← The Audit Podcast
Loading summary
Transcript20 lines
- [00:00]
A
In a lot of ways, the risk and the risk management going into 2026 mirrors the things that are on the minds of boards.
- [00:13]
B
Hello everybody. Welcome to the first episode of the audit podcast in 2026. I'm your host, Trent Russell. Today on the show we have Pat Niemann. Pat has joined us. I think this is the third year in a row where we've done this episode with Pat. So Pat's the partner at EY for the center for Board Matters and actually let Pat do a little bit of his intro and background to offer his perspective, which we usually don't do with guests because they can spend way too much time talking about themselves and it's not necessary. But I did want Pat to give his again the context of where his answers are coming from when we talk to him. But basically Pat's job is to talk to a whole bunch of board members and understand what they care about. So we take what Pat does all year long and then we condense it into a 30 minute episode for the list listeners. So as you might imagine, we talk about what's top of mind for board members going into 2026, potential new risks going into the year. AI governance, pretty hot topic right now. So we get the board's really perspective via Pat on all those areas that we just talked about. And we also hit on tariffs a little bit. All right, here we go. All right, so we have Pat Niemann with us today, our resident what's coming up next year expert. I think this is the third time, third year in a row where we, we tend to have you on towards the end of the, the calendar year, so this year 2025. And basically what you're hearing amongst the directors, the boards, audit committees and the folks that you hang around with and what they're seeing and what they're saying. And so just to get your perspective, that is the covers, you know, spans across the country, across the globe and boil that down for our listeners. So with that said, for those that maybe are not familiar, if you could just real briefly kind of your role at EY and where your perspective comes from and maybe another way of thinking about this is when people are listening, they go, oh yeah, I should listen to this from Pat because of.
- [02:18]
A
Yeah, Trent, good to be with you again and your audience. It's always my pleasure, love being with this group. Hey, for me, 34 years with ey out of college, that's how some of us do it. That's how I've done it. Been able to do a lot of things in My career, I'm an audit partner by background and all those years spent serving audit clients. In more recent years, I've really had two roles. For the past number of years, I've been focused on audit committees as part of our EY center for Board Matters. We do different things to try to support not just audit committees and boards in their oversight and governance roles, but we work with a lot of, whether they be audit executives, other C Suite executives who are always trying to better prepare for their audit committees and boards. So that's what I've done as part of EY's center for Board Matters for the past four years and very recently taken on a new role that as the co leader of the center for Board Matters with my partner Lee Henderson, who's also a good friend. The two of us both have those as new roles and we, we've got pretty great jobs because we spend a lot of our time with board members. We do a lot of convening. Sometimes it's through the audit committee lens, most of the time through the broader board lens. And in any given year, if I'm doing my job right, I'm sitting in the room with hundreds of board members to let, let them tell us what's on their minds and glean what we can. And it's all about trying to serve our clients better and help educate those who work with boards regularly.
- [04:04]
B
And then we get to take all of that that you learned over the year and put it into a 30 minute podcast. So we appreciate you coming on. So, like we've probably kicked off the past two episodes where we've done this again kind of at the end of the year, going into 2026. What's top of mind for board members?
- [04:23]
A
Yeah, a lot of different ways that I could choose to answer that question, but it'd probably take more than the time we have here for the podcast. Certainly been a year of change. And I'd say if there is one word that I feel we're hearing from, certainly boards, certainly audit committees and management teams. Uncertainty is a word that I think is an important one. What are they focused on? Hey, the evolving economic conditions. Where are we going to go in 2026? Where are we even right now? Is a fair question. I think there's, there are different points of view from pretty reasonable people that as to where we are and where we're going. Geopolitical volatility. I don't throw those words around loosely, but if you look at what's been going on in the year, in the world what we may be on the brink of what has recently happened and transpired in places like the Middle east. And even though we all know what has happened or what is happening, where does that go into 2026? What does it mean for our risk profile for our companies trade and you know, you may, you may choose to talk about tariffs and things like that, Trent, and that can be an interesting discussion, but where is that going and what is our relationship with different countries and things like that? Certainly on the top of minds and then new laws and regulations. I don't think that's anything new if you think of it in just the big regulatory bucket. And what do things like the one big beautiful bill mean? What do things that, you know, could, could. Where, where does the SEC go in our business? Where does the PCOB go? Those are all things top of mind. And, and then I'll wrap my response up with a couple just very specific points. Having said all that, you know, if there areas that we hear boards wanting to talk about, wanting to learn more about both with firms like ours and people like us, but also with their management teams and from their management teams, hey, cyber security always top of the list, always with boards, especially the audit committees. But I would say something that has changed over the past 12 to 18 months for sure. It's not that AI just has become a big deal right now. That's not the case. But I would say board's interest and what they want to know and that's evolved quite a bit from hey, this is interesting. I realize it's upon us, I'm going to stay with us. But I think that's evolved into now I want to really understand how my companies are deploying that technology and what are the risks associated with it. And important to this audience. How is my management team addressing the risk? So those are a few very specific things that I would point out in response to your question.
