Interested in this topic? Visit the links below for more resources:
Visit The IIA’s website or YouTube channel for related topics and more.
00:00:02 The IIA
The Institute of Internal Auditors presents All Things Internal Audit.
00:00:06 The IIA
In this episode, Scott Madenburg and Sanjay Vatlamani talk trust and why it's the defining currency of internal audit.
00:00:13 The IIA
From hyper-growth environments to large, mature organizations, they discuss how audit teams can build credibility, avoid the gotcha cop perception, and deliver value without slowing the business down.
00:00:26 The IIA
Through real-world use cases, they share practical examples of how trust enables earlier insights, stronger controls, and a true seat at the table.
00:00:37 Scott Madenburg
Hey, Sanjay, it sounds like you had a rough morning with the computer and the train and the leaks, but you persevered as you always do.
00:00:49 Scott Madenburg
But you know what?
00:00:50 Scott Madenburg
That's what makes you and others a great otter because we work in the gray and we're dealing with the mess, but we persevere.
00:00:58 Scott Madenburg
So.
00:00:59 Scott Madenburg
Exactly.
00:00:59 Scott Madenburg
We're nimble.
00:01:00 Scott Madenburg
We're very nimble.
00:01:01 Scott Madenburg
Maybe for the audience, I don't know, just so you just know who we are.
00:01:05 Scott Madenburg
I am Scott Madenberg.
00:01:06 Scott Madenburg
I'm the
00:01:07 Scott Madenburg
founder and president of ArcHybrid and have been part of this journey for over 2 decades.
00:01:16 Sanjay Vadlamani
My name's Sanjay Vadlamani.
00:01:18 Sanjay Vadlamani
I'm a senior manager, internal controls here at Payjoy.
00:01:22 Sanjay Vadlamani
Over 15, 17 years in the industry.
00:01:24 Scott Madenburg
So let me start off with this one.
00:01:27 Scott Madenburg
When you think about trust in the context of internal audit, what does it actually mean as far as day-to-day work?
00:01:35 Sanjay Vadlamani
That's a great question.
00:01:37 Sanjay Vadlamani
And I think here at Payjoy, trust, it's inserting yourself into the business, understanding the business, translating complexity into clear solutions that don't slow the business down.
00:01:51 Sanjay Vadlamani
It's solving problems that the solutions are felt today, but not in reinventing something that is going to be more bureaucratic and that's unnecessary.
00:02:03 Scott Madenburg
And I agree from my own perspective, what I have felt from internal audit is, in part of it's because of misnomers of what people always thought about internal audit was getting that social capital.
00:02:17 Scott Madenburg
So establishing those relationships and building trust amongst the organization, your stakeholders.
00:02:26 Scott Madenburg
And the hardest is always trying to get management to make sure they have that trust so that they can
00:02:31 Scott Madenburg
be a supporter of internal audit.
00:02:34 Scott Madenburg
But there's also the flip side is there's another form of trust I think that's often we have to look at.
00:02:42 Scott Madenburg
And that's when we are going to actually do an audit.
00:02:46 Scott Madenburg
And that when we're doing that process, that the folks that we're auditing trust us enough to
00:02:57 Scott Madenburg
give us the unfiltered information, that they're going to give us that raw spreadsheet with their notes on it, not redacted, and so that we can actually do the best work.
00:03:09 Scott Madenburg
Because at the end of the day, yes, internal lot's a independent function, but we are all part of the same team.
00:03:17 Sanjay Vadlamani
I couldn't agree with you more.
00:03:18 Sanjay Vadlamani
In fact, I'll kind of dovetail on that and say, I think it's imperative that we're not looked upon as gotcha cops.
00:03:26 Sanjay Vadlamani
To your point of sharing sensitive information that would be very useful in a scoping exercise when we're trying to understand what are the areas that we want to focus on to provide value, if they're hiding because they're thinking that we're going to then hang them out to dry, that's counterproductive.
00:03:45 Sanjay Vadlamani
So I totally agree.
00:03:46 Scott Madenburg
From my perspective, and I've mentioned this to you in the past, is the risk is evolving so fast for organizations.
00:03:55 Scott Madenburg
And the one thing that I think is so interesting from internal audit is that we are probably one of the only few people within the organization that actually goes and sees the entire organization.
00:04:13 Scott Madenburg
And whether that's audits where we actually, I don't know, talk to the security guard at the front of the office building or out in the field, or then have a conversation with the CFO, we have this whole visibility.
00:04:29 Scott Madenburg
So the value we can bring to the organization is this holistic view that I feel that everyone in the organization.
