Loading summary
Transcript38 lines
- [00:00]
A
Foreign
- [00:04]
B
this episode is brought to you by Green Skies analytics, an audit analytics service provider that works with internal audit departments that have data analysts and are still frustrated with trying to make analytics actually work, aren't getting the expected roi, who can't break through the communication barrier between the analyst and the audit team and those that need experience, direction through an audit analytics strategy and process. Those that feel like they've wasted time and money on trainings aren't getting the value they want, not prioritizing the highest risk, scariest for the organizations, or have projects that seemingly never get completed. Do you deal with any of that? If you do, go to the Show Notes of this episode and click the Green Skies analytics link or go to greenskiesanalytics.com to schedule a call and understand how Green Skies analytics makes analytics actually work for internal audit hello everybody.
- [00:51]
A
Welcome to another episode of the Audit Podcast. I'm your host Trent Russell and today on the show we have Danielle Ritter. Danielle formerly led the internal audit team at Instacart and now she leads a team at GitLab, which is one of the reasons we wanted to have her on. Reached out to her shortly after she joined GitLab to understand and what we want to talk about on the show. What was priority one for you on day one at GitLab as the CAE, what the next 99 days look like? What advice would you give others who are coming into a similar situation? I think it can also be helpful for CAEs to think about how they could prioritize even if they've been in any given area for five years or whatever the case is. And Danielle also shares how she has her team building relationships within the organization, something that we talk about a ton on the show. It's usually at like a CAE level, but Danielle has some practical, tactical ways of having her team build relationships within the organization also. So we definitely want to hit on that. And then a bit of a hot topic right now is all right, AI's here. How are you coaching your staff to be ready as an internal auditor in the age of AI? With that said, here we go. All right, Danielle, the question we've been asking I think for pretty much every guest for like two years now, AI use cases for you. How are you using it in your personal life and how are you using it professionally?
- [02:18]
C
Also, I used it in my personal life to do some tax loss harvesting strategy for some RSU stock stock options that I had granted my last company. The stock had been fluctuating a bit at the end of the year I realized I had sold a bunch was going to have a big tax bill. So I let ChatGPT help me figure out how much I should sell at a loss so that I could reduce my, my tax liability at the end of the year. So that was kind of fun to, to have that help me do that. I just got access to Claude cowork at my company, so that's been a huge game changer personally as well. My two daughters, their school calendars came out last week for next school year and you know, it just magically posted calendar invites in my calendar for every single day. I needed to remember the kids don't have school, which I think is going to be a game changer because in the past I'd forget and be like, oh shoot, the kids don't have school on Monday. What do we do? Well, now it's all in my calendar.
- [03:13]
A
I probably, I mean there are days where like the mornings of I'll wake up, go about my day, check email, and there's literally 30 to 50 calendar invites and I, I just start to freak out like what is going on? And then notice, of course it's that time of year. They're all for my wife. It's, it's always during like summer camp season for kids or like you said, the new schedule comes out for school and everything's blocked. The new schedule comes out for the gym. Here's all the dates for that. And so yeah, that's, that one's going to be big at the Russell household.
- [03:46]
C
Schedules start coming out and stuff. Right. That was just like such a time savings from an admin standpoint.
- [03:52]
A
Yeah. Cause you used to have to like, even you could get on like Gmail. You could go and find like federal holidays and download those to your calendar. Like we would always download the Alabama football schedule to the calendar. So we knew what was going on there. So yeah, that's made that significantly easier. Okay, perfect.
- [04:10]
C
Yeah. Yeah. Then I would say work wise, I mean I've been using it a ton of. We're just now starting to run metrics on our usage both within. We use Claude at GitLab, so Claude usage as well as we use glean for our internal searches and I'm happy to report I personally am up there and the champion status of usage of Claude internally. Like I said, we just got Cowork turned on. So I really view that as gonna be a game changer as we're really trying to build some agents to help us test things related to either our SOX controls testing and, or just recurring, you know, audit insights that we want to gain. But you know, Creighton PowerPoint decks, that has been just a game changer realizing that it can do that as well as I really view it as kind of my, my chief of staff, my, my right hand person. Like I ask it questions, hey, I'm thinking about this. What do you think? It's learned me and is really just a sounding board for, you know, thinking through how I want to talk through stuff as well as present things. And you know, I, I feel like it's, everyone should be using it every single day.
