Don't do things just because auditors tell you.
If you don't understand why we're telling you to do
something, challenge us because you should never do something
just because the auditors want you to do it.
The auditors should be able to explain we want you to do this
because here's the risk, and you need to control that risk in
accordance with your risk appetite intolerance.
Hey everyone, my name is Henry Surya Viravan.
And you're listening to the Technical Journal Podcast, the
show where I'll be bringing you, the greatest technical leaders,
practitioners and thought leaders in the industry to
discuss about their journey, ideas and practices that we all
can learn and apply to build a highly performing technical team
and to make an impact in your personal work.
So let's dive into our journal. Hello again everyone.
You're listening to the Technijunal Podcast, the podcast
where you can learn about technical leadership and
excellence from my conversations with great thought leaders in
the tech industry. If you haven't, please follow
the show on your podcast app and social media on LinkedIn,
Twitter and Instagram, and also video contents on YouTube and
TikTok to support my work in producing this podcast and its
various contents. You can buy me a coffee at
technijunal.net tip. Or subscribe as a patron at
Technically. Journal dot dev slash patron.
My guest for today's episode is Clarissa Lucas.
Clarissa is an audit and risk management leader and the author
of Beyond Agile Auditing. In this episode, Clarissa shared
a novel approach to internal auditing called Auditing with
Agility. She shared this concept at the
DevOps Enterprise Summit 2022, which drew some parallels to the
revolutionary birth of the DevOps movement.
Clarissa explained the three core components of auditing with
agility, which are Value Driven Auditing, Integrated Auditing
2.0, and Adaptable Auditing. I hope you enjoy listening to
this episode and learning a new approach to internal auditing
that doesn't cause you to drag working with your auditors.
From my experience, I sincerely believe we need to revolutionize
the way auditing is done in order to bring a better value
for the organization and make the experience better and more
productive. If you like this episode, it
will be really great if you can help me share this with your
colleagues, your friends and communities and leave a 5 star
rating and review on Apple Podcasts and Spotify.
It will help me a lot in getting more people discover and listen
to this podcast. Let's go to my conversation with
Clarissa after quick words from our sponsor.
Are you looking for a new cool swag?
Technically, Juno now offers you some Swags that you can purchase
online. These swags are printed on
demand based on your preference and will be delivered safely to
you all over the world. Where shipping is available,
Check out all the cool swags available by visiting Tech Lead.
Journal dot dev slash shop And don't forget to break yourself
once you receive any of those swags.
Everyone, welcome back to another new episode of the Tech
Lead Journal Podcast. Today I have with me Clarissa
Lucas. She's the author of a book
titled Beyond HR Auditing. The three core components to
revolutionize your internal audit practices.
As you can tell from the title, we are going to talk about
auditing. I myself have to be honest, I'm
not the person who likes to be audited.
No, I know a lot about auditing. So this episode I think is going
to be insightful for me at least.
And I hope it will also give you some learning experience about
how we can do audit better. So, Clarissa, thank you so much
for this time. I'm really looking forward to
learn from you about auditing. Henry, thanks for having me.
And you are not alone. And not really being excited
about getting audited. That was a big reason why I
wrote the book. So I'll introduce myself.
But I do want to dive into that a little bit, this part of about
me so. One of my personality traits is
I love when people get along and I struggle when they don't get
along. So when people don't like the
auditors to be there, they see me as the bad guy and I get it.
But those are things that I want to fix.
So you're not alone in that. I am trying one organization,
one person at a time to turn that adversarial relationship,
turn that fear of the auditors into something that's super
valuable. So I am so happy that you have
me on the show today. I have spent most of my career
in internal audit or risk management second line function,
so maybe not always as an internal auditor, but usually in
that type of role where somebody's coming and they feel
like they're being audited has to do speaking engagement on
this topic. This is something that is super
near and dear to my heart and as you mentioned, I'm a published
author. My book Beyond Agile Auditing
just came out a couple of weeks ago.
So this has been a whole new learning experience.
A few major highlights in my career.
Are presenting at my first DevOps Enterprise Summit, taking
on my current leadership role where I pivoted my focus from
individual accomplishments to people, and then publishing my
book. If you don't mind, I'm going to
take a couple minutes and talk through each of those because
they think that'll help paint the picture for the rest of the
episode today. So first one DevOps Enterprise
Summit in 2020. I wasn't too far into my current
role and I had the opportunity to speak at the DevOps
Enterprise Summit, so I was new to technology auditing.
Most of my career in auditing had been on the operational
side, not necessarily on the technology side, but this was a
new adventure for me. I love learning things and
technology is really important, so I was intrigued by taking on
that role. It was virtual that year, this
was 2020, the start of the pandemic.
Public speaking has always been a source of anxiety for me, even
though that's a lot of what I do now.
Learning and growth is important and so public speaking and I'm
the only or one of the only auditors at this.
Conference that is focused on technology leaders, really smart
technology people, and I didn't have that background either.
To say that it was overwhelming and terrifying for me was
probably an understatement. So that virtual environment
since the pandemic was there, made that a really great
stepping stone for me. It made it super enjoyable.
It helped me build that confidence, which has been a
stepping stone for a lot of these other types of
opportunities. Another reason that that was
such a pivotal moment for me was while I was there and presenting
a lot of the questions that were coming through from the audience
really opened my eyes to a number of misconceptions about
auditors that led to that fear. And not looking forward to the
auditors coming and seeing auditors as roadblocks and
seeing them as getting in the way of technology organizations
progressing in better ways of working in things like DevOps.
