← The Audit Podcast
The Audit Podcast
Ep 239: Reimagining Audit Staffing w/ Chris Denver
00:26:18
This week on The Audit Podcast, we’re joined by Chris Denver, former CAE and IIA Chicago President. In this episode, Chris walks us through the forward-looking staffing model he’s developed—one that balances internal talent with digital...
Loading summary
Transcript27 lines
- [00:00]
A
Whatever you come up with today is what's not. It's, that's what it's not going to be. Right. That's precisely wrong. But you want to be as close to precisely wrong as you possibly can be so that your course corrections are all very minor as those future events unfold.
- [00:17]
B
Hello everybody, and welcome to another episode of the Audit Podcast. I'm your host, Trent Russell. Today on the show we have Chris Denver. He was formerly the chief audit executive at Whitehall Jewelers. He was also the former IIA president for the Chicago chapter and is currently, and has been for a while acting as an interim CFO or a fractional CFO wherever he's needed. We had Chris on the show because he wrote this article for the IA magazine called the Audit Function Reimagine. This is in the December 16, 2024 issue. And in there he lays out this pyramid which if you go to our YouTube channel, you'll be able to see what we're talking about. So the full episode is on YouTube along with all the episodes we've done over the past year and will continue to and so on. There you'll see the, what he calls the new internal audit organization model. He has the traditional model that he shares and then we have the new model also that he shares. And basically it's just a conversation around this. And so if you can access that, that article that I'm talking about, for sure read it. You'll also be able to see the visual if you aren't watching this on the YouTube channel. If you don't want to go that route, totally fine. So some of the things that we talk about though, relative to the article is to describe that four part Org model and the practical steps that a CAE can take to start implementing it. We also talk about how automation is ultimately going to be the lowest cost option, even beating out offshoring. And so we talk about how should audit leaders build a business case to get closer to the model that Chris talks about. And then someone else who had read the article sent me a message, said, hey, I know you're talking to Chris. I'd be curious to know with the lack of talent already. So we're referring to the model with the lack of talent already, though, where's the management talent coming from? So if you take a look at the model, you'll understand what we're talking about there. And then Chris has also gone to universities and talked to them and said like, this is the future. Not only that, but we're here now. And so he's talked about how to get the education for the folks in schools right now, how to educate them to be able to lead in this kind of new world. So we talk about, if Chris was to develop a course around this in a higher ed institution, what would that curriculum look like? All right, here we go. So what is in either your Internet browsing history or any kind of LLM, Chat GBT copilot, anything like that? What's in that history? It can be personal, it can be private. Just anything that you feel like would be maybe even a novel use of so.
- [02:57]
A
Hi Trent. So yeah, looking back at my Chat GPT history, so regrettably I've been doing a lot of action figure designs using Chat GPT. So some of the folks at work did one of me, I did one back of them, slightly less flattering potentially, and then have highlighted some of the unique personality traits of my wife and my children and created their own sort of shrink wrapped doll, you know, whatever the thing is, action figure, shrink wrapped action figure of each of them. So it's, it's all in good fun and I think everybody's really enjoyed that. Been doing some work with some private equity funds, so I've got quite a bit of searching around private equity specific issues in terms of startup and compliance issues, sort of reg. Cf. Let's see what else a couple of so in. In some of the organizations I've been working with, I've had to file some incorporation paperwork and so I've got some specific, you know, what's the state of Florida's rules around this or what is State of William's rules around that? And I find Chat GPT is pretty good, but I really actually like grok, to be honest with you, for more of the legal stuff, it seems like that that's better. However, the action figures are much better in ChatGPT than anything else that I've seen.
- [04:19]
B
And that's what really matters.
- [04:21]
A
It's all where your heart lies, right?
- [04:23]
B
I did see where I forget the number. Let's call it a million. I mean call it 10 million, I don't know. But ChatGPT had more users onboarded during that like 24 hour period of those action figures becoming a thing than they did I think since like day two or three or something like that. So it was like one of their best days ever because of this entertainment action figure thing.
- [04:48]
A
It's, it was, it's a cute thing. I'm sure you probably tried it yourself.
- [04:51]
B
But I didn't jump on it just because I Saw it so much, but now I feel like I have refused.
- [04:58]
A
You refuse to be one of the first lemmings off the cliff. I see. Yeah.
