Brad Monterio

we're trying to adapt. And some recent evidence of that is obviously updates the standards and recognizing various pathways into the profession. As you may be familiar with Zach Cass, who was former head of go-to-market at OpenAI, he keynoted at our recent international conference in Toronto. And he really stressed in the beginning a couple things, but what stuck with me

00:21:29 Brad Monterio

was the fact that entry points into the internal audit profession will no longer be linear. They won't come from students from high school going into undergraduate roles, maybe graduate roles, and then into this profession. The point is they can come from anywhere, and they might come right from high school. He used examples of how Nvidia is now hiring high school graduates.

00:21:50 Brad Monterio

to help them reimagine and rethink their business with respect to AI and advanced technologies. And I couldn't help but think, you know, what are the possibilities for pathways into this profession? Where will they come from? What paths will they go through?

00:22:05 Brad Monterio

and that we have to be prepared to help, well, first of all, recognize that they'll come from various paths. It won't be linear. And that we have to provide the support services to help develop them into functioning internal audit professionals, no matter where they came from. And I know you probably have some thoughts on certification in an AI world. What does that do to certification and sort of some of those traditional pathways in the profession?

00:22:33 Tom McLeod

Yeah, it's a fascinating conversation because

00:22:36 Tom McLeod

if you look back on a career such as mine, you probably could have marked within an accurate pro two or three years where I would have progressed through the audit journey. So I would have been the junior through to the junior manager through to the senior manager and things like that. And putting aside my competency or the lack thereof, I was probably pretty going to hit those marks as we move through the decades long of career. You've hit a very good point about the entries, the linear nature or the lack thereof

00:23:06 Tom McLeod

of an assurance professional. I'm not even going to call an auditor at this moment. An assurance professional is now so diverse. And it's not only the ability to examine and interrogate, but it's also the ability to story tell. And it's so the person that can produce content, and I'm deliberately calling it content, that is relevant to me as the receiver, not relevant to me as the distributor. So it might be that the same content is being produced in 20 different ways. And if

00:23:35 Tom McLeod

If that can affect a change and improve the better management of risk within an organization, why would we not go down that path? Our skill set is absolutely critical to assess, and I'm going to break it down into two parts: the practical and the theoretical. So, in the practical sense...

00:23:50 Tom McLeod

I envisage a world where there will be a lot more what we currently call guest auditors, rotational auditors, where people will be brought in for a moment for a particular task. I can also see the disaggregation of in-house audit teams, not to be co-sourced, but rather that there be speciality SWAT teams anywhere in the world, you know, that just brought together for a particular risk or brought together for a particular moment. And as a consequence, I can see those people actually

00:24:20 Tom McLeod

remuneration-wise go through the roof, because you're the world's best in terms of doing this algorithmic auditor on bias in a consumer-facing LLM. We will pay you

00:24:34 Tom McLeod

$1,000,000 to give assurance over the top of it, because the value at the end of it is 10 million, $10 billion. And so that's minuscule. So the practical aspects, I can see us getting skills from all and sundry. On the theoretical side, it's really interesting and it's a challenge for the institute. The certifications has served as well as a profession and at the institute over the decades.

00:24:57 Tom McLeod

As with everything, we have to constantly reevaluate as to where they sit. One, all certifications going forward have to have some form of AI literacy and digital literacy, not as an add-on, not as a module, but it permeated throughout every aspect of it.

00:25:14 Tom McLeod

The second part is then a conversation about the relevance of certifications against standards in a world where everything is digitized. So if I can access the total corpus of digitized knowledge that has ever been produced in the history of the world, the internal audit standards as a component thereof is so fractionally small,

00:25:37 Tom McLeod

does that, do we need to be focusing on those standards? And especially if they're very general, or do we need to be focusing on specifics or just principles?

00:25:46 Brad Monterio

Along those lines, though, so I very much believe, even in the age of AI, that some form of standards will be necessary because we will still have to have a barometer or a benchmark for what's good and bad, what's right and wrong, right? We can't, we need something to measure from as a point of reference. I'm A sci-fi nerd.

00:26:06 Brad Monterio

And I can't help but think, as you talk about, you go to any LLM, and especially, I mean, they're powerful today. What will they be with quantum computing and agents and all those great things in just a couple months, let alone years? I can't help but think how much foresight certain sci-fi movies that deal with something called a matrix

00:26:27 Brad Monterio

talked about, you just plug into your head everything you need to know about flying a helicopter and then you can go fly it. Now, what it doesn't do is give you the quote unquote experience, right? On the job, in the role experience of flying that helicopter. But it can teach you all the technical things you need to know about what all those switches and buttons do and how you turn and fly and adjust everything. But you know, I often wonder how far are we away from

00:26:53 Brad Monterio

that experience can also be handled in some way by this intelligent, adaptive technology in any profession. And so do you need to be the expert in XYZ topic auditing and know every single aspect of it and have done it yourself or work with a team that has done it?

00:27:15 Brad Monterio

Or how much can the AI sort of compensate for that and handle some of that? And I'm curious what your thoughts are on that.

00:27:22 Tom McLeod

Yeah, look, it's a very good point in the sense, one about the availability of information. We've gone from scarcity to abundance, and how does that actually drive our understanding of risk within an organization?

00:27:34 Tom McLeod

The one thing that I'd call out, and I will invoke a different, slightly different movie, we all love The Matrix, but I'm going to invoke a movie that for anyone of my generation, and I'll include you in that as well, Brad, that was so definitive, other than the cinematically grossly underappreciated now 40th anniversary Back to the Future, which is for me the greatest movie of all time. But there is a movie, and I watched it just recently, and when I say the name, you'll very much appreciate why I call this out. I watched this movie again for the first time

00:28:04 Tom McLeod

in about 25 years ago, 25 years. And I watch War Games, the Matthew Broderick classic. And the reason why that resonated with us all, shall we play a game? He's gone from changing his grades to thermonuclear war, is that it was a simulation. It generated the moment of, oh my gosh, we've unleashed something here. So we can have all the information in the world, and we will have very soon all the information in the world, we'll have all the information to be able to condense and analyze and

00:28:34 Tom McLeod

and distribute. But there's also an emotive aspect. And the beauty of war games was that it actually showed in a simulation what can actually go wrong. So I think that there's a real need to be using education through a simulation mentality. And I mean that both not just for the junior auditor, not just as chief audit executive. I mean it for people in the organisation as they relate and work with risks within the organisation. I mean it for governance. And I can see the Institute for argument's sake developing a whole new genre of education

00:29:04 Tom McLeod

simulation. And it is simulation of akin to the airline simulations that, if you don't land this plane properly, you are going to get a terrible shock sitting in the aircraft simulator. You are going to bang, bang, alarms going off and things of that nature. Yes, you can walk out and have a cup of tea afterwards.

