Chris Chung of The Doctors Company Explores the Upside Opportunity of Risk

Join Richard Chambers for a new episode of his Agents of Change video series, featuring conversations with internal audit leaders from some of the world’s most prominent organizations about innovation in the profession.

In this episode, Richard sits down with Chris Chung, SVP of Business Assessment & CAE of The Doctors Company, to discuss how connecting risk and audit can create opportunities and positive change, including:

• Leveraging a wide reach that helps internal auditors create influence and drive positive impact
• Relying on core pillars of audit, advisory, and risk to guide an organization through chaotic times
• Remaining open to implementing new methods and technology like AI to better combat risk
• Building rapport and practicing empathy to earn trust and gain new perspectives. 

Watch the full conversation, and read the can’t-miss highlights below.

Gaining a Viewpoint on Risk Across the Organization 

Richard Chambers: Chris, in one of my previous books, Agents of Change, I made the case that internal auditors have to embrace change and seek to drive value in their organizations. I define agents of change in the profession as those internal auditors who are catalysts for transformational ideas that create value within the organizations they serve. What’s your view on the internal auditor’s role in providing that kind of help for their organizations?

Chris Chung: Internal audit has an enormous opportunity to be an agent for change. If you think about internal audit and the function that we’re in, we have a tremendous capability on various things that the teams do ––  in particular, connecting with the business. We’ve got folks on our team who interact from an audit standpoint with the frontline business. We’ve got folks who connect and interact with senior management, and, in some of our roles, we interact with the board. So you’ve got an incredible organization that has outreach and touch. To have that influence and the ability to become an agent of change is quite powerful.

Richard Chambers: You mentioned enterprise risk previously in our conversation: You have that role as well, right?

Chris Chung: In our organization, I not only run audit, but I also have responsibility for enterprise risk. That’s given us a great lens into all of the things that we care about, not only from a downside risk standpoint but from an upside opportunity.

We’ve got approximately 200 risks and 600 mitigating activities, which we constantly update and have conversations on — but the biggest thing for us is how do we have meaningful conversations and talk about risk in a way that demonstrates value?

It was less about what keeps you up at night and more about the things that you want to achieve this year in your function in your business. As a part of doing that, how do you measure success? Those conversations were pretty valuable and pretty fruitful.

Richard Chambers: So instead of asking what keeps you up at night, you’re providing sleep remedies! 

This idea of internal audit and risk being combined is not as unusual as people think. I think as many as 40% of the Fortune 500 audit departments in this country set it up where the chief audit executive also has some risk management responsibilities. What do you think is the value of that? How does pairing those two together help the organization?

Chris Chung: Internal audit has a broad reach across the organization. Because of that, we have the opportunity to gain perspectives and create influence. We can marry the enterprise risk function and understanding with the things that might help us achieve the audit, the advisory — and ultimately — the risk. 

That viewpoint on risk across the organization helps us think about what level of assurance we want and how to work on the most meaningful projects that create the highest impact on the organization. We’re still working through that. It’s a journey in progress, but ultimately trying to bridge that connected risk view.

Living in Permacrisis: Assurance Through Audit, Advisory, and Enterprise Risk

Richard Chambers: We’re living in an era of permacrisis where there’s so much disruption, so much uncertainty, so much ambiguity, so much chaos. It’s more important than ever that internal audit help their organizations navigate this kind of environment. Agents of change have to be innovators. They have to have an innovative mindset. What’s been your experience in terms of internal auditors acting as innovators?

Chris Chung: I’ve shared this one slide with the board for five years now, and it has a great perspective. That slide has three pillars: the first is audit, the second is advisory, the third is enterprise risk.

Audits are the type of things that we do typically for assurance that are compliance-related or operational in nature –– things that help us run the business a little bit better. Advisory is really more consultative; it includes helping the business with perspectives that they may want or ask us for. Enterprise risk is risk across the organization.

Those three pillars are really important — but the biggest thing is they provide a level of assurance. The question is, how much assurance do we want to get out of them? How do we think about all those pillars, starting with the company’s strategic objectives and priorities? Once we understand that, we can better understand risk.

Internal Audit and AI as Evolving Risk and Opportunity

Richard Chambers: As we think about the era we’re operating in, one of the big challenges that’s starting to emerge is AI. How can internal audit embrace it? How can it leverage it? And what threats or risks does it present? What’s your view on AI when it comes to internal audit?