- [05:03]
B
Hey, everybody, we're gonna take a quick break from our guests. And if you need to get analytics or AI actually working in your internal audit department, or if you already have some of it, you feel like you're not really getting exactly what you need out of it, you know, there's more you're not getting that. Go to the Show Notes, look for the Green Skies analytics link. Click it on the website. There'll be other links that you can click that'll take you directly to a calendar to schedule time. It's literally three clicks to get the time scheduled to get it figured out. All right, back to the show. So one of the main things that I wanted to hit on was this. It's an article from the iia. I don't know what's called the. The Internal Auditor. Internal Internal Auditor Magazine. So for those that haven't checked it out, we'll link to that in the Show Notes. And if you're looking at our screen now, so if you're on the YouTube version, you'll see exactly what we're talking about. A new internal audit organization model. So this is something that Chris has come up with and has been talking to multiple people about to really raise awareness for it and to get some actionable action taken against this to go. Like, hey, this is likely the future, if not in its entirety to some degree. And so you need to be preparing yourself for it. So with all that said, we do have it pulled up. I'm sure there's people who aren't watching this on in a video format. And so even for them, you might need to, like, kind of describe it a little bit for. For them as they're listening to it, as opposed to just looking at it. But can you describe what we're looking at here, this 4part.org model, and then the practical steps that a CAE can take to start implementing this?
- [06:35]
A
Yeah, thanks, Trent. You know, one of the things that just react slightly to one of the things you just said is I would say this is more a representation of the way things are today more than they will be tomorrow. These are, you know, real and pressing demands. And so what I was thinking is I was noodling around with some ideas about what the future of internal auditing looks like. And I've done quite a bit of automation work already in the last five or six years in terms of robotic process automation, which involved AI, even way back in the day before AI became super prevalent now with ChatGPT and the other LLMs, as I thought things through, I was realizing there's this tremendous, there's a tremendous shortage of resources, of human resources available. First of all, there's a tremendous shortage of quality human resources. Right. So hiring people that you'd actually want to hire, let alone hiring anybody. Right. So you just. Finding an accountant who has a pulse can be difficult or an auditor's now pulse can be a very challenging endeavor. So it's necessary, I believe in, even in today's current environment, let alone tomorrow's, is to find new ways to identify resources that can assist your organization in terms of achieving its objectives. So this could be human objectives. It could be, sorry, those could be human resources, they could be technology resources or digital resources. Right. So that's sort of the automation angle on this. And then you can also hire outside resources of some kind, whether that's offshoring, low level tasks and to low skilled employees, say in India, or that's bringing in somebody who knows SEC derivative accounting for a very specific technical issue that you've encountered. So whether that's sort of at a SME level or more of a transactional type of level, but looking forward, the old style pyramid which you're showing here on the left hand side, you can't find enough bricks, right? So you can't build that pyramid because there's just not enough bricks, bricks available to anybody. So you've got to sort of build a modified pyramid which is a more sort of showing on the right where a lot of those bricks are coming from. Some sort of a resource that's not your own W2 employee.
- [08:48]
B
And let me for the, the folks that are audio only. So the one on the left at the base of this pyramid is technology support. So that's supporting the entire department. And then at the bottom layer, staff, imagine a triangle, right? So at the bottom, staff auditors, then senior auditors, audit managers, directors, cae. All right, so that's the one on the left that we're talking about, the one on the right, exact same, except there is, let's just call it. And maybe Chris, you can describe this better than I can. Let's say there's a chunk of senior auditors and staff that have been removed and replaced with automation and outside services. So to write a little bit more context around what Chris was just talking about, that's what we're talking about, this new model that is to your point, Chris, today, not necessarily tomorrow.
