← The Audit Podcast
The Audit Podcast
Ep 280: Why Passive Voice Is Hurting Your Audit Reports w/ Sara I. James (Radical Reporting)
00:46:21
Loading summary
Transcript57 lines
- [00:00]
Sarah I James
Most of us are tired. Most of us have too much going on. Most of us, you know, have attention spans that are shot to pieces, not least because of our delightful little precious toys. But remember, your readers are in the same position, so do not trespass over long on their energy levels and their goodwill.
- [00:30]
Trent Russell
If you've ever been to a conference and at some point you're like, I didn't really get anything out of that, or I don't have anything practical, tactical to take back and do, that's why we started the Audit analytics and AI conference, because I can empathize. I did the same thing. That's cool. Can you show me how to do it? And so as part of the analytics and AI conference, especially the spring conference that we have on May 20 this year from 9 to 4 Central, it's 9 to 4 Chicago time. We have six presenters, you can get seven CPEs, and it's some of the best presenters that we've had over the five years that we've been doing this conference. So these are the ones that I've seen personally, three of which for sure, I have gone back and watched their recordings, you know, months later to go, I know they did this thing that was really cool. Let me go back and watch it. So I can do it too. So there's no way that you won't have something you can actually do relative to analytics and or AI. So some of the fine folks we have coming back, Brittany McKinley, Brian McNally and Val Zappia from Elevations Credit Union, Macy's and Victoria's Secret, respectively, all three of those. I've gone back and watched their sessions from the prior years to see what they did so I could replicate it on my end. And then we have Paul Kerstein and Madeline Novelli from Vulcan Materials, and they're going to show you how to use AI to build a, like a central hub of audit intelligence paired with a library of reusable AI prompts. So you can. So any auditor on the team can use analytics. We also have multiple people from the Williams Energy Audit team. So they have a framework of using AI to do analytics, but then each one prefers different tools. So one person's like, I like Python, so they do theirs in Python. 1 likes R, they do it in R. 1 likes Power BI, they do it in Power BI. They also use databricks. And so there's some functionality they do in databricks for SQL or even Python in there if they wanted to. So it's one framework that gets applied and everyone kind of interprets it and uses it differently. It's fantastic. And then the last of our speaker slots, so we have five. The last one. We are having to keep a secret for now and hope to be able to tell you as soon as possible what that's going to be. But, but I think we can at least say it's going to be very innovative. All right, like I said, it is May 20, 9 o' clock till 4 o' clock central. You can search Audit Analytics Conference. It should be towards the top. If not the top. You can go to The Audit analytics conference.com links are in the show notes. You can go to my page on LinkedIn Trent Russell, find me. There's links there if you follow me. It's pretty hard to miss some of the posts that we're going to be putting up for the Commerce this year. So this is probably the most excited I've been about this conference since the very first one that we did. All right, hope to see you guys there. Thank you. Hello everybody. Welcome to another episode of the Audit Podcast. I'm your host, Trent Russell. And today, returning to the show, we have Sarah I James. Sarah is author of the book Radical Reporting, Writing Better Audit Risk Compliance and Information Security Reports. This is the second edition. So we had Sarah on the first time we talked about the first edition. Now she's back for the second time we're talking to her about the second edition. Also, she's the owner of Getting Words to Work. She is one of the top audit report writing trainers in the world, in my opinion, largely because not only is she an audit nerd, she's also a language nerd. So she was a language expert who also happens to be an audit nerd. Which when you marry those two together, you get one of the best internal audit report writing trainers in the world. We'll put a link in the show notes. But again, check out Sarah's book Radical Writing Better Audit Risk Compliance and Information Security Reports. The second edition. Some of the things that Sarah and I hit on if you're going to have a second edition, what's different from the first edition? Why should people go get the second edition if they already have the first edition? So kind of covering like what's the new content more or less. The first time we had Sarah on, we said book's fantastic and it really is. If you haven't read it, get the second edition, of course. But it's very, very good and there's definitely a lot of takeaways and things you'll learn from it. But we Asked basically, hey, there's going to be people who are not going to read any book you give them. Actually, I was talking to my dad last night and he said he's literally never read a book in his life anyway. So I asked for those people like my dad, what. What's one takeaway from the book that they can apply? And so we got a really good answer from the first time. So I kind of summarize that so you don't have to go back and listen to that episode if you don't want to. But we asked the same question, like, what's one solid, good, practical, tactical takeaway that people can use for those that maybe aren't going to read the book? One of the things I was most interested in asking Sarah, because a lot of internal