00:00:02 The IIA
The Institute of Internal Auditors presents All Things Internal Audit Tech.
00:00:06 The IIA
In this episode, Adesh Ghandre is joined by Dave Montaz and Richard Penfield to introduce Swarm Auditing, an emerging approach that combines human judgment with orchestrated AI agents working in parallel.
00:00:21 The IIA
They discuss how audit functions can move beyond prompt libraries,
00:00:25 The IIA
embed AI directly into audit workflows, and rethink the operating model of assurance without sacrificing independence or professional judgment.
00:00:37 Aadesh Gandhre
Hi, my name is Adesh Gandhre.
00:00:39 Aadesh Gandhre
I'm A Chief Audit Executive at DTCC.
00:00:41 Aadesh Gandhre
So internal audit has always been about assurance, but the way risk shows up today has fundamentally changed.
00:00:47 Aadesh Gandhre
Risk is continuous, digital, and increasingly driven by AI-enabled decisions at machine speed.
00:00:53 Aadesh Gandhre
Yet, many audit models still operate like they're in the world of fixed scopes and hindsight reviews.
00:00:59 Aadesh Gandhre
So I'm really thrilled to be joined by Dave Montes, Chief Audit Executive at PayPal, and Richard Penfield, who is the Data Science Manager in Audit Operations at PayPal, the two leaders who aren't just experimenting with AI, but rethinking the operating model of audit itself.
00:01:15 Aadesh Gandhre
So this conversation is about the mindset shifts, leadership courage,
00:01:19 Aadesh Gandhre
and what it really takes to move from the pilot projects to scalable and responsible innovation.
00:01:25 Aadesh Gandhre
So Dave and Richard, take us back to the moment when the traditional audit model started to feel insufficient and what experiences in your careers led you to rethink how audit work gets done.
00:01:40 Aadesh Gandhre
and ultimately to experimenting with swarm-based approaches.
00:01:43 Dave Montez
Sure.
00:01:43 Dave Montez
Why don't I start with that, Rich, and then I'll pass it over to you.
00:01:46 Dave Montez
I've been at the internal audit game for a lot of years.
00:01:50 Dave Montez
You know, I actually started my career with Coopers and Live Room, which is Price Riders Coopers now.
00:01:55 Dave Montez
And in my second year, they introduced the computer.
00:01:58 Dave Montez
That's how long I've been in the business.
00:02:00 Dave Montez
So things are constantly changing.
00:02:02 Dave Montez
Technologies are changing.
00:02:05 Dave Montez
control design, risk programs are changing constantly.
00:02:08 Dave Montez
So internal audit, as anyone who's been in the business for a while, as you know, it's not static.
00:02:14 Dave Montez
It's constantly on a change.
00:02:16 Dave Montez
So this is just another revolution of what internal audit will be in the future and what the control and risk environment will be in the future.
00:02:25 Dave Montez
Here in PayPal, we challenge ourselves annually on our entire design of our
00:02:30 Dave Montez
team, our approach to audit and compliance with the IAA standards.
00:02:35 Dave Montez
And as the new standards are extremely rigorous.
00:02:37 Dave Montez
And so that's something that's played a large role in the design of our future of internal audit.
00:02:43 Dave Montez
And when AI became a common used approach to internal audit, we had to not only rethink holistically how we approach internal audit and how we document what we do and how we risk assess what we do,
00:02:56 Dave Montez
But we also had other challenges going on in the organization of how do you actually implement AI as just an individual on a team as opposed to the grand views that we're taking a look at holistically for the team.
00:03:08 Dave Montez
So it was a parallel evolution that, again, it'll be constant.
00:03:12 Dave Montez
What we do now will be different than what we do next year.
00:03:14 Dave Montez
What we do next year will be different, what we do with so on and so on and so on.
00:03:17 Dave Montez
So it's constantly evolving as it always has.
00:03:19 Dave Montez
It's just evolving at a lightning speed pace now with the use of large language models and the tools associated with it.
00:03:25 Dave Montez
So
00:03:26 Dave Montez
That's been our journey.
00:03:27 Dave Montez
And we've been on this accelerated journey for about a year and a half now.
