
Loading summary
A
I've never worked with or worked in an internal audit function that managed to deliver its audit plan properly. In other words, I've always worked in under resourced internal audit functions. So AI allows us to get closer to actually meeting our obligations fully.
B
If you've ever been to a conference and at some point you're like, I didn't really get anything out of that, or I don't have anything practical, tactical to take back and do, that's why we started the Audit analytics and AI conference, because I can empathize. I did the same thing. That's cool. Can you show me how to do it? And so as part of the analytics and AI conference, especially the spring conference that we have on May 20 this year from 9 to 4 Central, it's 9 to 4 Chicago time. We have six presenters, you can get seven CPEs, and it's some of the best presenters that we've had over the five years that we've been doing this conference. So these are the ones that I've seen personally, three of which for sure, I have gone back and watched their recordings, you know, months later to go, I know they did this thing that was really cool. Let me go back and watch it so I can do it too. So there's no way that you won't have something you can actually do relative to analytics and or AI. So some of the fine folks we have coming back, Brittany McKinley, Brian McNally and Val Zappia from Elevations Credit Union, Macy's and Victoria's Secret, respectively, all three of those. I've gone back and watched their sessions from the prior years to see what they did so I could replicate it on my end. And then we have Paul Kerstein and Madeline Novelli from Vulcan Materials and they're going to show you how to use AI to build a central hub of audit intelligence pay paired with a library of reusable AI prompts. So you can. So any auditor on the team can use analytics. We also have multiple people from the Williams Energy audit team. So they have a framework of using AI to do analytics, but then each one prefers different tools. So one person's like, I like Python, so they do theirs in Python. 1 likes R, they do it in R. 1 likes Power BI, they do it in Power BI. They also use data bricks. And so there's some functionality they do in databricks for SQL or even Python in there if they wanted to. So it's one framework that gets applied and everyone kind of interprets it and uses it differently. It's fantastic. And Then the last of our speaker slots, so we have five. The last one we are having to keep a secret for now and hope to be able to tell you as soon as possible what that's going to be.
A
But.
B
But I think we can at least say it's going to be very innovative. All right, like I said, it is May 20, 9 o' clock till 4 o' clock central. You can search Audit Analytics Conference. It should be towards the top, if not the top. You can go to The Audit analytics conference.com links are in the show notes. You can go to my page on LinkedIn. Trent Russell, find me. There's links there if you follow me. It's pretty hard to miss some of the posts that we're going to be putting up for the commerce this year. So this is pretty probably the most excited I've been about this conference since the very first one that we did. All right, hope to see you guys there. Thank you. Hello everybody. Welcome to another episode of the Audit podcast. I'm your host, Trent Russell. Today on the show we have Sandro Boeri. I met Sandro at the Chartered IIA Conference in 2025. So this is the IA UK just in of it like that. And I was emceeing that event and I think it was the first introduction that I made that day or the first thing that they had asked me to do. I forget, but it was pretty early on and I was definitely jet lagged and I just remember going, okay, Bo. Aerie. Boery. Boeri. Boeri. Sandro Boeri. I just want to make sure I got the name right and probably spent 15 minutes saying Boer out loud only to get up on the stage and go, here's Sandro Barry. And then walked off. So I was excited, if nothing else, that I finally got the last name pronunciation correct. But in doing that introduction and meeting Sandro there, even as he was on the stage as the president, he was talking about culture and said something to the effect of, hey, just because, you know, you no longer going to hear from me from this perspective on this stage, I'm still going to be preaching culture. So he's been doing this for a really long time. Many of you know by now that what I've just been calling a culture topical requirement is out. And so we spend some time talking about that, of course, and then we have a real conversation about the threat of irrelevance to the internal audit profession. And I think typically what we hear is it's not AI, it's going to take the auditors it's the auditors that don't know AI. And so we take that a little bit deeper and have, I think, more of a real grounded conversation about the reality of that situation right now. Of course, like I said, we talk about the culture audit, how we should approach that. Sandra has some really good thoughts relative to that. If you have questions about that topical requirement, if you need help with that, Sandro is kind of the guy right now in that space, so I'd highly recommend hitting him up on LinkedIn or some other method if you need to talk through that and get covered there. And that naturally flowed into, okay, if AI is everywhere, then what is our role in internal audit? It's a. A hot topic. Sandro, again, gives a really good answer and we have a really good conversation around that. Sandro is the immediate past president for the Chartered iia. So that's the UK IIA chapter, we can call it. He's also a board member at the European Confederation of Institutes of Internal Auditing, and he's the managing director at Risk Audit Professional Development. So that's his keynotes, that's his training, that's Sandro's. Hey, we need help with topical requirement. Sandro is the guy. Do you have a go to, maybe a favorite, maybe a novel prompt that you're using in Copilot or Claude or Chat GBT or anything else?