So it really started my journey to I need to tear down these
silos and help bring some truth to these misconceptions and help
these two groups get along better.
Because there was a huge opportunity to have them
leverage each other instead of getting in each other's ways.
Words are hard today, so that was the first turning point.
Another one was when I took on this role, so we're backing up.
The first one was 2020, this is in 2018-2019.
I took on this role as a technology audit leader.
And I'd had leadership positions before, but I still hadn't
really mastered that transition from individual contributor and
focusing on getting the things done to being a leader and
focusing on the people. And that shift was super pivotal
for me as well and just really helped me become a better leader
both to my direct reports and in the audit role where I'm leading
conversations and leading activities where there are
multiple people in the room and you really have to focus on
people more so than. The mechanics of getting things
done. So those two led to my third,
which was publishing my first book.
Had I not experienced both of those earlier turning points and
experiences, I definitely would not be here today.
The experience of publishing a book and taking on more and more
speaking engagements and connecting with people that I
normally wouldn't have had the opportunity to has been an
absolutely incredible experience, absolutely
one-of-a-kind. I love helping people, and this
book has been a great accelerator to enable me to
connect with people and start helping people and like I said,
tearing down those silos and shining a light on those
misconceptions. Wow, thank you for sharing your
story. I think that's really great.
So I myself, I'm pretty amazed that you got quite a good
reception in the DevOps Enterprise Summit talking about
audit. So there must be something.
Maybe we'll talk about that later as well, but for people
who are new to getting to know in depth about auditing.
Maybe we can start from there. First, right?
What is actually the real purpose of auditing?
What is auditing and internal auditing?
Specifically, if you mentioned in the title right, is there
anything that you can enlighten us about auditing here?
Yep. So a lot of people might think,
OK, the purpose of auditing is to shine a light on things that
are going wrong and make you look bad.
I can assure you that is not what we're here to do.
And the really cool thing about internal auditors is we work for
the same organization that the people we're auditing do.
So we are. Different from an external
auditor, we are different from other internal assurance
functions because we do have a bit of that step back, that
independence. But we are still part of the
same organization. So we are on the same team.
And I know that sounds like, Oh yeah, yeah, you're you're all on
the same team, I promise you we are.
So the purpose of internal audit is to be independent and
objective. We try not to be as biased by,
you know, if you're in the weeds every day doing this.
Of course, you're doing it great.
Like it's wonderful and I'm sure it is.
But there's a value that that objective perspective, that
fresh perspective can bring to those things.
So our goal is to add value to our organizations.
If I had to summarize it, it's to add value.
And we really want to do that through partnering with our
clients and bringing that fresh perspective and providing our
clients with value through assurance.
So letting them know the things that you rely on to go right,
are they going to go right? Is there a good chance that
they're going to go right? Or is something not working the
way you think it's going to work and you're probably going to run
into problems down the road? Or do you have the mechanisms in
place to make sure that when it doesn't go right, you're going
to identify that in a timely manner and be able to fix it
right away so that you can achieve your objectives?
That's really why we're here. None of that is to make it look
bad or to ruin your day or anything like that, which is
probably what some people may have experienced, unfortunately.
Right. I like when you say that you
bring value as well to the organization, Of course, we are
talking about internal auditors here.
Yeah, external might be different, but it's an internal
auditor. You also work together, right,
to bring value. And I like specifically in the
book you mentioned that internal auditors are much better or
maybe you call them experts in risk and control, right.
So things when you said when things go wrong, what mechanism
we should have in place or how to make sure that things do
actually go right. So I think that's also important
when we said that many people. Dread being audited.
There must be a reasons, definitely right?
I myself maybe can share some of my frustration, but maybe from
your point of view, First, what are some of the common
challenges? Why there's a bad perception or
maybe misconception about auditors?
Yeah, I think when things go wrong, people are always looking
at where we're the auditors here.
So you know that sometimes would put the auditors on the
defensive of we have to look at everything so that we don't get
those fingers pointed at us, I also think.
It's gotten potentially worse in the past few decades because we
used to show up with checklists and here's what we're going to
audit. And things didn't change very
often. So a checklist that you dust off
every year and do the same testing was effective for those
purposes. But that is absolutely not the
world we're living in today. Things change so quickly, so
when auditors show up with that checklist and do the same thing
that they did last time they were there.
Clients are like, this is not helpful, like that checklist is
so outdated and they're not digging into what's really
important to me or maybe they are, maybe the checklist is
still focused on those areas, but the auditors might have
their heads down and are just focused on executing that
checklist. And like when I mentioned moving
from that individual contributor to this role, like focusing on
executing versus understanding people and understanding their
processes and what's important to them, we needed to make that
shift so. I think you know with the rest
of the organization keeping up with the pace of change and
modernizing their ways of working, modernizing their
technology and their processes as well and audit kind of got
left in the dust for a little bit.
And that I think also created some of those challenges and
barriers and then. Yeah, Somebody's just going to
show up and throw some unplanned work on your plate.
That's not going to add any value.
I don't blame you for not being thrilled that they're there.
I mean, if somebody walked in here today and is like, do all
this work, that's not going to help you at all.
And you still have to get your other stuff done.
I wouldn't be thrilled either. I'd be fearing or, you know,
dreading like I think you said some of that person showing up.
So I think those are some of the things that have led to that
strained relationship, I'll say. Right.
So when I read the, I think the first few chapters in your book,
you mentioned also common challenges that you frequently
find from either your previous organizations or from your
customers clients. So I think when I read that some
of them actually ring true to me.