00:03:30 Dave Montez
And we actually redesigned our team structure where we had something called an advisory portfolio, where we had a group of people dedicated to doing consulting work out in the business.
00:03:41 Dave Montez
And you talked about adding value.
00:03:43 Dave Montez
This is one of those ways that we added value above and beyond just the audit process.
00:03:47 Dave Montez
And then during the audit process, it's also the tools that we developed for the first and second line to use to look at data the way we look at it and to find the results.
00:03:56 Dave Montez
that we find and more.
00:03:57 Dave Montez
So that's the constant evolution of the audit process.
00:04:00 Dave Montez
And then ours in and of itself, Rich is an extremely talented individual who has a vision, not just of what we do, but what we can do and how we can be better.
00:04:10 Dave Montez
And he designed this concept of swarm agents and swarm monitoring.
00:04:14 Dave Montez
So I'll turn it over to Rich to talk about that piece.
00:04:17 Richard Penfil
I guess a little personal journey prior to PayPal, I had been a data scientist in all three lines of defense.
00:04:25 Richard Penfil
Including an internal audit department with over 1,500 auditors.
00:04:30 Richard Penfil
There I had used GPT-2, which was prior to ChatGPT for data analytics.
00:04:37 Richard Penfil
But I remember the day that ChatGPT came out and my social blew up.
00:04:43 Richard Penfil
And that same week, Dave and I were on a call.
00:04:47 Richard Penfil
And I don't think it took long for both of us to know that this was going to be a drastic change.
00:04:54 Richard Penfil
In not just audit, but all fields.
00:04:56 Richard Penfil
I think going back to the original question, I don't think traditional audit hasn't necessarily broken overnight.
00:05:03 Richard Penfil
I think it's just starting to feel like using a flip phone in a smartphone world.
00:05:10 Aadesh Gandhre
That analogy is really sticky.
00:05:12 Aadesh Gandhre
I'm definitely going to steal that, Rich.
00:05:15 Aadesh Gandhre
So it resonates very deeply with me.
00:05:17 Aadesh Gandhre
I think you and I seem like we found ourselves in this profession as a third line of defense.
00:05:24 Aadesh Gandhre
You know, I'm an accidental auditor myself.
00:05:27 Aadesh Gandhre
Deep down, I'm still that technologist who loves to code, and I couldn't be happier to experience what we are witnessing now.
00:05:36 Aadesh Gandhre
as Dave, you mentioned, the speed at which it's changing, and change is the only constant in this whole world.
00:05:43 Aadesh Gandhre
So I'm fascinated by this whole AI shift and how we use it.
00:05:48 Aadesh Gandhre
So thinking about the mindset shift, right?
00:05:52 Aadesh Gandhre
So yes, we have the tools.
00:05:54 Aadesh Gandhre
Yes, you know, we're seeing the evolution on a day-to-day basis.
00:05:58 Aadesh Gandhre
But before the tools or the architecture, there's a mindset shift that's required.
00:06:02 Aadesh Gandhre
So what beliefs about the control, the ownership, or even what it's meant to audit have to change for swarm auditing to work?
00:06:12 Dave Montez
I think it's what you said.
00:06:14 Dave Montez
It's having a view of internal audit that's fluid and the control environment that's fluid.
00:06:20 Dave Montez
You've got to understand there's standards that we have to adhere to.
00:06:22 Dave Montez
There's rules that exist.
00:06:23 Dave Montez
There's policies and procedures that exist today in a corporation.
00:06:27 Dave Montez
You've got to navigate in between those.
00:06:29 Dave Montez
But you constantly have to be fluid and nimble and willing to completely revisit your design of controls.
00:06:37 Dave Montez
And don't be married to one view.
00:06:39 Dave Montez
Be open to many different views and to different tools as well.
00:06:43 Dave Montez
And that's, I think, been the biggest challenge for us, and Rich can speak to it better than I can, is the evolution of the tools at the pace with which they're evolving.
00:06:53 Dave Montez
we change every couple months.
00:06:56 Dave Montez
Our ability can grow faster and faster and faster.
00:06:58 Dave Montez
And we'll have to pivot to different tools that we use and approaches that we take.