audit departments have turned to AI for the report writing. And basically understanding from her, like, what's the point of doing any of this stuff anymore if AI is going to do it for us? She had a fantastic answer. Highly recommend checking that out. And then I asked her what's worrying her about people using LLMs. Like, what are the risks with AI and LLMs relative to report writing? And how are you, report writing guru, using LLMs and your report writing? But that said, here we go. All right, Sarah, I typically hate asking this question of people that wrote books. Um, but the more people that we've had on that write books, I think, okay, they can describe this in their 30, 60 seconds better than I ever could. And so I'm gonna. I'm gonna throw it to you. Tell us about the latest book. If you want to. You can tell us about the, the first one. Also. I know we had you on a couple years ago to talk about that one, which was fantastic. Anyone, pro tip, Anyone, audit report writing wise, go back and listen to that one also that episode, because Sarah gives some, like, very tactical, practical, like very tactical practical advice in that one. So go check that one out. But anyway, briefly tell us about this book. And then since this is version two of version. So we have version one. That's what we talked about last time. This is version 2. Basically, why should the audience get this newer book that's version two, if maybe they've read the prior version also? So a couple questions in there and I'll just throw it to you and you can take it however you want to.
- [06:53]
Sarah I James
No, thanks. Trent, great question, and I'm very glad to answer it because the second edition of Radical Reporting is doing a couple of things that the first edition wasn't in a position to because it was a different time and there were other reasons as well. So the second edition, I think is really timely and speaks even more to a lot of concerns people have. There is more content, not a huge term. I would say there's about 10% more content, but specifically focusing on two topics. So critical thinking. There's a lot more in there about critical thinking, resources for critical thinking, different types of critical thinking, barriers to reasoning, things that we all deal with every day, but maybe we're not as aware of it as we should be. And the other one is what people call AI, but what we actually mean is large language models, because AI has been around for decades. Absolutely decades. Decades. Large language models, however, really burst into public consciousness November 2022 with ChatGPT, and we know how that's taken off. So I do talk about judicious use of large language models for those who wish to use them. The other thing with the second edition was it was an opportunity to correct multiple production errors from the first edition.
- [08:15]
Trent Russell
Got it.
- [08:15]
Sarah I James
Thanks production team. They did a great job this time
- [08:20]
Trent Russell
on the critical thinking part, I've seen more. I feel like we've been talking critical thinking, not necessarily on the show, but in society, I guess we could say, really once we all kind of realize, oh, social media is terrible for us. And the critical thinking was a piece of that. And especially the way social media has influenced like our politics and beliefs and everything else. And that's where I think I felt like I first started to hear about it and go like, yeah, this actually does make sense to invest time into that as a skill. Why? Why critical thinking in this book as opposed to the previous one? Is it because times have changed? Or what's the reasoning behind going like, okay, we have to make sure we include critical thinking as part of this one.
- [09:06]
Sarah I James
Yeah, I think a couple of reasons. The first reason I would say is because it became clearer and clearer to me over the past few years what demand there was, especially from internal auditors, who on the one hand see themselves as almost robotic paragons of cold logic, and on the other hand say, but we need to learn critical thinking. Just because you're an accountant by profession, for instance, doesn't mean you're always logical. We're not. We're human. So I've been doing a lot of critical thinking training with a huge range of clients over the past few years. And actually the first time I did my critical thinking course, it was with the Greek Institute of Internal Auditors. And I felt a little bit self conscious because I was saying to the attendees, attendees, you know, I feel this is kind of strange because you guys invented the Western tradition of critical thinking. And they looked a little bit embarrassed. They said, yeah, we learned about it in school. We kind of need a refresher. And I think everyone does, even if they learned it in school. So I would say the last three to four years, I've been doing a lot more with critical thinking and seeing there's a huge need. And I think it's also becoming more apparent that with the use of large language models, people really need to acquire and hone and retain those critical thinking skills. Because otherwise, you know, as I'm sure we'll talk about later on the. The large language model no longer is a tool. It's the master. You know, we have to. We have to stay in control there. I did talk about critical thinking in the first edition, but there was an element maybe on my part of assuming people knew what it was, had had at least an elementary grounding at some point in their schooling, and that this was just saying, hey, guys, remember this? You know, it's really good. And then I realized, no, we need to go a bit deeper and we need to explain or refresh some of the basics a bit more.