So for example, the things about us versus them, the silos, I
think that's the first impression that I got as well,
especially if the auditors do not come from the same team,
right. They are just separate maybe
reporting to different boss and they will just throw you
checklist, OK, we're gonna do an audit for your system or
whatever. And yeah, you have to just come
prepared whenever there's any findings.
So that is always not good. Because the first interaction
itself is kind of like maybe many tensions, right?
It's like, yes, you're policing us and we are like criminals.
Yep. Yep.
And that's not our intent, although I get that the way
things have been working in the past, it feels like that,
especially when you know, you mentioned they send the
checklist to you, We send sometimes and you'll get this
with external auditors as well. Here's our request list.
So we're figuring out what we want to audit.
We talk to you a little bit, figure out what it is you do.
We sit over at our desks and we create our scope for our audit.
We fill out a request list and we toss that over to our clients
and it's usually written in audit terms.
So you mentioned we're the experts in risks and controls.
We speak in risks and controls. Most people outside of audit or
risk functions do not speak in risks and controls.
So it's typically in a different type of wording that then our
clients are used to and they're stuck trying to figure out what
the heck are these auditors actually looking for or even if
it is clear what we're looking for, it might not actually be
the documentation of the evidence that we need to test
what we're looking at. So those silos really get in the
way of a common understanding and really an opportunity to add
value more efficiently. So I know you were going in a
different direction, but I did want to point that out.
Yeah, no problem. I would also love to share some
of my point of view, right, the frustrations that I have so that
we can discuss and maybe other people can relate as well.
The other frustration point that I have is about for example,
right, they give us some findings, but they don't seem to
relate so much with the context that we are working in or maybe
that comes from an outdated version of some documents like
you mentioned because some of these comes from compliance
which are probably. Created some years ago and they
may not relate, but they create that as a finding and you just
have to build some kind of rationale why this is not
applicable for us before they can say, OK, check.
And sometimes it goes through a few rounds of, you know, back
and forth before they can accept that.
Yeah. So some of the, I think that's
inherent in those silos that you mentioned and not working as
collaboratively together and not getting that based understanding
of what is very important, what you mentioned from a compliance
perspective, what are the current requirements.
What are the most important compliance requirements today?
Because there are so many different requirements, but what
are the ones that are really impactful to you and your
organization, both from a regulatory perspective, from an
internal policies perspective? Because you're right, We could
spend all this time over in this space to the left.
But if that's not what's most important, if that's not working
and we hand you a report that says these things are broken or
you're not complying with these areas, you don't care.
That was a waste of your time and my time.
So what I talk about in the book generally is called auditing
with Agility and it's a flexible approach where we break down
those silos and we really focus on value.
So there's three core components.
The first one is value driven auditing and that is one of the
things that I think would help with.
I don't think I know I've experienced that helping with
delivering audit reports that actually provide value because
the scope of the audit is focused on what's going to add
value to the organization and the clients.
I think that's the perfect segue to go into your concept, right?
So explain to us a little bit more about this auditing with
agility. Is this just some application of
agile methodology to some other parts of non technology?
So tell us more about it. Yeah.
So you're on the right path there.
The traditional way of auditing is a waterfall approach.
So that stage gated approach that is similar to software
development, waterfall and software development.
You do one stage before you go to the next stage, before you go
to the next stage and you're very heads down in each of those
stages. So we were finding a lot of
those challenges that we talked about.
We, the auditing profession, not just Clarissa and her daily
struggles, but the auditing profession realized that things
were changing. This waterfall approach, strict
framework that we have to do this very sequential thing and
every situation wasn't keeping up with the environment that all
of our organizations were working in.
So we also saw that in the technology world and business
world, people were applying. Agile concepts and seeing
success. So we moved to There was a big
movement for what's called Agile auditing.
Agile auditing is pretty much applying A Scrum framework to
the audit process. So you've got sprints, typically
about two weeks, you've got Scrum masters, daily standups.
All of the things that you'll see in a Scrum framework applied
to internal auditing. And just like with waterfall, it
was do the same thing all the time.
So do sprints all the time, do your daily standups all the
time, in every situation. And some organizations found a
lot of success with that. My own personal experience, I
found a lot of success with that in certain parts of the
organization. So auditing technology.
Some of my clients leveraged Scrum frameworks to manage their
own work. So we were able to fit right in
there and deliver our audits and sprints in those situations and
it was amazing. But there were also situations
where that didn't work out quite as well, so.
I started thinking, you know, we started thinking, okay do we
want to do agile auditing or not?
And it was very binary, like you have to pick waterfall or you
have to pick agile auditing. And we were doing agile.
And it kind of dawned on me that the whole point of as I was
attending more conferences related to IT and working
DevOps, ways of working and agile ways of working, reading
about business agility, I was really realizing that we were
falling into a trap of doing agile instead of being agile.
We were looking for a framework because we're auditors.
We like frameworks. We started out with checklists
like it's comfortable. But again, that's not working
today. I mean it's working.
It's got so many opportunities to be so much better.
Like I don't want to be the bad guy anymore.
I don't want you to run from me as an auditor.
I want you to call me up and say like, hey, I've got a question.
I need audit perspective. Can you help me?
So following in the trap of doing agile versus being agile,
so started experimenting with what I call auditing with
agility and it sounds very similar to agile auditing.
But instead of agile auditing, when people hear that, they
think it's a thing to do. When you hear auditing with
Agility, I think it's more clear that you're auditing.
That's what you do. You're not changing what you do,
but you're doing it with agility.
