
This week on The Audit Podcast, we’re joined by Matthew Oleniuk, founder of The Risk Insider and former Chief Audit Executive in the public sector. Matthew shares lessons from 15 years as a CAE, what he’s most passionate about right now, and his...
Loading summary
A
I mean, there's the audit side and I think there's a big component there, and then there's the audit leader side. And so if we're looking at the audit side, one of the traps that I think so many auditors, especially within the public sector, I mean, that's been. My background has been the public sector has been reliance on on tools. So when I say that, I mean the business tool. So if we're auditing a function, we're looking for existence, but we're not necessarily looking for effectiveness. And that's really the core value that that audit can provide.
B
Hello everyone and welcome to another episode of the Audit Podcast. I'm your host, Trent Russell. Today on the show we have Matthew Aleniuk. He is the founder of the Risk Insider, where he helps public service leaders take control of complex high stakes projects by helping them see the real risks before they become real failures. Prior to that, he served as a chief audit executive in many public service areas, which is why he is able to help on the consulting side for those in the same area. So check out in addition to his LinkedIn profile, if you're watching the video version, you can see what I'm talking about. But in addition to that, go to the riskinsider.com and we don't keep the conversation too public sector heavy. We try to apply Matthew's general knowledge within internal audit, his time as a CAE to the episode. Hopefully you guys can learn something from that. So we hit on a couple things. I mean, he was a CAE for 15 years. What are some lessons learned from that wisdom to impart on aspiring or current CAEs? We talk about what Matthew is especially passionate about and we talk about the best way to predict a public sector project success. There was another podcast that I had listened to years ago and they studied this. A bunch of economists studied this. Why do these public. Why are these public sector projects never are done on time? They always go over budget. You can think interstates being built, subways being built, any of those things, right? And they're always late and they're never under budget or on budget. And so we talk about that and we talk about what the podcast that I listened to years ago, what their recommendation was, and then what Matthew's recommendation was on how to make that work. Well, that said, here we go. What is in your either your Internet browsing history, your ChatGPT copilot, whatever your LLM of choice is, maybe something professionally that you're using it for, and then something personally also any kind of Personal interest. Or maybe another way to think about it is like, what do you do when you're not working? What do you do on the weekends? Is another way to think about it.
A
Yeah, well, within, for the first part, I use ChatGPT about a thousand times a day for my business. I think it's the absolute best way to leverage what you already know. I think one of my biggest skills as a leader was power of delegation. And that's not dumping, but rather guiding, empowering, letting other people come to you with ideas, bouncing it around, repackaging it and finishing it. And I, I think ChatGPT is, is the ultimate or all of them. I haven't really used Grok because once you use something that you like, you kind of stick with it. But I find that they're just like a powerful team. If you rely on them to just deliver it and you walk away, it'll never work. But if you use it as kind of a really strong, skilled and fast team member, it's going to give you something great. Now, on the personal side, I think using it a little bit, my wife and I are getting prepared to wave our son goodbye to university. It's, it's going to be a tough moment, but we're trying to explore a little bit. He's going to be going to Galway in Ireland and so we're using it to just find out a little bit more. You can do your Google searches, so that's definitely there. Finding a bit more about the city, but trying to get a hold on life out there and give us as much comfort as him. That's probably what I'm using it for these days too.
B
My kid's only six. I'm already upset about him going away to college.
A
It creeps up on you. Boy, that's someday, someday, someday. And then all of a sudden, no, it's in a couple of months.
B
I tell people this on the podcast before, but I will selfishly just ask a question that I care about. And so like the audience might even care about it, but I don't care. And kind of knowing your background also. And then just in our like off camera conversations like there was that, we really don't even have questions, like really specific questions planned for you because I went, look, we'll just throw some stuff out there and you're really, really good.
A
Absolutely.
B
So we'll just talk. So maybe that's part of the reason why also. But with that said, maybe give some fatherly advice to those or some parental advice to those that are listening right now.
A
About what in particular?
B
Whatever.