00:29:24 Tom McLeod

But in the moment, you need to feel the stress and the intensity of it. So this education moment, and I think that these are the three E's for me of this era. So the first A for me is efficiency. How can we do a report quicker? We've all written the poem quicker. And so that's great. The effectiveness is how does it impact the management of risk within our organization? Ultimately, how good is the sonnet? How good is the poem that we've actually created?

00:29:54 Tom McLeod

The third E for me is actually education. As much as this is the AI era, it's the education era. Because I need to know what the boundaries on my incompetency are, as much as I need to know where the boundaries of my competency are.

00:30:07 Tom McLeod

And I need to have standards, practical standards. They can't be what I would call motherhood standards, that you should assess risk. Of course, we should assess risk. We're living in that era. They need to be, this is how you assess. And if I can give an example, just very quickly, as it relates to AI bias, about two or three months ago, I set myself to go, I was asked by someone, how would you audit AI bias? And I was like, I'm an auditor, I know how to audit anything that you put before me. And I was like, sat down,

00:30:35 Tom McLeod

And I wrote it. And I wrote this post. And in it, I wrote the whole thing. And I got to the end of it. And it was about two minutes before I wanted to publish it. And I realized that the way that I'd audited bias was again an old framework to a new risk. And at the very end, I decided to put a disclaimer at the end to say, I'm actually not sure that I've actually helped in the assessment of the AI bias on this machine. Because I'd talked about, have you got a policy?

00:31:04 Tom McLeod

Have you done this? Have you done that? Very traditional way of doing it.

00:31:07 Brad Monterio

Assuming those things will apply in this environment, yeah.

00:31:10 Tom McLeod

if you've got a policy, that's great, but there's still AI bias. So what have you actually done to mitigate the risk? And it was deliberate, so like self-flagellation moment, because I really wanted to feel that unease. I really wanted to feel that moment. And I really had to, right up until the last minute, I had to decide as to whether I was going to put it out there

00:31:33 Tom McLeod

or not. I decided to put it out there and then I had to decide whether I was going to put it out there with a caveat. I thought, I'm going to be honest. Otherwise, I'm being a little bit disingenuous as a whole. It's those moments that we as a profession need to keep having a conversation around. I don't know. I've audited robotic supply chains, but I've never understood or never done an assurance review of a fully robotic chain. I don't know what I don't know. I need to feel that awkwardness. So it comes back to the education

00:32:02 Tom McLeod

and comes back to the war games analogy, is that we need to have those simulation moments. We need to test ourselves. And this is where the Institute has this extraordinary rich vein, and so unashamedly talk about it as a revenue generating, but an extraordinary rich vein opportunity with regards to simulation development.

00:32:21 Brad Monterio

I oversee learning and development for the profession. And you know, I'm excited to hear your ideas on this because I, like you, I agree.

00:32:30 Brad Monterio

Gone are the days of the talking expert at the front of the room with death by PowerPoint, right? That's the last thing we want to do. And the data already shows us that you as a professional sitting in that seat retain a small amount of that information, right? To help learning be more experiential and like you said, simulations, hands-on, practical. Theoretical is good for some things, but there comes a point that people want to know, tell me what I do in my job day to day.

00:32:56 Brad Monterio

And so it needs to be experiential and practical and actually let them try it and experience it. your analogy of using the airplane simulator is a great one because, they can walk away and have a cup of tea, like you said, even if they crash the plane. But they need to feel the experience of either successfully landing that plane or crashing it and, killing all those souls on board and what that feels like.

00:33:20 Brad Monterio

Better done in a test or simulation environment than certainly the real world. But at the end of the day, they've got to deal with the real world. I feel we have an obligation at the IAA to equip them with the skills and competencies and help them elevate their proficiency level in those skills to be the best they can be. But here's the challenge from my perspective, Tom, is some of these bodies of knowledge themselves are changing so quickly. And then when you layer on technologies,

00:33:49 Brad Monterio

like AI and machine learning and intelligence, if I use that in quotes, it's adaptive. How is that introducing new risk? How is that introducing changes into what they thought they knew literally an hour ago that could change within the hour, right? We know the pace of change in evolution is significantly faster than what used to exist. And so, you know, what you learned a week ago,

00:34:17 Brad Monterio

might totally change today. So how does the learning keep pace? That's what I worry about. That's what keeps me up at night. And then, you know, they go back to something you said earlier. If the whole corpus of knowledge and information, if you can go to an LLM and it has everything that's ever been written and said and videoed and everything else in between, why do you really need to be a proclaimed expert?

00:34:39 Brad Monterio

in an area, if you can rely on those sources of information to update you. May not plug it into the back of your head, like in the matrix, at least not yet. But are we moving towards those kinds of situations where the technology is so beyond what any of us can imagine literally today in two years? Where will it be? And how do we adapt our learning and our training platforms and our mechanisms for getting information inside your head, even if it's not a direct connection to a cable?

00:35:08 Tom McLeod

The distinction I actually make is between expert and specialist. So I think we're entering in a world where everyone, the PhD in your pocket, as it's often being described. And so we will have this expertise on every imaginable topic. Specialism, though, is understanding the fundamentals of assurance for argument's sake, understanding that it is trust

00:35:29 Tom McLeod

but verify. And I think that the auditor, the audit concept, assurance as a whole, whether it's management or independence, is a specialization. Specialization for me is knowing the boundaries of what you know and also the boundaries of what you don't know. And so it's being able to say, yes, trust, but verify.

00:35:47 Tom McLeod

So even if we keep coming back to that phrase, even if you're the specialist in the room, the person that can actually speak about it. So I'm not saying specialization skills. It's understanding that you can add something to the conversation. Because I can't add anything to quantum physics.

00:36:02 Tom McLeod

physics. Like there is nothing that I can add as an accounting person of 40 years. There's nothing I can add to it. But even if I did need to add to it, I could get that access and I could get it framed through an accounting prism in an LLM in 3 minutes to me to make myself sound like an expert. But a specialism, and it comes back to the training, it comes back to the awareness, it comes back to the desire. And it also comes back to the speed of the profession to be able to move. And just

00:36:32 Tom McLeod

Just be open. But this risk has changed. It has dynamically changed in the last five days. It has dynamically changed in the last five weeks, whatever it might be. What we gave you assurance before, and this comes back to real-time assurance, no longer holds. And so, yes, the map, when we showed it to you 3 weeks ago when you called me to your desk, Madam CEO, was all green. It's now all red. I can explain why that has happened. That is not a failing of the system. That is actually the system working well.