It's a very minor tweak in words, but it's very
intentional. It's trying to get the point out
that it's not something you do. It's not this framework that
you're going to cookie cutter apply in every situation.
We're still auditing. We're still providing that
assurance that things are working right or that you're
going to identify things when they don't work right.
We're just doing that in a more flexible approach that anchors
back to those agile principles instead of specific frameworks.
And then it also incorporates, because I was heavily influenced
by these DevOps Enterprise summits and the talented
speakers there explaining super highly technical things that
most of the time we're way over my head.
But I was picking up a lot of their ways of working and the
success they were seeing through applying that DevOps mindset.
Also, what resonated with me and kind of why auditing it with
agility, I think is, you know, really where organizations need
to go is after I did one of my presentations.
It wasn't in 2020, I think it was in 2021.
I started talking about applying some of these DevOps concepts to
internal auditing. It was kind of the birth of
auditing with agility and Gene Kim when I submitted my
presentation for that, he said. He was really impressed by it
and he said this is very similar to the 2009 presentation that
John Alspa and Paul Hammond did about Flickr and that was kind
of the birth of DevOps. So this is kind of awesome
because it was the birth of auditing with agility and.
We had not seen the 2009 presentation at that point.
So I went and I watched it and it was so cool to see.
It was operations team and the developers, they're not getting
along and they're not incentivized to do the same
thing. They're incentivized kind of to
get in each other's way, very similar to audits and clients.
You know, clients are trying to do their thing and here come the
auditors get in their way and we're just trying to get an
audit report out. But management's doing these
things and not sending us the right things that we're
requesting. So it was really, really cool to
see that. Those parallels and then how
DevOps got the two of those groups who historically didn't
work so well together to work together.
That's what I'm trying to do with auditing with Agility is
trying to get auditors and clients to get out of each
other's way and work together and help each other.
That was a long, long explanation, right?
I think that's really exciting, especially again like coming
back to you mentioned about DevOps Enterprise Summit, right.
I think that also picked my interest when I read your book,
the parallels between your presentation and the 209 John
Osborne presentation, the first moment where we all get
introduced into DevOps, you know, so many deploys per days
and things like that. So I really love the parallels
that you bring here, which brings us to the concept of why
DevOps is needed. So the first traditionally in
the 1st place, right, people try to create a silo between
development and operations and the functions actually kind of
like different if you look from the traditional perspective.
One is to introduce more change, the other is to actually control
change. I believe this is the same thing
that happens in the audit and the clients, let's call it
client as well. So client always wants to do
their own business, you know, introduce change, create new
products, create new systems, whatever that is while audited,
try to manage the risk, the control and things like that.
So when you took this parallels right, what would be some of the
interesting things that Jin see in your presentation that
probably will become a birth of something new in the future?
Yeah, a lot of it was. So in my presentation there, I
was representing audit and I was copresenting.
So historically, up to that point, I had copresented with
other auditors and this was the first time that I was
copresenting with one of my clients.
And similar to the 2009 presentation, it was somebody
from development and somebody from operations sharing the
stage. And my client and I had a lot of
fun too. I mean, I think work should be
fun. I love having fun when I work.
So us having the presentation and you could tell we had a
great relationship. We had a lot of fun doing the
presentation that really paralleled with that.
And then with the 2009 presentation, the two
presenters, one from development, one from operations
talked about how at their organization they were able to
break down those silos, break down those barriers, have a
common objective and work together.
Very similar to what my client and I were explaining in our
presentation to so auditor, audit client, typically butting
heads, not getting along super well or just tolerating each
other to get through an audit. And we talked about how we
worked as one team. So it wasn't the auditor team
and the client team, it was one team, the team and we were very
like specific when we would say very intentional when we say
like the team, all of us not you know you over there in us here
we were one team. We did have our separate
reporting structures as is needed for us as auditors to
maintain our independence, but that doesn't mean we cannot work
together closely as one team. We worked so closely together to
make sure that we were aligned on what our common objective was
and it was provide and get insights about the most
important things in that particular area.
So really those two primary differentiators were the huge
parallels between the two. You mentioned something about
different reporting line, right. So I think in the world we
always have this thing called segregation of duty maker and
checker. I think that is also what
happened before the DevOps world and someone needs to have like a
different maybe a like access control or approval yeah, before
some change can go into production.
I think similar thing in audit as well.
So how do you see this segregation of duty now with
your auditing with agility concept?
Yeah, this is a common question and this was one that really
sparked me getting into these DevOps enterprise summits and
presentations. So the question that we would
get, that I would get from my clients is how do I pass an
audit when we're using DevOps and we're not doing segregation
of duties through the access controls or how we historically
would. And I mean this was my kind of
my first view into the misconceptions like there's no
passing and audit. I don't have a pass fail.
I don't have like a. Big green check mark to provide
at the end of an audit, but then also thinking through
segregations of duties and being new to the role.
I and I still ask like very elementary questions which has
turned out to be a strength of mine and something that has
added value. But here I am a couple days into
my new role leading technology audit and I was like why do we
segregate duties? And the first answer was because
the auditors told us we had to. I'm like, ooh, try again.
Don't do things just because auditors tell you if you don't
understand why we're telling you to do something, challenge us
because you should never do something just because the
auditors want you to do it. The auditors should be able to
explain, we want you to do this because here's the risk and you
need to control that risk in accordance with your risk
appetite and tolerance. So when we really started
peeling back the layers of why do we segregate duties?
We started thinking about things like we want to make sure that
somebody doesn't introduce something into production that's
going to do bad things. Megan is like super not
technical. So bear with me there.