00:07:01 Dave Montez
But it's just being nimble and open and not being tied to one view.
00:07:06 Richard Penfil
Yeah, I agree with both of you that the biggest blocker isn't the software itself.
00:07:11 Richard Penfil
It's what auditors tell themselves about what makes them valuable.
00:07:15 Richard Penfil
It's not, I do the work and that's what makes me valuable.
00:07:18 Richard Penfil
It's I can assure that the outcome is valid and sufficient.
00:07:23 Richard Penfil
So the mindset shift is going from using AI to go from being a doer to a reviewer.
00:07:32 Aadesh Gandhre
Makes total sense.
00:07:33 Aadesh Gandhre
So in all of this, where do you see the most resistance?
00:07:36 Aadesh Gandhre
Is it technical, is it cultural, or is it psychological?
00:07:39 Dave Montez
What I want to start with is everything is so new right now that there's a legal component to data.
00:07:47 Dave Montez
And that is one of the most complex pieces of navigating through this.
00:07:53 Dave Montez
is aligning with risk, aligning with, what our programmatic governance is of the company over to AI, and then with what we want to do.
00:08:02 Dave Montez
That to me, from where I sit, is the biggest challenge that we have.
00:08:05 Dave Montez
I think what Rich does, the skill that he brings, all of that just makes it easy to move forward.
00:08:12 Dave Montez
It's just moving forward with legal and risk and compliance and our governance policy together.
00:08:18 Dave Montez
That's the challenge.
00:08:22 Richard Penfil
From my perspective, it's had seen it's been the psychological element where people need to be given the permission to fail and fail forward.
00:08:34 Richard Penfil
And thankfully, that comes from the top.
00:08:36 Richard Penfil
And we've been fortunate enough to have that permission here at PayPal.
00:08:41 Aadesh Gandhre
That's a huge kudos to you, Dave.
00:08:43 Aadesh Gandhre
And I completely agree with this notion of allowing your auditors to fail.
00:08:49 Aadesh Gandhre
And once you create that culture, then obviously the magic happens.
00:08:52 Aadesh Gandhre
And I heard about this acronym somewhere, which I'll mention in this podcast.
00:08:57 Aadesh Gandhre
You know, the word fails is the first attempt in learning.
00:09:01 Aadesh Gandhre
And when I heard this, it's so sticky, it just stuck in my mind.
00:09:05 Aadesh Gandhre
And I've used it now thousands of times, but every time I say it,
00:09:09 Aadesh Gandhre
it just resonates even deeply.
00:09:11 Aadesh Gandhre
So it is your first attempt in learning.
00:09:14 Aadesh Gandhre
Let it be that learning exercise.
00:09:17 Aadesh Gandhre
Of course, when somebody makes the same mistake again and again, then it's a different conversation we need to have.
00:09:23 Aadesh Gandhre
But we definitely need to allow our auditors to experiment and fail.
00:09:28 Aadesh Gandhre
We do it through several ways, hackathons, giving them permission to work in the sandbox environment.
00:09:35 Aadesh Gandhre
And I'm actually excited seeing some of the traditional audit
00:09:39 Aadesh Gandhre
who've been in the business for 20 plus years, now leveraging Copilot in their day-to-day and really exploring it in the angles that I'd never imagined before.
00:09:51 Aadesh Gandhre
So kudos to you, Dave, for creating this culture.
00:09:54 Aadesh Gandhre
Shifting to the topic of the leadership, the job displacement fears, because I get this question all the time.
00:10:02 Aadesh Gandhre
Is AI going to replace
00:10:04 Aadesh Gandhre
the auditors, what's going to happen to my jobs?
00:10:08 Aadesh Gandhre
As audit becomes more agent-driven, how does the identity of the auditor evolve?
00:10:14 Aadesh Gandhre
And how do you respond to this very real fears around AI replacing the judgment rather than amplifying it?
00:10:21 Dave Montez
From my perspective, there definitely will be...
00:10:24 Dave Montez
change and impact.
00:10:25 Dave Montez
There's no doubt about that with what we can do with the large language models and all the tools associated with that, from coding to analysis to data pull, data clean.