- [07:35]
B
Hey everybody, we're going to take a quick break from our guests. And if you need to get analytics or AI actually working in your internal audit department, or if you already have some of it, you feel like you're not really getting exactly what you need out of it, you know there's more. You're not getting that. Go to the Show Notes, look for the Green Skies analytics link. Click it on the website. There'll be other links that you can click that'll take you directly to a calendar to schedule time. It's literally three clicks to get the time scheduled to get it figured out. All right, back to the show.
- [08:06]
A
Okay.
- [08:07]
B
I think the first time we had you on, if I summarized the topics there, it was ESG and cyber. And then year two, which was last year, I believe it was cyber and AI. And so now if we, if we did just like boil those down, it sounds like maybe within AI specifically, probably most likely with the audit committee, is going to be AI governance. And then what would be cyber security? Is it. Are we still kind of hanging around AI and cyber security as the top two. Ish.
- [08:39]
A
I'd say the two of them. And by the way, some would put it in one big bucket of technology, right? Or I tend to talk toward developing technology, emerging technology. In other words, what's new and different? And while cyber, I wouldn't say it clearly isn't a new or different technology for virtually any company, but it's an always changing landscape. So I would say cyber, I'd describe, you know, what do we hear where our board's focused. It's just staying aware of the threat landscape, understanding what their companies are doing. And probably a trend that we're seeing, not a new trend, but just more of it is boards participation in readiness. And you know, it's always. Or it has surprised me, Trent, in the past how some really sophisticated, advanced and even very large companies, even a couple years ago, readiness simulations, desktop exercises on cyber, some were doing it, but some were not. And I'd say that's evolving to a place where not just the companies are doing it, but the boards are getting more involved. And I think that, you know, is that every quarter, is it every month? Maybe not in some cases, yes. But is there something being done on an annual basis to test their readiness in a simulation or similar exercise on cyber that's, that's happening on AI, very different, even though once again, in one big broad bucket. And yes, it's governance. No doubt the boards want to be serving their roles. But I think what I see boards talking about and what I think they're asking questions toward their management teams. I think this includes audit executives. And once again, firms like ours who see a lot, talk to a lot, serve a lot of clients, I think they're getting more focused on, okay, I've gone through the exercise and I've evolved in my understanding, my learning that's important. Um, they're buying into AI has really significant implications, you know, in the business world, capital markets world as a whole. But now what does it mean to the company where I'm a board member or companies and conversations around that at the board level with management teams? I think are evolving into, hey, help me understand as a board member, where are we using and deploying AI? What are the risks associated with it? How are we managing, monitoring, evaluating those risks? Very direct tie into risk management professionals and executives, audit executives, no doubt, but a more specific understanding and as you can imagine in this audience knows that all gets a more acute focus when it deals with financial reporting, really other forms of external reporting as well, I suppose. And what, you know, what, what might have external implications, whether it's economic implications, reporting implications, reputational implications. But I think boards are getting more focused on having those discussions. I think management teams often are driving those discussions. I'd say if they're not, then, you know, they're, they're likely to get more interest from boards and understanding those things. And there, there will be some things that, hey, may not, may not need to be front and center for boards because they might be small implications for the company. They might not be as risky as some other things. But I would say not assuming anything is a good idea. And once again, I, and I may have said this to you and this audience in the past, Trent, but I just think, think of it as an inventory. What it, where are we using and deploying AI and what does it mean to, to me as a board member?
- [12:52]
B
Okay. I think with AI and its evolution, which is seemingly changing every week, there's going to be new risks. So if we're looking forward to 2026, what are audit committee members saying about new risks and how are they, or maybe should they be preparing for those?