00:04:37 Scott Madenburg
So when you're thinking about risk,
00:04:40 Scott Madenburg
and controls, we can bring this kind of perspective of how does the left hand or the right hand actually work and maybe what we can bring together.
00:04:51 Sanjay Vadlamani
I completely agree.
00:04:52 Sanjay Vadlamani
I think, and I'm just thinking here at where I work.
00:04:56 Sanjay Vadlamani
having that holistic view, being able to plug and play within different groups when you understand what the company's overall goals are.
00:05:06 Sanjay Vadlamani
And there might be issues that a specific team might not be aware of.
00:05:12 Sanjay Vadlamani
You bring that to the table.
00:05:14 Sanjay Vadlamani
It, I think, increase visibility.
00:05:16 Sanjay Vadlamani
It makes this overall solution, I think, better.
00:05:19 Sanjay Vadlamani
And it just creates, I think, a more healthy discussion because there's a lot of unforeseen hidden risks
00:05:26 Sanjay Vadlamani
that a team may not be aware of.
00:05:29 Sanjay Vadlamani
And for them, the velocity of that risk and the impact could be a lot greater.
00:05:35 Scott Madenburg
Yeah, and the one thing I want to, and I kind of to that point and add is internal auditors, the more you do internal audit, the more critical thinking you do, the better you get at seeing the forest through the trees and asking the question of why, and if we can help bring
00:05:55 Scott Madenburg
some insights and some innovation to that, to the organization, we can show our true value.
00:06:02 Sanjay Vadlamani
And that kind of made me think of this concept that's been going around for a while, and I think is really relevant to this, is connected risk.
00:06:11 Sanjay Vadlamani
This whole concept that risks are not in silos.
00:06:15 Sanjay Vadlamani
Risks don't just aren't on a piece of paper.
00:06:18 Sanjay Vadlamani
It is real.
00:06:19 Sanjay Vadlamani
We have to understand how they connect
00:06:22 Sanjay Vadlamani
from the go-to-market team to the sales team to finance to accounting to the month-end close.
00:06:29 Sanjay Vadlamani
There is, it does exist.
00:06:31 Sanjay Vadlamani
And understanding that through line, I think, is where we really have value.
00:06:37 Scott Madenburg
Yeah.
00:06:37 Scott Madenburg
And I would also argue that besides the connected risk, there's sometimes a connected control.
00:06:45 Sanjay Vadlamani
Yes.
00:06:46 Scott Madenburg
And I think that's something that we have to think about a lot too, is to mitigate that risk, how does that control, maybe that's even done just in the AP function, but how does that impact other areas of business?
00:07:01 Scott Madenburg
But I think it's great.
00:07:02 Scott Madenburg
As far as what do you feel are some of the biggest gaps between audits, views, and beliefs, and leadership's perceptions?
00:07:15 Scott Madenburg
And I know that you're coming into an organization that's emerging and growing, and you've had to do some of that training.
00:07:22 Scott Madenburg
I did that as well, coming, and I've been at established organizations coming into an internal audit function where they had their views and have come into organizations where internal audit's brand new.
00:07:33 Scott Madenburg
And maybe we could talk about both.
00:07:35 Sanjay Vadlamani
We can start with the fast growing, the, you know, from the maturity model, the less formal.
00:07:42 Sanjay Vadlamani
And honestly, I think the gaps
00:07:45 Sanjay Vadlamani
between the function and leadership is strictly, I think it's just exposure.
00:07:52 Sanjay Vadlamani
Exposure of going back to what you talked about of what internal audit can do.
00:07:57 Sanjay Vadlamani
And it's not just a check the box.
00:08:00 Sanjay Vadlamani
It's not, we've only, we've not become relevant just at the time of Sarbanes-Oxley.
00:08:06 Sanjay Vadlamani
We're there well before, we're there after, and we're there during.
00:08:11 Sanjay Vadlamani
It's operational improvement.
00:08:13 Sanjay Vadlamani
It's
00:08:14 Sanjay Vadlamani
looking at data integrity, data compliance, just internal processes, making them more efficient for the business so they can achieve their goals.
00:08:25 Sanjay Vadlamani
At an individual level, it's making things less manual so they can then focus.
00:08:30 Sanjay Vadlamani
And like you were saying, it's not just internal audit that's going to be doing critical thinking.
00:08:37 Sanjay Vadlamani
the business too, the more critical thinking that we can have people doing, I think we as a company will be moving at a faster rate.
00:08:47 Scott Madenburg
Yeah, and one of the things that we're at a critical stage and to the credit of the IA, and I know there was a lot of mixed emotions, but when the new standards were issued in
00:09:04 Scott Madenburg
2024, and they, came effective, it's January 25.
