← The Audit Podcast
The Audit Podcast
Ep 246: Retired CAE Summer Series – Part 4 w/ Kevin Ryan
00:30:09
This week on The Audit Podcast, we’re continuing our Retired CAE Summer Series with Kevin Ryan, former Chief Risk Review Officer and General Auditor at KeyBank, where he spent 38 years—15 of those in audit leadership. In this episode, Kevin...
Loading summary
Transcript36 lines
- [00:00]
A
I think you start by trying to understand what's important to the CEO and I think you make sure that that's what you're bringing to the table in that initial, you know, five or 10 minutes of the conversation. And there are a lot of things that, that you might think he or she wants to know. You need to focus on what you know is important to them.
- [00:24]
B
Hello everybody. Welcome to the Audit Podcast. I'm your host Trent Russell and we're continuing the retired CAE summer and today we have Kevin Ryan with us. Kevin is currently the interim CAE at New York City Bank. Prior to that. So technically we'll say maybe this should be the semi retired CAE series with Kevin on. Prior to that he was the Chief Risk Review Officer and General Auditor at KeyBank. He was at KeyBank for 38 years and the last 15 of which he served as the Chief Risk Review Officer and General Auditor. Since retiring from Key, Kevin's engaged in several special projects including providing, providing advisory services on developing and executing internal audit strategic plans and the remediation of internal audit regulatory issues as well as CAE coaching services at firms including Flagstar bank and Discover Financial Services. Some of the things that we hit on is if you've listened to the show enough, especially from the CAEs, they all talk about relationships. And so we wanted to ask Kevin if there's any lessons learned that he could share from his time as a CAE relative to the importance of, of relationships. Off air, Kevin had talked to me about how he was able to get the ear of the CEO. I feel like all aspiring CAEs, current CAEs auditors in general, to be able to have the ear of the CEO is something that is worth striving for. And so we asked how Kevin was able to do that. We also asked that if a new CAE asks for a politics lesson from a personal experience while Kevin was in the job, what story would you tell them? And then lastly, if Kevin wrote a book about being a cae, what would the first chapter be about and then what would the last chapter be about? With that said, here we go. So usually we kick this off and by usually I mean for like two years now I'm realizing by asking about favorite prompts or what's in your Internet browsing history. And it got to the point where we had to say, okay, in the kind of pre recording part of the process that we run here, no more talk about travel, everybody. Everything was always like, I'm going here, I'm doing this, this is the travel. But after talking to you and your extensive, very extensive travels, if you want to share a travel thing, you're totally fine. I will give you permission to do that. If not anything else you want to, that's totally fine. Anything personal, professional, one of each, however you want to take it. But what's kind of going on in your world?
- [02:50]
A
Okay, so I guess again, a number of different things as I, I looked back and took a look at what I had been pulling up on Google in particular, and as you know, just recently got back from a month in Europe, so spent a lot of time looking at restaurants for Paris and for Barcelona and things to do there. Had a wonderful time and highly, highly recommend both cities to anybody that likes to travel. I'm also so spent a lot of time in Cleveland, Ohio, so spent a lot of time in the last month watching the Cavs unfortunately collapse and lose to the Indiana Pacers. But that's something that I've been spending an awful lot of time on. Also follow the Cleveland Guardians and the New York Mets. Being a New Yorker and then, you know, on the business side, I will admit that, that since I retired two, three years ago, while I stay very close to certain things, I've started to move away from that. One of the interesting things that I do look at on a regular basis is the OCC website and in particular the notifications relative to enforcement actions and orders and things like that. It gives you, you know, even though many of those are announced two or three years after the initial challenge occurs, it gives you some good idea when you look at the size of those as to what is still, you know, extremely high on their list of important issues. So that's something that even while I was away in the last month, I saw some interesting things come through.
- [04:36]
B
That's like the addiction people have with email. They see like a new alert. They have to open it and see what's in there. Yours is with these OCC announcements.
- [04:44]
A
That's exactly right. And interestingly enough, Trent, you know, when you, when you are providing, you know, coaching and things like that, certainly when I was in the seat, I thought that was an incredibly important piece of information. Usually you want to hear about it before the enforcement action is actually happening, if it's public. But, you know, board members absolutely love to hear what's happening in other institutions and ask that question, which is a good question. Are we prone to the same kinds of problems? And if not, how do you know that is third line of defense. So a good site to stay current on.