00:10:35 Dave Montez
It can do quite a bit of what we do right now.
00:10:38 Dave Montez
I think Rich described it really well earlier.
00:10:41 Dave Montez
You're going to move from a doer to a reviewers, providing that judgment, providing that view and that historical knowledge.
00:10:49 Dave Montez
You know, my question is that path forward, and Rich and I have talked about this,
00:10:54 Dave Montez
of the having that historical knowledge, having that understanding of to have the judgment to challenge the results that you're seeing, that's going to be the part that has to continue to be developed.
00:11:06 Dave Montez
You have to have it to be successful.
00:11:07 Dave Montez
Perhaps it'll be AI that actually is that judgment down the road, who knows?
00:11:11 Dave Montez
But certainly, the language, the models can learn, and it's just they have to be checked along the way as they're learning.
00:11:19 Dave Montez
There will always be a role for an audit function.
00:11:21 Dave Montez
I think the three lines of defense model, which is common in financial institutions and other companies, I think that will change.
00:11:28 Dave Montez
I do think it'll be compressed down to a two lines of defense type of review, but we'll see as things evolve.
00:11:37 Aadesh Gandhre
Rich, any other views on from your side?
00:11:40 Richard Penfil
Yeah, to quote Charles Darwin, exactly.
00:11:42 Richard Penfil
It's not strength or intelligence, it's the responsiveness to change, which will lead the next generation of auditors specifically.
00:11:50 Richard Penfil
I think you mentioned auditors in that quote too.
00:11:53 Aadesh Gandhre
No, well said.
00:11:54 Aadesh Gandhre
I think the responsiveness to change is certainly one of the core skills.
00:11:59 Aadesh Gandhre
It's no longer a good to have, it's a must have.
00:12:03 Aadesh Gandhre
And it's how quickly you adapt and keep pace at it.
00:12:07 Aadesh Gandhre
Yes, as you mentioned before, ChatGPT 2, came in and we've seen different versions and now Gemini kind of given competition, to different models.
00:12:18 Aadesh Gandhre
And every time you see a new model coming in,
00:12:21 Aadesh Gandhre
It's how quickly you are adapting and not becoming, dependent on one particular LLM.
00:12:29 Aadesh Gandhre
So, that's a great, great segue to the next question, which is the AI that is built for audit versus AI adopted by audit.
00:12:39 Aadesh Gandhre
So, you know, I know that you guys haven't just adopted the enterprise AI, you have built AI for audit.
00:12:45 Aadesh Gandhre
So how did that change the way your function thinks about the GRC, the governance risk, the responsible AI across a broader organization?
00:12:56 Aadesh Gandhre
And how has audit in the sense become a proving ground for AI discipline inside PayPal?
00:13:03 Richard Penfil
So right off the bat, you can't audit what you don't understand.
00:13:07 Richard Penfil
So building AI gave us a better understanding of more so than what we would have gotten from a vendor.
00:13:15 Richard Penfil
And doing so, I think we earned our seat at the table, going through the process, the governance.
00:13:22 Richard Penfil
Nevertheless, it's a very tricky situation trying to get an AI project through the governance process with stakeholders, knowing you will be auditing that process or already have.
00:13:35 Richard Penfil
So I think that's where the human side of things comes into play and where relationships really, really matter.
00:13:43 Aadesh Gandhre
No, that's great.
00:13:44 Aadesh Gandhre
I think it's the customer 0 experience, which is how you are leveraging, AI is definitely going to inform you, what some of the pitfalls there could be, right?
00:13:56 Aadesh Gandhre
I mean, I am obviously fascinated with what we can achieve, but at the same time, I'm a bit concerned that people may start taking the shortcuts.
00:14:08 Aadesh Gandhre
And because, you're able to wipe code and, get something working very quickly, you may miss out on some of the basics, which is where I feel things like ITGC, IT general controls are even more important in the space of AI.
00:14:23 Aadesh Gandhre
So, but I like what you said, Rich, which is you cannot audit what you don't know, and earning that sit at the table is extremely important.