00:09:10 Scott Madenburg
If you really read through it and you kind of understand, and even the work that the IAA is doing with political advocacy and just advocacy in general, I think we're trying to push, and we talked about the value and so forth, but we're trying to push that internal audits belief
00:09:29 Scott Madenburg
is that we can provide the value.
00:09:31 Scott Madenburg
We are more than just this cost center.
00:09:35 Scott Madenburg
We're not Milton sitting in the basement with the red swing line stapler anymore.
00:09:40 Scott Madenburg
We are a team and function of people that should be sitting at this table with other leaders to bring that holistic view.
00:09:51 Scott Madenburg
And one of the things that
00:09:54 Scott Madenburg
I feel that leadership perception is starting to change, but where internal audit is, I see a lot more, is getting better at, is skills that we haven't really practiced in the past as much, is better at branding, marketing, and selling ourselves as auditors, but also our team and what we can do.
00:10:18 Sanjay Vadlamani
I completely agree.
00:10:20 Sanjay Vadlamani
I'll add to that and say around
00:10:23 Sanjay Vadlamani
I'll call it the federal level, the national level, of how the IAA has been, I think, a great advocate of trying to just get us, get the whole, our profession, a seat at the table.
00:10:35 Sanjay Vadlamani
But then you look at the other end of the spectrum, and I think the IAA is also doing an amazing job of at the grassroots, at community colleges, at the local college, of having local chapters, people come and speak, a class,
00:10:51 Sanjay Vadlamani
in internal law.
00:10:51 Sanjay Vadlamani
All of these little things matter because then when we translate that to companies and leadership, you'll be surprised here at companies and even here, the leaders understand, they've read it, they've read something, they saw a little clip on internal IIA and oh, they can do this, they do these things, they do cyber reviews.
00:11:15 Sanjay Vadlamani
cybersecurity, they do pen testing.
00:11:18 Sanjay Vadlamani
Oh, we don't necessarily always need to go and hire somebody.
00:11:22 Sanjay Vadlamani
So I think it's coming, but I think the IAA is really helping us get there.
00:11:28 Scott Madenburg
Yeah, we need a big support group.
00:11:31 Scott Madenburg
That's what they're building up.
00:11:33 Scott Madenburg
And it's individually, we're all working together towards the same goal.
00:11:38 Scott Madenburg
So
00:11:39 Scott Madenburg
I would say that one of the things that we talked about was kind of hyper-growth, but maybe in kind of taking this to next spin.
00:11:45 Scott Madenburg
And we've both been at very large organizations as well.
00:11:50 Scott Madenburg
And folks that we've talked to, I think it's sometimes
00:11:56 Scott Madenburg
There's a trap on the small company is there's this education because maybe most, some people just have never heard of internal audit.
00:12:03 Scott Madenburg
But then when you're at a larger organization, it's maybe that there are people that have worked with internal audit and it's all based on their prior experience.
00:12:12 Scott Madenburg
So at a small company, even a startup, it's education, education.
00:12:17 Scott Madenburg
And sometimes you can get easier buy-in based on what you're doing.
00:12:21 Scott Madenburg
But at a larger corporation, there's
00:12:24 Scott Madenburg
It's more of retraining and educating and into of maybe you had a great experience and we want to continue that.
00:12:31 Scott Madenburg
Or maybe you had a bad experience, but how can we learn from that and expand upon it?
00:12:36 Scott Madenburg
So I think that from a larger organization, it's similar, but it's a little different.
00:12:40 Scott Madenburg
And the challenges can be a little different between what internal law it's trying to do, but also leadership's field.
00:12:47 Sanjay Vadlamani
I completely agree.
00:12:48 Sanjay Vadlamani
There's the, you know,
00:12:50 Sanjay Vadlamani
with the more mature companies, they have preconceived ideas.
00:12:54 Sanjay Vadlamani
They have either a good or a bad experience, and that stays with them.
00:12:59 Sanjay Vadlamani
The, we'll call it less mature companies, it's a completely different message.
00:13:05 Sanjay Vadlamani
It's more hand-holding, and it's more patience.
00:13:08 Sanjay Vadlamani
I think it's patience on both sides.
00:13:10 Sanjay Vadlamani
Honestly, I think it comes down to just
00:13:14 Sanjay Vadlamani
putting in the work, and the work is, okay, we're doing this to help all of us get better, and better at what?
00:13:23 Sanjay Vadlamani
Operational efficiency, for you to have more time to be able to think about problems that you aren't able to devote to.
00:13:31 Sanjay Vadlamani
Manually processing AP invoices.