Chris Chung: AI is one of the biggest things to pay attention to as we move forward. As we think about enterprise risk in the past, I love to equate enterprise risk with this utopian view of a great risk dashboard. Wouldn’t it be great if we could get our hands on an easy dashboard that helps us make better decisions that are more real-time and dynamic?

In the past 30 years, a lot of that decision-making methodology has been static; it’s been spreadsheets, it’s been interactive one-on-ones, it’s been updating things, it’s been figuring out we account for mitigating activities. But as we move forward, is there now an opportunity to tap into that data with AI? That dashboard view now is potentially a reality in the next five or 10 years. Maybe even sooner.

Richard Chambers: We just did a survey in which we asked internal auditors and chief audit executives, “Why aren’t you using AI more?” Almost 60% came back and said, “Because we really don’t understand it. We lack the expertise.” What would your advice be to a chief audit executive who says that? What advice would you give them in terms of remedying that? How should they go about building some competency and confidence in their ability to use AI?

Chris Chung: AI is still emerging and certainly new for all of us, so we’re trying to figure that out. The biggest thing that I see is understanding the difference between automation and machine learning. And some of the technology capabilities of true AI.

When we’re thinking about true AI, do we have the ability to understand the tool or technology so that we can make better decisions? At the end of the day, AI has a tremendous capability to help make things run more efficiently and get better information faster.

However, the real value is going to be in interpreting that capability and then making a decision. There’s a human element to using AI, which we haven’t quite figured out. I’ll be honest; I haven’t figured it all out myself. But I’m very excited to see where this is going to go in the next five years.

Richard Chambers: What differentiates you from a lot of the 60% who were apprehensive is that you’ve got an enthusiastic appetite to learn more about AI.

Chris Chung: I hope so. The enterprise risk angle certainly helps with that!

Looking Ahead: Empathy and Efficiency

Richard Chambers: One of the four characteristics internal auditors must have to be a change agent is business acumen. Change agents must have an understanding of their business and the industry in which they operate. How have you gone about grasping the industry and the business? What advice would you give somebody who’s new in an industry and doesn’t have that background?

Chris Chung: I say it quite simply, and it seems silly, but it’s a hundred lunches, dinners, and drinks. It’s building relationships with the individuals that you’re working with. Once you have that rapport, then the conversations become easier. I remember when we first started having conversations about audit or advisory projects. There was a lot of push and pull and a bit of challenge in trying to help both of us understand what we were trying to accomplish.

Once you have a relationship with the individual, it becomes much more natural. It becomes easier to pick up the phone and say, “Hey, we’d love to get your perspective on this.” “We’d love to work on this project,” or, “We are working on this audit.”

Richard Chambers: How does executive management of your company, and how does the board, the audit committee, for example, how do they embrace this idea? Are they receptive to the idea of internal auditors as change agents?

Chris Chung: We have a great audit committee chair. She’s been absolutely fantastic and supportive of the things that we are trying to accomplish. Before I joined, the company was doing all the right things from an audit capability to make sure that we are providing assurance and being compliant. But I saw it as an opportunity to talk to management and the board about expanding that. They’ve been absolutely great supporters. Having great management and board support is really important because it can help propel the function to become an agent of change. 

Richard Chambers: We’ve been through a very tumultuous first half of this decade. We’re reaching the halfway point. Looking to the second half, what do you think internal audit needs to do to be more successful and even more relevant at the end of the 2020s?

Chris Chung: When we think about this first tumultuous time period with the pandemic, it changed how we worked. Everybody went virtual instantaneously. In that virtual environment, I think we learned something –– we learned to value time.

Because we learned to value time, we did things more efficiently. It created an intolerance for being inefficient. Now that we’re back in person and many folks are going back into the office, we have to make sure that we value folk’s time. I challenge and encourage my team to think about it from the other person’s perspective. Empathy is the biggest thing that we could think about as internal auditors. Once we’re empathetic, there’s a great partnership, whether it’s for audit, whether it’s for advisory, whether it’s for risk. Then, you can have a fruitful conversation on the level of assurance you want to have.

Check out more audit leader interviews with Richard Chambers on our Agents of Change video series channel.