- [05:17]
A
I heard you said the word insight. And then also there's some efficiency kind of things that I'm hearing in there also. How, how are you balancing like from the CAE level, the strategy and approach with AI relative to do we spend more time on insight gains? Do we spend more time on efficiency gains? You know what I mean? Like relative to the use cases for AI, I hear different things from different audit leaders. I was curious where your head goes.
- [05:46]
C
I think it's should be really both. I haven't necessarily thought like is it a 50, 50 split? Is it a 2575? As you asked me that question. I mean, to me the insights have been there as far as the tooling that I've had access to and the last couple of jobs I've had over the, over the last couple of years. And so I think that's the more natural place that myself and my team members have been using it. But I do think as the technology has evolved, gosh, even in the last six weeks, 10 weeks, couple of months, it's moving so fast that getting to that efficiency play and actually being able to use it to automate things, to actually then get the insights is going to continue to be a game changer. I keep using that word, but I really think it is and it's, it's in a really exciting time to be working in the technology industry with technology because it's changing so quickly that it's really fun to play around with and be a part of.
- [06:48]
A
One of the main reasons I wanted to have you on was because I know you've been a CAE for multiple years, multiple companies, and so I wanted to get, for the audience's sake, kind of like what your first hundred days as a CAE were like, what was your number one priority? What, what did day 99 look like? So any, maybe a way to say this is any aspiring CAE, anyone who is maybe still within their first 100 days like, what would you advice you would give them? Like, day one, make sure you get this done or you have this meeting or you talk to this person or whatever the case is, and then kind of your priorities from there.
- [07:28]
C
Yeah, yeah, I'd love to share that with the audience. Day one, I would summarize that as listen and learn. Right. Just understand from stakeholders what's the perception of internal audit? What's their experience in working with internal audit? What do they want from internal audit? That's really insightful information to have as you kind of form your strategy. Building relationships is another thing that was a key priority from day one. Over the first couple weeks, thankfully, my team was great and kind of gave me the laundry list of folks that they felt I needed to meet with right away. Really build those relationships. Relationships are key in everything we do. I think it's really important for people to see the human side of me, for me to see the human side of my peers and to build that relationship so that when we need to have a difficult conversation or I need that relationship in order to be productive, it's there and established and we can have a professional working conversation, you know, on topics that we would need those relationships for. Without those relationships, it's so much harder to pick up the phone and call someone, be like, hey, I need something for you, or hey, like mic drop. I see this risk. What do you think about it? Right. I think having that was critical. I would also say focusing on getting to know my team. In addition to the stakeholders, the team's really important to know, like, what are their perspectives, what are their ambitions? What do they want internal audits to be known for and what do we want to change? And being able to have both those perspectives helps you down the road with the strategy, bridging the team's perspectives along with the stakeholders perspectives and also the audit committee. Right. Establishing that understanding from the audit committee chair, what are they seeing? What do they want me to dig into? And bringing all that together, you know, really, really helps me shape the strategy that I wanted to build. I would say at 30 days of being at my company, at 60 days of being with the company, I pulled together what's Danielle's perception and what are my perspectives? I shared that with our cfo, I shared that with my peers. I shared parts of that with the audit committee chair. As far as, do I have this right? What am I missing? What other insights do they want to share? Did it trigger any thoughts that I should know? And I also shared it with my team for the Same reason. So they could see where my head was at and where I was really trying to go to onboard and frame how we wanted to operate going forward. I also really looked for quick wins and wanting to make sure that I could show the impact that I could make to really establish that credibility up front and begin to bring that all together.
- [10:12]
A
Maybe the answer to this is get the quick wins. But I know there's people who started as C and they think, okay, C suite, hey, cfo, let's talk CEO, let's talk CEO. Like whoever, like, let's talk. And they kind of, maybe they don't get the response they're expecting and they don't get the time that they were expecting to have. Do you have any advice? You know, it's almost like if someone just cold emails you to sell something, like that's almost the vibe that I've gotten from CIEs who have talked to me about this issue. Is it like, maybe what guidance would you give them to be able to get in front of those folks that they need to get in front of? Is maybe it is, hey, try to wrangle up some quick wins, you know, and then you can go like, hey, look great, how great and wonderful you are now. Can you like, respect our time and, and have the conversation that needs to be had for us to be most effective in audit?