- [11:13]
Trent Russell
There's. There's an AI leader that we work with and you're talking about. I think I've said this on the show. I know I've been saying it to people lately. You're. You're talking about. AI's been around for, you know, a really long time, but LLMs have been around basically for three years. And so when this guy's introduced himself before, I've heard him say, I've been doing AI since 83. And you can just see people's face be like, it's only been around for like three years, man. What are you talking about? He like, no, no, no, no. I've been doing it since, like, the beginning. Well, 83 wasn't the beginning, but anyway, so anyway, very much AI for years and years and years and years and years, and the course of all things that he could put together, like any AI related topic on a. You know, because he built a course that he could do and he picked. Critical thinking was the one that he picked. He's like, this is the most pressing, important thing right now going on is that. And so that's what he did. Not something like technical AI necessarily related, but I mean, I've had to. Basically, once he did that, that was kind of a wakeup call for me because I'VE read the stories about people who over reliance on LLMs. I think the analogy that people might probably take to heart is with gpss, I don't know how to get anywhere. Like I know how to get from my house to my kids school and my house to like the grocery store. Any deviation from that path, like it immediately has to go into a GPS because I just, I don't even think about it. I just put it in and go, all right, tell me where to go. And so I think it's similar with LLMs but I think at a more detrimental level as we like I rely on my GPS once a week, twice a week, maybe LLMs, it's every single day.
- [12:53]
Sarah I James
I mean what you're saying is interesting cause I was thinking yesterday I was in London and I had a few appointments and meetings and things and I was using my phone sort of to navigate and I was thinking, wait a minute, you know like 10, 15, 20 years ago I would use what they call the A to Z so like the little book, you know, with every single street in London there and I would find my way. But also I got used to just using my common sense and you know, whatever inbuilt navigation skills I have. And I thought, you know, we're actively losing those. I mean another analogy I use with LLMs is a. I don't know if they still have this, but years ago you used to see ads in newspapers and magazines back when people read newspapers and magazines where it said, you know, become toned and fit and muscular by basically, you know, slapping these, these sort of pads connected to plugs. Yeah, all over your body. And so you plug it in, switch in and you could lie on the sofa watching soap operas and eating, you know, cookies and stuff and it would tone you up. And I think, you know, LLMs are sort of the mental equivalent of that. Nobody can go to the gym for you, nobody can do your thinking for you. And I think one thing we need to remember as well because people say, well, you do critical thinking and you do radical reporting where you focus a lot on language. And that pulls on my background as a language professional. I say background but I'm still a language professional, as a, a writer, an editor, a translator. And they say, you know, why those two different things? And you think, but they're not different. Logic and language go together. And you know, even in 1946 George Orwell was warning us and saying, you know, that the more sloppy and foolish our language becomes, the harder it is to think clearly. And so, you know, we do also get, I think, into a vicious cycle, especially in large organizations that all have their own form of corporate gobbledygook that everyone just starts parroting. You know, if that's what's going on, then you're not engaging your brain. You're not thinking of what you need to say. You're not choosing the fewest, best words for it, and you're falling out of the habit of using language thoughtfully. And because most of us think using words, that then affects your ability to think. So the two are, you know, completely enmeshed. And the fact that people even ask me, well, you know, what's the connection? Shows the extent to which I think that connection has broken down in public consciousness. And going back to the point you were making about social media and politics and people's daily lives, you know, that the fact that people maybe do not question things, do not question the language that politicians are using, do not question certain messages, you know, speaks to that. That link and Orwell's essay was called Politics and the English Language.
- [16:05]
Trent Russell
The. You're talking about, like, the. Or gobbledygook, as you put it. We have to be aware of that, my wife and I. So, like, the other day, I can't remember what it was, but just say some kids stayed in her house or something. I forget the situation, but she's like, yeah, we have to decision that. And I would decision that. Like, this is. We're not in a meeting, Laura. Like, this isn't a meeting. Please. We have to, like, keep each other in check. Because one that I've been. I don't think I've used it around her, but, like, operationalize is something that I've just started saying.