00:14:32 Aadesh Gandhre
So I guess in terms of the audit planning,
00:14:37 Aadesh Gandhre
audit plans are always full.
00:14:39 Aadesh Gandhre
There are things that we have to do based on the risk assessment, some of the functions like ourselves.
00:14:46 Aadesh Gandhre
we do have a lot of the regulatory driven audits that we have to do, on an annual basis.
00:14:52 Aadesh Gandhre
there is the audit cycle, driven audit plans that many people have.
00:14:57 Aadesh Gandhre
So how did you create space, both organizationally as well as psychologically, for experimentation of AI, given that you still have to complete and deliver the plan that you've committed to the audit committee?
00:15:10 Aadesh Gandhre
And what do you think is a bigger risk?
00:15:12 Aadesh Gandhre
Is it the trying or failing, trying and failing, or not trying at all?
00:15:19 Dave Montez
Not trying at all, clearly.
00:15:20 Dave Montez
You're going to be so far behind.
00:15:22 Dave Montez
our profession is going to pass you out very quickly if you're not out there trying.
00:15:27 Dave Montez
And we recognize that internally with our own team, where we were tracking who was using AI in any capacity, and then started leaning in on those people who clearly were afraid of it to help them identify very simple things that they can do, super simple things in daily and writing
00:15:45 Dave Montez
e-mail or writing a report or helping them analyze results.
00:15:49 Dave Montez
It's very simple things.
00:15:50 Dave Montez
We start there and then allow them to on their own grow.
00:15:54 Dave Montez
And then they see their peers doing things that are more challenging and exciting and cutting edge.
00:16:00 Dave Montez
And we were kept that stuff in a repository and we talk about it with the whole team.
00:16:03 Dave Montez
So it creates a little competitiveness and it also makes it a comfortable process as you start with the easy things.
00:16:09 Dave Montez
That's what we did internally, holistically for our plan.
00:16:13 Dave Montez
You know, it's like you said,
00:16:15 Dave Montez
there's a risk-based component of our plan, then there's the regulatory required audits in our plan that have to be done.
00:16:21 Dave Montez
The regulators are not going to be flexible in any possible way.
00:16:24 Dave Montez
So we allocated our resources appropriately to cover off on our audit plan holistically as we normally would, as well as providing a bucket of hours for the experimentation.
00:16:35 Dave Montez
And then people are on their own time.
00:16:37 Dave Montez
Rich is a prime example, constantly experimenting
00:16:41 Dave Montez
with different things and different approaches and different tools.
00:16:45 Dave Montez
So it's a combination of many things across our team.
00:16:47 Dave Montez
But fundamentally, we as a leadership team, all of us, are focused on knowing that one, two, three years down the road, we are going to be extremely advanced in AI.
00:16:58 Dave Montez
And it's going to have a large impact on how we risk assess, the work that we can do very strategically,
00:17:05 Dave Montez
that we can't do today necessarily, that it's more cumbersome to get so strategic on specific types of findings and testing that we do, especially when you have second, third, fourth parties involved.
00:17:16 Dave Montez
So we are constantly evolving.
00:17:18 Dave Montez
It's just like you said at the beginning, we have to be this way.
00:17:20 Dave Montez
And we are, we have minds already focused on what the future is, as well as those that are focused on executing on what we have to deliver for our regulators and for the boards across the globe.
00:17:31 Dave Montez
We have multiple boards that we report to.
00:17:33 Aadesh Gandhre
I think there is nothing better than creating some game, the gamification of learning, gamification around the experimentation.
00:17:43 Aadesh Gandhre
I mentioned hackathon previously, DTCC is going to host a hackathon in February.
00:17:52 Aadesh Gandhre
depending on whenever this podcast comes out.
00:17:54 Aadesh Gandhre
But that's one of the ways in which we are trying to get people interested and excited about the experimentation on AI.
00:18:02 Aadesh Gandhre
And we do have a separate track for Intel Nordit.
00:18:05 Aadesh Gandhre
So I'm excited to see what comes out of that experimentation and gamification, really.
00:18:13 Aadesh Gandhre
Rich, any points you have on this question?
00:18:18 Richard Penfil
I think Dave touched on most of it.