- [11:01]
C
I think the quick wins absolutely do that. I would say another piece of advice I have is like, get a sense for that during your interview process. Right? Like if you're looking to take a job as a cae, I think really understanding what is the perception of audit, you know, you'll definitely probably interview with the CEO or the chief legal officer, depending on kind of where audit audit rolls up to, you know, a lot of times at a CAE level, the CEO also wants to interview you before, you know, a hiring decision is made. And I think asking those questions to really get a sense of what does the company really think about internal audit. Right. And if it's a newer company, like I was at a pre IPO company before I'm, you know, before I joined GitLab and that was a little different because people had never really worked with internal audit before. It was all people first time in their roles. And you know, we were all kind of figuring, figuring that out together. But I do think at least understanding or trying to get a perception of what the C suites like attitude and culture and like perception of internal audit is, is really helpful because if during that interview process you get a sense of like, well, they don't actually think it's important, like maybe it's not the right fit for, for the role that you want. So I, I would say that is absolutely something to think about. But even if you can't get the time with the C Suite, go to their directs, right? Like, I think those are the folks that you're going to be working with day in and day out. And I think going to the idea of quick wins, I think also establishing that credibility with their right hand folks. Right. And helping those people understand and building a relationship with them, getting their perspective actually helps you form an opinion and a perspective that you can bring to the C Suite when you actually are able to get time with them. And so in some regards there could be a good strategy to think about of meeting with some of their deputies first to have a perspective and opinion so that that conversation you would have with the C suite is actually fruitful versus you going in cold without any insight that you can kind of piece together from their perspectives and what you're sharing with them.
- [13:10]
A
I appreciate that. I know there's people listening that appreciate that also because it is a problem that people have. So thank you for sharing that for those quick wins. Sure. They had to have actually added value for, for them to matter. And I know you talk about audit must bring value to the organization. How do you define value? Is it just a feeling? Do you. I wouldn't imagine there's a quantitative way. I mean, I guess you could on we saved X amount of dollars, we found X amount of fraud or something. But like how do you quantify value? Because we talk about value and internal audit all the time. Add value, add value, add value. What is, what is your definition? What does that mean to you?
- [13:48]
C
To me, at the end of the day, I want an auditee to say yes, working with audit on this project was worth my time. Yes, the recommendations and the observations they raise are valid and I actually agree with them and they're at the right level that I'm going to actually take their recommendations and put them in place. I think also from a value standpoint, audit brings value to the governance function. Right. Like, we really need to make sure that we're covering out the top risks of the organization to support the audit committee's role for the oversight of risks to the organization. And so focusing audit plans on the highest risk areas to the organization in itself creates value because you provide that coverage through the governance that it brings. But really, as I was working through my team going back to first 99 days is also defining the mission, the vision, kind of the operating principles, and the way that I wanted my team to show up and what we wanted to be known for. And my vision is like, I want people knocking on the door of my, you know, virtual office for. For insights. And I think if that happens, like you're. You've reached that value providing place because people want your input and they want your perspective on things without it being something that. That's on the Otto plan.
- [15:11]
A
I like the way that if I summarize that, that Norman Marks has said it in the past. He said when he gets a thank, like a genuine thank you, like an audit leader, he's like, yep, we did good. That's a good one. And I don't know if he talked about tracking that as an actual KPI. I feel like maybe he did, but maybe just for himself. But anyway, I always liked that and went, yeah, that's a really good. I feel the same way client work that we do. And they're like, my God, thank you. You go, oh, yeah, we did it. Right? We did a good job. So totally.
- [15:37]
C
I mean, it makes you feel good that you're actually doing stuff that's worth your time. It brings job satisfaction to your team. On the topic of KPIs, I was actually just going through our list of KPIs. We're a January year end, and so we're kind of in Q1 still. And one of the things we wanted to do in Q1 was to really relook at what are the KPIs that we want to monitor our audit function in. In the fiscal year. And we do send out an audit survey after we complete an audit. And I just looked at what that looked like, and we shifted the questions a little bit to answer the question, like, was this worth your time? Right. Did we bring valuable insights? So that's also how I would be able to like quantify that value a little bit. The results of that post engagement survey from. From our stakeholders.