00:37:01 Tom McLeod

And so you are flying blind at the moment. How do you know this? Because I'm a specialist in providing assurance. I'm not an expert in the risks underneath it, but I'm a specialist in providing assurance. My respectful challenge to the profession, and perhaps if I say it to the institute specifically, is to be prepared to make the mistakes.

00:37:23 Tom McLeod

Everyone is comfortable with mistakes being made. What people aren't comfortable with is inertia. People are comfortable with speed of decision making. What they're not comfortable with is when the European Union works quicker than the Institute works on matters. When you look at those benchmarks, you've got to start asking yourselves, and I don't mean the Institute as a whole, but any profession has to ask themselves as to whether they're servicing that which they've done.

00:37:51 Tom McLeod

But I think that what we are dealing with is a moment not only of great change, but great democratisation of assurance as well. So we are having conversations where our grandmothers and our children are talking about risks and talking about assurance. They're educating themselves on it, and we need to be part of that conversation. So there can be no

00:38:18 Tom McLeod

corner, no conversation, no conference, no podcast. I think at the moment we're talking a little bit too much within our own bubble. We need to be speaking at every single conference, that from the astronomers through to the zoologists conferences. And we need to talk about why assurance is so critical in your profession, not why

00:38:43 Tom McLeod

where our profession is so critical. It's why your assurance is critical within it. We need to talk from Johannesburg up to Stockholm, over to Beijing, down to Buenos Aires. And we need to talk at every jurisdiction in between at different languages. And I don't mean different jurisdictional languages, but we need to talk about that this is something that's changing. And I think the final thing that I'd actually say is that we as a profession just have to accept

00:39:10 Tom McLeod

that this is as bad as AI is ever going to be. Tomorrow it's going to be better and it's going to be better. So we can't just rest our laurels. Well, we did an analysis of, you know, O4 from GPT. Aren't we good if it went out to five? Well, model 6 is coming out, Gemini 3 is coming out, whatever it might be. And we've got to be prepared for it. We do have to avoid the phenomena of, oh my gosh, there's a new model coming out. Oh my God, the world's falling in.

00:39:40 Tom McLeod

We've got to stay the course. But can I just make an observation though, which is how an exciting a moment to be in assurance. We could say we're being forced, but we are close witnesses to the greatest change in the profession, in the history of the profession.

00:39:57 Tom McLeod

We are the people that we would have otherwise envied.

00:40:00 Brad Monterio

And I don't think that's exaggeration.

00:40:02 Brad Monterio

I know some people might look at that and say, wow, you know, you're really, really exaggerating that for effect.

00:40:06 Brad Monterio

I don't think they, I think we are at a very different time and on the precipice of something unfathomably large.

00:40:15 Brad Monterio

And it's transformational not just for this profession, as you said, it's every profession.

00:40:19 Brad Monterio

It's business, it's society and government.

00:40:21 Brad Monterio

And

00:40:22 Brad Monterio

consumers and it's touching everyone's lives and transforming them.

00:40:26 Brad Monterio

If they want to be part of that change, great.

00:40:28 Brad Monterio

There are always going to be people that resist or the laggards and that kind of thing.

00:40:33 Brad Monterio

And so that kind of makes me think everything that you've been talking about,

00:40:38 Brad Monterio

You've heard the concept, obviously, of human in the loop with AI and the concern that, somehow AI will take over my role, or maybe it'll replace junior auditors versus the more senior ones.

00:40:50 Brad Monterio

And I'm wondering if you, know, it's about a balance that you strike between the use of the technology and the humans in the loop.

00:40:56 Brad Monterio

I personally look at AI as like my robotic co-worker, if we want to look at it that way.

00:41:01 Brad Monterio

But I'm curious what you think about, you know, how do you keep CAEs

00:41:06 Brad Monterio

and the internal audit function relevant and at the table contributing real value amidst all of this change.

00:41:15 Brad Monterio

And I don't mean, you know, just they're someone that's consulted and others go and make the decisions based on a whole multitude of inputs, including what the internal auditors provided.

00:41:25 Brad Monterio

I want to make sure, how do you keep them relevant

00:41:28 Brad Monterio

and at the centre of that conversation and providing real value to the organisations they serve.

00:41:34 Tom McLeod

I'm going to start with your last observation.

00:41:36 Tom McLeod

It's about providing real value to the organisations that they serve.

00:41:41 Tom McLeod

So defining what real value is, and we've talked already about real-time assurance and 100% data testing and things of that nature.

00:41:50 Tom McLeod

The real value, I think, is in having the conversations prior to the risk manifesting itself, rather than when or after it is.

00:41:58 Tom McLeod

Now, as I say that, every listener here will say, but it's not internal audit's role to be part of the strategic decision-making process.

00:42:06 Tom McLeod

My challenge is, why not?

00:42:08 Tom McLeod

Why can't we?

00:42:09 Tom McLeod

And not in an advisory capacity.

00:42:11 Tom McLeod

Why can't we design?

00:42:13 Tom McLeod

We've talked about human in the loop, but increasingly I talk about assurance in the loop.

00:42:19 Tom McLeod

ATTL is how I abbreviate it.

00:42:21 Tom McLeod

I originally had it down as Tommy's Assurance in the Loop.

00:42:24 Tom McLeod

That comes out as TATL, which is probably not the greatest abbreviation that I've ever thought up.

00:42:30 Tom McLeod

So it's ATTL.

00:42:31 Tom McLeod

Assurance is built in the loop.

00:42:33 Tom McLeod

We're going to keep it in the loop.

00:42:34 Tom McLeod

We're going to be in the loop.

00:42:36 Tom McLeod

We are part of the design phase of things.

00:42:40 Tom McLeod

We are part of the design teams.

00:42:42 Tom McLeod

So that's adding real value to the organization.

00:42:46 Tom McLeod

It is also then providing what I'll call

00:42:49 Tom McLeod

a more traditional assurance role, which is, and to use the matrix or minority report is probably a better example.

00:42:56 Tom McLeod

Here is the screen that we moved around and by if we move this around, we move these controls, it simulates not one, but 50 million different variations.

00:43:06 Tom McLeod

We can give you assurance

00:43:08 Tom McLeod

that removing that control of double signatures over payroll for argument's sake, it will not lead to massive payroll for probably it's going to, bad example, but we can give it because we're simulated 50 million times.