- [16:39]
Sarah I James
My word.
- [16:40]
Trent Russell
Yeah.
- [16:41]
Sarah I James
And she is a key stakeholder.
- [16:43]
Trent Russell
Yeah, exactly. Yeah. So every now and again, we both have to be like, okay, take a break. I know we both, you know, like, we work from home, and so it's just, like, natural. It's still, like, our environment. We have to keep each other and call each other out and go, we're at the dinner table. We don't need to, like, operationalize anything or decision anything right now. We can just, like, eat and talk like normal people. So, okay, probably the number one question that I want to ask you, so I want to make sure that we get into it, is last book we asked you, like, all right, like, what's the one thing that we could take away or, like, one takeaway you could give us that. The practical, tactical thing that I talked about last time that I talked about Earlier. And so I'm curious, and maybe this goes into the critical thinking piece or something like that, but what is maybe the one. One or two big takeaways that you could go like, all right, I'm gonna give you guys a little peek under the hood of this book, and here's what it is. This is what, like, the one thing would be.
- [17:40]
Sarah I James
Wow. A couple of things occurred as you were saying it because of the way you. You articulated it. And even though I think about this most days, what you've just said has sparked some new ideas there. Last time, I think I said the difference between the active and the passive voice.
- [18:01]
Trent Russell
Right, right.
- [18:02]
Sarah I James
In an active, not a passive. Yeah, yeah. And most people will say, well, that's just grammatical. I say, well, yes and no. I mean, both active voice and passive voice are grammatically correct. You might say it's a stylistic choice. But I think that I would still say that because the distinction between the active and the passive voice when we're thinking and when we're communicating ties into not just our understanding of language, but do we actually know what we're talking about? Because if you are unsure of your message or if you are afraid to deliver it, you will probably default to the passive voice. So then we're in a situation where we might be unwittingly using language to cover up cracks, to mask assumptions, to hide the truth. And again, this goes back to George Orwell in Politics and the English Language. He named the passive voice of one of what he called the swindles and perversions of language. I think that's a bit hardcore, but I'd say just be alert to it, because if you are alert to how you and other people are communicating, are you using the active voice? Are you using the passive voice that tells you whether you or other people. First of all, do you know what's going on? Have you actually done your work? Have you come to a conclusion you can defend? And then do you have the spine to conclude, to communicate that that actually then ties into, I would say, the. The new standard 1.1 in the global internal audit standards, of which I was the copy editor. Honesty and professional courage. So, you know, actually using the active voice, I'm not saying get up in the morning and pick a fight, but especially for internal auditors, if you know there's a problem in a certain part of. Don't point fingers at individuals, but do not shy away from saying, this team or area department is not doing X. Yeah. And it also takes us to emotion. So, you know, I Might say active and passive, but lying underneath that, we've got, you know, the rigor of the work we do, the rigor of our analysis, which is critical thinking, our ability to display courage, and that ties into emotions. And I think very often, you know, people communicate in a particular way because they are nervous, they are afraid, their ego is wrapped up with communicating in a certain way. They think it might impress people to operationalize and decision for their stakeholders and whatnot.
- [20:52]
Trent Russell
All right, I see what we're going to cut out of this episode. All right, Keep going.
- [20:59]
Sarah I James
And, you know, never underestimate tiredness.
- [21:04]
Trent Russell
Okay. What do you mean by that?
- [21:06]
Sarah I James
I just think everyone's exhausted, okay? And when people are tired, mental effort is harder and people are distracted and people are stressed out. And so what I do when I run training is I say, you know, I think most of us are tired. Most of us have too much going on. Most of us have attention spans that are shot to pieces, not least because of our delightful little precious toys. But remember, your readers are in the same position, so do not trespass over long on their energy levels and their goodwill.
- [21:49]
Trent Russell
Ooh, that's a good point. I know when we talked active verse. Verse passive, last time, I didn't know what you were talking about. Like, I've never heard that explained before. Didn't really understand the concept. I remember looking it up afterwards, learning more about it. I remember, I think you can do this. It's been a while since we've talked, hasn't it? I think you could do it in Microsoft Word where there was some way to navigate and it would tell you if it was active or passive. Okay, okay, I'm starting to recall.
