Join Richard Chambers for a new installment of his Agents of Change video series, featuring conversations with internal audit leaders from some of the world’s most prominent organizations about innovation in the profession.
In this episode, Richard sits down with Lisa Lee, Vice President of Audit at Alphabet/Google, to discuss how her audit team gets involved early to stay ahead of the curve in their dynamic business environment, including:
- Why innovation requires not just good ideas — but also a flexible mindset and willingness to iterate.
- How Google’s “storyboarding” approach leads to better communication and understanding about risk.
- How investing in data science skills enables her auditors to apply and interpret tech like AI and ML in their audits.
Watch the full conversation, and read the can’t-miss highlights below.
How IA at Google Moves at the Speed of a Fast-changing Tech Company
Richard Chambers: I remember how exciting it was when I came to visit you and your staff out at Google a few years ago, because it was obvious that you were forging an entirely new direction for internal audit in the organization. In my book, Agents of Change: Internal Auditors in an Era of Disruption, I make the case that internal auditors should be change agents: catalysts for transformation that creates value. Do you agree that that’s an appropriate role for internal audit, and is that how you would define a change agent in the internal audit realm?
Lisa Lee: Absolutely. The keywords there are around being able to add value. I think that we had no choice at Google. Things were moving so quickly and the environment was changing so dynamically that if we weren’t adaptable — if we weren’t change agents, as you say — we wouldn’t be adding value in any way.
I think the ultimate responsibility of internal audit is to ensure the company can achieve its strategic objectives and goals in a compliant and risk-managed way. Part of that responsibility must be to ensure the company is prepared — given the dynamic environment that we live in and operate today — with technology and system advancements, an evolving regulatory landscape, and unexpected environmental impacts to operations such as the pandemic. If we can’t adapt, then I don’t know how we continue to add value. To do this, internal audit has to get in early to understand how the organization is adapting to these changes.
What we found at Google is that if the business is prepared, that’s great. Our audit efforts will provide assurance and comfort that the company will be prepared to respond to whatever comes its way. But if they’re not prepared, then audit will help influence change. You’re able to identify gaps and be included in their plans to continue to evolve.
Richard Chambers: Certainly, in the environment that you’ve operated in at Google over the years, you’ve seen such extraordinary change even within the organization itself — how does management react to internal audit as agents of change?
Lisa Lee: I can’t imagine management or the board not wanting an organization that they’re investing in to add value. Of course, it’s important to do that in the context of internal audit’s mandate. I’ve found that management and our board is receptive to this approach, as it allows the opportunity for risks to be proactively managed and addressed versus being reactive.
If internal audit engages after a process and systems have been built, then you’re reworking things and you’re redoing things. In cases where we haven’t been able to get in early at Google and we’ve audited after, let’s say a launch of a system and we have our stakeholders tell us, “I wish you’d come in earlier because it would have saved us a whole lot of time if you were walking alongside us, talking to us about risk, getting us to think differently and proactively about certain things.” I don’t necessarily see it as that internal audit is doing things for them, but we’re thinking ahead and asking the same questions that you would’ve asked in the backend — but while they’re building.
Navigating Ambiguity & “Storyboarding” to Effectively Communicate about Risk
Richard Chambers: What are some of the things that you’ve done in internal audit at Google to keep internal audit agile and changing as you’ve helped to lead growth?
Lisa Lee: Given the work that we do, auditors can sometimes gravitate towards eliminating risk or making sure there’s predictability and really structured processes for them to operate within. But in order to effectively operate in a dynamic environment, it’s important to be comfortable navigating ambiguity, making decisions in a timely manner with incomplete or imperfect information.
I think it’s also important to share that the audit plan is anchored in a risk-based approach. We’ve spent a lot of time working on developing our audit plan based on the results of our annual risk assessment that identifies the top risks of the company. That way, when we go to audit, if there’s any observations that we’re identifying, management is already aligned because it’s already related to something that’s really important to them.
While we may execute our audits and work based on processes, I think our leaders aren’t interested in hearing about processes, necessarily. They want to engage by talking about risk management and how well they are prepared in managing those risks.
Richard Chambers: That may be a characteristic that you get to take advantage of in the technology industry, because I can tell you that other industries where I’ve had some exposure, management would often much rather talk about processes than risk management, because they’re just more comfortable having the internal auditors play that traditional role looking at policies and processes and procedures than telling them what they do and don’t know about risk.