A
It's not so much a prompt, Trent, but it's a practice. It's become a religious practice where basically if I get a difficult email or I've had a difficult conversation with somebody, I copy and paste, obviously I delete anything which is secret or data privacy problematic. And I ask ChatGPT, what would you do in my shoes? And do you know what? The conversations never cease to amaze me. It's become my trusted or semi trusted assistant. So it's my little troubleshooter.
B
Is there, without giving away too much, is there more of an example that you could give where you ask that and helped you come to some conclusion without giving?
A
Yeah, I'll give you a very simple example. I'm negotiating with a client. We can take it down option A or option B, but clearly I haven't thought about option C. So I will put the two options in and I will ask chat gbt, tell me, what dilemmas do you see between the two options and just have a conversation. So I would say whenever I'm going into a gray zone, whenever I'm. I'm a little bit uncertain and the consequences are large. So it's whether it's dealing with a client, whether I'm building a training course and I've got to change it from half a day to a day or vice versa. What do I drop? Why do you think I should drop it? I see dangers attached to this, Trent. I mean, when people start talking about, people stop thinking. Yeah, I'm starting to see that's starting to happen. So a little bit of discipline, I think, is quite important. But that's on my to do list for next month. I've.
B
I've recognized the same and started to see a lot of the studies come out about the impact it's having on us with critical thinking, which I think we're already pretty far behind because of social media and addiction to mainstream media mostly. But, yeah, I have to sit there and go, do I really need to put this in here? I mean, it's. You have to think, should I or should I not put this in here for maybe, like, the greater good of my brain, basically. So, yeah, it's, it's. And it's so easy. That's the problem. It's so easy to use.
A
I've been around before computers were invented. I'm slightly exaggerated, so I've probably earned the right to. To treat chat, GBT and AI as. As a luxury. I was around before cell phones were invented. So if I, If I wanted to ask my girlfriend or a lady, would you like to go out with me? Or I had to queue up at a telephone booth, put my money into the booth, and then pick up the phone and make the call. The world's a much easier place now.
B
You mean you just send them a DM on Instagram? I'm curious. What's the. I asked. We had Richard Chambers on a year ago or so, and this might have been something we did with Audit Board. I can't recall where we had the conversation, but Richard's been around also, and we talked about the adoption of AI compared to the adoption of even, like, a personal computer. Like, I would imagine back in the day when you did, like, audit work or something, it was pen and paper, the red pen, that kind of thing. And eventually there was, hey, no, you have to start using this machine, and you have to start using a word processor. Do you recall what that transition was like? Like, was it. Did everybody go, yeah, let's. Let's do it. We're. We're down for it. Or was there kind of a. I don't really want to have to learn this new thing.
A
You had two camps, and so I was in the camp that saw this as a toy to play with a little bit like I see Claude in ChatGPT as a toy to play with. But you did add a lot of cynics. So how do I trust this machine to properly interpret my words? These are the same words you've typed in. How do I know somebody isn't going to change my words and I'm not going to find out about it?
B
I know.
A
Got to bear in mind I was interacting with internal auditors in those days. So, yeah, the. The cynicism, the doubt, the conservatism that was around, that is around today, was around in the 1980s and the 1990s. I just think it's a. It's a feature of the human condition.
