Internal Audit
August 10, 2021 • 5 min read
Agents of Change: Lisa Lee of Google
ON THIS PAGE
Join Richard Chambers for a new installment of his Agents of Change video series, featuring conversations with internal audit leaders from some of the world’s most prominent organizations about innovation in the profession.
In this episode, Richard sits down with Lisa Lee, Vice President of Audit at Alphabet/Google, to discuss how her audit team gets involved early to stay ahead of the curve in their dynamic business environment, including:
- Why innovation requires not just good ideas — but also a flexible mindset and willingness to iterate.
- How Google’s “storyboarding” approach leads to better communication and understanding about risk.
- How investing in data science skills enables her auditors to apply and interpret tech like AI and ML in their audits.
Watch the full conversation, and read the can’t-miss highlights below.
How IA at Google Moves at the Speed of a Fast-changing Tech Company
Richard Chambers: I remember how exciting it was when I came to visit you and your staff out at Google a few years ago, because it was obvious that you were forging an entirely new direction for internal audit in the organization. In my book, Agents of Change: Internal Auditors in an Era of Disruption, I make the case that internal auditors should be change agents: catalysts for transformation that creates value. Do you agree that that’s an appropriate role for internal audit, and is that how you would define a change agent in the internal audit realm?
“Lisa Lee: Absolutely. The keywords there are around being able to add value. I think that we had no choice at Google. Things were moving so quickly and the environment was changing so dynamically that if we weren’t adaptable — if we weren’t change agents, as you say — we wouldn’t be adding value in any way.”
Richard Chambers: Certainly, in the environment that you’ve operated in at Google over the years, you’ve seen such extraordinary change even within the organization itself — how does management react to internal audit as agents of change?
“Lisa Lee: I can’t imagine management or the board not wanting an organization that they’re investing in to add value. Of course, it’s important to do that in the context of internal audit’s mandate. I’ve found that management and our board is receptive to this approach, as it allows the opportunity for risks to be proactively managed and addressed versus being reactive.”
Navigating Ambiguity & “Storyboarding” to Effectively Communicate about Risk
Richard Chambers: What are some of the things that you’ve done in internal audit at Google to keep internal audit agile and changing as you’ve helped to lead growth?
“Lisa Lee: Given the work that we do, auditors can sometimes gravitate towards eliminating risk or making sure there’s predictability and really structured processes for them to operate within. But in order to effectively operate in a dynamic environment, it’s important to be comfortable navigating ambiguity, making decisions in a timely manner with incomplete or imperfect information.”
Richard Chambers: That may be a characteristic that you get to take advantage of in the technology industry, because I can tell you that other industries where I’ve had some exposure, management would often much rather talk about processes than risk management, because they’re just more comfortable having the internal auditors play that traditional role looking at policies and processes and procedures than telling them what they do and don’t know about risk.
“Lisa Lee: What we’ve tried to do at Google is to marry the two concepts. We’ve created this concept called storyboarding where we start with the risks, but how we execute our audits is based on processes.”
Richard Chambers: I remember the first time you were telling me about the storyboarding approach you used and how awesome it was. It just seemed so innovative and so different from the way a lot of internal audit departments do their very routine, methodological auditing.
“Lisa Lee: We found success in communicating with our stakeholders with it because they want to understand. What we’ve tried to do in audit at Google is move quickly. But if you’re moving quickly, sometimes we’re taking pieces of a process. How do you ensure that you’re not overwhelming the business — death by a thousand cuts? They’re seeing little bits and pieces, but if you’re explaining to them the story of how your audit is going to help address the risks, then they understand how all those pieces come together.”
Upskilling Google’s Auditors with Technology & Data Science
Richard Chambers: It’s not to say “I got you” — it’s to say “I helped you.” One of the great capacity multipliers that I always point to is technology. Are there some ways that you have used technology that you’re particularly proud of?
“Lisa Lee: One main way is that we’re investing in our technology audit skills — recognizing that the more tech savvy our auditors are, the more they can not only apply, but interpret technological advancements in the areas that they’re auditing. They can learn to sample better, and actually execute audits better by writing scripts.”
Why Innovators Need a Launch & Iterate Approach
Richard Chambers: In researching for Agents of Change, we surveyed more than 600 chief audit executives from around the world and we synthesized their views on what it takes to be a real change agent in internal audit into four characteristics: business acumen, strategic mindset, relationship-centric, and innovative. Are there any others that jump out at you when you’re looking for someone to join internal audit with this change agent mindset?
“Lisa Lee: I would add a flexible mindset and adaptability. Some may include that in being innovative, but I think it’s slightly different. Most of us think of innovation as coming up with new ideas or better ways to do things — that only works if you’re comfortable with a launch and iterate approach, right? What makes that process successful is being okay with failure.”
Training & Retaining Tech-Savvy & Innovative Auditors
Richard Chambers: I get asked a lot, what do I think are the big challenges and opportunities for internal audit in the decade ahead? No one can look farther out than three or four years, probably, in this day and age. But if I ask you to look ahead, what are some opportunities that lie in front of us as a profession?
“Lisa Lee: I would tie them together in the sense that acquiring and keeping our talent is going to be really challenging as we move forward in the future. The skills that we’ve talked about are in high demand and can be applied across many different professions. Being change agents can help us attract that talent in the type of work that we do. I think people are always interested in learning something new, and if we’re always looking backwards, it will be challenging to retain talent.”
Stay tuned for more Agents of Change episodes featuring conversations about innovation in internal audit with forward-thinking leaders from some of the world’s most prominent organizations.
You may also like to read
Internal Audit
InfoSec
Cybersecurity Audit Essentials: Roles & Responsibilities, Steps, and Best Practices
Internal Audit
Navigating Internal Audit Challenges in Retail: A Strategic Approach to Risk and Compliance
Internal Audit
Healthcare Audit: Ensuring Compliance and Improving Patient Care
Internal Audit
Cybersecurity Audit Essentials: Roles & Responsibilities, Steps, and Best Practices
Internal Audit
Navigating Internal Audit Challenges in Retail: A Strategic Approach to Risk and Compliance
Discover why industry leaders choose AuditBoard
SCHEDULE A DEMO