- [22:20]
Sarah I James
Absolutely, will.
- [22:21]
Trent Russell
Okay. And so anyway, I just remember reading it and going, like, okay, I feel like most audit reports I read are passive. If I were to write one, it would be passive. Like, I'm in the same boat. Like, it's not a natural, like, writing style. And so anyway, all that to say it would take effort to be conscious, conscientious of. Am I active or passive right now, based on the form of communication. So the reason I'm saying all this, I definitely could see it being difficult for someone. Like, this isn't like a turn the switch on. Oh, now you're in active. For me, anyway, that's not how my brain works. And so I'm sure, like, hey, practice this consistently and you'll get great and wonderful at it. But I'm thinking especially, and maybe it's just because you're like, audit report writer report writing guru. And so that's where my brain's going. But if there was a place to practice it the most, like if we did an 8020 on. Okay, if you're going to, if you're not going to do it, if you're listening to this and you search active versus passive and you go, that sounds like too much work. I'm definitely not going to do that. Where would be is is the audit report or we can just say the audit communication end report to a degree. Would that be the place where you go, like if you're going to do it anywhere or if you're not going to do it anywhere else, do it here relative to internal audit.
- [23:36]
Sarah I James
Oh, that's interesting because I would say at that point it's too late for several reasons. And just though to reinforce something that you said and I don't think we can emphasize this enough, this is hard. So working out what is actually knocking around in your head and then extracting something useful and relevant from it and then articulating it in a reader friendly way, this is hard work. This does not happen automatically. If it did, I would be reading much better reports than I am reading. And earlier this week I was told I yet again need a new prescription for my glasses. I think reading 4,000 reports or so will do that to you. I would say train yourself to try to use the active as much as possible simply because it's a really good check on whether or not you know what you're doing. So when I do an audit, and it's been a few years since I've done one, but my principle was always to put everything in my working papers in the active voice. Because if I can't, if I slide into the passive, maybe I'm making assumptions, maybe I'm relying on something that somebody else has given me that is in the passive. And the person they got it from put it in the passive or they got it from someone and already you're on shifting sands in terms of your fieldwork. When I did QA in a global audit function, I swear to you, nine times out of ten when I would sit down and look at a finding that was all passive, and I would say to the auditor, okay, just between the two of us, can you tell me who is not performing this control? I'm not looking for you to point the finger at an individual, but which team or area or department. Especially if we're talking about a really complex control that stretches across the organization. You could have, you know, three, four, five different divisions, even Involved, tell me where the car has broken down so we can go pick it up and fix it. I swear to you, nine times out of ten they would look a bit blank and they would try to say, well, it doesn't matter who did it, we're not playing a blame game. What matters is the control. I'd say, no, I totally agree. As I said, we're not naming and shaming individuals, but where in the control are things going wrong? And they still couldn't tell me. And at that point I was thinking, you did the risk and control evaluation six weeks ago, you came up with the testing plan, you did the testing, you've come up with a finding and you still cannot tell me. I'm now wondering what's in the risk and control evaluation? Because the first thing we do is what are the risks? What are the known or expected controls? And then you dissect those controls so you make sure you understand absolutely every element, every stage, every role, every department involved, so you can assess, first of all, is the control adequate or not, even before you test for effectiveness. If I'm getting someone who's putting everything into the passive and they cannot answer the question of where is the control failing, that is going to make me question the quality of their work throughout and indeed from the beginning. So I would say it's like the foundations, you know, get into the habit of doing it. Sometimes people say we can't say which area or which role is not doing something. And I've seen this myself, because nobody knows what they're supposed to be doing. And that's where you get those findings that say this isn't being done and that's been forgotten and this isn't being reconciled. My view on that is the fact that you're almost being railroaded into using the passive. There actually is a really useful alarm bell because what it tells you is maybe those are symptoms of a bigger control failure, which is a lack of governance, you know, poor the somebody. Because I would say it will be a board, it will be a committee, it will be steering group has not defined roles and responsibilities. So that's why I say be alert to it, because it's just so easy to slide into the passive and to let other people's use of the passive go unquestioned. And I'm not saying you jump on every single instance of it, but if I'm reading a report and most things are passive, it's. Besides anything else, it's going to be longer and it's really hard to follow. Yeah. And and again, it's part of language linking to logic. You have to know what's going on before you can articulate it.