- [13:10]
A
Yeah, hey, I think the big broad, the big bucket of risk management, you know, a whole lot always going on on that front. We've talked about some things that are the topics that drive the risk and where companies should be focused on the risk. But let me give a few thoughts. First of all, as you know, it's going to vary by company and there could be sector implications and, and all those good things. But I would, I would say in a lot of ways the risk and the risk management going into 2026 mirrors the things that are on the minds of boards. And we've talked about AI, we've talked about cyber, you know, some other things that I think just to keep on the risk radar. And I'll share a, a few more specific points on what we're seeing boards doing and talking about and expecting from their management team. But in addition to AI, cyber, the broader technology bucket, you know, keep in mind, board priorities include the capital strategy. You know, capital is always limited and there's an allocation of capital that boards are super focused on along with management teams. There's a review of how the capital is currently allocated and the portfolio review, all the mergers and acquisitions that are being contemplated and a little uptick on that front, certainly in people getting geared up, thinking the time is getting closer if companies aren't already doing this. So that whole capital strategy, Specific risks, call it geopolitical, economic, regulatory, crisis response readiness, we've talked a little bit about that. And innovation, which touches on, you know, some of the things we've talked about on AI and cyber. I think just I keep that on the radar because boards are focused on it and increasingly interested in talking about it. So I think, hey, first of all, I think board members are always looking, they love talking about what are the leading practices. Their agendas are growing, especially the audit committee. So a couple things that leading boards, in my view, what we hear, what they're doing. First of all, hey, I mentioned uncertainty. That's a very real thing right now. Who knows where things go in 2026. But I think that the best management teams and boards, they're focused on and understanding. Let's look at this risk environment strategically because there are opportunities that can be uncovered. Right. We want to manage risk, mitigate risk, but let's also understand what the opportunities are for the long term growth. You know, while it's not terribly unreasonable to get defensive and have a defensive posture in these uncertain times and with all the risk that's out there, I'd say the better way, the leading way, is to understand the risk and understand and really be proactive in defining the company's risk appetite. And should that be driven by management? Yes, but there's clearly a board role. Sometimes that's the audit committee, sometimes it's the risk committee or other committees. It's always a full board thing. What are we willing to accept as far as risk? Understanding the markets that are relevant and then preparing to capture the shorter term opportunities that I talk about and what's going to be emerging on the horizon. I think a bit of that is. How do we go about that? Well, scenario planning, you could call it different things. We often think of simulations in the cyber world or some others. But I would be, you know, we're seeing it more and I think it's a really important concept for boards and their management teams to consider the rigor around their scenario planning and whether it's thinking about three things that could happen in this uncertain economy or on the, you know, whether it's the cyber landscape. And all those risks, whether it's AI, whether it's capital, and you know, where we might go with M and A activity or spin off activity, just really playing that out. And the other thing I talked about, capital be limited, but the only thing that is equally limited, maybe more so. Time is limited and board time is limited. And it's tough to fit this all onto a board agenda, a committee agenda. But I really do think that these scenarios, thinking through what might happen, the simulations, are an even better set of exercises. And whether that's three things to think about. Five things there could be. You talk about a few of the uncertainties out there and gosh, you could figure out 20 different things to model. And I'm not necessarily suggesting that, but given the fluidity of the landscape that is out there, what I think is an obvious statement is that a single point forecast, that's just not sufficient going forward. And for these times that we're in.
- [18:44]
B
Yeah, I think it'd be fair to say that CAE should be. Audit leadership, should be asking the question of their audit committees. What are the scenarios that we're thinking through at a board level or have? Are we thinking through this scenario and proposing some of those based on what they're seeing relative to the risks that they know that's going on and being kind of part of the risk management crew there? So I think that makes a ton of sense as a takeaway for folks. I think that that would make a ton of sense to ask that question. Start posing that. We did hit on tariffs a little bit. We haven't talked about it a ton on the show since, like the day that it all went down. I think we talked about it shortly after, but that was about it. Impact on corporate investments, what are you seeing? How are companies mitigating their impact there?