- [09:34]
A
Yeah, And Trent, I believe chunk is the proper technical term. Well, and not to put too fine of a point on it. Right. And one of the, one of the criticisms that you've offered of me and other people have offered to me here is that when you. Using my very limited graphic design skills, when I designed the pyramid on the right, where we've got these sort of the two smaller pyramids nested underneath this dive into the now, right, so your. Your own internal staff becomes a diamond, people have said, whoa, whoa, hold on a second. How do you develop sort of future leadership in the profession if it looks like anybody who's coming into your organization is coming in at a senior level or a manager level? And so this is, again, this is sort of a limitation of my graphic design skills. I think it probably makes more sense to have more of a, a straight up and down kind of a pyramid, which is not a pyramid, Right. But more of a channel where you're able to hire in at, you know, especially like a public accounting firm, for example, is going to hire in right out of college. And so you're going to have a whole wide rank of staff members who will progress up through the profession according to that pyramid. But again, this is more a limitation of my tech, my technical skills with computer graphics. And I think it's also representative of just kind of try to poke people a little bit and get them thinking and talking about it, which has certainly been happening quite a bit. All right.
- [10:55]
B
If you want to draw it out on a piece of paper, we have some people on our side that will make it look good. So if you do that and you send it to us, we'll do that and we can get it thrown up on the video so people can take a look at that.
- [11:07]
A
Oh, cool. Okay. So I'll draw the little housing thing.
- [11:09]
B
Draw it up. It can look as terrible as you want it to look. And then we have some pretty creative people that can make it look really good. So we'll do that.
- [11:17]
A
You're full services.
- [11:20]
B
That's a full service firm. Yeah. So automation is a big chunk there. It's what a lot of people are talking about. Especially with AI, A lot of things are easier to automate. There's a guy here locally who has a company and it's all about building workflows to automate practically anything using AI. And so there's a lot of these companies that are popping up. And so that one, I think, is a good place, I feel like, for a lot of folks to start is automating with Some of these tools. With that said, you said that's going to be the lowest cost option eventually, maybe not right now, but I don't think we're too far away from it. Including, including the offshore folks, which is historically kind of been the cheapest option, because with automations, you build them, they break, you have to fix them. And that's significantly easier now. So how should CAES and other audit leaders, how should they build the business case to get closer to this model where the automation piece is key, as well as obviously the outside services?
- [12:22]
A
But, Trent, great question. So one thing I would say is there's in full disclosure, there's nothing in this model, this pyramid model, and for the folks who are listening on the radio, there's nothing new in this. Right. So everything I've described here, it's not my original flaw. So a lot of organizations have already realized this. People are already putting various pieces to play to solution around these challenges. You have to, right? So you can't get your audit work done under the current environment with the limited resources you already have. Oh, and guess what? You know, you're continually being asked to do more with less, and as I keep saying, more with less. So everybody's sort of feeling this squeeze and has been for a number of years, really, probably even since SOX came around. So nothing new here, Right? My perspective on this is the challenge for an organization is, yeah, you've got to sell it, but you also have to be able to figure out how to deliver it, right? So if I'm your CFO and you're the chief auditor, Trent, and you come to me and say, hey, look, I want to implement this, this cool new model, I'd say, great. What does that look like at maturity? If you can't answer that question, then I'm not giving you money for it. Right? So I think the challenge is each organization will have something of a bespoke model that's going to require the CAE to be highly creative and flexible. And maybe those are not areas where internal auditors are, like, historically known to have a lot of strength in both creativity and flexibility. But you've got to build your own team to run this race, right? So you've got to train your team to run this race, which means you're going to need some short sprinters, you're going to need some medium runners, you're going to need people who can go up and down hills. And this is a terrible analogy. I'm going to be way too hard, I think. But the idea here being is that your staff has got to be able to be comfortable chunks of your staff to be able to be comfortable managing the chunks of this model, if you would. So who can run the automation piece? Who knows enough about it that they could be an effective entrail auditor, sort of leveraging that automation resource to help you get your overall audit plan done? Who can leverage those outside resources and manage those relationships? Maybe they're in India, right? Maybe they're in Argentina or Chile. Maybe it's, you know, a CPA firm, big four firm down the street, who brings in a targeted SME to help you accomplish some sort of technical task, building that internal team. And I think having a vision for that is really what you need to bring to your leadership team to sell them on the vision. I don't think that they're going to say, oh, that makes no sense at all. This is crazy talk. Your CFO has got the same problem on their own team, right? Your CIO has got a lot of the same problems on their own team. So when you share this sort of the need, they're all going to get it. And I think if you share sort of the solution to them, they'll all be like, well, yeah, that kind of makes sense. But my poorly designed, perhaps graphic here that we've described of the pyramid model, that's not sufficient, right? You can't walk into your CFO's office and put that down, put this thing that I had in the magazine down in the desk and say, give me some money. They're going to say, well, wait, yeah, what does this look like in our company? Right. What's the best solution for us, you know, today? Sort of the next two or three years, five years plus. What does this look like over a longer haul? And the one thing I'll share with you, Trent, is that you're always completely wrong, regardless of what you decide today. But if you don't have some sort of a plan, you're going to end up in a terrible place. Right? So build the plan and continually adjust the plan. As you mentioned, new technology is coming out all the time. AI piece has really kind of changed the game just from an accessibility standpoint, you know, where you and I, and I'm not sure what your technical skills are, Trent, but, you know, maybe not the most technically it savvy guy in the world, but I can leverage LLMs to do coding, right? Pretty sophisticated coding that two years ago I could not have possibly done on my own. So it's become much more democratized to build in These, these bespoke solutions for each company. And then again, you can turn some outside resources where you need on a targeted basis to bring in the skills and the resourcing need.