00:13:34 Sanjay Vadlamani
Okay,
00:13:35 Sanjay Vadlamani
But maybe now you can look and say, are we paying too much for some vendor?
00:13:40 Sanjay Vadlamani
Should we go and get a new vendor?
00:13:42 Sanjay Vadlamani
Because you don't have time, but now you may have time to do some thinking and look at the data.
00:13:48 Sanjay Vadlamani
So I think it's, with us, it's spending the time with these people and explaining on both ends.
00:13:56 Sanjay Vadlamani
One, getting rid of preconceived ideas, and the other is helping them along the journey and showing them, as best we can, the why.
00:14:05 Scott Madenburg
Being in a high growth org right now, would you want to share an example of kind of the slowdown concern in a high growth organization?
00:14:14 Sanjay Vadlamani
Yeah, it's real.
00:14:15 Sanjay Vadlamani
It's something as simple as a policy adoption, something that most people and most companies would think, oh, okay,
00:14:24 Sanjay Vadlamani
is the language in here, can I, as someone who would be having to follow it, will I, can I adopt it?
00:14:31 Sanjay Vadlamani
Oh, okay, yes.
00:14:32 Sanjay Vadlamani
But at other companies, at high growth companies, it's a little different.
00:14:37 Sanjay Vadlamani
First and foremost is, will this affect product?
00:14:41 Sanjay Vadlamani
Will this slow down the business?
00:14:45 Sanjay Vadlamani
Will this slow down the database?
00:14:47 Sanjay Vadlamani
Will this, and that hesitancy forces
00:14:53 Sanjay Vadlamani
conversations that I did not anticipate.
00:14:56 Sanjay Vadlamani
And it goes back to, I think, pivoting, understanding, and maybe having a, the main goal isn't of adoption.
00:15:07 Sanjay Vadlamani
I have a micro goal.
00:15:08 Sanjay Vadlamani
And the micro goal might be, okay, let's get everyone in the same table and let's start from there.
00:15:14 Sanjay Vadlamani
We're all on the same team.
00:15:15 Sanjay Vadlamani
We all have the same goal.
00:15:17 Sanjay Vadlamani
and clearly spell out what the objective is and why I'm doing it.
00:15:21 Sanjay Vadlamani
To your point, maybe they have preconceived ideas about this from a prior company.
00:15:26 Scott Madenburg
Yeah, and especially in a high growth area, things move so fast.
00:15:32 Scott Madenburg
And now with AI being a big thing there, and we got to innovate very fast, or we got to bring in maybe a solution, and we don't have time to get it.
00:15:45 Scott Madenburg
perfect.
00:15:46 Scott Madenburg
We got to get it 80%.
00:15:48 Scott Madenburg
And I think that's, again, where audits changing and so forth.
00:15:52 Scott Madenburg
And it's like, hey, we don't have to come in and do a two-week or a two-month audit.
00:15:59 Scott Madenburg
We could come do something that's even maybe a day long.
00:16:04 Scott Madenburg
analysis of something very critical.
00:16:06 Scott Madenburg
So we're not going to slow you down.
00:16:08 Scott Madenburg
We're just going to give you another pair of eyes, kick the tires for you, just make sure, you know, it's like, you know, if you're driving along and it feels like one of your tires might have a little leak in it,
00:16:21 Scott Madenburg
You're not going to have to spend all day there.
00:16:23 Scott Madenburg
They can quickly take the tire off, just evaluate it, say, oh, it looks like you have a tiny little leak.
00:16:29 Scott Madenburg
We could plug it.
00:16:30 Scott Madenburg
And after an hour, you're back on the road.
00:16:33 Scott Madenburg
And audit can do those things.
00:16:34 Scott Madenburg
We're not there to per se slow you down, but we can, someone I once heard said the best thing.
00:16:42 Scott Madenburg
You need to slow down to speed up.
00:16:44 Scott Madenburg
So we're tapping the brakes a little.
00:16:47 Scott Madenburg
like any type of car so that you can get around that corner faster.
00:16:51 Scott Madenburg
And that's definitely what I'm seeing in high growth.
00:16:54 Sanjay Vadlamani
So it's funny you say that.
00:16:56 Sanjay Vadlamani
So I actually, I was just thinking of something just happened.
00:17:01 Sanjay Vadlamani
So I was reading a Slack message and in this message, in this group thread, they were talking about AI-assisted code.
00:17:08 Sanjay Vadlamani
And someone said, hey, how can we check AI-assisted code?
00:17:12 Sanjay Vadlamani
Do we need to check it?
00:17:14 Sanjay Vadlamani
And so then, to your point, I said, using that mantra of slow down to speed up, I made a simple suggestion of, hey guys, how about we just add these tiny, small checks at the very end, these small checks on the code.