Lisa Lee: What we’ve tried to do at Google is to marry the two concepts. We’ve created this concept called storyboarding where we start with the risks, but how we execute our audits is based on processes.
Our audit plans are a document that shows risk on one axis and processes or auditable entities on the other. Then we identify what audits we’re doing and how those risk areas touch those different process areas. Because it does come back to how you execute the work that we need to do. I’ve definitely encouraged many that I’ve talked to in the regulated environment to launch and iterate, to explore and experiment — to see what’s possible.
Richard Chambers: I remember the first time you were telling me about the storyboarding approach you used and how awesome it was. It just seemed so innovative and so different from the way a lot of internal audit departments do their very routine, methodological auditing.
Lisa Lee: We found success in communicating with our stakeholders with it because they want to understand. What we’ve tried to do in audit at Google is move quickly. But if you’re moving quickly, sometimes we’re taking pieces of a process. How do you ensure that you’re not overwhelming the business — death by a thousand cuts? They’re seeing little bits and pieces, but if you’re explaining to them the story of how your audit is going to help address the risks, then they understand how all those pieces come together.
I also feel that by taking pieces of the puzzle, you’re giving them information on a more timely and regular basis so that they can react. The goal isn’t for audit to say, “I got you!” The goal is to say, “I’ve given you insights so that you can continue to adapt, evolve your processes, and be ready.”
Upskilling Google’s Auditors with Technology & Data Science
Richard Chambers: It’s not to say “I got you” — it’s to say “I helped you.” One of the great capacity multipliers that I always point to is technology. Are there some ways that you have used technology that you’re particularly proud of?
Lisa Lee: One main way is that we’re investing in our technology audit skills — recognizing that the more tech savvy our auditors are, the more they can not only apply, but interpret technological advancements in the areas that they’re auditing. They can learn to sample better, and actually execute audits better by writing scripts.
Secondly, we’re investing in data science. This has been critical to help inform how we approach an audit. Given the increase in AI and Machine Learning models we’re coming across in our audits, being able to develop some of those technologies within our own team and apply them has been incredibly useful.
Why Innovators Need a Launch & Iterate Approach
Richard Chambers: In researching for Agents of Change, we surveyed more than 600 chief audit executives from around the world and we synthesized their views on what it takes to be a real change agent in internal audit into four characteristics: business acumen, strategic mindset, relationship-centric, and innovative. Are there any others that jump out at you when you’re looking for someone to join internal audit with this change agent mindset?
Lisa Lee: I would add a flexible mindset and adaptability. Some may include that in being innovative, but I think it’s slightly different. Most of us think of innovation as coming up with new ideas or better ways to do things — that only works if you’re comfortable with a launch and iterate approach, right? What makes that process successful is being okay with failure.
To me, translating the ability to fail and learn from it requires having a flexible mindset and adaptability. I’ve always tried to get others thinking: what is the difference between waste and R&D? At its extremes I think it’s obvious, but there are times where it’s more likely about intent and that’s not always clear, so auditors need to be flexible and not fear failure. They can’t think about things that go wrong as a waste.
Training & Retaining Tech-Savvy & Innovative Auditors
Richard Chambers: I get asked a lot, what do I think are the big challenges and opportunities for internal audit in the decade ahead? No one can look farther out than three or four years, probably, in this day and age. But if I ask you to look ahead, what are some opportunities that lie in front of us as a profession?
Lisa Lee: I would tie them together in the sense that acquiring and keeping our talent is going to be really challenging as we move forward in the future. The skills that we’ve talked about are in high demand and can be applied across many different professions. Being change agents can help us attract that talent in the type of work that we do. I think people are always interested in learning something new, and if we’re always looking backwards, it will be challenging to retain talent.
Turning to opportunities, I think the biggest opportunity for us is, how do we develop some of that talent? There’s an opportunity to train our auditors to be more technologically savvy and innovate the way that we do things. It’s like being a consultant in some sense, though I want to be careful in how I phrase that. We have a mandate that we have to fulfill, but I think the skills and the techniques that consultants utilize is something that we can use well in the audit process. Engaging auditors in the business, understanding the strategic objectives — I think that is going to keep our auditors interested in the profession.
Stay tuned for more Agents of Change episodes featuring conversations about innovation in internal audit with forward-thinking leaders from some of the world’s most prominent organizations.
