Auditing the Auditors: Building Internal Audit at KPMG

00:00:02 The IIA

The Institute of Internal Auditors presents All Things Internal Audit.

00:00:06 The IIA

In this episode, Charles King sits down with Becky Mann to discuss what it takes to build and evolve an internal audit function inside a global firm.

00:00:14 The IIA

They share lessons from leading internal audit through disruption, how to structure teams around the business, and why auditors must move beyond rigid audit plans to deliver real value.

00:00:27 Charles King

Welcome to All Things Internal Audit.

00:00:29 Charles King

My name's Charles King.

00:00:30 Charles King

I'm the Technology and Innovation Leader at KPMG's Internal Audit Services Practice.

00:00:36 Charles King

And I'm here today with Becky Mann.

00:00:38 Charles King

And this is a special treat for me because Becky is KPMG's Chief Audit Executive.

00:00:44 Charles King

Becky, tell everyone a little bit about yourself.

00:00:47 Becky Mann

Well, first of all, Charles, thanks for having me.

00:00:49 Becky Mann

This is a treat.

00:00:50 Becky Mann

for me as well.

00:00:52 Becky Mann

Like you said, I lead KPMG's internal audit function, and so I get the privilege of auditing the auditors and everything that goes along with that.

00:01:02 Becky Mann

I started my career in client-facing internal audit roles, doing controls assessments, compliance reviews, initially in the government practice, and then changed into our commercial side of the house, and Sarbanes-Oxley happened, and

00:01:19 Becky Mann

I spent a lot of time in controls testing there.

00:01:22 Becky Mann

And there came a point where life was happening and I needed to hit pause on serving my clients.

00:01:30 Becky Mann

And so I had the opportunity to do some different things in the operations side of the farm and got to learn a little bit of the behind the scenes of what goes on, which was unique and different.

00:01:41 Becky Mann

And I don't know that a lot of our client-facing folks get that appreciation.

00:01:46 Becky Mann

And then about six years ago, those two experiences married up to make me uniquely qualified to lead our internal audit department.

00:01:57 Becky Mann

And so I've been doing that for the last six years, and it has been both eye-opening, rewarding, and I've learned a lot, and I'm excited to talk about it.

00:02:06 Charles King

So you took a new job right in the middle of COVID.

00:02:09 Charles King

Which was disruptive for everyone and certainly disruptive for KPMG.

00:02:13 Charles King

That must have been a pretty exciting time.

00:02:16 Becky Mann

It was exciting.

00:02:17 Becky Mann

There were so many things happening.

00:02:20 Becky Mann

in the world, obviously, and trying to understand and build a new internal audit approach, really think about what are the risks to our firm, how do we need to be helping our firm mitigate those risks, all in the wake of this big giant risk of COVID and trying to protect our people.

00:02:44 Charles King

And pandemic was not on anyone's bingo card.

00:02:47 Charles King

Like all of these enterprise risk management things, nobody pegged

00:02:50 Charles King

pandemic as a big risk?

00:02:52 Becky Mann

So it was a lot of figuring it out as we went.

00:02:55 Becky Mann

And like anything, when you're trying something new and different and implementing a strategy and building a team,

00:03:02 Becky Mann

You find things that worked, and so we stuck with those things, and then obviously there were things that didn't work as well.

00:03:10 Becky Mann

And so we tried to learn from that and course correct and keep at it.

00:03:13 Charles King

Well, I want to dig into what worked and what didn't work in a minute, but let's level set a little bit first.

00:03:18 Charles King

Talk to me about what the internal audit function at KPMG looks like.

00:03:21 Charles King

How many people do you have and

00:03:24 Charles King

What are some of the focal points for how those people spend their time?

00:03:28 Becky Mann

Yeah, it's a great question.

00:03:29 Becky Mann

So we have a team of about 40 people that includes some of our offshore resources that we leverage, just like our client-facing folks and probably most of our clients as well.

00:03:41 Becky Mann

We are

00:03:43 Becky Mann

geographically dispersed all over the U.S.

00:03:46 Becky Mann

firm.

00:03:46 Becky Mann

And our audit plan is also a lot like what you would see at our clients.

00:03:51 Becky Mann

Obviously, we're not a sock shop.

00:03:53 Becky Mann

We're a private partnership, but we do focus on financial controls.

00:03:57 Becky Mann

And so we...