00:17:33 Sanjay Vadlamani
And there's tools out there that will recognize AI-assisted code and will
00:17:39 Sanjay Vadlamani
Literally you could color code it or whatever, right?
00:17:42 Sanjay Vadlamani
So then you have an extra scrutiny over it.
00:17:45 Sanjay Vadlamani
Something as simple as that, simple suggestion created credibility.
00:17:50 Sanjay Vadlamani
And it didn't slow the business down.
00:17:52 Sanjay Vadlamani
We slowed down for, I don't know, a tiny bit, but everything's back to normal.
00:17:56 Sanjay Vadlamani
So I think it's understanding, providing value, surgically being precise, is going to pay huge dividends.
00:18:04 Scott Madenburg
And 2, if they ran that and they found a significant error, you, I'm not saying that, or you're coming in as a hero, but together as an organization is, that could have resulted in a very big slowdown.
00:18:17 Scott Madenburg
So, you know, it's those little things that matter.
00:18:21 Sanjay Vadlamani
Exactly.
00:18:21 Sanjay Vadlamani
It's being proactive, right?
00:18:23 Sanjay Vadlamani
Being preventive.
00:18:24 Sanjay Vadlamani
We always, if we go, if we're talking about like the control culture, control words, preventive is what we want.
00:18:32 Sanjay Vadlamani
Automated, yes.
00:18:33 Sanjay Vadlamani
But
00:18:34 Sanjay Vadlamani
You don't want to look at something after the fact.
00:18:36 Sanjay Vadlamani
Ideally, it's always you want to detect errors, identify the errors, and then have some type of remediation, something in place, which does not slow the business down.
00:18:50 Sanjay Vadlamani
We only want to help speed it up.
00:18:53 Scott Madenburg
And as I've always told you, Sanjay, it's the small, tiny, little unknown that worries me more than the big known.
00:19:02 Scott Madenburg
Going back to trust.
00:19:03 Scott Madenburg
How does building trust, what does it look like in a developing organization?
00:19:09 Scott Madenburg
And I'll chat, just kind of chim on this first, because I've been in this situation before.
00:19:16 Scott Madenburg
And I would say that the most important thing is before you're going to just start doing any type of audits or making any type of preconceived assumptions of things is
00:19:31 Scott Madenburg
The best way to build the trust is just go out and just start having conversations, just starting to speak to people.
00:19:42 Scott Madenburg
And then this is when I did, I remember being at a developing company and even starting an audit function, but I just spent time,
00:19:51 Scott Madenburg
letting people get to know who I was, doing the educating, but at the same time, just lots and lots and lots of listening.
00:20:00 Scott Madenburg
Because I've been through the situation where they hadn't had the experience, but if you can go through that and start building up the trust of those conversations, then you can take it to the next point and start doing some audits that are aligned with what they need.
00:20:20 Scott Madenburg
it may not fit to that cookie cutter type audit, but something that's more of where we need to be at that stage of the organization. sort of just even going to the policy aspect. I mean, I had one where it was just talking about and hearing what their needs are, but then bringing up some concerns that we had within the systems. And in actuality, the company I was at this point in time, the systems were
00:20:49 Scott Madenburg
Over-controlled, in fact, because...
00:20:52 Scott Madenburg
and they were causing issues from a policy perspective. So we had to rethink about what we were doing from the system standpoint to get and add some tweaking to the policy so that we could find a happy medium for everyone. And it wasn't that we were degrading control or
00:21:13 Scott Madenburg
bringing more risk in. It's just the viewpoints. And so by listening to everyone's counter-argument, you can actually come into the room and have some honest conversations.
00:21:23 Sanjay Vadlamani
I completely agree. I think your point about reaching out to many people and having conversations. So I'll give you like a real live example. When I joined here at Payjoy, I realized I was the very first hire in internal audit.
00:21:41 Sanjay Vadlamani
And so I told myself my 30, 60, 90, my goal is literally to meet and set up one-on-ones with heads of all the groups across all the countries to kind of set the table when internal audit will be having a real seat at the table. And
00:22:05 Sanjay Vadlamani
It took, it did take 45, maybe even maybe in three months, four months, maybe a little longer until I had a couple opportunities. And I was really grateful for having those relationships already kind of created. So when I had the ask of, hey guys, we really need to get all hands on deck. We need to address this issue in our system.