B
I've started to. I'm realizing this now. I remember the first external audit engagement that I was on. I had no idea what was going on. I honestly didn't even know what a control was. But I had this evidence and they were like, yeah, test this control, and this is how you do it. And I went, okay, I don't know what a control is, but I'll do what you told me to do. And it was an email, was like part of the evidence. And I went, how do we know this is real? Like, how do I could fake an email? How do we know? And they went, well, we just kind of have to trust that it's right. And so that was, you know, my skepticism even then. And now I think with AI, like you've probably seen on social media, where people can make like fake receipts, fake documents, and they look extremely real. I have a little bit of a concern about the fraud scenarios in that way.
A
Fraud's been around since day one, really. It's just we're using different toys to commit fraud now. I still think we need to be skeptical and, and we need to be less than trusting. And we need to ask the question, why do I think that's valid occasionally? And we need to surround ourselves with people that challenge us to think in a skeptical fashion. All that's changed is the venue and the toys.
B
Got it. You mentioned something I wanted you to speak on a little bit. You mentioned these training courses that you're doing. What are the trainings that you're doing around?
A
So at the moment, I'm obviously heavily involved in training people associated with auditing culture. I'm spending a lot of time helping internal auditors with leadership. I quite like my leadership course. It looks at life through three dimensions. When we think about leadership, we think about leading an organization how do I lead an organization? But I normally start at base one. Before you can lead an organization, you need to understand how to lead yourself. In other words, what are the disciplines that you need to actually understand yourself and put yourself into the best condition that you can be a good leader with other people and an organization. My understanding is the military teaches people how to make their bed first thing in the morning. Because if you can't make your bed, good luck with leading a 250,000 person organization. Yeah, there's a certain truth in that. So leadership and culture are my key areas of training at the moment.
B
Okay, I know. When we've talked off camera, so not during the recording, you mentioned the threat of irrelevance to the profession of internal audit. How it's very real. Share with the listeners your thoughts there and how real you think that is and what we can do to stay relevant.
A
Cost efficiency is everywhere. I live in a continent that's struggling to grow at the moment in Europe. And the easiest way of growing the share price of a company is cutting its cost base. That doesn't involve any creativity or any innovation. So therefore there's greater pressure on every cost center to justify itself. I see the internal audit profession as being quite vulnerable to that challenge. So what value do you add? Well, I provide assurance. Well, what does that mean? Is there anyone else providing assurance? Don't I pay the external auditors to provide me with assurance? And what about that risk manager in that corridor down the road? For all of those reasons, I think we do need to have a pretty good script as to what value we are adding. And I think we're in a profession that's been protected for too long from this cost pressure. And we haven't really learned, obviously I'm massively generalizing trend. We haven't really learned how to pitch and how to defend ourselves and how to answer the question why do we exist? What value do do we add? I think there's the additional threat that artificial intelligence brings along to our profession in the sense that in the past we were quite good at checking samples, looking at populations of data and coming to some conclusions. It's a skill set that we've developed and we're very good at as a profession. But now we've got the AI box that can do it far more effectively than we can. And therefore that raison d' etre is now disappearing. And as internal auditors, for us to say that, well, you know, AI hallucinates and is unreliable, well, have you ever met an internal auditor that doesn't hallucinate and is totally reliable. So I think there's a very real threat and I'm delighted that Global's 2035 document focuses on this. But I do think we've got an awful lot more work to do in working out well how do we respond to this particular threat.
B
And so certainly the 1:1 solution that is to make sure folks understand the value that we add. I think you put it as pitch and defend. And there was a cae. I don't think we got it recorded. I think it was after the fact or maybe just some random one off I was talking to. But I asked somebody might have been during like our pre interview personal process for this show. So we don't have it recorded. But I asked the CA one time of a Fortune 500 organization, like what skill do there a veteran CAE, one that I have a ton of respect for, just really good. It's a really good ca. And I said like what? You know, what skill set do we need do do you see missing? Would you give advice to other CAEs aspiring veteran otherwise? And pretty bluntly he said sells. He's like, we don't. We're not good at selling ourselves and we need to be better at doing that. Is that kind of what you're getting at also?