- [16:39]
B
If you were a CIE, again, and you can pick the, like, what the people look like in terms of, I would have this many it, like, just make up a scenario. Or you can reference the one from when you are a CAE of like this many business process auditors and this many IT auditors and, you know, whatever. So whatever that looks like for you in your head, the first thing that pops in your head. Or again, reference what it was like when you were a ca. So let's say you have that you're in that role now. How would you roll this out? Would it just be like, hey, go do a bunch of trainings, all right, see ya.
- [17:13]
A
Right. So that's the wrong approach. So leaving everybody up to their own devices is not why you're paid to be the cae, right? Let's put it that way. So your job is to provide the leadership and the guidance to the overall team and to align those responsibilities, those activities, to the organization's goals and missions and objectives. I sound like the new professional practices framework somewhat. No, I think it's, it's. It's incumbent upon the CE to, if they don't have the proper knowledge and skills themselves to get themselves trained to build the proper leadership skills. And if they need to bring in someone to help them architect what this future vision should look like, they'll need to do that too. So a lot of it's being realistic with yourself as to what you can achieve and what you can't, but then sort of determining who can fit into what bucket or which brick in this pyramid and who can be those building blocks and that foundational piece of it so that you understand, look, if I take my current staff, how would they map into this future vision now? Everybody, like I said, everybody's bespoke in some respect, right? So nobody, no two companies run the same systems or same processes or controls in exactly the same way. So you can't just take a boilerplate template from one company and just blindly apply it to the next. Everything will require modification and some sort of a tailoring. So understanding, sort of who on your team can map into that future vision. Mapping them in there, Trent, do you have the right skills? Can I upskill you in some way? Give you some additional training? Is one of the things you sort of just described there. Maybe you need to go back to school and learn Some computer programming. I don't know, maybe you need to learn Hindu. So maybe there's, you know, there's different challenges every organization is going to face in terms of what do they need versus what do they have and how do they bridge that gap. And maybe the decision is, sorry, Trent, like you just don't have a role in this future vision. You know, you don't have the right skill set to map into where this organization is going and then having some of those tough conversations. But I'm not tying up for just firing people. It's not cool. The hard part is getting it the right on the hiring side and making sure that the training and the, and the upskilling of your staff is effective.
- [19:30]
B
What if someone doesn't fit the model? Do you just try your hardest knowing that it's probably not going to stick with them? Do you say, look, I've given you every resource I can give you and you aren't doing what is necessary. I have to let you go? Like, how would you handle that?