00:03:58 Becky Mann

We have a portfolio of audits around our finance and accounting group.

00:04:02 Becky Mann

We do technology and data audits.

00:04:05 Becky Mann

We're looking at a lot of our process level controls that enable our client-facing professionals to do what they do and to do it seamlessly and efficiently.

00:04:15 Becky Mann

So we deliver about 25 audits a year, give or take.

00:04:20 Becky Mann

We do some agreed upon procedures that both our board and management tap into our skill set for.

00:04:26 Becky Mann

And we do a bit of consultative work as well.

00:04:30 Becky Mann

Less of that.

00:04:31 Becky Mann

One of the areas we kind of want to expand into is providing some more of those insights in a different way.

00:04:37 Becky Mann

But that's the gist of our plan.

00:04:39 Becky Mann

We do not, so we are not the peer review, quality review of looking at

00:04:47 Becky Mann

client deliverables.

00:04:48 Charles King

Right.

00:04:49 Charles King

So we have a separate function for.

00:04:51 Becky Mann

That.

00:04:51 Becky Mann

Exactly.

00:04:52 Becky Mann

So there's sometimes some confusion on that of are we looking at what we deliver to our clients and how well we align to the standards.

00:04:59 Becky Mann

And that is not us.

00:05:00 Becky Mann

So we're kind of the back office for lack of a better word.

00:05:04 Charles King

And functionally, you roll up to our general counsel.

00:05:07 Becky Mann

I do.

00:05:08 Becky Mann

Our general counsel also heads up our risk management compliance

00:05:12 Becky Mann

all of our second line functions.

00:05:14 Becky Mann

And so it's kind of a good home for us.

00:05:17 Becky Mann

I do have that line into the audit and finance committee.

00:05:21 Becky Mann

So I report into them and have a great relationship with our board.

00:05:28 Becky Mann

They're very supportive of our work and very challenging to us as well, which I think is important.

00:05:34 Charles King

Yeah, good.

00:05:35 Charles King

When you were talking a little bit about the role change from

00:05:39 Charles King

being a client-facing professional to taking out some internal roles and eventually becoming the chief audit executive.

00:05:45 Charles King

You said that some things that you had tried worked and some things didn't work.

00:05:48 Charles King

Let's talk a little bit about some of the things that worked.

00:05:50 Charles King

What are some of the big lessons learned and successes that you had in steering a new way forward in our internal audit function?

00:05:59 Becky Mann

One of the things we focused on was our team and how to build that team in a way that allowed us

00:06:09 Becky Mann

to understand the business that we were auditing.

00:06:13 Becky Mann

We've adapted that construct.

00:06:16 Becky Mann

I think we got it pretty close out of the gate.

00:06:19 Becky Mann

But what we've done is adapt to our firm universe such that we have folks that are focused on particular parts of our firm.

00:06:28 Becky Mann

And the expectation is that not only do they understand

00:06:33 Becky Mann

how that business works and the processes that go along with it, the risks they're facing into, but they also understand the initiatives and the investments that we're making and the stakeholders and that they do become this trusted advisor as we've executed our audits.

00:06:51 Becky Mann

And it's really helped too in giving our team different experiences, allowing them to learn from each other.

00:06:58 Becky Mann

And then I have the unique benefit of

00:07:02 Becky Mann

having a firm of experts for just about any subject I would want to audit.

00:07:07 Becky Mann

And so as needed, I can tap into all of our professionals when we do have a bit of a subject matter that either we're not familiar with, it's really unique, we really need to drill into, you know, cyber as an area, making sure that we are evaluating that holistically.

00:07:28 Becky Mann

And then I think that too has helped us identify where do we need

00:07:32 Becky Mann

to kind of up our game and skill sets in-house such that we don't need to tap into our experts because more and more those areas are becoming standard.

00:07:41 Becky Mann

Like everyone needs to know cyber risk.

00:07:43 Becky Mann

Everyone needs to understand how data works.

00:07:45 Becky Mann

We can't be successful without it.

00:07:47 Becky Mann

So that's been what's worked.

00:07:49 Becky Mann

Adapting our teams, challenging them.

00:07:52 Becky Mann

I think one of the things that didn't work so well out of the gate was a very

00:08:00 Becky Mann

stay the course approach.

00:08:02 Becky Mann

This is our audit plan.

00:08:04 Becky Mann

It was approved by the board.