- [05:22]
B
Hey, everybody, we're going to take a quick break from our guests. And if you need to get analytics or AI actually working in your internal audit department, or if you already have some of it, you feel like you're not really getting exactly what you need out of it, you know, there's more you're not getting that. Go to the show Notes, look for the Green Skies analytics link. Click it on the website. There'll be other links that you can click that'll take you directly to a calendar to schedule time. It's literally three clicks to get the time scheduled to get it figured out. All right, back to the show. Nice. We've been doing this show five years. There's two overall takeaways we've had. It's importance of relationships and communication. Any lessons learned relative to relationships from your career that you could share?
- [06:07]
A
Yeah, and when I think about relationships and communication, you know what, what comes to mind is kind of the overarching emotional intelligence, you know, commentary around self awareness for one, which I think might be one of the most important things that, that I found in my career. Many of us aren't always self aware. Many executives lack that strength and I don't think they last really long or can be very effective or as effective as they need to be without having that focus. And of course, the whole self management part of emotional intelligence and how you communicate, how you're perceived to communicate. I think another very interesting discussion to have with new executives and even middle managers is getting them to recognize the difference between perception and reality and how important perception is, even if they disagree with how they might be perceived. You know, at the end of the day it becomes 90% of reality if you're perceived a certain way and you still want to change that perception if it's not the way you want to be perceived. So again, when I think about, you know, communication and creating relationships, I think those are self awareness. Certainly self management. And of course relationship management is again more of an overriding focus. In my time as a cae, you know, I came to understand it was one of the most important things that you do on a day to day basis is work on those relationships. And you know, we've talked a little bit, you and I, it's not about, you know, being best friends with folks as much as having some established credibility and respect in a relationship that allows you, you know, the better it can be, the better and more effective you can be most of the time. I've had a number of occasions where, you know, you in the third line will work very Closely with both first and second line, but risk management and legal, you know, one of those kind of quasi first second line functions is, is a critical area and establishing relationships and ongoing communication with the leaders of those areas, if you're the chief audit executive, you know, to me is invaluable as you will work with them continuously, you know, throughout your career.
- [08:58]
B
You mentioned when we talked the patience being something that a lot of folks don't think about relative to relationships. Is there an example from that or even more context? Because I clearly didn't provide very much for the audience who wasn't part of our prior conversation.
- [09:12]
A
Yeah, sure. I guess what I mean by patience, you know, and it, it's again, it's, it's, it's broader than just, you know, being patient with people who are maybe challenging you or questioning your approach or things like that. I think it comes back to communication once again in that listening the early part of my call it senior manager career. So when I was a senior manager in internal audit, I had a manager who would bring us together for senior staff meetings and would, would hurl grenades on the table and you know, watch how people reacted. And inevitably he would sit and he would listen to everybody and you know, go out of his way not to say anything until everybody had put their two cents on the table. And then he would come back and you know, kind of encapsulize some of the best thoughts that were put on the table in a, in a very concise and effective way. And you know, what he was doing was, was kind of exercising some self management, some patience in, you know, trying to learn what, what he could from some of the experts around the table, even though he was the manager. As you know, most of us rely on the folks around the table who are the real experts. And then, you know, kind of put that together in a way that he could use some of his organizational savvy, which we can probably touch on too. His, his political awareness, his, his awareness of the company and, and figure out the best way to approach any particular.
- [11:00]
B
Issue and from the relationship that you built. I know you said one of the most important things you feel like for a CAE is to have the ear of the CEO. I don't know, when talking to some CAEs, they'll say basically like, hey, I came into the situation that I came into, that's not going to happen. Like there's, there's nothing I can do. The folks before me didn't really set me up for success. Did you have enough to talk badly about Your, you know, the, The CAE before you, if that's the case, you're like, oh, yeah, that person was terrible, and I had to rebuild this whole thing. But was it a little easier for you for. For whatever reason because of that? And what did you do? What can others do to get that ear of the CEO?