So I'm like, OK, so historically we have managed that risk by not
letting the same person push their stuff through without
having somebody else give the OK, we've segregated duties.
So then I challenged the group and was asking, OK, what else
could we do? Manage that risk without having
two separate access lists. And that's when we really
started understanding. OK, well, maybe we could have
automated checks and I can push my stuff through and it'll go
through only when this automated test says it passes all these
things the same thing that a human would do when they're
looking at the code. Or the change or whatever it is,
if this automated test, it passes that test, then it goes
through and essentially you've segregated the duties not
between two people, but between the person wanting to promote
the code, the developer, and an automated test.
So that was one example. There's other examples, but it
was really about thinking through, getting rid of that
checklist of we need to look for segregation of duties, working
with our clients to understand what are you trying to
accomplish. We're trying to make sure things
get into production so that we can help serve our business.
What could go wrong? What are the risks?
We could get something in there that does bad things, either
intentionally or unintentionally.
People make mistakes, Okay. What can we do?
Or what ways can you manage that risk?
And what ways do you manage that risk?
So instead of walking in and saying, I need to see
segregation of duties, give me your access lists and you give
me your access lists. And I tell you, well, these
people have access to do both. You're like, why?
No, it's set up that way. Like, that's a waste of time.
Instead, we're understanding what you're trying to
accomplish, what can go wrong, how you're controlling that
risk, how you're managing that risk.
And then we test that. So then instead of looking at
the access list, we're going to look at how is this test set up,
this automated test set up, How's it designed?
Is it designed the same way to look for the same things that a
peer reviewer would? Or, you know, in a world where
those duties are segregated? And then is it operating the way
that you think it is? So it's supposed to identify
these things and not let it go through to production if it
doesn't? Meet these criteria.
Is it doing that? Is it letting things through
when it's supposed to? So if it passes all of these
tests, it's supposed to go to production.
We would test that. And that's going to provide a
lot more value than to your earlier point, us handing you a
report that says you don't have segregation of duties in place.
What are you supposed to do with that?
That's something you're hanging on your fridge.
Right. I really left a new set in the
beginning that we just follow whatever auditor set sometimes
that was what happened. I think in most of the client
situations, we just follow whatever auditors say because
maybe they come from a compliance point of view or they
come from a standardized practices and things like that.
But always ask or maybe challenge right, why we need to
do certain things. Because sometimes the context is
different and like you said, probably we could do a better
way instead of just following word by word what the auditor
said. Or maybe you are doing it in a
different way. So maybe the finding is you
don't have duties segregated, but you do have these automated
tests in place. So instead of having a finding
or an audit report that says you have to segregate duties and
just now segregating duties, you can educate your auditors on
this is how we're managing that risk.
Let me walk you through this. So yeah, I just wanted to point
that out too. Yeah, I think it all comes back
to the controls that you want in place, right?
So not necessarily the technique or the tactics, right, whatever
that is. How you're managing that risk
and bringing your auditors along so that they understand it?
Right, so let's go to your in depth about your concept
auditing with agility. You mentioned there are three
values, so the first one is value driven Auditing.
The second one is Integrated Auditing 2.0.
It's interesting there's a 2.0 there.
And adaptable auditing. So maybe we can just go through
scheme, some of them one by one Value driven auditing.
What do you mean by this? Yep.
So this is it. Gets back to that point and
solves that problem of. You getting a report that's an
audit report, that's not valuable to you.
So value driven auditing is really going to make sure that
the audit scope. So what the auditors are going
to look at and what they're going to do is going to add
value to the organization. So it's going to be anchored
back to what's most important to the organization and its key
stakeholders which include the audit clients.
So we're going to look at where are the biggest risks or where
are the greatest opportunities, too.
So there's risk in not doing things and there's risk in doing
things. So value driven auditing is
really just anchoring back to what is going to add the most
value to the organization and focusing the work there.
And we do talk through a number of practices that you can
implement to achieve that value driven auditing.
But I first just want to focus on like, what are those 3 core
components? Let's define those and then we
can. Dive into some that I think the
audience today are really going to benefit from.
So Yep, value driven auditing first.
I know you mentioned integrating auditing 2.0 and we're
interested in the 2.0 piece of that.
So in the auditing world, it's probably been more than a few
years ago, but audits used to be performed.
You'd have a compliance audit, you'd have an operational audit
and you'd have an IT audit and then those would all be
delivered separately or they'd stitch them together at the end
in one report, but all the work would be performed separately.
So the auditing profession started doing what's called
integrated auditing and you would have all of those auditors
on the same audit. So each audit would have a
compliance operation on IT lens which really helped and breaking
down those silos within the audit function and provide a
more holistic view and better view of the environment than the
separate audits being stitched together.
That's not what I go into in the book.
That is should be a given right now.
We should all be there. So what I mean by integrated
auditing 2.0 is it's kind of taking that to the next level.
And what we do here is we're integrating audit work with our
audit clients work and we still maintain that independence.
I know that's a question I get a lot from auditors is like how
can we do this and still be independent.
There's plenty of ways that we can do that and still be
independent. Even the institute of internal
auditors who is our governing body, they set the standards for
internal auditing. They tell us that independence
doesn't mean isolation, so you don't have to have working
silos. We still have that different
reporting structure, we still maintain those decision rights.
But what we focus on with this 2.0 version of integrated
auditing is integrating audit work with clients work.
The third component is adaptable auditing and this is where we
build in the ability to respond to change.
So we're going to have a flexible process to audit
instead of this strict framework.