00:43:22 Tom McLeod

And that's real value.

00:43:23 Tom McLeod

And I think the third one is being the conscious, the ethical guider, the conscious of the organisation, and just really saying to people, well, there are some things that, some lines that we can't cross.

00:43:36 Tom McLeod

you are crossing over that.

00:43:38 Tom McLeod

So there is 3 or 4 aspects of real value.

00:43:41 Tom McLeod

I can see us being, funnily enough, not the de facto, but the central risk education function within an organisation going forward.

00:43:49 Tom McLeod

And the model that I actually use is actually occupational health and safety.

00:43:54 Tom McLeod

If there is one model that we can take over the last 30 years that has done a wonderful job from moving from the periphery to the very centre,

00:44:02 Tom McLeod

is how patiental health and safety has done over the last, in the Western world, over the last 40 years or so.

00:44:08 Tom McLeod

They've gone from being irrelevant, why can't we smoke and drink in the workplace, why can't we jump off ladders and why do we need high visibility vests, to having really profound, deep...

00:44:20 Tom McLeod

conversations where it's embedded in our understanding.

00:44:22 Tom McLeod

Initially it was started off by training, but now people have the courage to call out.

00:44:26 Tom McLeod

And that's the last part where value actually is created, is not only being part of the conversation, not only being part of the design, not only being part of the reporting, but it's being.

00:44:36 Tom McLeod

The value is created when you have the courage to call out that you can't, there's lines that you can't cross.

00:44:41 Tom McLeod

So these are all extraordinary opportunities.

00:44:44 Tom McLeod

They do present us as a profession and the institute as an educational body with challenges, because how do you educate people around those?

00:44:53 Tom McLeod

But the greatest professions are the ones that have looked at it and, you know, to borrow the Socrates phrase, wisdom begins in wonder.

00:45:00 Tom McLeod

You know, just ask yourself,

00:45:02 Tom McLeod

just ask yourself the questions.

00:45:03 Tom McLeod

And if I may challenge the institute for one moment, the Singapore conference next year, what a magical, I'm not sure how Singapore was come to be chosen, but there is probably going to be no more important country in the world in terms of AI moving forward, not in terms of its development, but in terms of East versus West than Singapore going forward.

00:45:26 Tom McLeod

A country 40 kilometers wide, it's barely a speck on the map.

00:45:31 Tom McLeod

But it's so critical.

00:45:32 Tom McLeod

Now, why that's so important is that the Asian influencers, the Chinese influencers, are meeting the American influencers right at this moment.

00:45:41 Tom McLeod

The Singapore conference next year has to be awkward.

00:45:45 Tom McLeod

I'm deliberately using that word for the internal audit profession.

00:45:48 Tom McLeod

We have to ask ourselves some profound questions.

00:45:51 Tom McLeod

If people get up and do the, I'm going to take you through the standard 23, 44, I know that there's not a standard 23, 44, that's a wasted opportunity.

00:46:00 Tom McLeod

If someone gets up there and says, my gosh, the sky's falling in, that's a wasted opportunity as well.

00:46:05 Tom McLeod

Instead, it has to be a collection of people, the thousands of people that will turn up, we need to be finding ways for each of us to engage with each

00:46:15 Tom McLeod

We need to challenge the vendors that are there, that it's not just vendor vaporware that they're presenting that, you know, we're on trust.

00:46:22 Tom McLeod

We need to be asking of the big four as they'll be represented, well, what are you doing in terms of standardizing and scaling this information globally, because they are the great scalers.

00:46:32 Tom McLeod

We need to then be looking at the different jurisdictions and the different cohorts and saying,

00:46:39 Tom McLeod

You're doing something brilliant.

00:46:40 Tom McLeod

We need to, in some respects, finish that conference with a communique of intent that is then not just shared amongst ourselves, not just shared amongst them, but we need to share it amongst everyone going forward.

00:46:53 Tom McLeod

And those are the things that I think what a wonderful moment.

00:46:56 Tom McLeod

We've got six months to prepare for it, seven months, whatever it might be, seven or eight months.

00:47:00 Tom McLeod

And what a wonderful moment to be had.

00:47:02 Tom McLeod

And please correct me if I'm wrong, but I think the next conference after that is in Riyadh.

00:47:07 Tom McLeod

So 2 breathtakingly insightful selections.

00:47:12 Tom McLeod

As much as I love Sydney, rather than going to Sydney, don't go to Sydney until I'm a little bit older and can't be bothered traveling.

00:47:20 Brad Monterio

Well, hopefully you'll be excited about, we're planning to make an announcement for what's happening after Riyadh.

00:47:26 Brad Monterio

at Singapore.

00:47:27 Brad Monterio

So, and I believe that you will be excited about where those locations will be as well.

00:47:33 Brad Monterio

I agree with you.

00:47:34 Brad Monterio

I mean, we have significant opportunity.

00:47:36 Brad Monterio

The way Singapore was chosen, you know, as COVID came into being, that was where it was locked down.

00:47:42 Brad Monterio

And so this is sort of a redo, but I think there's

00:47:45 Brad Monterio

It's not just chance, right?

00:47:47 Brad Monterio

I believe in fate in some ways.

00:47:50 Brad Monterio

And it was meant to be back in Singapore for many of the reasons that you talked about and others.

00:47:54 Brad Monterio

And I think that the leader of our National Institute there is extremely excited.

00:47:59 Brad Monterio

And I think we have some great things planned.

00:48:01 Brad Monterio

I will certainly share with the program of development team for the event some of your thoughts, Tom, because I think they're really exciting and interesting.

00:48:10 Brad Monterio

And you've shared things with me and other discussions we've had about

00:48:15 Brad Monterio

you talk about provocateurs, right?

00:48:17 Brad Monterio

I consider you a provocateur, and that's a good thing.

00:48:19 Brad Monterio

That is not a negative thing.

00:48:21 Brad Monterio

Because I think when you plant seeds and provoke a discussion, and you get people to talk about the various perspectives,

00:48:31 Brad Monterio

and views towards those issues, that's a good thing.

00:48:34 Brad Monterio

You're engaging people.

00:48:35 Brad Monterio

You're getting them to talk about issues and figure out where do they stand on those and how are they going to contribute to those issues being resolved or, you know, continue to complain about them.

00:48:45 Brad Monterio

So to me, you know, provoking a discussion is a good thing.

00:48:50 Brad Monterio

You're catalyzing something.