A
Well, I mean, to tread old ground. I just say that, you know, when we're trying to give advice, the last thing anybody wants to hear is advice. So probably just trying to package it in a way that communicates more what you're thinking, what you're feeling, and how you see the world as opposed to, you need to see it like this. Because once we do this to our kids, they just tune out and they block it and say, everything is different now. But if you say, you know, here's my experience, and I just want you to factor this in when making your own decisions, it. It tends to. To help them to. To listen a little bit more and because things are going to be different for them regardless.
B
Right?
A
They're different people, different times and different people out, you know, outside of them, different experiences. So everything is going to be different. Hopefully, though, a little bit of the. A little bit of our experience can help the principle of what they're trying to do while they work their way through life.
B
So you're a Senior Leader for 15 years. We recently did this retired CAE series throughout June of 25. And so it was basically like, lessons learned. What would you do different? Like some pretty common, almost kind of weak questions, but I think that we still got some really good answers from that. So that maybe since you've been out of it now for a few years, you've had some time to reflect. So any lessons learned that you could share? Any wisdom that you could impart on aspiring CAEs or senior leaders or current CAEs or senior leaders?
A
Yeah. So, I mean, there's the audit side, and I think there's a big component there, and then there's the audit leader side. And so if we're looking at the audit side, one of the traps that I think so many auditors, especially within the public sector, I mean, that's been. My background has been the public sector has been reliance on tools. So when I say that, I mean the business tool. So if we're auditing a function, we're looking for existence, but we're not necessarily looking for effectiveness. And that's really the core value that audit can provide. And I've seen this time and again where we say, they've got this, they've got this, they've got this. So check, check, check, check, check. But we fail to ask the question, okay, well, you know, is it working? We all know it's. This area isn't working. That's kind of why we're auditing it. So if they have everything and they're doing everything right. What's the problem here? So it's those kind of dirty spaces in between the cracks there that, that auditors really need to look at, not to, you know, quote unquote, find anything, but to try to get at the root cause of why things have not been delivered as intended. So I'd say that that's the biggest thing. And if we can put even a little underline underneath the governance side, because I don't know how many times team members have come to me and say they've got a committee in place, they got meeting minutes, they got meeting membership, everything is great, so no problem, let's move on. And we say, hold on a second. You know, we've already agreed that there are big problems with this area. So why haven't the governance bodies, you know, found this or done anything to. Course, correct. So that's probably the first thing on the audit side, big picture. Second thing for audit leaders is kind of like what I hinted at with the. The chatgpt there. I mean, the power of teams. The more that individual team members can take on, the more the collective will be able to deliver. So that means empowering team members as much as possible, giving them stretch assignments as much as possible. And the way that I look at it is to try to prepare them for the next level as much as I can right now, so that when they are ready for a promotion, whether that's on my team or elsewhere, or they just feel like exploring that they're already ready. So that's kind of the target that I always set, whether or not I say it to them. Sometimes I do, and sometimes I just try to gently, gently push them along from the sidelines. But that's the kind of targets that I set. And once we do that, and we provide challenge, we provide feedback, we provide guidance, all of that stuff, but once we, once we do that, we begin to really leverage and it becomes a complex task, becomes a simple request because they can already process it. They know what to expect, they know what they're meant to deliver and how to get there. And most of my roles in the last 15 years have been either moving into functions that, that hadn't been delivering as intended or that were very, you know, that there were skeleton staff and we needed to build it up again. And so for each role in the beginning, and whether that's six months or 12 months or whatever, very long hours, weekends, just working, working, working all the time. And a lot of that was because I insisted on, you know, Working with the team and delegating rather than just doing it myself, because that could happen. I could just take something this, take me an hour, but it might take several days with back and forth. But within a couple of years or around that time frame, in each case, I kind of put myself out of job. I mean, not quite literally, but the work was getting more and more manageable to the point where it got almost easy because all of this work was being tackled by extremely capable team members and I provide my guidance, but I was no longer in the doing. And as a result, we'd expand functions and we'd go into areas that, that we hadn't considered before, take on new data analytics tools that we hadn't done before. So we're just scaling, scaling, scaling. And, and as a result, you know, that challenge for me sometimes went away and I consider myself a change agent. And, and so as a result, that's why I ended up moving after a few years. So build up the capability, put it into steady state and, and then find a new challenge for myself.