- [28:31]
Trent Russell
People listening now going, okay, active versus passive. I'm just going to write it how I always write it. And then I'll have the LLM and I'll tell it, write this in active voice now. And then I'll copy and paste and I'll go, I did it. I'm good to go, Sarah, I did exactly what you told me to do. So with that, why even bother, like, why even bother with some of this stuff if, if. Because of AI, why even bother with it?
- [28:53]
Sarah I James
Because the LLM will only be able to do it if you actually, at some point in the prompt, have, get, have given it the information about who's doing what.
- [29:03]
Trent Russell
Got it.
- [29:05]
Sarah I James
Because one thing I have to say, LLMs that I've seen do understand is they understand the term plain language, which is, you know, a defined accepted term. There's an ISO standard about plain language. And so if you ask, let's just say chatgpt, please give me a plain language summary of X. And it could be maybe some legislation. So it can be very good for that. Still say spot check it, because it does make stuff up, but it does know you mean short words, short sentences, more active than passive. So, you know, you said 80, 20 earlier and Rupert Morris, who, he's retired now, but he's a great writer, a political biographer, he was a writing tutor, he's a journalist. But he came up with the 8020 rule where he just said, you know, 80 to 85% of your writing should be in the active voice because otherwise, at best, you are confusing the reader. At worst, you could make them doubt your credibility, make you think. You might make them think that either you don't know what you're talking about or you're trying to hide something from them. And that's really not a good look. So, yeah, the large language models, if you're giving them the information to make it active, it will. If you don't have that information, it can't give you that and it will either feed the passive back to you or it might, in desperation, pick information from elsewhere in the chat.
- [30:46]
Trent Russell
Yeah.
- [30:47]
Sarah I James
And start making stuff up.
- [30:49]
Trent Russell
Yeah, I see that being very real possibility and happening often.
- [30:54]
Sarah I James
Yeah.
- [30:55]
Trent Russell
Well, what else, what else is worrying you relative to LLMs and report writing and maybe audit in general, if you want to take it from that perspective. But if we stick to just report writing, what. Where are your concerns with people doing this? Where they just Go, look, I'm just going to turn on my microphone and talk about what the issue is and then it'll spit out the four or five Cs and this is our template and it's going to put it in there and I'll human in the loop.
- [31:21]
Sarah I James
Can I just say something about the five C's to begin with?
- [31:24]
Trent Russell
I thought if I brought it up, you might have an opinion to share. Yeah, go ahead.
- [31:27]
Sarah I James
Yeah. The five C's is, in my mind, one of the most vexing myths. First of all, standards have never said five Cs. Never, ever, ever, ever. 2018 practice guide never said five Cs, but it's become this sort of, you know, cult of the five Cs. And the real problem I have is when people start with the first C and they think it's criterion or criteria, so singular or plural. And most people in the UK will say a criteria. And that just drives me up the wall. But the problem is if you start with the criteria. So what are the standards or controls you're expecting to see that you're measuring against? I would have to say with the hundreds of teams I've worked with, the only teams I've seen who use the so called 5C's approach, who write useful findings, have heads of audit who've said the criterion or criteria element. No more than two sentences. No more. Because when you ask what are the criteria, you are asking auditors to immediately indulge in one of our favorite pastimes, which is, let me download all the detail I know about this control. And we do it because we were good at detail. It shows how much work we've done. We do it sometimes defensively, as in, you're not going to like the finding, but I really know what I'm talking about. What I see in, I would say 99% of cases is you get 95% of the finding is the criterion or the criteria, and then the observation or the condition is kind of hard to follow. It's passive. The cause or the risk, as I would say, is usually another failed control. It's not really a risk. No, it's consequence. Sorry, consequence for risk. See, this is another thing. If you just say risk, you know, you're talking about risk.
- [33:22]
Trent Russell
I remember I left external, got into internal audit and then There was the five Cs and I had to fill this out and I was like, isn't this and this one the same? I mean it. My over analytical brain just sat there and I was like, what is going on?
- [33:34]
Sarah I James
The five Cs are criteria. Condition, consequence, cause, corrective action. Nowhere mandated in the standards, never have been. So criteria, again, that's just blah, blah, blah. Let's walk through the testing in real time. I don't care. The condition is usually in the passive, so I'm none the wiser about where the control's broken down, the consequence. Because sometimes people put cause first, sometimes put the consequence first. Consequence, what I call risk, is usually a failed control. Cause, as in root cause. They usually leave it out.