00:48:52 Brad Monterio

You're sparking a debate.

00:48:55 Brad Monterio

Those are good things.

00:48:56 Brad Monterio

And I hope that our international conference serves as a platform to spark those debates.

00:49:01 Tom McLeod

One is I always call it respectful provocate, provocateur.

00:49:06 Tom McLeod

Provocation for the sake of it is, you know, can be counterintuitive.

00:49:12 Tom McLeod

So one needs to be respectful.

00:49:13 Tom McLeod

Can I respectfully challenge the institute on 4 grounds, if I may?

00:49:17 Tom McLeod

And this is done with a great affection for the institute and what the institute actually does.

00:49:23 Tom McLeod

The first and foremost is my challenge to the Institute is to the full corpus of content that the Institute has developed over the decades needs to be instantaneously accessible to all people, both members of the Institute and non-members.

00:49:41 Tom McLeod

So that it's a chatbot of some sort that can just be, that can interrogate everything.

00:49:47 Tom McLeod

You know, I want to understand how the standards have changed from 1973 to 2025.

00:49:54 Tom McLeod

Who needs to know that?

00:49:55 Tom McLeod

Well, there's someone asking, so be the person.

00:49:57 Tom McLeod

So it's that, it's that really exposing the institute as a whole as a center of great historical knowledge.

00:50:06 Tom McLeod

The second thing is on the network side.

00:50:09 Tom McLeod

We all are on LinkedIn and we will all continue to be on LinkedIn, but there is an opportunity for the institute in this environment to really bring through micro schools of constituency or groups of thought.

00:50:22 Tom McLeod

You know, it is, let's set up a, not a committee, but anyone wants to do a drop in every Friday just to talk about AI bias, Tom McLeod's going to run it or Brad's going to run it.

00:50:33 Tom McLeod

And if there's one person there, that's great.

00:50:35 Tom McLeod

But there might also be 500 people that turn up.

00:50:38 Tom McLeod

And we're just going to continue to talk about AI bias.

00:50:41 Tom McLeod

And we're going to continue to learn from that, from it.

00:50:44 Tom McLeod

And someone one day is going to come along and say, hey, someone in my team, a 12-year-old who was just working on a maths problem has just worked out something.

00:50:53 Tom McLeod

Well, we can't listen to a 12-year-old.

00:50:55 Tom McLeod

Well, why not?

00:50:56 Tom McLeod

Why can't we?

00:50:56 Tom McLeod

So that's the second challenge that I would do.

00:50:58 Tom McLeod

I think the third one is in terms of the

00:51:03 Tom McLeod

So I've talked about content, I've talked about communities of interest.

00:51:06 Tom McLeod

I think the third one is with regards to communication, is that we need to find a way to communicate in the TikTok era.

00:51:13 Tom McLeod

And we can bemoan the TikTok era, we can bemoan the Avatar era, but in some respects it's like bemoaning television.

00:51:20 Tom McLeod

It's not going to go away.

00:51:21 Tom McLeod

So we need to find ways to condense the information

00:51:26 Tom McLeod

the same information in 50 different ways instantaneously.

00:51:30 Tom McLeod

So not only is it this podcast, not only is it this conversations that we're having like this, but there needs to be a 20-second grab.

00:51:39 Tom McLeod

That also extends to having senior people both from within the profession and within the institute constantly

00:51:47 Tom McLeod

in conversation so that people can see, and if I may use CEOs as an example of the institute, can constantly see Anthony having a every other day, this is my 5 minute take on things.

00:51:58 Tom McLeod

No one expects, we no longer live in a world of perfection in terms of editing.

00:52:03 Tom McLeod

Zoom got rid of that.

00:52:04 Tom McLeod

So I don't care if the person stumbles or not, or stutters or things of that nature.

00:52:09 Tom McLeod

What I want is authenticity.

00:52:12 Tom McLeod

XYZ has hit this region today and we have no idea what type of insurance you can actually handle to it.

00:52:18 Tom McLeod

And then the final thing I'd actually come back down to is education as a whole, is that I would wonderfully throw the pages up into the air and see where they actually land.

00:52:29 Tom McLeod

You'll notice that I didn't say get rid of education as a tool.

00:52:32 Tom McLeod

It's so central.

00:52:33 Tom McLeod

This is the education era.

00:52:35 Tom McLeod

But it is, we've always thought that

00:52:38 Tom McLeod

let's take for aim's sake an easy one, is conferences.

00:52:40 Tom McLeod

Conferences are good.

00:52:42 Tom McLeod

They will always continue to be.

00:52:43 Tom McLeod

But for some people, conferences are just CPE gathering moments.

00:52:47 Tom McLeod

That's a waste of time for everyone if you can't sit there and read your magazine while someone's talking about the future of AI going forward.

00:52:58 Tom McLeod

And so it's this education era.

00:53:00 Tom McLeod

So whether it is communities of interest, whether it is how we communicate, whether it is how we engage,

00:53:07 Tom McLeod

These are moments that the institute has this extraordinary opportunity.

00:53:11 Tom McLeod

But if one was to rebrand internal audit, I would rebrand it keeping the same IIA.

00:53:19 Tom McLeod

It'd be the Institute of Intelligent Assurance.

00:53:22 Tom McLeod

If you think of it in that sense, it does keep our assurance.

00:53:26 Tom McLeod

It does broaden our mandate.

00:53:28 Tom McLeod

It does talk about value, the intelligent.

00:53:31 Tom McLeod

And I know intelligence is not the world's greatest.

00:53:33 Tom McLeod

Your definition of intelligent, my definition of intelligence is different.

00:53:37 Tom McLeod

I'm smarter than you, you're smarter than me type moment.

00:53:39 Tom McLeod

So it's probably not the world's greatest phrase.

00:53:41 Tom McLeod

But then we start having these conversations that drive different considerations.

00:53:46 Tom McLeod

I would for the Institute be having very big outposts in

00:53:51 Tom McLeod

Riyadh and Beijing and in Nairobi and in this really, really outback town.

00:53:59 Tom McLeod

It's called Melbourne, Australia, but that's just out of interest.

00:54:05 Tom McLeod

But not Melbourne, Florida.

00:54:06 Tom McLeod

I want to manage expectations there.

00:54:08 Tom McLeod

They're different cities.

00:54:09 Brad Monterio

I got your point.

00:54:11 Brad Monterio

Actually, you made me think of as you were talking about IIA and keeping the acronym.

00:54:14 Brad Monterio

The other thing that popped into my head as we've talked about, you know, the integration of insurance across an enterprise.