- [16:21]
A
Okay. I like having that. Those two specific questions in there mainly, was this a waste of your time or not? I think that's a really good one. It's just a good question to ask, I think.
- [16:32]
C
Yeah. Yeah. And it's right. If they say yes, right. Then it's like, okay, well, why? Right. Let's figure out what could we do differently? Because certainly want the answer to be yes.
- [16:40]
A
It was worth your time and similar question. But like, how do you decide what goes to the board versus what doesn't? And I know people talk about give them what they need when it matters and all that kind of good stuff. How do you decide? Is that another gut feeling or is that, hey, we gotta thank you on this, so that's what goes there or what, how do you decide?
- [17:00]
C
Yeah, I mean, I would say I go with my gut more. The company I work for is still a pretty developing company. It's only been public for, for a couple years. I'm also still settling in, in my role, but because of the stage of the company that we're at, our board is, is pretty involved. And so I've taken the strategy that if something is important enough to be in my audit plan, it should at least get some level of written update to the, the audit committee. You know, I'll put the executive summaries of my audits in, in my audit materials for them to have visibility to, you know, audits with, you know, medium or higher risk observations. I am taking the strategy that I will summarize what the business impact of the observations are that we saw in the audit committee meeting. I won't go into every single, you know, there were four high risk findings and go through each one of those. But at least like the TLDR of what's the business impact that the audit committee should know. Absolutely think that that's critical, that they should hear that. And that's my role to, to communicate that. You know, if I think about even advisory work that we do, I will absolutely let them know the work that we're doing so that they have visibility and potentially they have input on areas that they'd like us to look at. We don't share the audit or, sorry, the advisory observations per se with the audit committee. But if it's a big risk, like I will share the business impact of the work we did and how we helped, you know, move that and improve the operations there. Because I think it's important for them to understand the work that we're doing and where the investment in audit is spending their time. And also going back to that value that I want to make sure that they're seeing that we bring to the organization. And then I also, you know, I meet with my audit committee chair about monthly. We're both, I'm new, he's new as the audit committee chair. And so we've agreed we'll meet, you know, on a monthly basis, which gives me an opportunity to, to discuss with him in more detail, you know, what we're, what we're seeing through our audit work as opposed to formal audit reporting.
- [19:01]
A
I don't want to bring it back to relationships because I know you have a tactical way of doing this within your team. And so, like, we talk relationships on the show all the time and I try to get down to the tactical, practical. How do you do this? If it's like I make sure every two weeks that I send a note to somebody that's on this list of people I need to maintain a relationship with or something like that. Whatever. I mean, whatever. There's no shortage of ideas there. But I did want you to share with the audience how you are helping your team build relationships within the organization.
- [19:39]
C
I'd love to share that. This is somewhat new for my team since I've been here, so I've really had to challenge them and also guide them and help them understand the importance of that. I think that it's critical for us to have relationships at all levels of the organization to help us gather, you know, risk intelligence and make sure that we're really focusing our audit areas on, on stuff that matters to, to kind of help coach them and kind of build that muscle. Earlier this year, I gamified it. We did a coffee chat challenge. I said, hey, whoever goes out and has the most coffee chats over this month period, we're going to give know gift card to, to our swag store. Whoever brings back the most insightful piece of information that actually allows us to adjust our, our audit program. Also going to give you, you know, a swag certificate and I reserve the right to. You like that one?
- [20:31]
A
Yeah, that's really good. I've not heard that. That's good.