- [11:42]
A
Yeah. So I would admit to having inherited a pretty good cultural situation in terms of the relationship. I think you're tested early on as a young CAE or an immature CAE in terms of experience in position, and I have seen through my career other situations where, know, you have folks that are much more difficult in that. In that CEO position may not see the value of. Of internal audit, and it becomes a real work in progress for folks, but one that's essential because at the end of the day, if you, if you want to be effective, you know, the CEO and the board, in particular the audit committee, are too incredibly important stakeholders that have to see your value and credibility. And if you can't, if you can't communicate that or if you can't get them to see it over time, you're kind of, kind of in a really difficult spot in terms of, you know, continued effectiveness for the organization. So my situation, I stepped into a role. I think we had a number of good caes prior to me, as I said, you know, was tested for sure in the early years, but, you know, over time, and I did have three CEOs, so I had the opportunity to, you know, start over a couple of times and thankfully, after having worked with a really good CEO as my first, and establish those relationships. And it is about communication. There's some marketing in there, which internal auditors aren't always good at, or they don't always like to think about what that means. But you need to sell the value of internal audit, which is tremendous if you use internal audit appropriately. And while we're an independent third line, and certainly our regulators want to see us focused on the really important things relating to our duties, or there's a lot of other things that can add value in addition to those important duties.
- [13:56]
B
For, for the people who, and I hear this often enough, it's definitely not every single person as it might be portrayed maybe on LinkedIn or something otherwise, but they go, I get like 15 minutes a quarter. That's it.
- [14:11]
A
Yeah.
- [14:12]
B
What do you do with those 15 minutes to where the CEO goes, you know what, let's talk afterwards, or whatever the case is, or to like, continue to develop the relationship a little bit more? Because I think in that case, that is very much the, the idea that you have of be patient with relationships. I think that is very applicable there. But you have 15 minutes to impress. What are you doing?
- [14:35]
A
Yeah, you know, I think you start by trying to understand what's important to the CEO and I think you make sure that that's what you're bringing to the table in that initial, you know, five or 10 minutes of the conversation. And there are a lot of things that you might think he or she wants to know. You need to focus on what you know is important to them and make sure you get that across. And I think, you know, most CAEs, in addition to some one on one time, which would be, you know, normal and expected, you know, are probably in meetings with their chief executive officer and other executives on a regular, more regular basis. That's where they really need to bring important things to the table. But again, with the knowledge of what that meeting or committee meeting is all about, not to just push a bunch of administrative statistics or the status of your audit, not that those things aren't important in the right place and time, but really understanding what are the drivers of your CEO or your executives. If it's other executives, you think it'd.
- [15:45]
B
Be too bold to walk in after X amount and you get the feeling of like they do not care about what I'm about to say and just go in and be like, I don't think you guys care about what I'm saying. What do you want me to talk about? Like, what do you want to know? And I'll just tell you rather than the here's our deck and I'm going to walk you through especially the administrative stuff. Unless they do want to know that. But what do you think? Yeah, just throwing things against the wall here.
- [16:09]
A
Yeah, I don't, I don't think it's, it's too bold. I think the way you do that might be, might be important. And I, you know, I will say I rarely would walk into one on one with my CEO and hand him a deck or her a deck. You know, to me that that isn't necessarily what they wanted. I would definitely speak with them, even if it was through an email beforehand and say, are there topics you want to cover? And I would have a monthly update, had access on a more frequent basis, but would have a monthly update. And if they had anything and frequently they didn't, they wanted to hear what the heck I had to say. You know, I would, I would make sure I covered their items first. But if a deck is Necessary because it's maybe more complicated, something you want them to have as a takeaway to use in the next meeting. That's all fine and good. Or if it helps you just keep control over what you want to cover. But in those scenarios where you're limited to 10 or 15 minutes, bringing a deck in is, you know, it's not the way to go in my view.
- [17:15]
B
The other thing that I was thinking, because I, I can see this happening if, if we go, hey, CEO, what do you want to know? And depending on their understanding of internal audit, exactly what it does, what it can do, the possibilities, maybe they go similarly, like, just whatever you have is probably going to be good. Like, you know, I don't have anything specific that can be tough. And so they don't have anything. What about the idea of, okay, because internal audit is very good about this, I feel like, better than any other profession, it seems like, of going, hey, you're my peer at this other company. I'm going to reach out to you and ask you, like, what does your CEO actually ask for? Great. Even though we're maybe even competitors to some degree. Maybe not like Coke versus Pepsi where it's that, that pretty high level of competition, but either way, I mean, the amount of caes that I see share stuff and go, I was on this, I. The CAE roundtable and you know, I'm in the same industry as this person, but what do you think about that? Just going to them and going like, hey, what does yours care about?
