The Impact of Internal Audit—What We Learned at IIA GAM 2023

Key Takeaways

Great audit minds gathered at the eye-opening 2023 IIA GAM conference. Ruth Nouanesengsy and Grant Ostler join the OTB crew to share what they heard throughout sessions and in conversation with their peers. This episode covers a lot, including ChatGPT, audit analytics, cybersecurity, and the IPPF evolution. Tune in! 

Show Notes:

Want more highlights from IIA GAM? Read the blog recap.

The draft of the Global Internal Audit Standards^TM is now available for public comment through May 30, 2023.

Check out the IIA’s yearly report, the Pulse of Internal Audit, which provides insights about internal audit budgets, staff, audit plans, risks, and more.

Get more internal audit tips and takeaways for 2023.

Season 4, Episode 21: The Impact of Internal Audit—What We Learned at IIA GAM 2023 | Transcript

Ruth: The relationship building within the company and outside of the company with your peers is helpful to help you to understand and to grow professionally and to provide additional value to the company. 

Catherine: Hello, and welcome to Off the Books, where we surf the uncharted waters of accounting, finance, risk, and wherever else the waves take us. This episode is brought to you by Workiva, the one platform that brings together financial reporting, ESG, audit, and risk teams. So instead of staying in silos, you can come out for a barn raising. My name is Catherine Tsai, professional asker of questions and lover of venti soy chais, and I'm happy to be here today with Mike Gravagno. Mike, why don't you introduce yourself?

Mike: Sure. I am a recovering Cherry Coke addict, unprofessional asker of questions, and an Off the Books producer. Normally, Catherine is joined in studio with accounting enthusiast and Diet Coke aficionado Steve Soter. He couldn't make it here today. So I'm going to do my golly gee darndest to fill his shoes while he's out. 

Catherine: Well, you're halfway there by saying "golly." 

Mike: That's the goal. I'm going to try to hit my golly quota. 

Catherine: Today we're mixing things up. So IIA GAM just wrapped up in mid-March.

Mike: So, that's so many just letters. What is IIA GAM? For just the listeners. I totally know. But for the listeners who might not know what IIA GAM is, what is that? 

Catherine: Yes, IIA is the Institute of Internal Auditors, and then GAM is the General Audit Management conference that they have every year. And since Mike, you and I didn't get to go to GAM, we wanted to hear some highlights from two people who went and who actually know a thing or two about internal audits. So we are here with Ruth Nouanesengsy and Grant Ostler, so it's great to have you two on the show. Would you like to introduce yourselves? Ruth, you can go first. 

Ruth: Sure. I'm Ruth Nouanesengsy. I'm the Director of Internal Audit here at Workiva. Let's see. I don't have an addiction issue. That seems to be the common thing. However, I do love motorcycles. So interesting fun fact. I have been doing auditing for a good long time, and I've been leading the internal audit function here at Workiva for three and a half years.

Grant: Right. And I'm Grant Ostler. I am an industry principal in the governance, risk, and compliance space with Workiva. I was an internal auditor like Ruth for a long time. I ran internal audit shops for about 20 years. And again, not a Diet Coke guy. I used to do some Diet Dr. Pepper back in the day. I know that probably makes me a real outlier here, but I'm mostly free of that at this point. So, other than a really weak moment now and then. 

Mike: That's what recovering means, I think, for me and Cherry Coke, so I got you. So the website for the conference says GAM stands for Great Audit Minds. How does that sound to the two of you, given what you heard at the conference? 

Ruth: I actually really loved that transition because really, that's what we're all about, is all of us getting together, sharing information, sharing insights with each other, and supporting each other. And so it really is about all of us having great audit minds. So I just love that transition in the titling.

Grant: I think I mean, there clearly were some great audit minds there. There were some people who truly are thought leaders that were there to share and to educate. I think, you know, to throw a few kudos to Ruth, we were able to have a session where Ruth and three of our customers talked about their experience and their journey down the road to ESG and be able to get ready for all ESG things coming down the road, which was awesome. We had great feedback on it, so we were able to contribute to that "Great Audit Minds" I think a little bit and learn from some others. I think it was great. 

Catherine: It's nice to hear internal auditors discussed as great audit minds. What would you say about how people think of the profession and maybe how that's changing today? 

Ruth: So I think people think about auditors as, "Oh my gosh, they're coming in, and they're going to audit us." And really my focus is about bringing value and being a business partner. You know, I'm an internal auditor. I am working for the same company where I am performing the audit. I want our company to succeed. Our company will succeed by looking at processes and ways that we can make processes better or looking at compliance and looking at how we're doing with compliance and ways that we can improve on compliance. So really my perspective on this, you know, when I'm talking to people about coming in and performing an audit is what can I do to help you with what you're doing? And so I do think that it really is about that type of an impact and that type of a perspective. And hopefully that's what people see when we come in and do our audits. 