- [20:33]
C
Yeah, yeah, insightful. Because, I mean, it's one thing to go out and have conversations, but like, the objective of the meetings is to, to gather risk intelligence and share perspectives and help them better understand what audit's doing. Right? And so to be able to bring back like, good, good insights and perspectives, I think is one of the key reasons you want to have those relationships, to be able to help you focus your audit on, on areas that really matter. And you know, when we did the coffee chat, I also was like, I'm going to reserve the right for giving awards for things that I want to, you know, give rewards for. And so as it started, it took the team a little bit of, you know, I don't know what the right word is. Confidence. Like, like, like ability, right? Like, it just, it took a while to get them started. So, you know, the first person that logged their coffee chat, I was like, winner, winner, you get, you get a, you get a prize. Thing to kind of encourage people to go do it. We have also implemented, I know a lot of other organizations do this, a stakeholder matrix. So you know, we looked at the org chart and said who do we want to be touching? Assigned people to own those relationships from my level all the way down to every single member of my team. In some regards it's duplicative, right. And maybe there's, you know, my director, one of the managers on my team is tagged to this particular person, but that doesn't mean that me as the CAE shouldn't have a relationship with them as well. And so we've kind of laid out our stakeholder matrix and it's, it's loose, right? I would say it's not perfect, but it's a guide as far as, hey, like roughly, it would be good to remind yourself, like talk to this person on a monthly basis or talk to this person on a quarterly basis. And I'm not necessarily holding my team to did you meet with this person? But encouraging them instead that hey, look at the list. Just use it as a refresher to be like, oh yeah, I haven't talked to someone in this org in a while. Let me remind myself and go have a conversation with them. And I also know that the matrix isn't perfect, right? There's people that we've probably left off of the matrix that we actually should be meeting with. There's people that have turned over. And so we, we use it more as a, as a tool and a reminder of folks that we should be meeting with as opposed to, you know, this rigid must, must communicate x X frequency.
- [22:46]
A
A pretty hot topic is basically job security. In the age of AI, what is audit going to do in the age of AI, what is, what's the landscape going to look like in three years? I was on a watching a webinar today and they had a polling question of do you think AI is going to take auditor jobs? Yes or no? Basically. And I was a little surprised. I thought there would be more yeses is about close to 80% no. So I'm, I'm interested your thoughts on like how are you preparing your team in the age of AI?
- [23:22]
C
Basically, I would probably be in that camp of the 80%. I don't think that AI is going to replace internal audit. It may replace certain things we do and it certainly may make us more efficient. And this is probably a generic thing that many other people have said, but I think that the people who don't know how to use AI will get replaced. By the people who do know how to use AI. If we're not capable of using AI, we will become obsolete. And that needs to be clear that it's not optional to play around with it. But I think it's important to enable the teams to build that skill to give them room to explore. Right? Like some of the best learning I've had is through failure and trying something and realizing like, oh, that doesn't work, like I need to do it this way. And so I think really providing that room to explore and also the expectation that that room that's provided should be used for learning and development and exploration and trial and error is really important. You know, I've asked my team to share because some of this stuff is so new and the pace at which what AI tools can do is changing so quickly. I'm like, hey, like if you do something cool, will you share it? Like I want to learn from you, right, but share it in Slack. I'm like, take a quick 30 second Zoom video and post it. Post the recording up to, you know, our team so we can all learn and see what you're doing. That I think really having to be kind of a group share and a crowdsourcing sort of training and education is a great way to learn from everyone. On top of there's some really amazing stuff out on YouTube that you can watch, you know, in a 20 minute segment that really helps you, you know, kind of continue to learn. But I think it's setting the expectation, giving room to explore and learn and then really brainstorming on like what is inefficient and could this even be possible to, to be able to enable with AI and trying that out and then just exploring the art of the possibility, right? Like getting out there and attending, you know, webinars or talking to peers and maybe going back to that, that crowd. Sharing of training I think is so, so important to help all of us audit professionals kind of figure out how we can use technology to make us more efficient. I think the more efficient we can get, the broader risk landscape we can touch and therefore we become more effective in, in our roles by being more efficient. Not that it's going to replace us.
- [25:57]
A
What about like traditional trainings? I know for myself what I like to do is basically like I can, I'll take the quote week off and I'll design a training for me. So it might just be like, it might not be CPE related, it might be an hour and a half long YouTube video, but it's like hands on stuff and show me how to do something I can learn from it. And so I'd set that up and like it's one of my favorite weeks now. I have to do it twice a year because things are changing so fast. But it's one of my favorite week. It's some of my favorite weeks of the year. Just to, I don't really. It's almost like setting out of office and do it. What is, what is your trainings as a team look like? How do you facilitate that?