- [18:17]
A
Cool.
- [18:17]
B
I'm going to try to that also and see if we get any traction that way.
- [18:20]
A
Yeah, I, I think that's outstanding. And that's something that we all regularly do, you know, is, is have roundtable meetings a couple times a year, but with the ability, you know, to call folks in between and when you establish, you know, a relationship and you know, and you're not giving away certainly, you know, company secrets, that is just one of the best sources of both knowing. You know, certainly your CEO will want to know what's, what's, what's the hot topics with, you know, our regulators? What are the things that they're focusing on? What are, what are some of the things that you're hearing other know, banks are, are struggling with or are trying, you know, and you never talk about the banks that, that you're, you're, you're maybe discussing. It's always generic and it's usually thematic. It's not, you know, though there's one bank that I heard, you know, it's more about, hey, here's what, you know, I'm hearing that is really becoming a hot topic with the CFPB or the, the, the frb. And you know, they're going to be doing the horizontal review and we're going to get pulled into it. So, you know, we might want to, at the next erm, meeting make sure we're asking the executives about how they feel their fair lending or fair banking documentation is, things like that. And that's just Trent, really, really valuable.
- [19:43]
B
Let's say there's a new CAE and they ask you for a politics lesson from a personal experience while you're in the job. What would be maybe one of the go to stories you would tell them or what pops in your head?
- [19:55]
A
Yeah, you know, politics is a funny word in terms of, you know, what the actual definition is versus how I think we use it in the corporate environment. Usually there's a negative connotation in the corporate environment. May imply folks that are making decisions more based on how it affects them personally than the organization overall. And in, in an organization that has a good culture, it exists everywhere, you know, these things are going to happen. But in an organization that has a good culture generally trying to call those things out, you know, in a one on one situation as opposed to any type of group situation, that's the kind of advice I would, I would put out there as the, the chief audit executive. Obviously your focus has to be on the, the best strategic solutions for the company, not any one particular executive. And if you start to see there's a thematic, you know, decision making process where it seems to highlight more, you know, something like the success of a particular group or something like that, you know, it's almost like, you know, one of those things where when you see it, you know, it, it's kind of hard to describe, but it's there all the time. So I don't know if I'm doing a good job. Describe. I think what I would tell that person is if you feel like things are being handled for political benefit as opposed to, you know, organizational overall effectiveness, I would first try and handle that directly in a one on one manner carefully. And, and you know, if you, if you don't have success, you may get to a place where you need to call it out a little bit more clearly.
- [21:49]
B
If you were, if you're going to write a book about your CAE career, what would the first chapter be about?
- [21:57]
A
Wow. I might call it failures. Yeah, you know, I, I stepped into the, the chief auditor position in July of 2007. And boy, you know, the financial services world almost came to an end. A lot of things almost came to an end thereafter. And you know, the, the focus wasn't on improving internal audit for the first year or so. It was really on survival. And you know, we, we played a role. But what, what I found out about two years into, you know, the crisis was we had kind of not spent enough time focusing on improving internal audit. And when our regulators very appropriately got around to looking at all three lines of defense and coming down again, I would say appropriately on the third line saying, the heck are you guys been doing? We have good answers. And we struggled. You know, shortly thereafter, you may remember, satisfactory to strong became a, a theme of the occ and they wanted to see folks rated strong, let alone, you know, satisfactory, which could be a, a goal for some organizations. So, you know, I would tell you I learned an awful lot in those first two, two years. Two, three years. I remember sitting in a, an executive leadership team meeting with the CEO and we had our, our friends from one of the regulator agencies there and boy, they, they ripped internal audit, if not the CAE up and down. And I walked out of that meeting, boy, with my tail between my legs, feeling about as low as you can get. Went, sat down in my office. It was kind of contemplating, yeah, maybe what I'd be doing next or where. And my CEO called me up, which may have been the first time he actually called me directly on my phone and his name came up and I.
- [24:11]
B
Picked it up and I'm like, it's a good feeling. Yeah.