- [19:32]
A
Yeah, tariffs are such. It's such an interesting topic. And I mean, it's so fluid. And I think it's hard to predict what's going to happen later today or tomorrow, much less early in 26 or thereafter. But. And it also is just something that really, I don't know if I should say, just evokes so much emotion and so much passion and maybe even some political feelings and sentiments. But a couple things that I would share. One, even before the tariffs hit and all the discussions really started to ensue, it's interesting. I think companies were already very focused on the broader set of risks. Call it geopolitical, call it trade. We did a survey, Trent, that showed 85% of CEOs and once again, before tariffs hit, 85% of CEOs had talked about altering their investment plans and more than half of those had delayed some planned investment. And once again, that was not even talking about terrorists, but just the uncertainty of the geopolitical environment that exists. And since that survey, clearly things have changed in the world and they're going to continue to change. I'd say what's most important, hey, most importantly, try to focus, try to sort through all that you hear, read, maybe mow upon. I'd say what's specific to your company, what's specific to the risk environment for your company. I've already talked about, we've talked about scenario planning. I'd put as much rigor around that as possible. And even though the board doesn't have to be a part of all of that, I do encourage get the board involved because your board members are board members for a reason. They bring broad perspective, great experience, a lot of business judgment. They've been there, they've done that. So management drives that scenario planning. But the board certainly being a part of it, I hear board, really smart board members, a few have said this to us. They're going to be winners and losers, right? So terrorists, we're all entitled to our opinion on terrorists. You can ask 50 economists and you're going to get more than one opinion clearly on what the tariffs are going to do short term, long term, to the US Economy, the global economy. But there is opportunity. And I don't love to talk about winners and losers. I guess I'd like everybody, every company that that's represented in this, in our audience today, to be winners, but just focus on that. There will be opportunities, those opportunities, some are going to be short term, some are long term. You know, what should your company's strategy be? And very importantly and perhaps obvious, but it needs to be said, think about the risks associated with the strategy, the implications, the different scenarios. And final thought on terrorists sitting back, letting things happen, just seeing where things go. I just don't think that's the right approach, although there are some taking that approach. I just don't think that's the most strategically sound approach. If you want to get the most and be in the best position, whether it's right at this moment going into 2026 or beyond. All right.
- [23:14]
B
I know in my role, helping internal audit departments with analytics and AI, AI governance is top of mind for me. So I'm curious again from what you've distilled from the hundreds of folks that are in your circle and that you work with AI governance, obviously it's going to be more and more important. 2025 was supposed to be the year of the agent, the AI agent. And there's certainly a lot that's been done there, but it wasn't quite, hey, everybody's doing this now. And even at a high level, maybe some of that is because of the governance structures that are needed around that. But 2026 is more likely going to be where you're going to start to see a lot of really cool stuff come out with AI agents with that, especially when there's multiple agents running governance around, that is going to be absolutely insane. An AI governance expert friend of mine said it's basically impossible. So I think that'll be fun. But anyway, that's my rant. What are you seeing and what are you hearing?
- [24:12]
A
Hey, develop an area for sure. We talked earlier about even the difference from a year ago to now, 18 months ago to now, how boards are having discussions around the very broad topic of AI. And to your point, Trent, it's not a monolith. There's so many different dimensions to it. And gosh, as we get into 2026, they're going to be dimensions that we're not even thinking about right now or knowledgeable of. I do keep it simple. I'm a pretty simple guy for boards. Hey, and for management teams, boards need to understand the specific implications for their companies, right? And I talked about the inventory or just management proactively sharing with boards how AI is being utilized and deployed throughout the company. So you know, boards, they do not need to understand every detail of every, all the AI technology being deployed, every agent, you name it. But they do have to have an understanding of where is it being deployed, what are the implications to our business. I'd say a risk that probably hasn't gotten enough focus when you think about governance of AI or any other technology for that matter, is what's the value at risk? And that value. And hey, I'm an accountant by background, so I'm a quantitative sort of person. There are qualitative risks that are really, really important. But I also think, just thinking of value, whether it be quantitative and economic value, it can be certainly publicity, you know, that old. Do you want it to be front page news when there's a use of AI that maybe the public would have an opinion on? I just think it's important for boards to understand in their governance role, but management teams to drive. Here is how we look at the value that is at risk, whether it is economics Economic risk, public relations risk, continuation, business continuance risk, all those things. So actively understanding that management teams actively sharing that and, and having that as a regular discussion. Another point, I think there's the, the risks associated with AI being involved in financial reporting. Once again it's another area where that is just much more commonplace and better understood by boards. But if, if AI is being deployed in financial reporting, there's integrity of financials involved. It's just an area where the governance of that AI is going to be important. It all keeps going back to does the board understand and is management sharing with this is how we're deploying AI in the company. I'll give you one stat not to get bogged down in numbers with your audience Trent, but we do a survey on disclosures annually. It's typically been a cybersecurity disclosure report and we've broadened that to AI disclosures so in 10Ks and annual reports and so forth. It's interesting. Fortune 100 is what we analyzed and published and almost 6 in 10, 58% of the company filings reported preparedness on the cybersecurity and other fronts including simulations, tabletop exercises, you know, being, being important. I think we're going to keep seeing that increase. I think it's the same for AI governance. More and more is going to be occurring. More companies are going to want to tell their story. When you think about probably should be 100% or very close to it, whether it's on the cyber front, the AI front, that there is a good deal of expertise being driven in the companies governance being more active and even public disclosure of that. So I, I'd say you know that that's going to be, that's going to continue into 2026 and beyond. Not just the, the trends of what's happening but also looking to tell the story and some public information on it because just like cyber analysts and investors want to know more. So those are a few thoughts in a really, really broad area.