00:18:20 Richard Penfil
I'm just thankful
00:18:21 Richard Penfil
again, from leadership and from the team in general, that it's maybe not as strict as non-negotiable, but it is almost a requirement that we start using AI in our work.
00:18:34 Richard Penfil
And so it's at that point, it's not really any like a calendar trick.
00:18:39 Richard Penfil
It's embedded in your process.
00:18:42 Richard Penfil
And that's what it will be in the future is embedded.
00:18:45 Richard Penfil
It's not going to be an option at that point.
00:18:48 Aadesh Gandhre
Makes total sense.
00:18:49 Aadesh Gandhre
I'm going to ask you the next question, because I know this is topic near and dear to your heart, which is the topic of this podcast itself, the term swarm auditing, right?
00:19:00 Aadesh Gandhre
So the swarm models, they depend on the collaboration across auditors, data scientists, technologists, the business.
00:19:08 Aadesh Gandhre
So how do you design that collaboration intentionally rather than hoping that it happens organically?
00:19:14 Aadesh Gandhre
And why the term swarm auditing?
00:19:18 Richard Penfil
So Swarm Auditing is something we're really excited about because it sits right at the intersection of where internal audit is heading and where AI agent technology is already today.
00:19:29 Richard Penfil
At its core, Swarm Auditing operates in multiple levels, the first of which is about agent orchestration.
00:19:38 Richard Penfil
As audit departments start bringing AI agents into their processes, you quickly move beyond just one agent doing one task.
00:19:47 Richard Penfil
You end up with teams of agents, which are referred to as agent swarms, working together.
00:19:53 Richard Penfil
How do you coordinate them?
00:19:54 Richard Penfil
How do you make sure their output is accurate and consistent?
00:19:57 Richard Penfil
How do you make sure they are operating within boundaries?
00:20:01 Richard Penfil
These are techniques that we can adopt from the software development community for internal audit.
00:20:07 Richard Penfil
But here's where it gets really interesting.
00:20:09 Richard Penfil
The second level is how do you integrate between those teams of agents and your team of auditors?
00:20:16 Richard Penfil
Agents aren't replacing your audit team in the near-term future.
00:20:19 Richard Penfil
So the question becomes, how do you organize this collaboration?
00:20:24 Richard Penfil
How do auditors and agents work together in a way that's safe, secure, and always produces the best result?
00:20:30 Richard Penfil
That system, that framework for human-agent collaboration in audit is what we mean when we talk about swarm auditing.
00:20:39 Richard Penfil
Now, this is obviously the high-level view.
00:20:42 Richard Penfil
We'll be diving into the specifics and practical details at GAM.
00:20:47 Aadesh Gandhre
Makes sense.
00:20:47 Aadesh Gandhre
Dave, from your perspective, when your audit shop starts experimenting with AI, builds these agents, the swarms of agents, and obviously they're collaborating with the auditors, they're working together, and they end up developing something which then can potentially be
00:21:10 Aadesh Gandhre
desired by the first line or the second line, and they come to you that, hey, can we have this?
00:21:16 Aadesh Gandhre
And, obviously we all always worry about, the blurring the traditional lines between the three lines of defense.
00:21:22 Aadesh Gandhre
So how do you manage that perceived conflict of independence?
00:21:28 Dave Montez
Yeah.
00:21:29 Dave Montez
No, that's a good question because we, data analytics, where we started back in 2016, I'd say, we're really advanced in that.
00:21:37 Dave Montez
And so we're constantly developing scripts in the different audits that we do that'll help the second line of defense or the first line of defense.
00:21:44 Dave Montez
We give them those scripts knowing that you own them.
00:21:47 Dave Montez
We don't own these things.
00:21:49 Dave Montez
You're going to modify them to fit where you're going to do it.
00:21:51 Dave Montez
Here's how we thought about the approach to risk and to control, and here's how we design this script, and here's the value it can bring to you.
00:21:58 Dave Montez
We're constantly in that business, but we ensure to them that this is your tool.
00:22:04 Dave Montez
You own this tool going forward.
00:22:07 Dave Montez
We will take a look at the tool when we come back to see how it's been modified and if it's complete, accurate, and sustainable.