We're going to be able to pivot. We're going to be able to
understand when we should stop auditing.
So with our old audit waterfall approach, we would have our plan
and we would go heads down and execute it and not come up for
air until the end. And we really miss opportunities
to determine do we still need to go down this path or do we know
enough to deliver now and get out of our clients hair and move
on to something else. So adaptable auditing is where
we have that flexibility, the ability to respond to change
which is super important in today's crazy fast changing
environment. Thanks for a quick overview of
the three values of the auditing with agility.
So like you said right, the 1st that picked my interest is
actually the integrated auditing.
Regardless 2.0 or not, right? Because I don't.
I don't know the. History of the auditing, so
specifically you mentioned that integrating audit work with the
client's work. So does it mean that auditors
now have a place in the team like you have a dedicated
auditors as part of the team that instead of thinking about
business stories, right, we call stories in the tech world
business stories or business requirements, but you also have
a like an audit kind of a stories, audit requirements as
part of the work. Maybe tell us a little bit more
on that. There's a bunch of practices
that you can implement and here is where I think the audit
clients have a huge opportunity to influence a better audit
experience. So a lot of people think, OK,
beyond edge auditing, this is primarily for auditors to read.
It's got two primary audit audiences, both auditors and
clients, because just like DevOps, the developers couldn't
do DevOps by themselves. Neither could operations.
They both needed to go and implement those concepts.
It's the same as here and integrated auditing, I think
it's a great place for clients to start and start influencing
that experience. So you mentioned in the
question, do you have a dedicated auditor, You could,
but you also don't know, you know that the type of work, you
don't know when it's going to be there and when it's not.
So there's some things that we can do is like my clients know
that they can call me anytime with questions and they do.
I'll get a random hang on a Tuesday afternoon.
Hey, do you have a minute for a quick call and they'll call me
up? Hey, I'm going through this.
I wanted you to get your thoughts on should I think about
it this way or that way or, you know, they're looking for advice
and I can give that advice and then they go on their way and I
go on my way. So it's not a full blown audit
being able to just call somebody up and get that real time
feedback from them is. Super helpful.
And that's part of the integrated auditing feedback
loops. So regular feedback loops, real
time feedback loops. Those are probably the most
straightforward thing that I can think of for clients to start
implementing. That is, you know you don't have
to wait for the auditors to reach out to you.
You can implement and you can start a feedback loop so you
have a question for your auditor.
Call them up and it may be intimidating, especially at
first. If you don't have that working
relationship with them yet and you're afraid this is going to
trigger a huge audit and it's going to be a bunch of extra
time spent, you could start by figuring out what do you need
from an audit, what do you need from your auditors and set up
coffee with them. Virtual coffee, Real coffee.
I love coffee, so you know, it's one of my favorite things.
But just start that feedback loop of, hey, we had this audit
or I know we've got this audit coming up.
I'd love to see us do this in it.
I'd love to see a focus on this particular area or you know
what's really keeping me up at night this?
Can we spend some time talking about that?
Or even if you don't have an audit coming up, just here are
some things that I've got questions on or I'd love to see
from my auditors. Feedback can even be that
clients reach out to me and say I'd love you to attend our OPS
review meeting so that you can help us stay on top of the open
findings we have because we sometimes lose sight of those.
Sure, absolutely. Not only am I connecting with
them and providing them information on open audit
findings, but I'm also learning more about what's important to
them. So I have this idea of what I
want to audit in that space, but they're spending all this time
and all this money on this one thing.
Hey, could you use some objective advice as you're
building that out? Yeah, that would be great.
So feedback loops are super, super helpful.
Another thing about feedback loops is if you don't provide
feedback to your auditors on what a better audit experience
looks like, they're not going to know to make a change.
Or they might know that they should make a change, but they
might try a bunch of things that aren't what you want to see.
So feedback loops are super important.
Another one that I want to highlight in this integrated
auditing space that is. I get so excited about this.
It's integrated planning. So you also mentioned, I keep
anchoring back to this because the concepts that you're
bringing up, the challenges that you've brought up, you are so
not alone. I bet if you asked your audience
today how many of them experienced some of these same
challenges that you've experienced, most of them who
have interacted with auditors have probably experienced that
too. So we talked about getting an
audit report. That doesn't help you.
It's focused on the wrong things.
It doesn't really add value. A great way to overcome that
challenge is through integrated planning and that's where we're
going to work super closely together.
So Henry, I'm going to come audit you.
We're going to work closely together and we're actually
going to build out the audit scope together.
So I'm going to be still independent because I get the
final decision rights. If I say I want to look in this
closet and you say, no, no, no, you don't need to look in that
closet, but I still think I need to look in the closet, I'm going
to look in the closet. But if you're also saying, hey,
you know what, this is great. But what I'm really worried
about or what I really need to go right is this area over here.
Let's spend some time there and let's identify.
So let's work together to identify what's most important
to you. What can go wrong with that?
Because I have my own ideas about it.
Generally, they're aligned, but. It's so much more helpful when I
get that confirmation from you. Or maybe you help me think about
it in a different way. Like, yeah, that's really not
when we go back to segregation of duties.
You know, I may come in without integrated planning and say,
like, give me those access lists and you're like, I mean, I could
do that, but you help me understand, you know, I'm always
thinking, well, we're looking for bad actors and that's the
risk. And you're like, yeah, but
actually mistakes happen more often than intentional bad code.
So you can help me understand what those risks are and how
they actually might manifest in your world.
And then integrated planning, instead of me saying okay, I'm
looking for a segregation of duties control, which doesn't
exist because that's not the way you're doing things.