- [19:48]
A
Well, that's a really interesting question. And it's a really strong. For instance, right. Speaking hypothetically, of course, I guess the challenge there is if you cut that person loose in some respect, who do you replace them or what do you replace them with? Right. And is that better or worse than your current scenario? I'm going to guess that in most cases, replacing somebody with nothing is probably worse. So until you're ready to make that move, you've got to maintain your staff, which can be its own challenge. If somebody totally does not map into this new vision of the organization. My personal preference would be that you look to find other ways to deploy them within your company and preserve their institutional knowledge and hopefully the brilliance that they're going to bring as a former member of the internal audit team to the rest of the organization. They should understand controls very well. Those are all great assets to deploy, human resource assets to deploy within the company. So I would, I would say, boy, that should be a last resort at the end of the day, like I said. But I, I think the key thing to keep in mind here is that as we're moving more and more towards automation and AI, a lot of the challenger that, Sorry, a lot of the talk about everybody's going to lose their job to an agentic AI program, I think is, is completely overblown just because there's not enough people to go around right now anyway. So if agentic AI covered off 30% of internal audit jobs, great, right? Like we have a deficit of People, that's probably more than that. So we would just be kind of getting close to breaking even if they took over 30% of the job work or the. The manual work that has to be accomplished. So, you know, one of the things I think about constantly, and you mentioned this earlier, Trent, is that there's this constant and seemingly accelerating challenge to the technology evolving and evolution and revolution or revolution, potentially both occurring at the same time. Who knows what that looks like for your staff tomorrow or in two years or five years. That's why I said, as we sit here today, whatever plan we make is guaranteed to be wrong. Like, that's exactly what's not going to happen. But you've got to have that plan in order to start getting ready for that future and make hopefully just very small course corrections, as opposed to not having. Not even having the arc built when the rains are coming. Trent, I think at the end of the day, it's incumbent upon every CAE to perform some sort of an assessment of the organization to really understand where you stand today, Mapping into your organization strategy over the next two, five, ten years. Where do you need your internal audit department to be to service that organization of the future? And then getting you from today to that point in the future, what's the path look like? And again, like we said, like, whatever you come up with today is what's not. That's what it's not going to be. Right. That's precisely wrong. But you want to be as close to precisely wrong as you possibly can be, so that your course corrections are all very minor as those future events unfold.
- [22:56]
B
It's a great quote. There's sometimes, in listening to this, where I go, there's the quote for the show. There's a good quote for the show. And I think you've got two or three already. All right, so there were a ton of great quotes from this, and I'm sure whatever you leave us with will probably be a strong ending. Also, you've been fantastic to have on. I'm glad you wrote the article. If nothing else, obviously it brings more awareness to this situation. But if nothing else, it was really great just to sit and talk to you for, you know, basically an hour. But with all that said, what do you want to leave the audience with today?
- [23:25]
A
Hey, Trent, thanks very much, and it's been a real pleasure getting to know you over this process and spending some time with you. I would say that the key takeaway here is that there is not a lot of guidance available to CAEs as to how to do this right. So I think everybody you can speak with will sort of agree that there's this resourcing challenge. Most people you speak with, probably not everybody, but most people you speak with will agree with some version of this pyramid model kind of being okay. That makes sense for me to try to frame my future organization around. The question is, what do you do first, second, and third? And that becomes a real challenge for every single organization. What are my next set of steps? We talked about having that future vision and mapping into that how many ces can do that? You know, how many ces have the training and the knowledge and the skills, the leadership principles to do that? Many do. Right. Which is the good news. But a lot don't. So where do you go to find those things? I'll be very frank with you. It's challenging. I've been looking high and low. I've talked to a number of universities, I've talked to a number of professional organizations like the AICPA and the iia. And there's not a lot of deep. I say deep thought is probably the wrong word, but there's not, not a lot of available training for you as a CE to take for yourself or for you to get your employees and your staff members to take to develop their skill sets in these areas. So you're going to have to be very creative. I'm always happy to talk to people and make personal recommendations based upon individual situations. But again, there's no, hey, you know, correspondence course that you can take or, or what do they call those? Those massive online courses that you can take that gives you pretty much an overview of everything you need to do to operate this model going forward. It'll come eventually, but it's not here today. So. But the problem is, right? And the solution is so getting your team motivated, demonstrating great leadership principles. Those things are available to you and I recommend that you take advantage of those first and then start speaking to your peer group within the ia because all this has been figured out by somebody someplace. You just need to pull it all together.
- [25:40]
C
Hey everyone, thank you very much for listening to this episode of the Audit podcast. Whatever platform you're listening on right now, I'm sure there's a subscribe button somewhere, so please hit the subscribe button there. If you're listening through itunes or Spotify, feel free to go give us that five star rating. It only took me about 16 seconds to give myself a five star star review and it really helps to get future guests to come on the show. So we'd really appreciate that. Lastly, be sure to check out the show notes and follow us on all our social media channels, on Instagram, on LinkedIn and on TikTok. Also, if interested, please sign up for our weekly newsletter from the Audit Podcast.
- [26:13]
B
Thank you all. Have a great one.