00:22:13 Dave Montez
So it's something we've been doing for quite a long time.
00:22:14 Dave Montez
We'll just have another version of that with any form of AI that we develop and allow them to use.
00:22:21 Dave Montez
We also collaborate as they build their AI.
00:22:23 Dave Montez
They're talking to us about, one, does this look okay?
00:22:26 Dave Montez
And 2, have you done this?
00:22:28 Dave Montez
And many times we've already experimented with what they're looking at.
00:22:32 Aadesh Gandhre
I am a strong believer that audit is a perfect place of trying out different innovative experiments without that being
00:22:43 Aadesh Gandhre
afraid of failures because it almost becomes an incubator of ideas where you're better off trying these out with an audit without breaking the bank, as some would say, than do it in the most business critical operation of your firm.
00:23:01 Aadesh Gandhre
So it's great to share the ideas.
00:23:04 Aadesh Gandhre
It's great to influence the second line and in many ways also the first line.
00:23:09 Aadesh Gandhre
where they can learn some of the ways in which audit has looked at things differently, identified the blind spots, and some things that we would expect the management to do it themselves as well.
00:23:21 Aadesh Gandhre
So this is great.
00:23:23 Dave Montez
I will say, we learn as well from them.
00:23:26 Dave Montez
We can't be everything everywhere all the time.
00:23:29 Dave Montez
And we learn a great deal about their views on risk, data, how to use the data.
00:23:35 Dave Montez
So it's a two-way street for sure.
00:23:37 Aadesh Gandhre
Absolutely.
00:23:38 Aadesh Gandhre
So I guess moving from the tools to true swarms, right?
00:23:42 Aadesh Gandhre
As Rich mentioned, many firms are stuck in the concept of Gen.
00:23:49 Aadesh Gandhre
AI limited to the prompt libraries.
00:23:51 Aadesh Gandhre
Yes, those are important things.
00:23:53 Aadesh Gandhre
That's a start.
00:23:55 Aadesh Gandhre
But then, how do you move away from, or not away from, but from the chatbots and the co-pilots towards the agentic swarms?
00:24:04 Aadesh Gandhre
which is obviously the next logical steps.
00:24:07 Aadesh Gandhre
Your team has done it.
00:24:08 Aadesh Gandhre
But what does that next actually look like in a mature swarm-based audit function?
00:24:14 Richard Penfil
In a mature one, which I'm not sure if we're even at that point yet.
00:24:19 Richard Penfil
Is going beyond just prompt engineering to full context engineering and having, again,
00:24:27 Richard Penfil
that extra layer of how the swarms of agents integrate with auditors, the teams of auditors.
00:24:35 Richard Penfil
And then I guess you could take it even one step further than that.
00:24:38 Richard Penfil
It's how different internal audit departments can collaborate with one another.
00:24:43 Richard Penfil
And whether that's the open source model that is popular in software or something similar, I think that's the.
00:24:52 Richard Penfil
Third tier of swarm auditing.
00:24:54 Richard Penfil
And I think.
00:24:56 Richard Penfil
Having that collaboration between us would benefit the community as a whole.
00:25:03 Aadesh Gandhre
That's well said, and this is really an important point, which is that we get this through the different IA conferences that we go to.
00:25:14 Aadesh Gandhre
And one of the benefits of going into this conference is you get to meet with people from different firms at different levels of maturity, but then you share these experiences and you learn.
00:25:28 Aadesh Gandhre
We should definitely be doing more of that.
00:25:30 Aadesh Gandhre
And as I mentioned before, things like hackathon, where you will learn from different use cases
00:25:38 Aadesh Gandhre
And yes, I think there will be some firms who would like to keep that secret sauce with them.
00:25:43 Aadesh Gandhre
But most of the things that we do with respect to our day-to-day audit processes is not a secret sauce.
00:25:48 Aadesh Gandhre
So if there is a way that we can come up with different ways in which we can use technology to make our lives better, you're actually helping the whole industry, the whole profession, and we should be sharing that.
00:26:01 Aadesh Gandhre
Dave, I know you wanted to share something.