You're going to tell me how you manage that risk and how you
manage that risk. Let's say it is through those
automated testing. Great.
So now we've just saved ourselves a ton of time.
Because now I understand what's really important to you.
I understand those risks and what can go wrong.
I understand how you control it. And then you can help me.
You're saying, okay. You know what?
Here's what I can provide you that will show you how those
automated tests are set up. And then if you want to sit with
me tomorrow, I can run through and I can send something through
that's supposed to fail and send something through that's
supposed to pass and we can get this test knocked out in a day.
Great. Way better than going back and
forth, getting confused, getting frustrated and hinting.
You report that tells you you don't have duty segregated.
You know that that was intentional.
So I know I went on about that. This is something I'm super
passionate about, but I really think that integrated planning
in those feedback loops are something that audit clients can
start doing today and really, really have a much better
experience with their auditors. Thanks for sharing explicitly
what happened in these kind of situations.
I think it's always great to hear from the auditor's point of
view. It's not just from client's
point of view. And I like the quote that you
mentioned earlier, right? Independence doesn't mean
isolation, right. So that's integrate together,
talk about the plan, the audit scope together.
Like sometimes what happen is when we get audited, we just
follow whatever scope they have, we wait for a couple of times,
they go and ask us questions, we answer.
Go back and forth and they'll come up with reports, right?
So instead of doing that, I think we could do much better by
doing this integrated auditing 2 point.
Zero. I say real quick with that too
is we're both aligned on the same goal.
So I don't want to hand you an audit report that means nothing
to you. You don't want to receive an
audit report that means nothing to you.
So it's not just helping you, it's helping the auditors too.
And that's why it's super important for us to work
together to make sure that we're both at the end producing this
report that's going to add value to the organization.
Right. And it will be best if both the
clients and the auditors at the end actually like the reports
that they produce. Yeah, they erase about it
together just like what you did in the presentation.
The other value that I think I'm very interested in is you
mentioned about adaptable auditing in many of the audit
process that we do actually is following some compliance
framework certifications. And they do have a lot of
checklists, a lot of areas, a lot of scope we mentioned.
So how can we be more adaptable, like be flexible, know what to
audit, when not to audit? So I think this is very
interesting as well for people who normally go through audit by
following compliance. Yeah.
And part of that starts with the value driven.
So focusing on what's most important.
But then when it comes to the adaptability, so you have that
stuff, how do you build in the ability to change and pivot,
really prioritizing your work. So breaking the audit scope up
into manageable pieces and limiting how much you're focused
on at a time is something that really helps Dr. adaptability,
and it's something that clients can influence as well.
So instead of going in and saying we've got these 12
controls that we're going to look at or these 12 compliance
requirements we're going to look at and we start looking at all
of them at once, we're going to figure out what is most
important. So when it comes to compliance,
certain things are going to have larger fines and larger impacts
than others. If it's going to be a fine of a
dollar every year, yeah, we want to comply with it, but.
Do you need audit to tell you like this?
That's not a good use of anybody's time.
And I know I'm over exaggerating here, but bear with me.
So if there's something that's going to cause millions of
dollars in fines and a frequent basis and there's a decent
chance of that, you want to focus on that.
So prioritizing that instead of starting everything at once.
So we're looking at something that's going to be a dollar and
a fine and something that's going to be $1,000,000 and
getting pieces of that and keeping those all going in
process throughout the entire audit.
You're going to limit what you're doing at a time and that
is going to give you results sooner too.
And then with those results we can pivot and say like have we
done enough, have we audited enough, have we learned enough?
So focusing on those areas that are most important, knocking
those out first, and this is a concept, I mean a lot of these
concepts should seem familiar. They should be things that.
That you and your audience do already in your own daily work.
So you're really well positioned to help your auditors pick these
up and you can teach them. So limiting what we're doing at
a time, picking it up, doing it, delivering it, starting another
thing. And that helps with our clients
too, because then you're not doing all that context
switching. I'm not asking you about
compliance with this piece of something.
And then over here and then taking you back to that and
where were we with that? So that's really something that
can help us deliver those results sooner.
And then we think through okay, now we've done these four
things, do we need to keep going?
What value will we get by completing the rest of this
audit? If the answer is not that much
and it's not worth it, then we stop because there could be
something else like if we look at all these other things that
we initially thought we were going to look at.
We just have to do when everything's in process at the
same time. So while we're limiting that,
that gives us that opportunity to pause and think about should
we spend our time collectively, everybody, not just the
auditors, Should we spend all of our time finishing this or is
there something else out there either in your space or a
different space that is more important that we should pivot
to. So I think that's a really good.
Way to drive that response to change.
And that's something that as a client you can help with that,
help them, help your auditors with.
You know what, I think you've provided us enough assurance.
I think this is good. The value we're going to get out
of this is minimal, like let's pivot to something else.
Perfectly makes sense, right? Because I mean, in the tech
world, we are so familiar with the HR concept, lean concept,
right? So these things definitely make
sense. And I think one more key from my
point of view is also don't do this auditing when the certain
time comes, right. So for example if you have a
yearly requirements to do audit, then you only do that close to
the time. So I think you can't do this
definitely right because you have to complete all the
checklist in one go. So I think maybe doing it also
throughout the time in small iterations that they will value
and pivot along the way. I think that may be also a great
way to. Have this flexibility in terms
of auditing. So we discussed a lot about
internal auditing. So how do you see the external
auditing part? Because these are different type
of people, they may not come from the same organization,
maybe the values may not be aligned.