- [24:13]
A
And I remember him saying, hey, Kevin, you guys are part of the solution. You're not the problem. You need to make sure you're part of the solution. And anyway, so that was a fantastic moment in terms of recognition and turnaround. But those first two or three years were full of a lot of lack of maybe self awareness in terms of what we should be doing.
- [24:42]
B
Okay, what about the last chapter?
- [24:46]
A
Well, I'm not going to say failures again because I was about to say.
- [24:49]
B
You can't have a whole book of failures.
- [24:51]
A
Yeah, nobody's buying that book. But you know, I think after 15 years, which is a long stint in a chair, you know, you better know your job and you better know it pretty well. But I think I would probably, I would focus on the continued learning as you know, and as anyone who's been a chief audit executive knows, one of the great things about the job is there are really no two days that are alike. Every day is different or potentially very different. And in my career I can say that's what kept me interested, that's what kept me going. You are constantly learning. If it isn't through real planned training and education, it's day to day. You're learning on the job constantly. And I think that's know I, I'd finish it off with that theme of, you know, this, this job is going to test you right up until your last day and you'll continue to, you know, the reason I, I think you'll embrace it is because of that and you'll continue to learn right through that, that last day.
- [26:03]
B
Okay, you've mentioned self awareness multiple times. I know, I just wrote it again and I looked at my notes and went, oh wow, I wrote that twice earlier. How do we become more self aware? Is there a practice, a tool, something, or is it. I feel like the self awareness that I have is basically because I'm not 16 years old anymore. And so, so I guess with that it just seems like with age comes self awareness. But is there anything else that people do, can do to expedite that self awareness?
- [26:36]
A
Yeah, you know, I think you can ask for feedback as often as possible and, and when you're the cae, you know, might limit your choices, but you know, you can have mentors throughout your career and coaches and you know, they can be both, you know, subject matter experts as well as really just folks that know you fairly well. And as you talk through events and, and things that occur on the job, they can give you some pretty, pretty good insights into how they perceive you. And again, you know, you need to take that and recognize maybe others perceive you the same way. So maybe that's something that you, you need to be more aware of. And you know, then you, you design a, a process for trying to work on it. And I do think it has to be, if it's important enough to you, it has to be. It has to be something that is a design and you know, you set some goals for yourself and then, you know, you get feedback six months, a year later too and see if maybe you've started to address some of those things.
- [27:40]
B
I think I'm making sure I get this. That was one of the, maybe one of the best quotes I've heard on this for me personally was if it's important to you, there has to be a design. Because there's all this talk that we have on here about like relationships and I try to go, how do you do that? How did you do that? How can we do that self awareness, how, how, how, how, how, and try to get down to the how on a lot of this communication. How can you do that? Practical tips, whatever. But I think even with that, like it can be said a thousand times, a thousand different ways, but if it's not important to you, you don't develop the process for yourself to make it happen, then doesn't really matter. All right, that seriously was one of the, I think the best quotes that I've heard on the show. And maybe just because it hit me personally, I don't know, maybe for others it will too, who have been trying to do something or even stop doing something and they go, oh, well, if I really care about it, let me build this process around it. So thanks a ton for that. We could probably end the show right there and be in a really good spot. But I'm going to hand the mic over to you. I'm going to let you take us out. What do you want to leave the audience with?
- [28:44]
A
Okay, so when I wrapped up my career and was was fortunate enough to have a little get together and my CEO asked me the similar question after I spoke for a few minutes, I, I passed on a quote from one of my favorite movies and I guess for a chief audit executive it might sound a little bit out of place, but Ferris Bueller's Day off, one of my favorite movies of all time. And he kind of ends the movie with the music playing over and he says, life moves pretty fast. If you don't stop and look around once in a while, you could miss it. Don't miss it.
- [29:31]
B
Hey everyone, thank you very much for listening to this episode of the Audit Podcast. Whatever platform you're listening on right now, I'm sure there's a subscribe button somewhere, so please hit the subscribe button there. If you're listening through itunes or Spotify, feel free to go give us that five star rating. It only took me about 16 seconds to give myself a five star review and it really helps to get future guests to come on the show, so we'd really appreciate that. Last, lastly, be sure to check out the show notes and follow us on all our social media channels, on Instagram, on LinkedIn, and on TikTok. Also, if interested, please sign up for our weekly newsletter from the Audit Podcast. Thank you all. Have a great one.