00:54:21 Brad Monterio

the Institute of Integrated Assurance.

00:54:23 Tom McLeod

How beautiful is that?

00:54:25 Tom McLeod

And see, isn't this a great example of just in this small dialogue between 2 middle-aged guys who have been able to identify, who have been able to identify a slightly different iteration?

00:54:37 Tom McLeod

Because what we haven't moved away from is assurance.

00:54:41 Tom McLeod

Integrated assurance means something that is integrated across the organization, integrated across the economy.

00:54:47 Tom McLeod

Yeah, and so imagine if you were, so what's your role?

00:54:50 Tom McLeod

Why are you at the table?

00:54:51 Tom McLeod

I'm the head of integrated assurance.

00:54:54 Tom McLeod

So I look at it across the board for both management, risk assurance, and independent assurance.

00:55:00 Tom McLeod

And also, by all the way, we will always need external audit and their external assurance.

00:55:05 Tom McLeod

And the reason why I can show you a dash

00:55:07 Tom McLeod

dashboard immediately from an integrated assurance perspective.

00:55:10 Tom McLeod

And my team is educated through the IAA, which is the Institute of Integrated Assurance.

00:55:15 Tom McLeod

My team is educated not only in how to provide integrated assurance, but how to talk about integrated assurance.

00:55:23 Tom McLeod

So I know that materiality, for argument's sake, is relevant to financial, but is irrelevant to occupational health and safety.

00:55:31 Tom McLeod

So we don't have a single materiality phrase anymore.

00:55:36 Tom McLeod

because one death isn't the equivalent of losing $1,000,000 or things of that nature.

00:55:41 Tom McLeod

And all of a sudden, that is value adding into that organization.

00:55:44 Tom McLeod

It is in both in-person and synthetic assurance as well.

00:55:51 Tom McLeod

Part of the in-person assurance is that I will stand at the gate and ask you to take your shoes off before you get on the plane.

00:55:56 Tom McLeod

And then there's synthetic is, yep, we're actually doing the analysis of where you've flown previously and things of that nature.

00:56:04 Tom McLeod

These are the things that I want the profession to have the conversation about.

00:56:07 Tom McLeod

And Brad, it's probably a nice summary point is that any person that stands before us, before the institute or before the profession and says that they know all the answers is my definition of a liar.

00:56:21 Tom McLeod

At the moment, none of us know the answers.

00:56:24 Tom McLeod

All we know are the questions.

00:56:26 Tom McLeod

And even those questions, we're still struggling to form.

00:56:30 Tom McLeod

And we're forming them with a bias to our historical assumptions and our historical knowledges.

00:56:36 Tom McLeod

We've got to loosen our grip on those to the alter your value.

00:56:41 Tom McLeod

I call it the Benjamin Butter moment, if we continue on with the thematic and film moments.

00:56:46 Tom McLeod

My first day of work was the start of December 1988.

00:56:50 Tom McLeod

So

00:56:50 Tom McLeod

Anyone can do the 37 years coming up onto it now.

00:56:54 Tom McLeod

And in that context and in that construct, I've never been more excited.

00:57:00 Tom McLeod

So I've by any measure long into my career, by any measure, but I've never been more excited and more feeling like a beginner than I am at this moment.

00:57:11 Tom McLeod

What an extraordinary privilege to have

00:57:14 Tom McLeod

have that in one's career, rather than to see out the back end of one's career as a wise, wearied soul, is that I'm waking up every morning and thinking, well, I didn't know that.

00:57:25 Tom McLeod

Oh, that's interesting.

00:57:26 Tom McLeod

I haven't learned that.

00:57:27 Tom McLeod

It's lifelong.

00:57:28 Tom McLeod

And it's also this wonderful feeling of, well, what am I going to learn tomorrow?

00:57:32 Tom McLeod

And if one thing defines an advancing profession, it isn't snobbery.

00:57:38 Tom McLeod

I'm not saying the Institute, the Internet or the Institute has that.

00:57:41 Tom McLeod

It's not calmness.

00:57:43 Tom McLeod

It's unease.

00:57:45 Tom McLeod

It's a, I've learned something new today.

00:57:48 Tom McLeod

And that's the true definition of a profession.

00:57:50 Tom McLeod

And if we as a profession and the institute as an enabler of that can sit down and say that we generate that, then we're doing something right.

00:57:58 Tom McLeod

But we don't, we won't know it.

00:58:00 Tom McLeod

We probably won't, it's like the old men that plant the young trees in a garden and they'll never sit under its shade.

00:58:07 Tom McLeod

We are planting trees at the moment.

00:58:09 Tom McLeod

that our successes in 100 years will either be dismissive of because those trees have turned into boring car parks or be very, very thankful of that those trees are providing great foundations.

00:58:24 Tom McLeod

I know it's tortured analogy, but that great phrase is that, you know, the society moves forward when old men plant trees that they'll never sit under is exactly the moment we're sitting in at the moment.

00:58:34 Tom McLeod

So fascinating times.

00:58:37 Brad Monterio

I relate really well to what you said in terms of, because I too wake up every day, I'm 59 now, and in my role of helping professions, learn and upskill and enhance their competencies and proficiencies, I have not gotten complacent, right?

00:58:55 Brad Monterio

I'm also looking forward to tomorrow, finding out what's new and what I didn't know, but I'm also doing that yearly and with a strong degree of, hunger.

00:59:05 Brad Monterio

in wanting to know more and wanting to change and wanting to evolve and wanting to be modern and help our profession be future fit for purpose and not be arrogant, not be complacent, not be comfortable with where things are today.

00:59:20 Brad Monterio

If I get that way, then maybe I should retire.

00:59:23 Brad Monterio

And I'm not that way.

00:59:24 Brad Monterio

And the point is, you know, you don't have to be 22 years old to think that way.

00:59:28 Tom McLeod

No, and it's an extraordinary gift.

00:59:30 Tom McLeod

Isn't that an extraordinary gift that this moment is given to us in a profession that

00:59:35 Tom McLeod

I keep coming back to, a profession that is very central to the conversation about providing assurance over risks.

00:59:43 Tom McLeod

At our very heart, we provide assurance over risks.

00:59:45 Tom McLeod

We are in an era where risks are both opaque and not transparent.

00:59:51 Tom McLeod

We've got an opportunity of a professional, the history of the profession.

00:59:54 Tom McLeod

And it's just an extraordinary moment.

00:59:56 Tom McLeod

It's an extraordinary moment.