B
Hey, everybody, we're going to take a quick break from our guests. And if you need to get analytics or AI actually working in your internal audit department, or if you already have some of it, you feel like you're not really getting exactly what you need out of it, you know, there's more you're not getting that. Go to the show Notes, look for the Green Skies analytics link. Click it on the website. There'll be other links that you can click that will take you directly to a calendar to schedule time. It's literally three clicks to get the time scheduled to get it figured out. All right, back to the show. I've got two things. So you answer that from two different perspectives. Audit and then the leadership one or the cau. And. And so you said on the audit side that basically they had these governing bodies and there was notes and attendance and all that kind of stuff. And you kind of go, yep, they should be figuring this out themselves. What was kind of. Was there a root cause that you typically found, like an underlying cause? Was it just lack of, like, intent from the committee? I mean, I know I've been on committees and a lot of times you just look at somebody and go, why are you even here? Like, you don't do anything. It's just kind of like, yeah, put that on the resume, or I tell people that I'm on this committee and that's about it. Was that. Is it. I don't know what, what was the kind of root Cause of governance side of this, did not find this or put in anything to fix it.
A
Well, there could be a few different reasons. I mean, you, you did kind of hit on one and sometimes composition is not right. As auditors, I don't know if it's necessarily in our place to say this guy shouldn't be on this committee, but we can look at how do you select your committee members, how do they get there? Are there any requirements at all? Or is it, you know, the, the nearest warm body in, in certain organizations, I definitely lump public sector in with this and maybe lots of larger private sector organizations as well. There are so many committees, there are so many demands across senior management that people are being pulled into tons of things that, you know, they don't even have the time for, let alone the expertise. So that's kind of a systemic issue. And you can't really blame the people. They're just doing what they were asked to do. But, but it remains, remains a problem. The other thing I hint at here is, is a lot more systemic within the infrastructure of the public sector. And that is we rely a heck of a lot on the infrastructure and on the notion that we have so many eyeballs on this, that everything must be fine. That starts right at the beginning. So if we think of a major project, a major initiative, first of all, maybe it's launched on the political sphere. So it has to be debated and lots of people agree on it. They pass it great. So then it gets passed over to the central treasury people. The organizations, the departments, the teams have to apply for the money. And central agency is going to say, well, we'll release the money. But this and this, this have to have to be in place and you have to report to us. Then it goes to the department or agency. They set up their own oversight committee, steering committee, working groups across multiple levels, maybe it's in multiple agencies. So they're all doing the same things. And then they put interagency departments on top of that and they're all reporting to the central agency. So there's just so much reporting going on that it becomes kind of a churn. Right? So, so people are pumping information up, whether they, you know, whether it's purposeful or not. It's just, it was, it was asked of me, this is the template I was given. I was told I have to use this. I'll populate it, I'll send it up, and if anybody has any problems, I'm sure they'll tell me. But so many people are looking that so many People are also just saying, well, somebody would have caught it if something went wrong. And that's. That's where the governance really kind of breaks down. The effectiveness of the oversight really breaks down that we are relying on the machine rather than the individuals.
B
This has nothing to do with the topic. I mean, sort of. I just thought this was interesting. So had a roommate in college. He took some kind of whatever, psychology class. Just, you know, whatever. Take the class. And the only thing that I remember him ever telling me that I thought was actually useful was that. And I forget what it's called, whatever the theory or whatever, I don't know. But basically that. So it was like, hey, if the example he gave is if someone's committing a. Somebody's getting robbed on the street and 20 people see it, then those 20 people are going to go, well, somebody like one. No, I'm not going to do it, because somebody will do it. And so similarly, we actually took that and applied it. So at the rec center at the university, we went to. The parking lot was huge. So before you told me that, we would always just be like, all right, whatever spot you see in the back, just get it, because the front is definitely going to be full. But then we went, you know what? I bet everybody else thinks the exact same way. And so we would start with the first pass. We would always make the first pass on the first row. And I don't know, 80, 90% of the time, there's always a spot right there because of exactly that. So actually, I did teach my kid that the other day. I was like, hey, look, I bet if we go in the front because it's a huge parking lot. I bet if we go in the front, everybody else is going to think that it's taken. And it wasn't taken when I dropped him off at a camp the other day. So anyway, for whatever that's worth.