Grant: I think Ruth's right. I remember when I first went out of school, the joke was that the auditors do come in after the battle and bayonet the wounded, and that never sat very well with me. It kind of bothered me. I think audit is going through a transition right now. So, you know, we went through a period after Sarbanes-Oxley where people became very compliance-oriented and really just hunkered down on compliance because the stakes were huge, right? I mean, everyone understands that. We're at a point now where I think it's normalizing a lot. We've learned a lot through Sarbanes and getting a lot better at it. And the stakes are raising for people to say, hey, you got to do compliance. That's, again, that's just expected. But you've got to do more than that. You need to bring additional value through that compliance work you do. We need you to spend time looking at other things as well and helping us be more efficient, more productive, more profitable. You know, some of these are what Ruth talked about. So I think we're in kind of a renaissance period, if you will, for auditors to really get out of checking boxes and doing just compliance to really say, hey, look, how do we have great audit minds and really help the company grow and be more profitable? 

Catherine: What did you hear at the conference about ways that you can show the value of internal audit?

Ruth: One of the things that was talked about was, you know, identifying emerging risks. When we think about internal audit and what Grant was talking about, bayoneting the wounded, yikes. You know, instead, what are we approaching? What's coming our way? Where can we actually go? Can we get ahead of this? This is maybe a risk that we need to be aware of so that we're taking action proactively instead of reactively. And so rather than that historical view that, you know, people are thinking of when they talk about audit coming in, instead, thinking about emerging trends, emerging risks. What's the next best step? 

Mike: What would you say some of the emerging risks right now in like midway 2023—is that what year it is? 2023. 

Ruth: It is 2023. That's almost like a trick question. No wonder you are the unprofessional asker of questions. 

Grant: Oh! 

Ruth: But cybersecurity is what we're hearing all about. There was actually some excellent speaking about that type of risk and ways that we need to think about it that are so different than the ways that we thought about it in the past. Considerations that we need to use. That's been a big focus. No big surprise, right? 

Grant: And I think that, again, there was a lot of talk about helping our organizations be more resilient. Cyber is clearly an area where auditors are looking and looking hard because there have been so many challenges there, and there are going to continue to be. ESG is a topic that was, you know, they had a whole track on ESG saying, look, how do you get in front of this? How do you get ready so you do it right, not be playing catch up? How do you do those things? I had a conversation with a handful of people around crypto and blockchain and different things, so I think there's a lot of things that are out there. It's like we're trying to understand as a profession, what's the risk to my organization, but also what are the opportunities for my organization of these things as well? How do we get the benefits and mitigate those risks so that we can do it in a profitable, sustainable way? And so I think there is a lot out there right now the profession is trying to understand because every day it's like, you know, it's ChatGPT. There was a lot of new, fresh stuff from when the sessions were submitted that we didn't have sessions about it, but there was a lot of conversation about it. What does this mean to us? What does this mean to our organizations?

Mike: Yeah, I mean, that makes sense. If thinking about emerging risks and you're like, here's the general areas, but it's evolving all of the time. So yeah, ChatGPT hit the scene, the public knowledge, just like a few weeks ago or a month or two ago, right? Like, it was bubbling for a while, and now it's like, well, we actually have to deal with this. So is that something the two of you are excited about, like the looking-forward and then keeping that very future mindset?

Catherine: Because we've had former auditors on the show, and they've said like historically the profession, they're always looking back. 

Ruth: I think the thing with that is you have to be aware of what the potential risks are so that you are proactive. So there are risks. ChatGPT is not the end all, be all. Does it have great things about it? Yes, absolutely it does. But it's not a wave of the magic wand, and everything happens. So it takes a different level of effort when you have new technology that is coming at you quickly. Everything is so much faster than it was 15 years ago. So it just is a different perspective. 

Grant: Yeah, I think ChatGPT is a really good example because, to Ruth's point, it doesn't cure everything. And there's downsides, right? There's pros and cons. So I think one of the risks for auditors and anybody is relying so heavily on something and losing your objectivity. Losing your questioning and saying, wait a minute, does this make sense to me? You know, it goes back to when GPS first happened. I know people who literally drove off roads. "Well, it told me to turn right, and I turned into a tree." Well, open your eyes. I mean, that same kind of thing applies here, right? So all of these opportunities are just that. They're opportunities for us to do things more efficiently, but we have to maintain our critical thinking. We have to really maintain the skepticism that as auditors we're supposed to be bringing. Say, does this make sense? How is this going to help. And how do we get the upside, again, while mitigating the downsides? What controls or barriers do we put around this to make sure that we don't make a bet we don't want to have to pay for later. 