A
Yes, but I think there's something else that to me is quite profound. I actually think we need to transition from the product that we have to a product that I think is a lot more valuable. Let me explain what I mean. Our current core product is to provide assurance as to what has happened historically in the recent past and what does it mean going forward. But we are, our product is heavily focused on hindsight. In the new global internal audit standards. The word foresight has been thrown in. But what does that practically mean? I actually believe we need to develop our product into a product that, that is more of a trusted advisor, trusted concier type product. Last week I think Robert Duval died. I don't know how many of your listeners can remember the Godfather films.
B
I would assume if they haven't seen it, they should at least know it by name.
A
They should certainly look at it because to me there is, to me there's the model for our profession going forward. And by the way, I'm not saying that we should be the intern lawlessness to the mafia. But what I am saying, if you look at the trusted advisor as represented by Robert Duval to Don Corleone, number one, he had an independent mindset and that came from his training as a Lawyer. So this was a guy that could argue left or right, back or forwards. Whatever you argued, he could argue against you in a. From a very objective standpoint. Number two, he understood the business inside out. But number three, which I think is the most important, he was present when decisions were being made. One of my keynote speeches is called Internal Audit. Making a Strategic Impact talks about the concept of decision risk. If you look at some of the great organizations that have failed, they didn't fail because they didn't have policies or procedures. They had plenty of policies and procedures. They failed because there was some form of poor decision made at a critical point in time. And I think as internal auditors, we need to be metaphorically in the room and from an independent standpoint, using the data that we have, using our view of what might happen in the future, contributing to that decision, that, to me, gets us into a position of absolute value if we can transition our product accordingly. I think what I've said is totally compliant with the global Internal audit standards, by the way.
B
Okay, is it fair to say that that's on the CAE then? And if so, then what's the role of everyone else on the team?
A
I think it's on everybody. So I think it's on everybody to understand the process flowchart in the organization, to actually plot where is the decision point, then to look at the whole choreography that leads to that decision point. And then it's incumbent on every single member of the team to try and work out how do I influence that decision before it's too late. So obviously it's on the CAE to set the tone and set the climate in which people can behave in that fashion. But the devil is in the detail. I mean, key decisions in an organization are not only made in the boardroom, they're made sometimes at the ground floor level in the organization. So you only realize their key decisions after the event.
B
Okay. I think you've mentioned culture already, and that's an area where you've really hung out. I think it was at the Chartered IA conference that I was at where we first met. And that was the first time I'd met you. And there was something you had said on the stage about. So you were rolling off as president. Right. And you said something to the effect of, but I'm still going to be pushing the culture audits, or I'm still the culture audit guy or something like that. But it made it seem like, no, I've been preaching this for a really, really long time. And just because I'm no longer in this position doesn't mean that's going to stop. That's what I've always believed in. So with that, and I'm going to broadly call the topical requirement around this just the culture one. I know there's. I'll let you fix that for me. But how should. Since that is a topical requirement that people are really talking about, it's relatively new, I think it came out last month as of the time of this recording. How should internal audit approach those assessments? Is it so the.
A
Let me say a few things about this particular topical requirement because it's the third that's been published. The first one on cyber and the second one on third parties is our topical requirements that are reflecting market practice. This one is seeking to lead market practice. So for me, I've got nothing but praise for the global IIA in taking this particular position. Maybe that I've been partially involved helps me say that. So it's not asking us to conduct an audit of culture. It's asking us to recognize that there's something called behavioral risk. Which is what? It's the risk of behavior which is misaligned in relation to strategic objectives. If you accept that concept exists and it's important and it's significant, then surely an organization should be managing behavioral risk, should be mitigating behavioral risk. And what the topical requirement argues is there are certain control themes, what I like to call control pressure points, that we should focus on using traditional risk based audit methodologies. We should focus on challenging whether these key controls are properly designed and operating effectively. Now the whole argument is the topical requirements should be embedded in the day to day work. Can I bore you a little bit more?