A
Yeah, yeah, yeah. I mean, it's the fallacy of power numbers in a lot of ways. Right?
B
Yeah. The other question I had. So you were talking about empowering the team. And whenever there's something, a topic like that, I'm always curious, is that a mindset for you? Like maybe you were either just born that way or you were, I say raised, but, like, mentored that way or whatever, wired that way, whatever it is, or was there some kind of process that you followed to get there? Was there some kind of like, weekly check in that you kind of did with yourself or, like, process? And if there was a bit of a process to it, any details you can give us around that. And if it's mindset, that's fine too. Like, I think that's really tough to just develop a mindset to do any given, you know, whatever the, the area is. But was it mindset or process?
A
I, I, I guess I'd probably just chalk it up to, you know, getting a lot of notches on the experience belt and, and, and trying to, to learn from them. Um, and sometimes we learn from positive experiences. I think more frequently we learn from negative ones. And I've been in those situations where I've been micromanaged and, you know, told go from A to B to C to D and so on, and being felt, you know, slowed down by that, being felt controlled by that. And then conversely, I've, I've been with just a few that, that were really about saying, just go do it, and if it breaks, just come and tell me that it breaks and we'll figure it out. And remembering, acknowledging just how exciting that that is, right, to, to all of a sudden feel like, you know, you sure you don't want me to come back, you know, this afternoon with a no, I'll see you next week? And, and that, that kind of freedom, when it first happens is pretty intimidating because all you're thinking about is, are you? All the different ways that you could mess up, but once you kind of get used to it, then you realize it is, it is liberating, it's empowering. And so then when I see other people in the same role, I just try to see myself in that role. And as I said, it can be intimidating for people for the first time. And so knowing that and knowing how I felt intimidated, I do like to set it up. Rather than saying, just run with it, just say, you know, this is yours. What do you need from me? And what would make you feel comfortable going on this now? You know, there is that balance. And I don't want to suggest that everything is always positive and, you know, 100% empowered. The leader still needs to lead. And if it's not going the way it's supposed to, then that conversation needs to happen as well. There need to be guardrails on that. Um, but in my experience, most people respond very, very well to that, and most people who, if they're not getting it, they will come to you and tell you that and ask for help rather than just not do it or walk away from it. So most of the time, it's, it's a very, very positive experience for me.
B
I was listening to somebody earlier this week, it might even been yesterday. So it's funny that you're saying this and they were talking about how regardless of how good a manager you are, they're like, think back to all the people that you ever reported to. And there had to be some friction, some just like, oh, my God, this person's so dumb. Like, why do I have to do this? This doesn't make any sense, et cetera. And so I was like, yeah, I think that's right. And so I started going through all the, all the ones. Especially, like in public accounting, you have, you know, in a given year you report to 10 different people depending on the number of audits you're on. So it started going through and I was like, yeah, I really like that person. But, God, that was frustrating and that. And then I got to the last one and she was my director and she was very similar to what you're saying. And it was just like, hey, so this is when I was doing analytics in internal audit, and it was like, hey, here's the audit plan. You know, how to execute the analytics against that. If you need something, come talk to me. And then I would go to her and say, here's the CM continuous monitoring stuff that I'm going to build coming up. And she'd go, yep, I agree with that on this thing, though. Think about it from this perspective. Or this is really the goal. That thing is really cool that you're talking about. So, yeah, that's fine, work on that. But this is the goal. Goal. And then that was it, you know, and then it was basically like, hey, come to me if you need anything. And that was the bet. Like, just having the autonomy to do that is. That was maybe my. Well, definitely was the favorite person I ever reported to. And I think with that, there's a caveat of if you're a junior person. Well, actually, now that I say this, I think because of ChatGPT Copilot AI, like, you can give a more junior person autonomy because the answer is. Or at least a lot of the answer is available in those tools and they can have that conversation with them and at least go, hey, boss, here's what I think the risk is. Do you agree yes or no, or, you know, come to them with this is what I think the answer is, instead of just coming to them with the. With the question.