00:59:58 Tom McLeod

And if anyone's listening to this, my challenge to them

01:00:03 Tom McLeod

is not only to look at it at a macro level, not only to look at it at a societal level, don't look at it just as a professional level, don't look at it just as an institute level, but please do look at it at all those levels.

01:00:15 Tom McLeod

Look at it at your personal level.

01:00:17 Tom McLeod

What am I doing today to be better than what I was yesterday?

01:00:21 Tom McLeod

And there will be, and I give everyone license and this will annoy every single manager in the organizations that are listening to this, waste time with AI.

01:00:30 Tom McLeod

The next time there's a model that comes out, spend 1/2 a day, catch up with your work another time, but spend 1/2 a day just sitting down and saying, I'm going to put in this audit plan and I'm going to check it out and I'm going to test it out.

01:00:44 Tom McLeod

Ask for weak causal links.

01:00:46 Tom McLeod

Ask for it to remove all the cliches.

01:00:50 Tom McLeod

Ask for it to show you the logic in your thinking.

01:00:54 Tom McLeod

And then sit back and think, gosh, this is interesting.

01:00:58 Tom McLeod

I never thought of it in that way.

01:01:00 Tom McLeod

only then with that development, the personal development, will that be the flower bed of an extraordinary garden.

01:01:08 Tom McLeod

My wish for the profession is threefold, is one, that it is courageous, secondly, that it is inquisitive, and thirdly, that it's insecure.

01:01:17 Tom McLeod

My wish for the profession, for the Institute, is equally threshold, but it sees itself as having a future.

01:01:25 Tom McLeod

It doesn't drown in the moments of self-doubt.

01:01:30 Tom McLeod

The second wish for the Institute is that it throws out that which is no longer necessary and invites that which is essential.

01:01:39 Tom McLeod

My third wish for the Institute is that it looks at the horizon and sees it as a 100-year organisation.

01:01:47 Tom McLeod

And if it doesn't, it will be a five-year organisation.

01:01:51 Tom McLeod

That's probably a nice way to sum it up.

01:01:53 Brad Monterio

So one thing, and so first of all, thank you for those insights, Tom.

01:01:55 Brad Monterio

And perhaps your ears were ringing a little bit.

01:01:58 Brad Monterio

I guess it serves as a nice, almost a validation for me maybe, as I think about some of the conversations we've been having recently with my teams and broadly across a number of other teams here.

01:02:11 Brad Monterio

You know, leveraging our full corpus of information, like you said, and having some kind of chatbot or bot or interface or something that, you know, can help members of the profession as well as those who aren't members of the profession.

01:02:22 Brad Monterio

sort of query that and interact with that.

01:02:25 Brad Monterio

I can tell you that those kinds of opportunities are being analyzed and with a sense of urgency and agility.

01:02:33 Brad Monterio

And this is not a five years from now, we're going to launch something kind of thing.

01:02:36 Brad Monterio

We fully appreciate the timeline that we're on.

01:02:39 Brad Monterio

And I always do believe in urgency isn't panic mode.

01:02:43 Brad Monterio

Urgency is just faster.

01:02:45 Brad Monterio

And with agility, it doesn't mean we cut all corners, but it also doesn't mean we strive for absolute perfection every time, because perfection gets in the way of progress.

01:02:55 Brad Monterio

And so, you know, working on those kinds of AI-based or AI-enabled platforms, capabilities, capacities are things that we are actively pursuing and exploring now.

01:03:08 Brad Monterio

The concept of the sort of the micro

01:03:11 Brad Monterio

sort of schools or groups or communities is also something we're looking at.

01:03:16 Brad Monterio

And not for something that we want to control, but something we just want to facilitate or provide the platform or the spark or the seed for, because the real value is going to come from you all, you and your peers, engaging in those communities when you want to and on what topics you want to engage on.

01:03:36 Brad Monterio

You and I have talked before about this sort of this

01:03:39 Brad Monterio

immersing ourselves in that rapidly evolving and moving stream of information and being part of the communication and getting 5 minutes of the profession's time every day on what are the current issues, what are the, even if it's things we haven't solved, right?

01:03:55 Brad Monterio

It's just to plant the seed and get the conversation going within the profession and showing that the IAA is in fact plugged in, aware, and has perhaps an opinion

01:04:08 Brad Monterio

But maybe they don't, but that's okay.

01:04:10 Brad Monterio

But to get the profession listening and then engaging, right?

01:04:13 Brad Monterio

We don't want just wires or lurkers.

01:04:17 Brad Monterio

We want people in the profession engaging and talking about these things.

01:04:21 Brad Monterio

And then finally on education, again, near and dear to my heart in terms of our responsibility.

01:04:25 Brad Monterio

I don't want to be in a position where we're comfortable or complacent or even arrogant about what we think works.

01:04:35 Brad Monterio

Literally, today I had a conversation with some folks on my team about conferences and the fact that a decades-old model exists, where we have opening session or plenary sessions, we have concurrence, we have lunch, we have more concurrent sessions than a closing keynote, and...

01:04:52 Brad Monterio

Everything is very scheduled, right?

01:04:53 Brad Monterio

So during the breaks, they're in the exhibit halls talking to vendors and partners.

01:04:57 Brad Monterio

And so I posed the question to some folks on my team, what if we approach this as people can be anywhere they want, engaging with whatever component at that event?

01:05:07 Brad Monterio

that they want to.

01:05:08 Brad Monterio

So maybe they're not sitting in the scheduled general sessions or concurrent sessions.

01:05:12 Brad Monterio

Maybe they're doing something, one of our activations in the exhibit hall, or maybe they're talking to vendors, or maybe they're networking with each other, and they'll go sit in on the sessions that are important to them and relevant to them, but we shouldn't treat it as this linear

01:05:27 Brad Monterio

schedule of events that they have to follow along with us.

01:05:30 Brad Monterio

They can plug in wherever they want.

01:05:32 Brad Monterio

We're talking to leading universities about design your own education program.

01:05:37 Brad Monterio

There's 150 modules at various levels of proficiency.

01:05:41 Brad Monterio

You pick at the time you need them, the things that are important to you.

01:05:45 Brad Monterio

So whether it's an hour, whether it's 16 hours, or whether it's something else, but it's the topics that you care about and that are most meaningful to you that you can supplement with whatever other learning and thought leadership and research.

01:05:56 Brad Monterio

that we make available to you or perhaps you get from your own employer or another source.

01:06:02 Brad Monterio

But the point is, hyper-personalize it, make it relevant to you, Tom McLeod.