B
Yeah, please, please. That's what I was looking for. We go for boredom on this show
A
if we focus on. So behavioral science tells us that there are many, many activities that influence the way human beings behave. But we wanted to focus on 5, 5 activities that do not require you to be an organizational psychologist, psychiatrist or psych, anything. So hiring, training, communications, consequences, incentives and disincentives and remediations. They're the five control pressure points. So what we're asking internal auditors to do is to embed the review of controls on hiring, training, comms, incentives and remediation into their day to day work in the most efficient way possible. So a traditional audit of hr, traditional audit of any business gives you the opportunity to look at the design, but certainly the operating effectiveness of these key controls. The most courageous thing the topical requirement is asking you to do is to look at governance of behavioural risk. So from the 15th of December, that raises the following possibility. If you can't find any evidence that the organization is managing behavioral risk and you believe behavioural risk is significant, then to be compliant with the global internal audit standards, you have to raise an audit finding that simply says, I could find no evidence that the organization is managing the single largest business risk the organization is running. Clearly, I wouldn't word it.
B
Could you give an example of what one of those would be like? A what a finding might be?
A
Yeah, so finding might be. And this would probably not pass the Sarah James test, but a finding would probably read, we reviewed the, the organization's risk taxonomy and we could find no reference to the risk of inappropriate or misaligned behavior, which is probably what most
B
people are going to see would be my expectation.
A
And I in the webinars I've been running, I've been saying, look, I believe, I know that some of the world's largest financial services institutions do not recognize behavioral risk and therefore, by extension, do not manage behavioral risk. And these are the same institutions that almost blew our economies up in 2007 and 2008. So that's going to take a degree of courage. But I'm hoping, given the compulsion that the topical requirement creates, we'd rather comply than not raise that finding. But I realize it's easy for me to say that on a Friday afternoon
B
here, but the thing that just popped in my head, so I'll rephrase it. The thing that popped in my head when we were talking about this is I feel like Caesar audit leadership might go when it comes to maybe reporting on some of these findings, like if we use that example, and they might go, hey, sorry, this is a topical requirement. I have to do this as opposed to. No, I believe in this, that like, I think we need to be likely better at selling. Why this is really important and understanding why this topical requirement is in place.
A
I. You said something interesting a moment ago. You said that as internal auditors, we're not very good at selling. I do believe we need to sell this concept. What does that mean in practical terms? I think in practical terms it means, look, we are developing the way we audit in a way that we're going to be able to give you a better insight as to why certain control processes are failing. They could be due to a hiring problem, a training problem, a consequences problem, and so, and so on. So our methodology. And by the way, I wouldn't even mention the topical requirement to anyone other than the chair of the audit committee. So we are going to get better at telling you why things are failing and actually telling you what I think you can do about it. As time goes on, I suspect behavioral science will become a mainstream discipline in every internal audit function and we're actually going to get better at doing deep dives where there are real pressure points in an organization to understand why people behave the way they behave. So I would be selling it as, look, this is an evolution in our profession. Just as risk modeling was an evolution, just as the use of spreadsheets were an evolution, this is a natural evolution. I certainly wouldn't be talking about topical requirements or global internal audit standards. That's a passion killer and will not help us in any conversation with senior management.
B
That's kind of how I was envisioning it also. So thank you for saying it's significantly better than I was attempting to. I know again we've talked off air about this, but the idea that AI is here, you kind of alluded to it earlier in cost reduction pressure coming especially for cost centers, which internal audit is a call center. So let's say today that, that, well, it is here, but let's say it's, it's widespread being used within majority of internal audit departments where hey, here's our pbc, here's our lead sheet. We're going to throw it into this AI tool. It's going to do all the ticking and tying and testing and I just need someone that can basically review and act as the senior or the manager now staff, good luck. If that is the. If that is going to be the case, which it seems likely, although it's scary and you still don't really hear a ton of conversation around it. What do you feel like the skills that are going to be needed to enter the profession going forward? If and all likely when that is the case.