A
Yeah, it does. I mean, it definitely poses a danger because in my experience, it's, you know, these AI tools are unbelievable. And as I said, it feels like you've got a team working with you, but very often it flip flops. You know, I found this, I don't know how many times where it gives me an answer and I'll just say, are you sure about that? And I'm not even saying no. I'm just, I need more information. And then it'll just flip and say, you're absolutely right, I shouldn't have said that. I'm going to say something completely different. So, so it's, it's amazing. It's unbelievable. For gathering information, it's that synthesis that, that, that is still required and you know, the way it's, it's, it's pacing. Now, maybe in a year or even less, that's not even going to be an issue. But for right now, it, it still needs that intervention. Now I, I will also say, though, for those who are maybe more junior listeners on the podcast here as well, I did do that quite a bit managing up. You know, I, I did fight for, for that delegated space as well, and never in a confrontational way. But if I felt I was being micromanaged, I would ask to go for coffee or, or just take a side, side conversation. I'd never like to do it in a person's office, like to go to kind of neutral territory to do that. But, but I would just explain to them, you know, we just, just started working together and I thought it was, would be a great opportunity to just talk about how you can get the most out of me and so start talking about how I like to work. You know, I like concrete deadlines, I like to be given the result. But, but I really work best when I'm trying to figure out the, the how and, and all the steps to get there and just lay it all out for them. And one thing that, that I have often done that sounds kind of silly, but it actually works to, to make the conversation more is when I'm talking about the work, I always picture it kind of off to the side on the table and I'll actually kind of point to it and say, you know, so when I'm working on the report and you'll see their eyes regularly look down and follow it. Now what this does is it treats the purpose of the conversation, the topic, and that's a work and it might be really personal to them, but we're talking about it. It's off to the side. It's a thing that we're debating. It's not people, it's not relationships, it's not anything else. And so once, once we, you know, make it clear how they're going to get the best out of us, which will make them look better. There. There's a lot more room for negotiation there. For the micromanaging doesn't always work. And in those instances when it hasn't worked, I can honestly say, well, I really told them how they can get the best out of me. It doesn't seem like that's going to happen, and maybe I should start looking elsewhere. But most of the time, people are very receptive to that kind of conversation. And you can grow within your role, even on with someone who's supposedly meant to look over your shoulder.
B
I like the questions. I mean, I wrote them down. I'm sure you saw me as I was doing it, so I was definitely listening. But I was also taking notes while you said that. But how can I get the most out of you? I think that's a really good question. I think it's a good question for people to ask themselves, like, how can I get the most? And the way that I've done that also was to ask people, even like during interviews is, what does your perfect day look like? So from time you wake up to the time you go to bed, Monday through Friday, like working hours, what does it look like? And so, like an analyst might say, and I've heard this, they've said it to me before, was, I just want to sit in a closet, turn the lights off and write SQL scripts all day. I went, okay, well, yeah, you're the junior on this, so that's fine. I'll just give you. I was like, if I just give you the list of everything to do, he's like, that, that, he's like, that was my dream job. You just give me the list, put it all on the board, tell me what analytics I need to develop, and then I'll run them, you test them. And it worked out really well. I mean, it was, you know, I gave him a week's worth of work, what I thought was a week, and he was like, I'm done in two days. Because he did exactly what he wanted to do. Obviously you got to grow and become a little bit more than that. But anyway, I really appreciate those questions. I definitely took note of those.
A
Okay.