- [34:10]
Trent Russell
Or it's not root cause.
- [34:11]
Sarah I James
Yeah, no, exactly. It repeats the condition. Why aren't they doing it? Because they're not doing it. Well, we're no further.
- [34:17]
Trent Russell
Maybe that's where I got confused. Where I was doing. I was like, this is the same thing. I just changed like two words in here.
- [34:21]
Sarah I James
Yeah.
- [34:21]
Trent Russell
Is this right?
- [34:22]
Sarah I James
Most people do that and then the corrective action would be your recommendation or action plan. Whereas if you look at the, the standards, especially GIAs, and if you look at the Global Practice Guide on Final Engagement Communications, which I was on the advisory group of, and I did say with the draft, where there was a huge amount under. What you should do with criteria like this is creating the problem. Keep it short. So if we're going to keep criteria, criteria, condition. So if you look at it, they first put conditions. So say up front what the problem is. You've got your criteria, so what should it look like? I mean, I think it's possible to combine them. So you could say staff are not requesting a second manager signature for payments over $5,000 comma, as required by group policy. Bang, there you go. In one sentence. Then you've got what they call the effect, that's the risk, cause, if possible, and prioritization. Because the standards do not mandate recommendations or action plans. They say recommendations and. Or action plans, if applicable. But they say if you are including recommendations under action plans, they must address the root cause. So, you know, it's one of the many things I encounter where people say we do the five Cs because the standards tell us to. I say they don't. They never have. These are the same people who say we produce a final formal written report because the standards tell us to. They don't. They never have.
- [35:53]
Trent Russell
Have. Okay, yeah. I said earlier the number one question.
- [35:58]
Sarah I James
Sorry, that was a bit of a digression on the first.
- [36:00]
Trent Russell
You're good, you're good. I like it. We, we're, we're going to keep that in there because we haven't really talked about that a ton on the show, and I enjoyed your perspective on it. And I think people are going, if nothing else, they go, oh, yeah, let's just combine those two. We'll keep it short. Yeah, yeah. So I think that's good. I think that's helpful for people to hear. So I like that. But I was asking, you know, the question I was most looking forward to asking you is on the, like, what's the one thing? And then as I'm thinking about this now and the issues that we've talked about relative to LLMs.
- [36:34]
Sarah I James
Yeah.
- [36:35]
Trent Russell
I gotta imagine you are using them. Right. So how. How are you using them for report writing?
- [36:41]
Sarah I James
I don't, because I'm one of the lucky ones. Because I was from a relatively young age, I was taught to structure, to draft, to edit. And I would say by the time I was in high school, it was. It was almost second nature, as in, I had that discipline sort of drilled into me. So I don't use them, but I do experiment with different ones a few times a year just to see what's out there. How is the functionality changing, changing, what's improving, what's not improving, what's getting worse? Just again, to know what's there. I have yet to come out of, say, an experiment and think, you know, actually that would have saved me time to do it using the LLM. So far, with what I'm doing, even with good prompting, I'm getting into multiple iterations and then still doing 80% myself. So it's not something that I see any gain for me from. And also because I personally like the process of thinking. I mean, I berate myself for the fact that I no longer write everything out by hand, because even by writing everything by hand, you're engaging parts of your brain that you're not when you type. And, you know, for decades I would write everything by hand and then, you know, type from the manuscript. And that in itself brought a level of discipline and editing to it. So, no, I don't use it. I also think that as a report writing trainer. Yes, I'm a CIA. I'm an experienced auditor. I'm also a language professional. And you know, my USP is that I actually am a professional writer, copy editor, translator, and the writing and the editing, it's been in two languages for over 30 years. This is what I do. This is a skill I have. And for me to then rely on, on LLMs, and I think the line between using them and relying on them and then becoming dependent on them is very fine. I think would to My mind bring an ethical dimension. You know, how can I honestly help people with their writing which means with their thinking if I'm taking shortcuts that I know will actually, you know, damage my cognitive ability. You know the study from it last year was, was pretty scathing even though they said need to do further research. So you know, my view is for people who think I'm having trouble writing so I need to really outsource it to LLMs. Okay, well in a few months not only will you not be able to write, but you won't even be able to think. But I have a great deal of sympathy for people because of what is happening in the corporate world. I don't know you, you'll have seen Accenture the other week announced