00:22:31 Sanjay Vadlamani
We need to have real guardrails in place to satisfy our auditors. We have a deadline. We need to follow this prescribed process, and let's work collaboratively together. And we were able to get a solution from zero in 45 days, go live, and we had over 300 people
00:23:01 Sanjay Vadlamani
were affected. They all joined the go-live. And if you had asked me before we started, if I had never had these conversations with these, with these people for months, I don't think I would have had the cooperation, the support, and we wouldn't have been a success.
00:23:19 Scott Madenburg
Yeah, absolutely. And this kind of goes into maybe beyond a little bit of the developing company, but how does trust enable earlier insights? And kind of to your point, this reminded me of one of the companies I worked at, and we were going through, we had five different ERP systems through different business units, and we were doing a Oracle implementation.
00:23:49 Scott Madenburg
Everyone was going, okay, we have all these different systems. We're going to go to one single system. And we asked the lead within the company, who was leading the implementation for the organization, if internal audit could participate this right at the get-go. And we explained to the audit committee, to management, that we wanted to push off a couple audits
00:24:18 Scott Madenburg
so that we could allocate the time to sit in on the discovery meetings, on meetings where we're discussing different configurations and so forth. And what we were trying to do was to understand how we had maybe different policies, different controls, that from these disparate systems, and now we're all going to a single source of truth. And what really happened was we were able to learn
00:24:48 Scott Madenburg
this system and the process along with everyone else. And then when decisions were being made, we were able to bring enough credibility to these conversations to say, well, we noticed that, this business has this, but did we consider this
00:25:09 Scott Madenburg
how it's going to impact everybody else. We were, and just throw another monkey wrench into this, was a no customization. It was all configuration. So by doing this, we were able to come away at the end of the day with a really good set of controls that mitigated all the risk. We had a system that went live that we were able to participate and make sure that when training happened, that
00:25:38 Scott Madenburg
we could help kind of support some of that. We weren't part of any controls, but then when we had to actually go out and do our walkthroughs, when we had to go and do our testing, we already had that built in and our stakeholders got to know us during the implementation. So they felt comfortable and we worked together. And if there were minor modifications that had to be made,
00:26:02 Scott Madenburg
It built the trust that they would call us and say, hey, we're thinking of maybe making a change here. Do you guys have any concern with this? And they would be able to be proactive. And so we were brought into that. So I feel that really was able to bring in early insight and build that trust credibility.
00:26:25 Sanjay Vadlamani
So that system implementation made me think of
00:26:30 Sanjay Vadlamani
stuff here. And I think you just talked about it, which is, you got a good set of controls. You went, you had successful go live because of credibility and getting everyone a seat at the table. Here, what I have been doing, because I know we don't have an internal audit function, I've just been rolling up my sleeves and doing, doing things that I know internal audit
00:26:56 Sanjay Vadlamani
can do, but we're not, quote unquote, that's not what people think of us as doing. Example, drafting from scratch an SOP. That is operational in nature. That is for the business, for a group. I've done it like 5, 6, 7 times. Why? Because I know in the end, there will be a time when you said there was
00:27:21 Sanjay Vadlamani
walkthroughs, there's controls, there's testing. I've created that, I've created that buy-in with this person, with these people, creating policies, creating a process flow map, identifying data leakage, data inconsistency, working on, you know, email, email naming convention for consultants, for crying out loud, right? But you and I, internal auditors, data matters.
00:27:51 Sanjay Vadlamani
data integrity, data consistency across the organization matters. And you said that system that you went go live was the source of truth. Now imagine that system, that one table was corrupted. Well, if that one system is the source of truth and is feeding other systems and other downstream processes and we have reliance, walkthroughs, well, you know where this is going to lead.
00:28:19 Sanjay Vadlamani
And you know who's going to be left holding the bag. So absolutely, right? When it's good. So I think putting in the work, doing what you did is tantamount. It's important, it's vital. And that's what I'm trying to do here.
00:28:35 Scott Madenburg
And as you told me that rolling up your sleeves doing some of these things is starting to pay dividends. And you're getting and where your organization's going and heading,
00:28:49 Scott Madenburg
they're already coming to you in advance, which doing that little legwork up front has bought you that trust.
00:28:59 Sanjay Vadlamani
Because like you said, you said this time and time again, if you put the work in, if you're able to put yourself in their shoes and envision their wrists, what keeps them up at night?
00:29:12 Sanjay Vadlamani
If you can help them for their top, not all, just their top, then what you said, and I totally agree, you will have a seat at the table.
00:29:22 Scott Madenburg
So let's flip the script here. Where do audit teams unintentionally undermine trust?