A
So I see a number of impacts of AI, but can I start in what I hope is a reassuring position, which is I've never worked with or worked in an internal audit function that managed to deliver its audit plan properly. In other words, I've always worked in under resourced internal audit functions. So AI allows us to get closer to actually meeting our obligations fully. That's, that's a positive. So impact number one, it's going to be easier to automate mundane, repetitive work in internal audit. So if we believe that's not going to have an impact on more junior members in internal audit, we're kidding ourselves. Why, why would we be immune to what is happening in the rest of the planet at this point in time. But what it does mean is there will be a premium on people that understand how AI works, understand how to code AI and interface with an organization's systems, understand how to prompt properly and understand how to analyze properly. So that critical human interactive skill with the box is going to be for me, heavily prized. Secondly, I do believe that where audit functions might be losing people at the more junior level, there'll be an opportunity to hire more experienced people at more senior level who can bring their expertise and insights to actually bear and actually help us to be able to have that consigliere conversation more effectively. So I, I do see a massive impact on the talent pipelines in our profession, a change in talent pipelines. I get quite frustrated when the only approach of an institute is to go to universities to sell internal audit, because I think we might be selling internal audit in, in the wrong places going forward. I think we need to be selling internal audit now where we have experienced managers, experienced operative, experienced human beings. I think we're going to be exposed a lot more to the people dimensions. AI is going to give us much deeper, more powerful insights as to what's going on in our organizations, which means we're going to have much more important and explosive information at our fingertips. Well, we're going to have to get better at knowing how to influence people with that explosive information. So there is a technological challenge, there is a people challenge, and we're going to be changing, I believe, the demographics of our profession. How quickly will this happen? I think it's going to happen very quickly.
B
Yeah. I think in the next couple of years, from what I've seen on the AI front, that actually works and is actually here. And some of the use cases that I've heard from certain teams, it's not widespread, but I'll find a pocket of a team every now and again and go, that's, that's really good. That's going to change things once everybody else is on that same boat.
A
I know we keep on talking that there's potentially there's going to be an AI bust. And you know, there's some signs this week that maybe it's in the stock market, maybe.
B
Yeah.
A
But even if we have a massive stock market crash, I don't see us going backwards. I mean, if we go back to the Internet boom and bust. The Internet was there at the turn of the century and the Internet was there after the, the, the Internet bust. And then obviously it grew again, but in a more measured fashion. That's what I believe is going to happen with AI. So the tools we're starting to use, they're not going away.
B
I'm not a market predictor, but if there is a bust, do you think that's where you could look at it as a leader in an organization and go, okay, now let's replace people with AI? Now we feel like we have to. Is that something you see as likely or most probable scenario coming out of that?
A
Yes, because if there is a bust, it's going to hurt budgets and pockets more generally, which means it's going to cause even more of a focus on added value from resources. And the tools exist and the tools are relatively cheap to actually replace repetitive human labor with a computer system. And yeah, and you said scary world or world. Do I now say that one time, a scary world? Or is it just this is the world we live in and have always lived in, frankly?
B
Is the, the key there? Then you mentioned influence. If you were saying like, hey, what skills do you need to be okay in your job in the future? Maybe is it like, hey, learn how to influence? And by that I mean there are master courses on, you know, like a masterclass on influence. There's so many books on how to influence. I think that one of the first books I read was how to Influence. I have to look up the name of it, how to Influence People. And I'll look up the title here in a second. I'm horrible with book titles and authors, but would you. Is that some advice, Guidance you would give is like, go learn how to do that. The resources are out there.
A
Oh, I think. Let me try and segment that into a number of bits and pieces. Where are my bricks? Segment one is this. So this, this is one representation of the human character. In other words, am I dealing with a fiery red person, the sort of person that basically has got hurry up syndrome, as I call it, or am I dealing with cool blue, the sort of person that's very data orientated. So an understanding of the type of human being that I'm trying to influence is, is critical. Secondly, the second box for me is human, sorry, emotional intelligence. Understanding what triggers different human beings is quite important. And then the third box is the critical thinking box. As internal auditors, we love black and white. We love grading stuff. I've worked in organizations where I've spent more time arguing over an audit report grade than the substance of that grade. We need to get better about debating the gray zone because ultimately, let's go back to decision risk. It's not about black and white. It's about understanding what am I going to do in a world of dilemmas. As auditors, we need to be better at balancing black versus white and gray and contributing to a discussion with the benefit of our independent structures and objective mindsets.