that they were going to base promotions on how much LLM use people were able to demonstrate and people who were, as they put it, resistant. And I thought how do you define resistance? Is it somebody saying I'm absolutely not going to even learn anything about this, which I think would be silly or is it somebody saying I've got some serious concerns, I've got some questions, I'd like to know what controls are in place. So people who are resisting are basically going to be moved on. I've used the passive there. So what concerns me is twofold it that I'm seeing at corporate level, even at board level I would say a lack of critical thinking. Total lack of critical thinking. And in a lot of internal audit and risk functions I'm not even seeing people keep abreast of widely reported, you know, security breaches, hacks, other failures that we should know about and we should have controls in place for if we're going to use these. But what I'm hearing at board level is sort of company wide mandates of for instance most common one is you will use copilot for absolutely everything Copilot's available for. So there are no objectives, there are no criteria. It's just you must use it almost for the sake of using it. And one client is it last month or January they were saying, you know, what do we do to push back? Because they were actually a risk function. And they said we have some serious concerns because we don't think it's secure enough. We don't like the way it's being imposed. There isn't enough training, there aren't the controls. But every time we question it, what we're getting back, not just senior manager but board level exco is we have to do it because everyone else is doing it. Otherwise we will lose, you know, market share, we will lose competitive advantage. And that really worries me because what I'm seeing is sort of, I would call and I'm finding it really distasteful, really. It's like a giddy infatuation from people who should know better. And when this Risk team, they were saying, what should we say to them? I said, okay, you're in financial services. What happened less than 20 years ago? I said, you know, look at the number of financial services organizations who were using, you know, collateralized debt obligations and credit default swaps, which in themselves with controls, perfectly legitimate vehicles, but to make, you know, short term, you know, high profit returns get rid of the controls. I said, and that was done because, quote, everyone else is doing it and if we don't do what everyone else is doing, we're going to lose competitive advantage. Look what happened. So that is really worrying me. As I would say, you know, the critical thinking at board level seems to have gone out of the window. It's like a collective corporate midlife crisis where entire boards are like desperately showing off their shiny new fast toys to show they're still with it, they're down with the kids and everything, and they understand tech. And I'm not really falling for it. I mean, one thing that's interesting as well is if we go back to the Accenture piece, if companies say we will only promote people who are using, who are heavy users of large language models, and if indeed MIT's study is correct, what this means is that you're only promoting people who are having ever decreasing cognitive abilities.
- [44:25]
Trent Russell
We probably could have just ended the show right there. That was very, very well made. Point that I'm gonna have to think about later. But with that said, thank you a ton for coming on and sharing that as well as everything else that you shared. Highly recommend people get the book. With that said, I'm going to give the microphone to you, let you take us out. What do you want to leave the audience with?
- [44:48]
Sarah I James
I want to leave the audience with hope for the future, as in we are still in control. You know, you can think your own thoughts and you are capable of articulating your own thoughts. And whichever technology you're using, whether it's pen and paper or a large language model, you're in control. So if you sharpen and retain your critical thinking skills and you use plain language, then you will be on top of things professionally, I would hope personally as well. And you know, you will be able to use the technology that's available and that is doubtless coming, you know, towards us as a tool, as an aid, not being subservient to it. So I would say take that control, fight the good fight and think critically and speak plainly.
- [45:44]
Podcast Host/Producer
Hey everyone, thank you very much for listening to this episode episode of the Audit Podcast.
- [45:47]
Trent Russell
Whatever platform you're listening on right now,
- [45:49]
Podcast Host/Producer
I'm sure there's a subscribe button somewhere so please hit the subscribe button there. If you're listening through itunes or Spotify, feel free to go give us that five star rating. It only took me about 16 seconds to give myself a five star review and it really helps to get future guests to come on the show so we'd really appreciate that. Lastly, be sure to check out the show notes and follow us on all our social media channels, on Instagram, on LinkedIn and on TikTok. Also if interested please sign up for our weekly newsletter from the Audit Podcast.
- [46:17]
Trent Russell
Thank you all. Have a great one.