00:08:06 Becky Mann

We've got to deliver this audit plan.

00:08:07 Becky Mann

So we were, you know, we were dynamic in our audit planning in that we were willing to take on additional audits as folks needed them or look into special projects as we were asked to do that.

00:08:20 Becky Mann

But we weren't so great at letting go of an audit.

00:08:24 Becky Mann

And so I think realizing that the auditee wasn't ready,

00:08:28 Becky Mann

It wasn't auditable.

00:08:30 Becky Mann

There really wasn't a lot of value we could add through a traditional audit.

00:08:34 Becky Mann

And knowing when and how to either give the business space to, if they're in the middle of a reorg or a process change or a system implementation, let them figure that out.

00:08:48 Becky Mann

Or how do we provide value, again, in more of a consultative way that helps them

00:08:56 Becky Mann

I think controls minded, a risk approach to what they're building such that, we don't turn around and then six months down the road issue them an audit report and say you got it wrong.

00:09:07 Becky Mann

But really focusing in on the goal of helping the firm, reducing risk, improving our control environment, and how can we pivot and do that in a more forward-looking way than a retrospective traditional audit?

00:09:21 Charles King

One of the things that you mentioned that I think is really interesting, and I don't know if I knew this, is that you have your team aligned around the way we are organized.

00:09:32 Charles King

Does that mean you've got what audit, tax, and advisory professionals that are tagged to each of those things?

00:09:37 Charles King

How much deeper?

00:09:39 Charles King

do you go?

00:09:39 Charles King

Is it that level or is it even deeper than that?

00:09:41 Becky Mann

No, it's about that level.

00:09:43 Becky Mann

So we call that portfolio our revenue and growth portfolio.

00:09:47 Becky Mann

So the sides of our firm that are focused on driving revenue, our advisory tax and audit operations, how those work, our marketing functions, our growth and strategy, sides of the house, clients and markets, all of that sits in what we call our revenue and growth portfolio.

00:10:06 Becky Mann

Then we have

00:10:08 Becky Mann

a business operations portfolio, which is more of our finance and accounting, talent and culture, our HR audits all sit in that portfolio.

00:10:19 Becky Mann

We have a technology and data portfolio, and tech and data obviously focus on our in-house technology estate and control environment, but also drive the integrated audits across the other portfolios as well, right?

00:10:34 Becky Mann

So they are evaluating

00:10:35 Becky Mann

providing our technology and data controls in both revenue and growth and business operations.

00:10:41 Charles King

Got it.

00:10:41 Charles King

You mentioned that you bring people in as subject matter experts, but I think people also rotate through your department, right?

00:10:49 Charles King

They go, they come out of the field for a little while, they might work in internal audit, and then they go back into some other function.

00:10:55 Becky Mann

That's right, although

00:10:56 Becky Mann

This might be a bit of a sore subject because all of our rotations so far have just stayed with me.

00:11:01 Becky Mann

They've not gotten back into the field.

00:11:05 Charles King

Well, I think that means they like it.

00:11:07 Becky Mann

That's right.

00:11:07 Becky Mann

That's right.

00:11:08 Becky Mann

It's too good to leave.

00:11:11 Becky Mann

But yes, we have had that model and it's worked well, at least from my perspective.

00:11:15 Charles King

Yeah.

00:11:16 Charles King

So I think guest auditor programs are a really underutilized asset for internal audit.

00:11:25 Charles King

teams.

00:11:25 Charles King

And I know you, we, KPMG may be a little bit of a special case because we have a lot of internal auditors, right?

00:11:33 Charles King

But I wonder, as you think about how you organize your guest auditor program,

00:11:39 Charles King

it's still a different thing, right?

00:11:41 Charles King

Doing client service, internal audit versus coming and being a part of, you're sort of going into industry without really going into industry.

00:11:49 Charles King

And the focus is different.

00:11:51 Charles King

The relationships are different.

00:11:53 Charles King

The dynamics, you know, in terms of, I imagine, in terms of budgeting and scheduling, like all that stuff is just a different thing.

00:11:59 Charles King

When you bring a guest auditor in, how do you onboard them into your

00:12:05 Charles King

function and how do you make sure that they're ready to be successful?

00:12:09 Becky Mann

That's a great question.

00:12:10 Becky Mann

It's tricky because what we do is different.

00:12:13 Becky Mann

And you're right, we do have a firm of auditors and folks that are delivering wonderful solutions to our clients.