Ruth: And what's truly something that you need to pay attention to versus just a distraction? And I'm certainly not saying that ChatGPT is a distraction, but sometimes there are things that are distractions. And so making sure that you're paying attention in the right way. 

Mike: Is there something from like a few years ago that seemed like it was going to be a big thing and turned out to just be a distraction? 

Grant: You all are too young for Y2K, but I think it lives up to that billing pretty effectively. 

Mike: Oh, no— 

Catherine: I remember that. 

Mike: —my garage was filled with beans and water bottles. My parents were ready.

Grant: I'm just saying I lived that one really hard, and we spent a lot of time for a couple of years, and all of a sudden, it was like, oh, that was fun. Let's go have a party, right?

Ruth: It's interesting that you asked that because I think some people may view ESG as that type of perspective. But I think that we have seen, you know, interest peaks and then wanes. And I think we've seen where in the past there's been the interest that peaked in ESG, but then it waned. But I think now we're seeing, at least to me, indicators that it's not going to wane, at least not to the degree that it did before. There may be some waning of that interest, but I think that that is going to continue to be a high priority for a good long time. And I think some of that indication is the SEC proposal around it, right? So, you know, if you look at the whole picture, you go, this is something that requires a little bit more.

Catherine: I could definitely see where internal audit could provide some value to organizations around ESG. And just a plug for our sister podcast, ESG Talk, I think they're going to be talking about that topic in future episodes as well. 

Mike: We're going to take a quick break to hear a word from our sponsors. 

Commercial: Today's episode of Off the Books is brought to you by Workiva. But I'm not here to talk about Workiva. I'm here to talk about grilled cheese sandwiches. Have you ever thought about how perfect yet so simple, the humble grilled cheese is? It's just bread and butter and cheese, but it is so much more. It melts. It stretches. It is gooey, which is not an adjective I use lightly, dear listener. More importantly, it pairs well with all sorts of delicious things. Tomato soup? Oh, absolutely. Onions and prosciutto. You know it. Peanut butter and Fig Newtons? I have not tried that, but I'm sure it wouldn't be that bad. The point remains. Things are better when you combine good things with other good things, which is the whole basis of the Workiva platform. Bring your SOX compliance and internal audit and SEC reporting and ESG needs and all that other financial and non-financial work into the same platform, and heavenly flavors will emerge from the ether and angels will sing. Yes! Workiva, get gooey with it, and learn more at workiva.com/podcast. 

Mike: And we're back with Grant Ostler and Ruth Nouanesengsy to talk about the scuttlebutt at IIA GAM. 

Catherine: So Grant, you touched a little bit on ChatGPT, but I'm wondering did other technology come up at the conference at all? 

Grant: Yeah, I mean, again, I think there's a lot of talk about analytics right now within the audit space. The Institute of Internal Auditors is, I think, strongly encouraging auditors to look at ways to leverage analytics, to be more efficient, to provide greater insights. Goes back to that, get beyond compliance and bring insights. And looking at data in a different way is a great way to do that and to bring a point of view and a perspective that they may not have because they're so close to it and auditors are a little bit more distanced from that. So that was an area I think that we talked about quite a bit. To Ruth's point before, I think new technology comes out a lot. Not all of it sticks. And so a little bit is, what's the business case? How well does it work? So a lot of things look great on paper and on the drawing board, and you got to see how they really add value over time. I think some of things we saw there will probably fade out a little bit, and others will really grab traction. 

Catherine: Well, tell me a little bit more about audit analytics, and do you think that's one that will stick around or fade away?

Grant: Analytics isn't new. I mean, I started doing analytics in the early '90s, so it's been around for a long time, and we were not using an abacus. We actually used computers back then, Mike, just in case you were curious. Seriously. It was crazy. But again, we tend to have a perspective sometimes that analytics is really big and different things. Analytics can be pretty simple work if you get access to the right data. And I think that's one of the real challenges with analytics is how do I get the data, how do I make sure that data is complete and accurate? And that's one thing that auditors have struggled with, is we've tried to get analytical in the past, and I think that that's something that as a profession we still struggle with is how do I do this efficiently and nimbly? 