So is there any message that you wanna give for external auditors
as well or for clients who are dealing with external auditors?
Yeah. I would absolutely love to see
external auditors leverage these practices too.
So the book is focused on internal audit practices because
that's where my background primarily is and there are
different standards that external auditors are held to.
And I'm not quite as familiar with those, but I would love to
have a conversation about what are those requirements and how
can external auditors also leverage these concepts so that
they're also not feared. And so that they're better
positioned. So by leveraging all of these
concepts, driving by value, integrating into the client's
work and being adaptable, those are going to set the auditors
external or internal up for better success.
Like I mentioned, we're going to be focusing on the right things.
We're going to be not wasting our time or your time.
Those are all things that the external auditors can benefit
from as well. So absolutely I'd love to learn
more about what those standards are that they're being held to
and work with them to figure out how they.
Can leverage these practices to not be feared, to have better
working relationships while maintaining they have even more
of an independence requirement than we do and you know, find
efficiencies, add more value. I just think it would be great
for them as well. Right.
And it will be great if all conversation with auditors is
like this, very friendly and we are collaborative.
So I do hope we. Do things also.
Happen. Yeah, in all the auditing
experience that everyone is having.
So thank you so much Clarissa, for explaining this concept.
Auditing with agility, I learned a lot and I probably have some
perspective change after you, you know, give some insights
about better practices for auditing.
So as we go to the end of our conversation, I have one last
thing that I would like to ask you, which I call 3 technical
leadership wisdom. Think of it just like advice
that you want to give to the listeners so that they can learn
from your expertise or your experience.
So would you be able to share the version of your 3 technical
leadership wisdom? I would love to so first.
Auditors are not your adversaries.
They should not be out to get you.
They actually should be a valuable resource for you to be
able to leverage. So absolutely, first thing I
want people to walk away with is that I want you to run to your
auditors, not from them. And I know that's going to take
some work, but keep that in mind.
We're not out to get you. We want to help you.
Second is, this is a journey. So it's not like laying a Scrum
framework onto an audit process. It's not a you know these five
steps and boom, you are agile. It's a journey.
And you and your audience probably know this from your own
experiences in these better ways of working.
So that's not an unfamiliar piece of wisdom to all of you.
But the way that you really get started on this journey is by
figuring out what's most important to you, you know
you're not going to apply everything in the book all at
once. You got to start small, so
figure out what is the most important to you.
Is it getting more value out of that audit?
Is it being able to respond to change?
I'd love to ask people, if you had a magic wand, how would you
use it to improve the audit process and what would that look
like? So that's what you're going to
start with. And 3rd, I would have each of
you reach out to your auditors today, connect with them.
So if you're in the middle of an audit, pause to go again.
Coffee is kind of my go to. It's like my peace offering.
Get coffee. Just set up a virtual chat,
start building it and strengthening that relationship,
and then provide them feedback. So we talked about feedback
loops. Activate a feedback loop.
So let them know. Now that you know, if you had
that magic wand of what it would look like, what's most important
to you? Tell your auditors.
Open that feedback loop. Ask how you can help.
And you know, I'm expanding like kind of into three, a 3B.
But I mentioned this earlier that many of you have a lot of
experience with these better ways of working and auditors
typically don't. This is something new for
auditors for a lot of us. So coach your auditors, tell
them, hey, you know what, I really think it'd be helpful if
you created a task board. I can show you how to do that
because we used JIRA and this is how it's been working for us or
maybe love standups. Hey, why don't you join some of
our daily standups and you can provide your audit status there
instead of having a separate meeting.
Or why don't you join into this meeting?
So coach your auditors. You're the experts in these
better ways of working. Teach them.
That's also going to help build those relationships and keep
those feedback loops going. So those are my 3 1/2 pieces of
wisdom. Okay, the third one maybe.
I would also call it auditors are human too, so maybe connect
with them right. Don't treat them as like robots
that just follow checklists. So they are humans as well and
they help us to get the same value, the same goal for the
organization. So thank you so much, Clarissa,
for this chat. So if people want to connect
with you or they want to ask you questions, is there a place
where they can find you online? Yep, so I would ask everyone to
check out my website clarissalucas.com.
I have a newsletter where I send out content that's helpful for
both auditors and audit clients, trying to help everyone have a
better audit experience. And then I'm also on LinkedIn as
well. And Henry, I really want to
thank you for having me here today.
Love getting in front of your type of audience so that people
don't have to fear their auditors, You know, I want
auditors and clients to get along and really, really
appreciate you having me on here and giving me the opportunity to
share. No worries so.
I am probably the first person who will not get scared to be
audited anymore, so I love it. So thank you for the insights
that you give in this episode. Clarissa, thank you so much for
the time again. So I hope people get
enthusiastic about their next audit experience.
And also for auditors, maybe you get a few lessons from here that
can change your practices. So thank you again for that.
My pleasure. Thank you for listening to this
episode and for staying right until the end if you highly
enjoyed it. I would appreciate if you share
it with your friends and colleagues who you think would
also benefit from listening to this episode.
And if you're new to the podcast, make sure to subscribe
and leave me your valuable review and feedback.
It helps me a lot in order to grow this podcast better.
You can also find the full show notes of this conversation on
the episode page at Technically journal dot dev website,
including the full transcript, interesting quotes and links to
the resources mentioned from the conversation.
And lastly. Make sure to subscribe to the
show's mailing list on techlyjuno dot dev to get
notified for any future episodes.
Stay tuned for the next Techlyjuno episode, and until
then, goodbye.