00:12:20 Becky Mann

But our approach to controls testing, it's a little bit different.

00:12:25 Becky Mann

A lot of times our controls aren't defined in a way that someone who's been doing Sarbanes-Oxley audits or a third year audit where they understand, here's my

00:12:35 Becky Mann

and control matrix, here's my audit program guide, and here's my test steps, and let me go execute that.

00:12:42 Becky Mann

So it is a lot of training in the sense of making sure folks are aligned around the operations of the audit entity.

00:12:53 Becky Mann

What do they do for our firm?

00:12:55 Becky Mann

What are the biggest risks to what they do for our firm?

00:12:59 Becky Mann

And then

00:13:00 Becky Mann

how do we make sure that we have the right controls in place?

00:13:03 Becky Mann

So it's a little bit more kind of critical thinking, I think, in that pre-planning phase, because it is, in most cases, the first time an area has been audited.

00:13:16 Becky Mann

So we spend a lot of time making sure that we understand

00:13:20 Becky Mann

whatever the audit entity is, how they work, what they do, how they measure success, and then that helps us design a better audit of them.

00:13:30 Becky Mann

And then I like to think that folks are better equipped when they, or if they do go back into serving clients, having that experience and really challenging themselves to think about

00:13:43 Becky Mann

how does this work?

00:13:44 Becky Mann

And not simply testing the controls that I've been assigned to, but really learning and understanding why those controls are important in that process.

00:13:55 Charles King

One of the things that I think is really remarkable about the success you've had at the firm is that when I talk to members of the board, they are very interested and engaged in the work that you do.

00:14:07 Charles King

And I think that's a testament to your leadership and your ability to communicate with them.

00:14:11 Charles King

But

00:14:12 Charles King

What are some of your habits or lessons learned, tricks and tips, whatever you want to call them, about how to engage with board members, with executive stakeholders to make sure that you're delivering what they need, you are a valuable asset for them.

00:14:30 Becky Mann

No, you're right.

00:14:30 Becky Mann

We do have tremendous board support and management support.

00:14:34 Becky Mann

You know, our senior leaders are very grateful for the service we provide them and giving them comfort to sleep at night.

00:14:43 Becky Mann

where they need to worry and where they don't.

00:14:45 Becky Mann

One of the things that we've done is a board orientation.

00:14:50 Becky Mann

So making sure that those nuances that we just talked about around internal audit of

00:14:56 Becky Mann

professional services, private partnership, how is that different than what you've experienced at all of your clients?

00:15:03 Becky Mann

What are you going to see that I'm delivering and in my audit reports that you probably haven't seen at clients?

00:15:09 Becky Mann

And how are those expectations different?

00:15:11 Becky Mann

So we spend a lot of time with our new board members making sure that our expectations are aligned around our plan and around what they can expect to see and how it can help them in their role as governing

00:15:24 Becky Mann

and overseeing some of our ERM risks.

00:15:27 Becky Mann

The other thing is transparency in all of our reporting, findings, findings analysis, making sure that everyone is aware of where things stand, how we are driving to the risk reduction, the remediation plan, and where we're not.

00:15:44 Becky Mann

And we need a little bit more muscle or escalation there.

00:15:49 Becky Mann

We spend a lot of time

00:15:51 Becky Mann

making sure that our board understands the current environment with our findings.

00:15:56 Becky Mann

And then I think the last piece that's important with our board and even our management committee relationship is the socialization.

00:16:05 Becky Mann

No one likes surprises, right?

00:16:07 Becky Mann

And so no one wants to find out that they're in the internal audit plan when you're presenting the internal audit plan to the management committee.

00:16:16 Becky Mann

And just like no one wants to find out that their audit didn't go so smoothly when you're reporting that to the board.

00:16:22 Becky Mann

So making sure that we have these channels of communication, that we're talking to folks regularly, that they know what's coming and when, I think has been, you know, obviously one of the keys to success there.

00:16:36 Charles King

Yeah, that's great.

00:16:37 Charles King

I mean, so much of friction is around mismatched expectations.

00:16:41 Charles King

And it sounds like if I were going to distill that down, it's

00:16:45 Charles King

making sure that expectations are aligned, which doesn't necessarily impact the work itself.

00:16:51 Charles King

It's just making sure that you're communicating about the work in a way that makes everyone as comfortable as they can be.