B
We've talked a lot about leadership and you've mentioned some of the public sector stuff. And so maybe there's a. Maybe these intertwined when I ask this. But what do you. What. I mean, what are you especially passionate.
A
About right now within the public sector realm? So. Within the business. Yeah, so. So I Began my business, the risk insider.com a number of months ago. Where I focus is with project managers and risk management. So project risk management. And the reason that, that I targeted that area is because of my experience in internal audit. I always found that there were kind of two clans with, with respect to the project side and the audit side. So on the project side they would too often treat risk as a parallel exercise. So it's a compliance activity. We have to fill out the forms, we have to populate all the different fields and then we can get on with the real work. And so there's this parallel stream that's very often driven by the enterprise risk management framework or organizational risk management fr and whatever, whatever it's called, but it's something large and it's something that's designed for the permanent state, so the mandate of the organization. And it doesn't necessarily point to any project risks, but that's fine because it's just kind of a boring activity that we need to get over so that we can get on with the real work. And then the auditors come in and they kind of take the approach of, you know, why aren't you more passionate about risk? This is everything. Risk is the only thing that we should be talking about. So you have these two extremes and both agree that risk is being discussed, and we both agree that these risk processes are in place. Most public sector projects nowadays, they've got all the systems, they've got the governance place, they've got the infrastructure. That's not the issue. So then what is the issue? Because we keep seeing in headlines, day after day, week after week, public sector projects failing for one reason or another. Either scaled back, didn't deliver, way over budget, missed the target, delivered something that people don't need, and the list goes on. So if all of these public sector projects have a very robust risk system in place, I mean, by all accounts it's all there. What is missing? And what I found over my years of audit has been that things are being documented, but they're not necessarily. It's funny, we use the term risk registry, but the risks aren't registering. And what I mean by that is that we are looking at risks as unique beasts. But a risk at its core is just something that can go wrong to prevent you from achieving your objective. That's it, full stop. It's a blocker in your path. And what we too often do is try to look at the library, go through the glossary, pick a nice one from the risk registry, slide it in. Yeah, I could see how this one is applicable, and there's our risk management system fulfilled, but that doesn't help anyone actually manage the project. So if we can't draw a direct line between the risk and the outcome, then the risks are not meant for this project and they're not going to be meaningful in any way. So it's trying to meld those two mindsets a little bit, to make it a little bit more practical. And one of the things, the best ways to unlock that conversation is to ironically, completely avoid the word risk. I just find that it. It just sets off this whole, you know, machine in motion where they say, oh, we've got risk management, we've got this, we've got this, we got this, we're taken care of. Boom. Okay, but if we rephrase it as, is there anything that can get of the way of you being successful in this project? Then we have start to have a different conversation, right? And then we start to have elements that are unique to the project as opposed to the mandate of the organization. And so that's really where I'm focused, is trying to have those purposeful conversations with senior leaders about delivering their project successfully, because I do. I firmly believe in the mission of the public service. I think there's a lot of good to be done by it. And frankly, I find it as frustrating as anyone if a project doesn't land. So I want to see those projects land. I want to see the outcomes delivered, the services know, improved, whatever the case may be. And I. I'd like to be a small part of that.
B
Okay, There was a episode of Freakonomics. So it's a podcast. I think it was Freakonomics. I should probably be able to cite this.
A
I read that book years ago, but I haven't heard the podcast.
B
So, yeah, the podcast is great. And it's similarly, it's about to usually behavioral economists and experts in a given area, and they try to slice and dice this one, you know, question based on the topic of the day. So anyway, it was. This was years ago, but it was basically, why do public sector projects fail? And how can you predict which ones are going to be successful? And so they had all these, like, I think I've told you this before, like, you should be on that episode. I mean, like, if they. If they redo that, because they. A lot of times they'll come back and go, oh, we did this episode two years ago, and here's an update. And there's new, you know, science or whatever. So you should. You need to hit them up and be like, hey, you do that again, let me know, because I've got.
A
I might just do that.