- [26:36]
C
I encourage folks to attend conferences where we've got some budget carved out out for that. You know, right now I'm also in addition to kind of looking at how we can continue to use AI, like everyone is looking at like how we better use data for insights, which I guess you could kind of think about, you know, analytics, automation, AI altogether. But so we're pulling together like a training curriculum for my team to get them to the same consistent level of capabilities across, you know, analytics and things like that. And we're kind of pulling that together based on access to some of the, you know, learning tools that our company provides us, access to YouTube videos, you know, other things, trying to define, you know, a 30, 40 hour curriculum that I'd like them to get completed in the next, you know, three, six months. I'll steal an idea that our chief accounting officer team actually just brought to all of our finance group the other day is like just 30 minute challenge a day. Like go, go try for 30 minutes just exploring and trial and error with AI, which I think I might try to adopt myself because I think just those tiny snippets of time to be able to explore things. Like it's pretty amazing what you could build with AI in under 30 minutes.
- [27:57]
A
I'll add to that because I used to do 20 minutes. I forget what time in the morning, but 8 o', clock, first thing I did and I tried to do 30, but then just brains. Everybody's, you know, works different. And there was something about a 30 minute block that I'd just be like, I don't want to do it because there's usually something hard that I was working on, you know, because you learning something new. So for whatever reason, even though I blocked off 30 minutes, I would put in there like 20 minute training and then I would go, all right, you can do 20, I do 20 minutes. Like you can do practically anything for 20 minutes a day. So I don't know psychologically saying 20 minutes, seeing 20 minutes, knowing I had a 30 minute block helped me so if 30 minutes doesn't work, try the 20 minute plan. And let me know if your folks are brains are wired like mine. I guess.
- [28:44]
C
Yeah, well, and I, I've. I did an executive coach program at my last company. Our CEO put all of the, the VP levels through a program with her executive coach that she'd had for years. And she taught us like 12 minutes. Set a timer for 12 minutes. Like, and not just from a training standpoint, but it was like, to get a task done. Like, it's amazing if you just set a like, timer for 12 minutes, what you can actually get done if you commit that that's the only thing you're gonna do for 12 minutes. So 12 minutes, 20 minutes. I think we're, we're onto something there.
- [29:15]
A
Okay. It sounds like, what's the movie? I think it's. There's something about Mary where he picks up the hitchhiker and he's like, you've heard of seven minute abs? Yeah, yeah, yeah, we're gonna do the six minute abs. Like, I feel like that's what the conversation you and I are having.
- [29:29]
C
I don't think it would work, but it does, right?
- [29:31]
A
If you want that extra minute, you gotta pay 7.99 to get that extra minute. Okay, this is going off the rails. All right, well, Danielle, I appreciate it. I think there's a lot of good, like, tactical stuff that you talked about, especially the relationship building. I love that. I know we hit on some of that when you and I met earlier, before we hit the record button, but there's even a few new things in there. So that was amazing. I'm sure aspiring caes caes even currently talking about your first 99 days, basically your first hundred days. Fantastic stuff there. With that said, I'm going to stop talking so you can tell us more. Great, wonderful stuff. But I'm going to hand the microphone over to you and let you close this out.
- [30:09]
C
Yeah, I mean, I would just say, you know, I think the question you told me to be prepared for was like, what do I want to leave the audience with? And I think something that I've been working on, I've been doing this for almost 25 years, is like your job and your career does not define who you are. And it's taken me a long time to figure that out. And so for those people that are, you know, listening, that are probably younger than I am, like, just know that. And like, there's so much more to life and importance of just doing things that you value and you love beyond your career. And if you do that stuff like you're still going to be a rock star in your career and you're going to give yourself the time and the bandwidth to fill your bucket in so many different ways. And so your job and your career does not define who you are.
- [31:00]
B
Hey everyone, thank you very much for listening to this episode of the Audit Podcast. Whatever platform you're listening on right now, I'm sure there's a subscribe button somewhere, so please hit the subscribe subscribe button there. If you're listening through itunes or Spotify, feel free to go give us that five star rating. It only took me about 16 seconds to give myself a five star review and it really helps to get future guests to come on the show, so we'd really appreciate that. Lastly, be sure to check out the show notes and follow us on all our social media channels, on Instagram, on LinkedIn, and on TikTok. Also, if you're interested, please sign up for our weekly newsletter from the Audit Podcast. Thank you all.
- [31:33]
A
Have a great one.