Ruth: And I think to add on to what Grant was saying, the only thing to keep in mind is—not the only thing—but one of the things to keep in mind is similar to what we mentioned with Chat. It's not the end all, be all. It's not a magic wand. It doesn't answer everything. It takes work to get analytics to work right. You know, Grant was talking about having the right access to the right data, understanding that data. It's not just somehow magically going to pull together and answer all the questions. 

Mike: With that, how much of an internal auditor's role is advising the leadership? 

Ruth: It varies. Yes, you definitely are an advisor, and the advisory role is very important whether that's, hey, here's the new thing that we can use in internal audit to help the company and provide value versus payroll processing: Here's something that you may want to consider as an improvement to the process that you're doing that would add value to what you're doing, gain efficiency, gain effectiveness. So there is a lot of advisory that comes from that, realizing that we don't know everything, but we can research it. We can reach out to our network of peers to say, what are you doing at your company? Taking those best pieces and parts and advising on that. But also realizing it's management's responsibility to make those decisions. They're the ones who have to go, gee, they advised us to do all these things, but in our circumstances we have to do maybe a fraction of it, or we have to take a different look at it. 

Grant: I think Ruth is 100% right. I think the other thing is, you need to start where you're at. You can't just fake it till you make it. That doesn't play here, right? It is what can I do today to use some analytics, and it may be pivots and things like that in a sheet, that gives me a little bit more time back because I'm able to look at things differently and again, draw those inferences, those insights that give me a little bit more time back to then reinvest. So as I continue to gain a little efficiency here and little there and I use that to then expand upon the analytics that I've done and learn new things and say, hey, is there a different way to do this, that really becomes kind of a flywheel effect from what I've seen and what I've experienced in the past where, again, my ability to look at things in a different way than the business because they're so close to it that's really insightful. And we've seen in my previous experience as a chief audit executive, the place where we brought really significant new insights to them. They had the data. They just had never looked at it the same way we did. And so I think that's one of the real powers. And again bringing those great audit minds to the table to say, look, we're bringing a different perspective that helps you to rethink how you're doing things. And analytics is a tool in our toolbox for that. It's not the only tool, but it's a valuable one. 

Mike: What other chatter did you all hear at the Great Audit Minds conference? Were there any other hot topics? 

Ruth: I think as time has gone on year over year, something that I've seen as a recurring theme has been networking, working together, and positioning ourselves so that we have resources available. I mentioned that maybe you don't know it, but you reach out to other people that have the experience. That's very critical. We aren't alone in this. We're working together, and we're trying to to do what's best as a whole. That is something that I think, you know, anyone that's in internal audit realizing that that's important and the relationship building within the company and outside of the company with your peers is helpful to help you to understand and to grow professionally and to provide additional value to the company, which is what we're trying to do.

Grant: Another topic that I think there were two sessions on, and I know there's a lot of chatter about is: This is a space where it's difficult to fill all the open positions that you have today. We've talked about the great resignation I know on other podcasts. It's a challenge for auditors, right? It's a big deal. And so a lot of the conversation was, hey, how do we retain the people we have? How do we make the work that they do, how do we make that more meaningful? How do we take the routine and monotonous things that don't add great value, automate those so that we can have people focus their energy, focus their minds on, again, adding value rather than doing just kind of that rote work. So there were a couple of really good sessions I thought about that saying here's ways to look at developing your people, here's how to retain them, those things. And you know, I think that is—the entire finance profession, if you will, is struggling with that. We're clearly as auditors not immune. There was also a lot of conversation that I had with people that was like, hey, I'm going to start looking at all alternate sources for talent. I had a person that mentioned that they've hired a couple of psych graduates recently. They said we had to teach them accounting, but they did a lot of statistics. They understand math. They understand how to do those kind of things, and they get along pretty well with people, which we do a lot of that. And so they're teaching them to audit. They're teaching them the accounting they need. But they're bringing someone with, again—to me that diversity of thought within the audit team also adds value, right? So I need people with different perspectives. I don't want to have all my auditors be exactly the same either because then I don't get that uplift that I can get from, again, challenging each other. 

Catherine: So you don't have to be a CPA to be an internal auditor?

Grant: No, you don't.

Catherine: That's a plus.

Grant: The Institute of Internal Auditors has some professional designations. They have a certified internal auditor. They have a handful of different certifications you can get in risk and different areas. But yeah, you don't have to be certified. 

Ruth: I think that that's a misconception that happened with the implementation of SOX that because it was so financial focused that people thought that you had to be a CPA. I actually worked places where someone had a marketing degree. Places where we had HR professionals, safety professionals, people that specialized in very specific areas and had never done any type of accounting work. And so there can be great benefit to that. 

Catherine: Mike, maybe it's our next career move. 