B
But the conclusion, I don't remember any of the details, but just the conclusion was the only way to predict if a public sector project is going to be successful is if that same or a very similar project was done in a same kind of environment or area. So, like, if you say public sector project in New York City vs Public Sector Project in a, you know, population of a thousand, like it's going to be different, you know, because the variables are different and the scales way different. So anyway, they said that was the only way they studied it, and they said the only way is if it's similar and we can predict the success rate based on that. What do you think about that?
A
Well, to use language that might be familiar to the Freakonomics listeners, I'd say that there's definitely a correlation, but not a causation. So we can see similarities for sure. But I would argue that so much of the infrastructure and the machinery behind most public sector projects is repeatable. It is the same, maybe not in exact design, but in purpose. And they're all sharing the same best practices, they're all following the same reporting mechanisms, et cetera, et cetera. So I, I don't think that a lot of public sector projects are that dissimilar. I, I mean, obviously they're delivering new things, but, but just at their core, if we're looking at some kind of common denominator, I'd say that that's a much bigger one than something that was done 10 years ago. The problem is that the machinery, the infrastructure is to blame for a lot of the. The infrastructure for a lot of the issues. And that's why I, I really, really, really firmly believe in the individual. So I look to the project leader to fix things. I think that there is a systemic issue with culture, with project delivery in the public sector. I think there's a little bit of a resignedness in the public sector culture. And so I think that there's a bit of an expectation that things won't go exactly according to plan so we stop being as vigilant as we might be. So there is that pervasive culture, you know, across the board. So it's really up to the project leader to create their own mini culture. And they might have to use the same machinery and the same templates and tools and everything else that everybody else is using. That's fine. You know, don't, don't start a Revolution or anything else like that. But they can start looking to where, to what they need to actually deliver the project. And that might mean those risks that aren't official corporate risks, but are ones that are true to them and their project, creating little side monitoring type of routines and getting at the heart of what they need to deliver and then creating that culture within the team. I still believe that ambitious targets are achievable for the public sector. I don't think that bringing risk into the conversation means reducing the ambition. I think knowing your risks, acknowledging your risks and designing your project towards those risks actually helps protect the ambition rather than reduce it.
B
All right, Matthew, really appreciate you coming on the show. The perspective, the leadership, I mean, I took, I have five questions that I wrote down to ask other folks, people that I work with, people that I delegate to. And so this is very valuable for me and I'm sure it was for the listeners also. Anything else that you want to leave the audience with, I'll hand the mic to you and you can close this out.
A
Yeah, well, I just want to share some, some exciting news with your listeners that I have just recently launched a whole new training series. So it is taking many, many years worth of, of learning, specifically oversight over billions of dollars worth of public sector projects and try to, to glean what project leaders can use to make sure that their projects don't end up in the headlines. So we've got a learning series, so tactical learning series, and that's broken down into three different courses. One is how to stop Project Drift before your project blows up. So often projects drift, their scopes drift, pull away from the outcomes. This is about getting it back on track and making it sure that it delivers their targets. Second is how to fix a high risk project in 30 days. And that is about crisis containment and trying to get things again back on track. And lastly, the one that's kind of close to my heart, build a real risk radar. It really draws from a lot of the lessons that we talked about here in that so much of the risk systems that we rely on won't help to serve the project's needs. So how does a project leader really dig down and find out what the true risks are to their project? Now, pulling all of those together is our flagship product, the subscriber strategy. So what this is is acknowledging one of the biggest risks to any major public sector project and that's people actually getting on board. And that's getting on board, agreeing with the vision, believing in the delivery, acknowledging the true risks and speaking up both in support of the project but also challenging it where it needs to be. Now that subscriber strategy, the flagship product, actually includes the three other courses as well. And for your listeners, we will launch a 50% off promotion. So if listeners go to subscriberstrategy.com and sign up and add in the voucher code audit50, then we'll honor that. You'll get the entire package. It's tons of learning with activities to make it properly practical and implementable within your project. And that'll be 50% off for the listeners that is will be only open for one week after this podcast release. So please, I do encourage you to go there. And of course if you just want to dip your toes in the water, there is free, free training available as well there. So so please visit subscriberstrategy.com and I hope to see you on the other side very soon.