00:29:28 Sanjay Vadlamani
One that comes to mind is one of my prior companies, scope was, you know, very well-defined and ours were defined. Let's call it a short audit a month. Well,
00:29:42 Sanjay Vadlamani
There's friction when we're on month three. There's friction when our recommendations are outside of the scope of the initial audit. And it's a, what do you hear? What are you doing? Why are you poking your nose there? That wasn't part of your scope.
00:30:01 Sanjay Vadlamani
And why are you taking so long? Do you not understand? It's the competency and understanding this quote unquote, getting up to speed, scope creep. All of this could undermine internal audits' long-term value.
00:30:18 Scott Madenburg
From my perspective, and I absolutely agree with what you're saying there, is I see a couple factors where audits can unintentionally undermine trust.
00:30:31 Scott Madenburg
One is going to be with external audit and internal audit. And if your audit team is not having routine and consistent conversations with your external auditor, and then you guys are making the same requests for the same things, or not explaining to the stakeholders why
00:30:59 Scott Madenburg
maybe that request has to be made twice, or why there's difference between external audit and internal audit, then there's going to be this undermined trust. Because then everyone's going to feel, everyone's wasting my time. Internal audit already asked for this, or external audit already asked for this. Why do I have to give you twice? The other thing that I see, too,
00:31:21 Scott Madenburg
going into sometimes in these audits is depending on the team and so forth. you have your scope, but maybe there's two components of the audit. You're going to have do your typical operational audit, but then there's an IT component. And maybe you're bringing in some IT auditors that are going to be doing this. If you're not going in as a team and you've communicated this, then there can be scope creeps.
00:31:50 Scott Madenburg
So it's got to be a unifying force. Don't try to just, it's one audit team. And I have seen where it's one audit team and I have seen where the two teams go separate. It shouldn't be that way. You should be a unifying force and coming in and working together. And to be honest, the IT function can learn from the operational function or financial function and vice versa.
00:32:19 Scott Madenburg
In fact, I'd use every audit as an opportunity to cross-train each other. The more we're all learning and working it. The last where I've seen this, pardon me, yeah, I know you guys, you want to chime in, is with a new auditor. And it's really on the managers, the seniors, et cetera, to help explain the why
00:32:44 Scott Madenburg
to an auditor. If a senior doesn't explain the why to the staff or the manager doesn't explain the why to the senior, vice versa, whatever, then you're going to have what you said, the scope creep. And that's when you start going down the rabbit hole and someone sees something that, oh yeah, and they spend, I've seen this so many times where
00:33:04 Scott Madenburg
Someone tells me a story where, I had a staff and they spent hours testing something only to find out that they didn't ask the right questions and it was a nothing.
00:33:16 Sanjay Vadlamani
I completely agree with everything you said and made me think about at a higher level, I can lose trust in a hurry. And that's at audit committee.
00:33:25 Scott Madenburg
Oh, yes.
00:33:26 Sanjay Vadlamani
So I've seen, I've
00:33:29 Sanjay Vadlamani
been an observer in several audit committee meetings where the questions asked were the same from the prior, and there was a sense that internal audit had lost its focus, had lost confidence, were not in touch with the company's risks and objectives, and there was a misalignment. The reporting that was being presented
00:33:57 Sanjay Vadlamani
was not what was expected. And then you see a more, they bring us back. And it could end up being fully outsourced, co-sourced model. And that's, I think, worst case. But the other thing that you talked about, and I totally agree, is new, you know, with new people coming on board, there's a, you know, a risk there.
00:34:26 Sanjay Vadlamani
But you also talked about rotation. I love that concept of leveraging people in the organization who, giving them exposure. You'd never know. I'm always a firm believer that why go outside when we have untapped potential sitting here, who know the systems, who know our processes, who already are up to speed on the basics.
00:34:50 Sanjay Vadlamani
that 90 days is out the window. They can hit the ground running. It's just a matter of teaching them, okay, what is completeness? What is accuracy? What is data integrity? What is a control? Why do we do it? We do it for this. I think if there's a lot of things we do that is teachable.
00:35:05 Scott Madenburg
I do want to touch and you brought up an excellent point is about the audit committee. And the thing that I feel that internal audit really needs to make sure that we're doing is verifying
00:35:18 Scott Madenburg
our alignment with the audit committee and management. Again, internal audit should have a direct line to the audit committee, and there will be an administrative line to someone on the management team, most likely a CFO or a CEO. But you have to have an honest conversation to make sure that everyone understands where those lines are, what internal audit's role is,
00:35:46 Scott Madenburg
but also to what are the expectations of everybody. Because if you don't, if you're not all aligned, that's where the trust can be broken unintentionally. You know, again, going real quickly back to what we were talking about the new standards. And there are things in there that are being called out. And I know it's a tough conversation, but to bring some of the new requirements
00:36:14 Scott Madenburg
than things that are being brought up about, I would say, expectations from the standards, even if maybe the audit committee or management doesn't agree, but it can be a good pivot to at least engage those conversations to start getting everyone aligned. So again, and even just saying to the point, to your audit committee management, let's talk about this so that
00:36:44 Scott Madenburg
Trust isn't broken. So let's go this. Over the next 6 to 12 months, what is 1 meaningful change leaders could make in your mind over the next 6 to 12 months?