B
If I can give two kind of tactical for those that are listening, one being a disc D I S DIS profile. If you take that assessment there, you can find them for free online. I think even at one point, like, if you, like, signed up for some kind of Tony Robbins thing, he would like, you could do a disc profile on there. But it'll tell you if you're a D and I an S or a C, and if you're high in one and low in another one. And I'm not going to go into the details of it, I am. I'm definitely not the D. I think I'm high S and high C. It's been a while since I've taken it, but, like, I know someone who gives those assessments, and within, like, 20 minutes of talking to her, she's like, take the assessment so we can understand a little better. But she's like, you're this and this. Like, I already know it's it. It doesn't. Especially to know, like, if you're a D or not. You can pick up on those people pretty quick. And so for those that are curious, a D is typically somebody who, like, if you get on a call with them and you schedule 30 minutes, you might be on there for 10 minutes because they're going to go, here's my question. What's the answer? Here's my question. What's the answer? All right, cool. Have a good day. Not that they're unfriendly, but they just want to get to the point. And sometimes. Those are fantastic. Oh, my God, those are so nice to have. Sometimes when it's just been a long day and they just go, what's the answer to this question? All right, have a good day. You know, so. But you understand people's disk profiles, and in that way you can learn how to communicate better with them. And you're using this illustration of the various blocks that you have here. Red and blue, yellow, green.
A
I lead with fiery red energy. And this brick says, be brief, be bright, be God.
B
Okay, well, I've noticed in your answer so far, they've been like, yeah, yeah, yeah, and to the point and very on point, whereas I tend to go on tangent. So I'm again pointing back to I'm not the red brick. I'm not the d. If I. I've
A
got this yellow problem, which in internal audit's quite. I don't know what I'm doing in internal audit. Yellow is the creative energy, the salesy energy. And I have worked in certain internal audit shops where that yellow energy is almost frowned upon. I think now, and I would say that it's a critical color energy because it's, it's the language of relationship management and sales. And by the way, I don't want to. I don't want to de. Minimize the blue. The blue is the, the color of analytics. Unfortunately for me, it's never been my strong suit. But we need, we need all sorts in our profession.
B
What's the green? Because the way you're talking, I'm blue and yellow, which would make me green.
A
Technically, green is show me you care. So green's an interesting energy. Green cares about the way other people are treated. So if, if other people are treated unfairly, green gets very anxious and can get very stubborn. I call it Gret. Greta Thunberg energy. It's. She. She's the living Persona of Earth green energy.
B
Got it. As you're describing that, there's someone we've had on the show and she popped in my head immediately. So I'm going to send her a message after this and go, hey, you're. You're the green. If you listen to this episode, you're the green. Okay. I said I was horrible with titles of books and the one I was trying to think of. And I know if there's any executive coaches, CAE coaches, anyone in that professional coaching world that's listening to this, they know the book. And I'm sure they're just like screaming at their listeners in the car like, the name of the book is. And it's how to Win Friends and Influence People by Dale Carnegie, which is like one of the most famous, you know, business books we can say ever. And so to. To just completely screw the pooch on getting the name of that book. I could imagine there's people going, how do you. Come on, man, you got to know the name of that one. But anyway, so for those that are interested, that is a really good resource. It tells you exactly, you know, the point of the book is exactly in the title. I recall reading that years ago and I highlighted a ton. There's a lot of good practical advice in there. So I do recommend that based on the conversation, we. I appreciate a to the point conversation and the redness that you showed, definitely you illustrated it. So with that said I'm interested see how we close this thing out. I'm going to give the microphone to you and let you lead us out. What message do you want to leave with the audience?