01:06:07 Brad Monterio

Your needs are going to be very different than Brad Monterio's.

01:06:10 Brad Monterio

They should not be cookie cutter or monolithic.

01:06:13 Brad Monterio

And I think from a learning perspective, we have to recognize that.

01:06:16 Brad Monterio

You know, we recently published the new competency framework in July.

01:06:20 Brad Monterio

We released it in Toronto at international conference.

01:06:23 Brad Monterio

And of course, that was a significant

01:06:26 Brad Monterio

I would say improvement over what we used to have, and it introduced the level of, 4 levels of proficiency in those various skill sets.

01:06:34 Brad Monterio

But we need to make sure that competency framework to talk about how quickly the market is changing, is that adapts on a real-time basis.

01:06:44 Brad Monterio

because six months from now, that AI sort of centric knowledge and skill that you talked about, they have to have, that's evolving.

01:06:51 Brad Monterio

So how does the competency framework evolve with that?

01:06:54 Brad Monterio

And then you can extrapolate that to how do things like the syllabus for the CIA exam evolve to adapt to that?

01:07:02 Brad Monterio

How do our standards evolve in real time or near real time to adapt to those changes?

01:07:08 Brad Monterio

and those new risks that are introduced.

01:07:10 Brad Monterio

So I think the timeline in which we've operated traditionally, which has been very slow, is dramatically changed overnight so that we're talking light speed plus.

01:07:21 Brad Monterio

And how does an organization like the IA or how does a profession adapt to that shift in time so that they are still relevant and out in front of it?

01:07:30 Brad Monterio

That's hard to do.

01:07:31 Brad Monterio

And we don't.

01:07:32 Brad Monterio

like you said, not yet.

01:07:34 Tom McLeod

I don't dispute that it's hard to do.

01:07:35 Tom McLeod

And indeed, if it was easy to do, everyone would have done it, to use that old cliche.

01:07:41 Tom McLeod

And your analogy of the linear, or the conversation with regards to the linear conferences is a really fascinating one, because we've all done the, it's 9 o'clock on Monday morning, we've got to be sitting in the plenary session.

01:07:51 Tom McLeod

and the major conversation and we've got to clap the person who's lecturing us rather than engaging with us.

01:07:59 Tom McLeod

And I walk away and then it's 10.15, I've got to go and have, oh, you've got a great pen set.

01:08:06 Tom McLeod

Thank you, vendor.

01:08:07 Tom McLeod

I'll take your five pens and you've got a great notepad.

01:08:10 Tom McLeod

If that's what you're going to a conference for these days, you're probably not getting the most out of the conference.

01:08:15 Tom McLeod

In my world, in my mind, I would love to have some form of coding on my registration that actually

01:08:22 Tom McLeod

lights up my badge that says that this guy, Tom from Australia is very much aligned with the thoughts of, not the desires and interests, but thoughts and other things of this person from Bangkok or this person from Costa Rica.

01:08:40 Tom McLeod

And as a consequence, why don't the three of you just go and have a coffee?

01:08:44 Tom McLeod

just sit down and have a coffee.

01:08:46 Tom McLeod

And I'll bet you're missing out on Tom McLeod presenting in hall #3 on X, Y, Z.

01:08:52 Tom McLeod

But the value is that now there's, I've developed my own school of constituency here, and they will last me a career, they will last me a lifetime.

01:09:01 Tom McLeod

And we've all had those moments where, and it's about forcing serendipity.

01:09:05 Tom McLeod

And I would be just, it comes back to being courageous as a profession as an institute, is just let loose of old thinking.

01:09:12 Tom McLeod

throw out old thinking as to how it goes.

01:09:15 Tom McLeod

It'll still be someone that wants to sit down and listen to the competency framework.

01:09:19 Tom McLeod

And that's okay, because it's relevant to what they are.

01:09:22 Tom McLeod

But if it's the only thing that people can sit down at, that's a failure of education.

01:09:28 Tom McLeod

Whereas the person might want to sit out, you know, we've always felt a little bit guilty if you're the person sitting out the front of a presentation, outside the hall with your lanyard on and everyone looks at you as to, why aren't you inside?

01:09:42 Tom McLeod

It's still like, well, I'm not inside because it's not valuable to me.

01:09:44 Tom McLeod

That's a failing of you, not a failing of me.

01:09:47 Tom McLeod

So I just think that, and it probably goes to the theme of all our conversations today, is that these opportunities are presenting ourselves by virtue of the changes of all professions.

01:09:59 Tom McLeod

These opportunities are presenting ourselves by virtue of the changes of AI for better or worse.

01:10:06 Tom McLeod

These opportunities are presenting ourselves because us as a profession is either going to die, like the bookkeeping profession, it still exists, but it's ultimately nowhere near as strong as it was 40 years ago.

01:10:19 Tom McLeod

We will either die and rue these moments missed, or alternatively, we'll sit back and say, we were the ones that actually stood up.

01:10:27 Tom McLeod

And if anyone listening today or anyone ever having these conversations,

01:10:32 Tom McLeod

can say with confidence that they actually ask themselves the hard questions, then they have done the profession and the institute as part of the profession an extraordinarily good service and they should be commended for it.

01:10:47 Tom McLeod

Asking the hard questions is exactly what's asked of us all now, not having the answers just because it's easy or to shut down that conversation.

01:10:56 Brad Monterio

Tom McLeod, you've given us a lot to think about.

01:10:59 Brad Monterio

It's really exciting.

01:11:01 Brad Monterio

Tom, you're an internal audit visionary, a change agent, a provocateur.

01:11:06 Brad Monterio

Those are all really good things in my book.

01:11:09 Brad Monterio

Thank you for your candor and sharing your ideas and insights with us.

01:11:13 Brad Monterio

I'm Brad Monterio, IA's Global EVP for Learning, Licensing, and Sales, saying, don't be a stranger and we'll see you again soon.

01:11:21 The IIA

Want more from Tom McLeod?

01:11:22 The IIA

Well, you can catch round two at the IAA's 2025 RISE virtual conference happening on December 5th.

01:11:30 The IIA

all online, all about leadership, and all the CPEs you need for the end of the year.

01:11:35 The IIA

So register your spot today and visit the iia.org.

01:11:41 The IIA

If you like this podcast, please subscribe and rate us.

01:11:44 The IIA

You can subscribe wherever you get your podcasts.

01:11:47 The IIA

You can also catch other episodes on YouTube or at the iia.org.

01:11:51 The IIA

That's T-H-E-I-I-A dot O-R-G.