00:16:58 Charles King

I think that's great.

00:16:59 Charles King

So you've been an auditor for a while, right?

00:17:02 Charles King

In different, all kinds of different capacities.

00:17:05 Charles King

I think as a profession, sometimes we question our relevance or we think AI is going to

00:17:12 Charles King

make auditing irrelevant or there's always some kind of crisis in internal auditing, but I'm a proud internal auditor.

00:17:20 Charles King

I love what we do.

00:17:21 Charles King

I love the work that we do.

00:17:22 Charles King

And I wonder for you, when you think about, you know, what draws you to audit, what do you get excited about?

00:17:29 Charles King

What do you feel passionate about?

00:17:31 Charles King

Like, tell me a little bit about just for you personally, how do you drive satisfaction from coming to work every day?

00:17:38 Becky Mann

My husband would say it's that I get paid to critique and challenge people on everything.

00:17:46 Becky Mann

And that is a bit of it.

00:17:47 Becky Mann

But I do think, I'm like you, I'm a proud internal auditor.

00:17:52 Becky Mann

I think the value in identifying gaps before they manifest into big issues,

00:18:02 Becky Mann

I'm a big believer in, the little things build to the big things.

00:18:06 Becky Mann

And so making sure that we have addressed our open risks before they become something that is bigger.

00:18:16 Becky Mann

I think that's a big one for me.

00:18:17 Becky Mann

The other thing is a lot of times, and I'm sure this is true with your clients as well, we know some of our challenges.

00:18:27 Becky Mann

We know the problem, but we don't know exactly why

00:18:32 Becky Mann

that problem is there?

00:18:33 Becky Mann

What is the root cause of it?

00:18:36 Becky Mann

And I think serving in this role allows me and us to really help management pinpoint, here's why this is a problem.

00:18:48 Becky Mann

helps us articulate how to solve that problem and really puts management on the hook to address it.

00:18:55 Becky Mann

if it's something that we agree needs to be addressed, because again, a lot of times we all know what the challenges are, but

00:19:02 Becky Mann

It's fixing it.

00:19:03 Becky Mann

That's the hard part.

00:19:04 Becky Mann

And I think that's the other thing I try to stay focused on.

00:19:08 Becky Mann

What is the outcome?

00:19:09 Becky Mann

How do I drive to getting this fixed?

00:19:12 Becky Mann

Is the mechanism to do that an audit report?

00:19:15 Becky Mann

Is the mechanism to do that, you know, an escalation?

00:19:18 Becky Mann

Or is the mechanism to do that simply a conversation and making sure that everyone is aligned around this risk that we're presented with and how we're going to fix it?

00:19:27 Charles King

Yeah, I don't know that we always have a great

00:19:31 Charles King

graduated approach to risk.

00:19:35 Charles King

I think too often in the internal audit space, we have a big list of risks and then we're going to do an audit of this and we're not going to do an audit of that.

00:19:42 Charles King

And we have this binary on-off decision, right?

00:19:45 Charles King

And sometimes we'll add a third choice, which is we can do a kind of consulting engagement.

00:19:51 Charles King

But I think maybe as a profession, we need to think more about the steps on the continuum between

00:20:01 Charles King

shrug and do nothing on one side and do a full forensic investigation on the other side, there's got to be more stops on that continuum than audit or not audit.

00:20:10 Charles King

And I think maybe that's what you're alluding to is figuring out the right tool to get assurance and manage risk is part of the magic of running a good audit team and getting the trust of management.

00:20:27 Becky Mann

Exactly.

00:20:28 Becky Mann

And you said that way better than I did.

00:20:29 Becky Mann

Thank you.

00:20:31 Charles King

Well, Becky, it's been great having you here.

00:20:33 Charles King

Thank you for coming on All Things Internal Audit.

00:20:36 Charles King

It's always a pleasure to chat with you.

00:20:37 Charles King

And as a partner in the firm, thanks for everything that you do.

00:20:41 Charles King

We appreciate it.

00:20:42 Becky Mann

Thanks, Charles.

00:20:44 The IIA

If you like this podcast, please subscribe and rate us.

00:20:47 The IIA

You can subscribe wherever you get your podcasts.

00:20:50 The IIA

You can also catch other episodes on YouTube or at the IIA.org.

00:20:54 The IIA

That's T-H-E-I-I-A.org.