A
Well, you, you only live one life and as, as I get to the age of 65, I'm it's becoming more obvious that you only lead one life. So I, I really hope Trent to be able to interact with as many people as you're interacting with. So I'm hoping to see some of you listening to me on a stage. Keynote speaking seems to be my calling at the moment. So if you want to come and listen to culture eat strategy for breakfast. So what? That's my one of my keynote speech. Or you want to come and listen to how internal audit can make a strategic impact. I'd love to see you. So come and see me on a stage. Come and see my theater production on orders in culture and we can surely make sure that we're living our life in the best way possible. It's been a pleasure. Thank you.
B
Hey everyone, thank you very much for listening to this episode of the Audit Podcast. Whatever platform you're listening on right now, I'm sure there's a subscribe button somewhere, so please hit the subscribe button there. If you're listening through itunes or Spotify, feel free to go give us that five star rating. It only took me about 16 seconds to give myself a five five star review and it really helps to get future guests to come on the show, so we'd really appreciate that. Lastly, be sure to check out the show notes and follow us on all our social media channels, on Instagram, on LinkedIn and on TikTok. Also, if interested, please sign up for our weekly newsletter from the Audit Podcast. Thank you all. Have a great one.
Ep 283: Topical Requirement: Organizational Behavior w/ Sandro Boeri
Host: Trent Russell
Guest: Sandro Boeri (Chartered Institute of Internal Auditors, Immediate Past President)
Date: April 28, 2026
This episode focuses on the newest topical requirement around "organizational behavior" (culture) for internal auditors, recently issued by the Global IIA. Trent Russell and Sandro Boeri discuss how internal auditors should approach culture audit requirements, the profession's threat of irrelevance in the age of AI, and the essential skills for auditors moving forward. Sandro offers candid insights from his decades in the field, including thoughts on leadership, audit evolution, and how to "sell" internal audit’s value in a rapidly changing environment.
"It's not asking us to conduct an audit of culture. It's asking us to recognize that there's something called behavioral risk...and what the topical requirement argues is there are certain control themes, what I like to call control pressure points, that we should focus on."
— Sandro Boeri (21:23)
"Our product is heavily focused on hindsight. In the new global internal audit standards the word foresight has been thrown in. But what does that practically mean? I actually believe we need to develop our product into a product that...is more of a trusted advisor, trusted concier type product."
— Sandro Boeri (16:38)
"I've always worked in under resourced internal audit functions. So AI allows us to get closer to actually meeting our obligations fully. That's a positive."
— Sandro Boeri (28:58)
"If we believe that's not going to have an impact on more junior members in internal audit, we're kidding ourselves. Why, why would we be immune to what is happening in the rest of the planet?"
— Sandro Boeri (28:58)
"An understanding of the type of human being that I'm trying to influence is critical. Secondly...emotional intelligence. Understanding what triggers different human beings is quite important. And then the third box is the critical thinking box."
— Sandro Boeri (34:45)
"As auditors, we need to be better at balancing black versus white and gray and contributing to a discussion with the benefit of our independent structures and objective mindsets."
— Sandro Boeri (35:54)
Metaphor of the Consigliere
Sandro likens the future audit role to Tom Hagen in The Godfather—a trusted, independent advisor who is present when decisions are made:
“He was present when decisions were being made ... contributing to that decision. That, to me, gets us into a position of absolute value if we can transition our product accordingly.”
— Sandro Boeri (17:43–19:21)
On Generational Change with Technology
"I've been around before computers were invented. I'm slightly exaggerated, so I've probably earned the right to...treat chat, GBT and AI as...a luxury. I was around before cell phones were invented..." — Sandro Boeri (8:25)
On Value of Skepticism
"Fraud's been around since day one, really. It's just we're using different toys to commit fraud now. I still think we need to be skeptical and, and we need to be less than trusting." — Sandro Boeri (11:15)
Sandro leaves listeners with a personal note:
"You only live one life...it's been a pleasure. Thank you." (40:32)
Summary prepared for listeners who missed the episode, with all central topics, highlights, and actionable insights captured.