Grant: Yeah, there you go. I've had credit people. I've had operations people. I've got friends who are in the health care space. They have RNs on their staff because they understand, right? Again what's going to put us in a position, what people, what skills do I need to understand what's going on in the business and be able to help them do it better and more efficiently and make sure it's done right? And so you really need that context and that understanding in some way. 

Catherine: I do have a nerdy question for you because I think on the conference agenda, it mentioned something about the International Professional Practices Framework standards. What are those, and what happened at the conference with those? 

Grant: The IPPF are the standards on how internal auditors are to do their work. So the Institute of Internal Auditors puts out standards to the profession as how we go about. So auditors have generally accepted auditing standards that apply to doing external audits that the AICPA puts out. We have these standards that help us understand, and they focus on maintaining our independence and objectivity, making sure that people have the capability to do the work that they're being assigned to do. It's making sure that organizationally we're where we need to be to have the most impact, and they go on and on. So they don't get updated a lot. I would say it's probably every 10 to 15 years probably they get updated. They just released, a couple of weeks before the conference, an updated set of the standards for comment, so public comment. To summarize real quickly, I think there was kind of a shift from more of a rules-based approach to more principles-based. So a lot of the expectations didn't change. The majority of what's there stayed fairly consistent. Internal audit didn't change 100% over the last 10 years, but it's really taken a more principles-based approach so that people can adapt and adjust them in a much more dynamic world than we used to live in. And I think that's a pretty important aspect of what what they introduced to us. 

Ruth: Yeah, and I also saw it more as, even though it had been called the international at the beginning of the title for a number of years now, truly trying to take that perspective of what can be in place that truly can be applied internationally rather than being more focused in the United States. 

Catherine: Any final thoughts from people before we get to our closing question of the day? 

Grant: My only question is, are you excited to attend GAM next year with us? Has this got you fired up yet?

Catherine: I am. I want to go. 

Mike: If professional podcasters can one day become internal auditors, then yes, we'll be there.

Grant: Oh, there's a road to audit for you. 

Ruth: It may be bumpy.

Mike: Yeah, that's fine. Keeps it exciting. 

Grant: Put on your bike helmet. Let's go. 

Catherine: Let's get to our closing question of the day. I want to hear from both of you. What is your pitch for why now is a good time to become an internal auditor?

Ruth: So I think that the why now is because there are so many opportunities open to us. There's so much new that's going on. There's so much that you can learn and that you can do. There's different directions you can take. It's not a one size fits all. It really isn't. So if you're interested in looking at analytics and that's your, you know, secret wish, then you can do it. If your secret wish is to get into the details, you can do it. If your secret wish is to be talking to people and building those relationships, you can do it. And if it's some sort of a combination of those, then this is the perfect opportunity to be in internal audit. There are so many new things to learn and to continue to grow yourself professionally and personally in what you can do. 

Grant: I think that's true. I think in addition to that, one of the things is as audit leaders we try to do is to try and develop certain attributes in our people. We want to help them to think critically and to ask the questions behind the questions. We want to help them understand how to do root cause analysis and risk cost benefit. And so really understand, how do you have a difference? How do I get behind things? How do I make a difference? And those are skills that are transferable anywhere in the organization. It's a great place to get a broad view of the organization and know what's going on. So if you want to go somewhere else, it's a great place to get in and to learn. To Ruth's point, we're living in a really, really dynamic time right now where there's incredible opportunities to make a difference. Organizations need people who can get in, understand a set of data, understand how I can go validate things, come back with proposals and validate and do those things. And that's what we do in the audit profession. So I think it's a wonderful time to be in this space right now because the influence that we can have on organizations is really outsized to what it's maybe been over the last few years with a very compliance-oriented view. 

Catherine: Might have to hit you up after this for some career advice. 

Ruth: Yeah. 

Grant: Not bagging on marketing. I'm just saying marketing is good, but audit's sexy. I mean, come on now. 

Mike: It seems sexy. It seems super dynamic and way more interesting than my ignorant self thought it was at first. Ruth, Grant, thank you so much for joining us today. 

Catherine: And thank you, dear listener, for surfing along with us. I'm Catherine Tsai. That was Mike Gravagno, and this has been Off the Books presented by Workiva. Please subscribe. Leave a review. Tell your buddies if you liked the show. If you're watching this on YouTube, you can leave us a comment, or feel free to drop us a line at OffTheBooks@workiva.com. If your comment was going to be, "Bring back Steve," don't worry. Steve will be back next week when we're planning to interview Jonathan Johnson, the CEO of Overstock. Surf's up, and we'll see you on the next wave.