B
Hey everyone, thank you very much for listening to this episode of the Audit Podcast. Whatever platform you're listening on right now, I'm sure there's a subscribe button somewhere, so please hit the subscribe button there. If you're listening through itunes or Spotify, feel free to go give us that five star rating. It only took me about 16 seconds to give myself a five star rating. Our review and it really helps to get future guests to come on the show, so we'd really appreciate that. Lastly, be sure to check out the show notes and follow us on all our social media channels, on Instagram, on LinkedIn, and on TikTok. Also, if interested, please sign up for our weekly newsletter from the Audit Podcast. Thank you all. Have a great one.
Host: Trent Russell
Guest: Matthew Oleniuk (Founder, The Risk Insider; former CAE in public sector)
Date: September 30, 2025
In this episode, Trent Russell sits down with Matthew Oleniuk, an experienced public sector Chief Audit Executive and founder of The Risk Insider. Their discussion revolves around why public sector projects so often fail, the systemic issues at play, and actionable insights for both auditors and leaders. Oleniuk draws on his decade-and-a-half of leadership to dispense practical advice on effective audit practices, risk management, empowerment, and transforming stagnant project governance into accountable, successful delivery.
The conversation weaves through leadership philosophies, audit pitfalls, the mechanics of public sector project oversight, and the difference between documenting compliance and driving real effectiveness. They also touch on the role of AI tools like ChatGPT in delegating, learning, and empowering audit teams.
Timestamp: [00:00], [06:29]
“If we're auditing a function, we're looking for existence, but we're not necessarily looking for effectiveness. And that's really the core value that audit can provide.”
— Matthew Oleniuk [06:40]
Timestamp: [06:29], [12:04]
“We rely a heck of a lot on the infrastructure and on the notion that we have so many eyeballs on this, that everything must be fine... There’s just so much reporting going on that it becomes kind of a churn.”
— Matthew Oleniuk [13:00]
Timestamp: [02:43], [16:40]
“The more that individual team members can take on, the more the collective will be able to deliver. So that means empowering team members as much as possible, giving them stretch assignments as much as possible.”
— Matthew Oleniuk [08:10]
Timestamp: [02:43], [20:49]
Timestamp: [25:03], [25:54]
“We use the term risk registry, but the risks aren't registering... If we can't draw a direct line between the risk and the outcome, then the risks are not meant for this project and they're not going to be meaningful in any way.”
— Matthew Oleniuk [27:09]
Timestamp: [29:19], [30:55]
“The problem is that the machinery, the infrastructure, is to blame for a lot of the issues. That’s why I really, really, really firmly believe in the individual. So I look to the project leader to fix things.”
— Matthew Oleniuk [31:45]
Timestamp: [04:54], [16:40], [23:43]
On Project Audit:
“…if they have everything and they're doing everything right, what's the problem here? …auditors really need to look at, not to… find anything, but to try to get at the root cause of why things have not been delivered as intended.”
— Matthew Oleniuk [07:00]
On Governance:
“So many people are looking that so many People are also just saying, well, somebody would have caught it if something went wrong. And that's… where the governance really kind of breaks down.”
— Matthew Oleniuk [13:13]
On Empowerment:
“Most people who, if they're not getting [empowerment], they will come to you and tell you that and ask for help rather than just not do it or walk away from it… Most of the time, it's a very, very positive experience for me.”
— Matthew Oleniuk [18:10]
On AI in Auditing:
“It's amazing… For gathering information, it's that synthesis that is still required.”
— Matthew Oleniuk [21:00]
On Project Leadership:
“Ambitious targets are achievable for the public sector. I don't think that bringing risk into the conversation means reducing the ambition. I think knowing your risks… actually helps protect the ambition.”
— Matthew Oleniuk [33:00]
This episode is a must-listen for anyone navigating the complexities of public sector auditing, governance, or project management—and for leaders in any field who want to create real impact through empowerment and sharp analysis.