- [29:02]
B
Do you see? I mean I think I was like 10 during the dot com boom but I've started to see people make these like comparisons, analogies, parallels between the dot com bubble and maybe what is a potential AI bubble right now. I see it for sure on the analytics vers AI front from this perspective. And this is what, this is what I mean a lot of people for years go hey we bought this tool, we can go do analytics now. And I would go well that's not exactly how it works. You bought a tool. But there's still A lot more to consider AI, it's kind of similar. It's like what do you, what's your strategy? And so we have this tool so you know, we're good now. Okay. That's not how it works either. And so I'm curious from your perspective if you were. I'm not exactly where you were career wise during.com era, but are you seeing any parallels between.com era AI era and then are you seeing any or hearing any relative to like what you're hearing from board members also?
- [30:06]
A
Yeah, I mean having lived through that as an audit professional, certainly a wife that went to work for one of those dot coms and left a firm like mine to do that, you know, seen it, been there, done that. Hard for me to prognosticate, predict the future where this all goes. There are similarities of the build up, the investment. You know, I'm not a stock picker or an investment professional, but we can all see in the capital markets that there is so much investment and cap flowing into anything AI related. I say anything that's an exaggeration but certainly to the big plays in AI that's happening. And we all hear from different sources. There are some who do predict and say there will be a bust. They might name companies, they might not. And then some say, hey, this is here to stay. And I guess if I need it to give a view, Trent, and you've asked me to do so, so I will. I think it's no different than on almost any other front, but maybe in a bigger way they're going to be winners and losers and so will there be busts? I think individually there will be some companies won't be the right answer who are in that field. Some are going to thrive. But perhaps more important to our audience, what I would say is within the companies where they that they are active, they're going to be things once again, the different dimensions of AI, some are going to work out in your company, some are not. I think virtually every company out there and I don't suggest just trial and error for the sake of it, but I think that'll be a likely outcome. Some things are going to be tried and found to be not as valuable as hoped and then some things are going to be big advantages and give a lot of lift and those are the ones that are going to survive and that's going to be probably a constantly evolving with landscape with a whole bunch of iterations that won't stop or slow down. And once again, I think sitting on the sidelines probably isn't the answer for most companies, but being judicious about where you choose to play is also really, really important from a risk profile, at minimum.
- [32:44]
B
All right, Pat, thanks for coming on again. Again, I think this is three years in a row. It's one that we always look forward to into the year for us and seeing the what's kind of happened based on what we talked about last time, what's coming up in the future. And again, just to be able to leverage the network of board members that you have access to and have then have you distill that information to our audiences leads me to one of our favorite episodes that we we do every year. So thank you very much for coming back on. With that said, I'm going to give the mic to you and let you lead the audience with some closing remarks.
- [33:21]
A
Well, hey, thanks, Trent, and thanks everybody listening and watching. I enjoy this. I always realize we're all sort of focused on the same things, and I think that's trying to really ultimately keep our capital markets strong and manage risks and things like that. Super important to those capital markets. And we all play a role. I think if I just wanted to share one thought I shared earlier that I've got a pretty great role that I get to interact with so many different board members, a lot of audit committee members, a lot of executives from all different kinds of companies, different sizes, different sectors, different backgrounds, different people. And it's always interesting when you're in a room with whether it's members of the same committee or board, whether it's convening with people from all different boards and companies, it's always interesting just watching them talk and learn from each other and listen to one another. And my role tends to be listening and gleaning and trying to get smart about these things. And I just think that's a pretty good thing for all of us to be focused on. And whether you're in a management role, whether you're a board member, whether you play any role, I think just I really encourage people just to be actively talking. If it's in your company talking, as a management team, pull that board, that audit committee into the discussion and I think we just get to better places ultimately and the best decisions possible when you approach it that way. So that's what I would leave and kind of a year end or new year thought for everybody listening. And once again, thanks for having me. Always a pleasure.
- [35:11]
B
Hey everyone, thank you very much for listening to this episode of the Audit podcast, whatever platform you're listening on right Now, I'm sure there's a subscribe button somewhere, so please hit the subscribe button there. If you're listening through itunes or Spotify, feel free to go give us that five star rating. It only took me about 16 seconds to give myself a five star review and it really helps to get future guests to come on the show, so we'd really appreciate that. Lastly, be sure to check out the show show notes and follow us on all our social media channels, on Instagram, on LinkedIn, and on TikTok. Also, if interested, please sign up for our weekly newsletter from the Audit Podcast. Thank you all. Have a great one.