00:26:04 Dave Montez
No, I think the collaboration piece is absolutely critical.
00:26:07 Dave Montez
And it's something that we do now where our audit ops team is created.
00:26:12 Dave Montez
They started a group, I don't know actually what they call it, but we have different firms, different companies, their internal audit shops get together and talk about their use cases, their advancement, their challenges.
00:26:25 Dave Montez
And it's a shared knowledge that we all have together.
00:26:28 Dave Montez
There aren't the people that are hiding information.
00:26:30 Dave Montez
It's just like Rich said, the only way we're all going to evolve is by sharing this information.
00:26:35 Dave Montez
We do that.
00:26:36 Dave Montez
And then we also have internally an AI council where we have our, with internal audit with our top leaders, Rich is there.
00:26:43 Dave Montez
And we talk about everything that's happening real time on development of use cases as well as modifications of use cases or additional use cases that we have.
00:26:51 Dave Montez
And then there's that challenge thing that you talked about that's going on within the team.
00:26:54 Dave Montez
We discussed that as well, the successes and how do we communicate that and make sure that we're inspiring people to continually grow and use this.
00:27:03 Dave Montez
And we talked earlier about that.
00:27:05 Dave Montez
model of it's okay to fail.
00:27:08 Dave Montez
In fact, that's how we learn.
00:27:09 Dave Montez
That level of trust that you have, when you have all that combined together, it really does build bravery in people and allows them to push themselves a little beyond where they thought was possible and to take those risks and knowing that we're going to be there to support them and help make things work or figure out what went wrong and why.
00:27:27 Aadesh Gandhre
Said.
00:27:28 Aadesh Gandhre
I think seeing that art of the possible is really an important thing.
00:27:32 Aadesh Gandhre
I think, I keep saying this, it's not about, what tools you use, it's about your imagination.
00:27:38 Aadesh Gandhre
You know, you're only limited by your imagination in this case.
00:27:41 Aadesh Gandhre
So I guess to close the podcast, the last question I have, you know, and I think we can go on for hours on a topic like this.
00:27:50 Aadesh Gandhre
But if there is a CAE listening today,
00:27:52 Aadesh Gandhre
there's a chief audit executive listening today to this podcast and wanted to take one meaningful step towards a swarm auditing this year.
00:28:00 Aadesh Gandhre
What would you advise?
00:28:03 Dave Montez
Be open to it.
00:28:04 Dave Montez
Open your mind to anything that's going to change how you approach your audit methodology and building efficiencies and understanding about the capabilities that you have at your fingertips.
00:28:17 Dave Montez
But Rich will have a more articulate response.
00:28:20 Richard Penfil
Mine is just promotional.
00:28:22 Richard Penfil
Come to our GAM session.
00:28:25 Aadesh Gandhre
That's a great plug, Rich, and I'm actually excited for the GAM session in Las Vegas.
00:28:31 Aadesh Gandhre
And this is one of those things, you know, what happens in Las Vegas, you know, is actually going to come with me and I'm going to talk about it.
00:28:40 Aadesh Gandhre
So I'm excited, you know, for your session.
00:28:44 Aadesh Gandhre
And I feel the future of audit is not just testing these controls, but it's about how we are orchestrating the trust, how we are orchestrating the different ways in which we can innovate, and the bridge that we have between the traditional assurance and the digital-first models.
00:29:02 Aadesh Gandhre
Thank you, and again, I'm looking forward to your session at IIA GAM.
00:29:09 The IIA
Hey, Audit Pros, if you enjoyed this episode as much as we did,
00:29:13 The IIA
you can listen to all three gentlemen at GAM 2026, happening in Las Vegas from March 9th to the 11th.
00:29:20 The IIA
This is just a quick overview of swarm auditing and what it means for the profession.
00:29:26 The IIA
If you're interested in listening to the full session, you can secure your spot at the iia.org.
00:29:32 The IIA
If you like this podcast, please subscribe and rate us.
00:29:35 The IIA
You can subscribe wherever you get your podcasts.
00:29:38 The IIA
You can also catch other episodes on YouTube or at the iia.org.
00:29:42 The IIA
That's THEIIA.org.