00:37:00 Sanjay Vadlamani
I think it's the elephant in the room, which is AI, is
00:37:03 Sanjay Vadlamani
We can't put our head in the sand and just ignore it. We have to acknowledge it. We have to have safe. We have to start talking, at least to your point. Start talking about what guardrails.
00:37:17 Sanjay Vadlamani
at X company, Y company, could look like. I think to me, having a discussion, having a roadmap of what a solution might look like would be the biggest win.
00:37:28 Scott Madenburg
And I would say over the next 6 to 12 months, and I agree, AI is the big elephant in the room. I would argue that there needs to be a hybrid view on it as well, and making sure
00:37:42 Scott Madenburg
you're going out having those conversations. What is the company's idea, et cetera. Internal audit. My first thing would say is within the next three months, make sure that your internal audit team, whether that's internally or however you want to do it, make sure the entire team of an internal audit function is literate on AI. That everyone on the team has the same understanding of
00:38:10 Scott Madenburg
all concepts of AI. Not that you're all going to be data scientists and et cetera, but how is AI used? What are the different type of models, different type of systems? And while you're doing that, if the audit team has that literacy, then you can go out and start asking smarter questions. But then at the same time, I would also then say is you can also then help the organization
00:38:38 Scott Madenburg
make sure that everyone else in the organization is literate on AI. And the reason I say this is we're moving so fast and this goes to the slow down to speed up concept is everyone's at a different perspective and view of AI and what it is and how it can be done. And there may be things coming from the board team where
00:39:04 Scott Madenburg
If we don't have the right literacy, we can't educate everyone. So if everyone had that basic understanding over the next 6 to 12 months, then you can make sure that internal audit goes out and has conversations. How are people using AI? And with the literacy, people with sort of understanding is, oh, I shouldn't be using my personal phone with ChatGPT on it because there's an exposure to the organization. And that's a bad thing for all of us.
00:39:33 Scott Madenburg
So again, I would, that's the one thing that I would highly recommend. The other thing is, and there's the hybrid part, make sure you don't lose your audit skills. It's going to be as vital, as important as anything with AI. If you don't want it to be a crutch, you're going to be using AI and internal audit. You're going to be auditing AI. But if you don't know how to still drive the car,
00:40:02 Scott Madenburg
and you're over-relying it.
00:40:04 Scott Madenburg
And as I say this all the time, I'm not going to be the one, I don't think anyone else listening to this is going to be the one that wants to get on the airplane that's on autopilot with no person behind that yoke.
00:40:18 Sanjay Vadlamani
So let me jump in real quick, because what you're talking about, I completely agree.
00:40:23 Sanjay Vadlamani
And I think that what you're saying is critical thinking.
00:40:26 Sanjay Vadlamani
That's what we can't lose.
00:40:27 Sanjay Vadlamani
We need to embrace it.
00:40:29 Sanjay Vadlamani
We need more of it.
00:40:30 Sanjay Vadlamani
And when we start using it and leveraging AI with the tools that will enable us to spend more time thinking, leveraging our internal audit skills to help the business,
00:40:46 Sanjay Vadlamani
not only us, but the overall business, I think we all will be growing and speeding up.
00:40:52 Scott Madenburg
Absolutely.
00:40:53 Scott Madenburg
Well, Sanjay, this has been a fun conversation.
00:40:57 Sanjay Vadlamani
Hey, thank you so much.
00:40:58 Sanjay Vadlamani
This has been fantastic.
00:41:01 The IIA
Hey, Audit Pros.
00:41:02 The IIA
GAM is back March 9th through the 11th in Las Vegas.
00:41:06 The IIA
It's where internal audit leaders come together to talk governance, emerging risk, and what's next for the profession.
00:41:11 The IIA
If you want smart conversation, fresh ideas, and some great networking along the way, head to the IIA website and register for GAM today.
00:41:20 The IIA
If you like this podcast, please subscribe and rate us.
00:41:23 The IIA
You can subscribe wherever you get your podcasts.
00:41:26 The IIA
You can also catch other episodes on YouTube or at the iia.org.
00:41:30 The IIA
That's T-H-E-I-I-A dot O-R-G.
