Join Richard Chambers for a new episode of his Agents of Change video series, featuring conversations with internal audit leaders from some of the world’s most prominent organizations about innovation in the profession.
In this episode, Richard sits down with Shannon Urban, Vice President and Chief Audit Executive at Hasbro, Inc., to discuss how internal audit can think innovatively and transform to meet the changing needs of their stakeholders and organizations, including:
- Taking advantage of cross-organizational perspective to offer guidance on mission-critical areas.
- Speaking the language of the business to change outdated perceptions of internal audit.
- Cultivating savviness to rally people and resources for transformative change.
- Making internal audit indispensable by translating data into insight and foresight to help drive business decisions.
Watch the full conversation, and read the can’t-miss highlights below.
Cross-Org Perspective & Access Positions IA as Effective Change Agents
Richard Chambers: Shannon, I authored a book on Agents of Change: Internal Auditors in an Era of Disruption. I think we can certainly agree that we have been in a period of disruption now for a number of years and it’s what makes things exciting for us as internal auditors, would you agree?
Shannon Urban: Yes, and one of the reasons I’ve stayed in internal audit as long as I have is that I’m constantly faced with challenges and learning new things. It does keep things exciting.
Richard Chambers: I had a similar experience earlier in my career. I once took a short hiatus from internal audit in an accounting role, and I nearly died of boredom. I wanted to get back into internal audit where I could get my fingers on so many different things. In the book, I defined agents of change as those internal auditors who are catalysts for ideas that help transform and improve the business. Is that how you would define an agent of change, and what’s your view about internal auditors being in an influential position to foster change?
Shannon Urban: I think internal auditors are actually uniquely positioned to be great agents of change across our organizations. We have this purview that gives us cross-organizational perspective. We’re regularly interacting at the highest levels of the organization. We’ve got unfettered access and license to, quite honestly, question and provide our thoughts on areas that are mission critical to the business.
I love the definition that you came up with in the book because it hits on two critical traits that I think all internal auditors will need to be successful in the future. First, the concept of being a catalyst, which means to precipitate action. Here we’re talking about transformative action, so that means we need to think big and think differently than we have historically. Second is the concept of creating value, which means that the work that we’re doing is actually making the business better. It’s moving it forward.
Again, I think we’re in a position to bring unique value to those kinds of discussions because we think about risk and opportunity, drivers of risk and how to manage those risks, as well as bringing a strong foundation in governance and internal control, which a lot of folks don’t have. As I said, we’re really well positioned to be change agents in our organizations.
Change Agents Speak the Language of the Business
Richard Chambers: You have a unique perspective, I’m sure, because of all of the folks we’re interviewing for this series, you’ve spent a longer time in client service and probably had the chance to touch more internal audit functions than everyone else combined. My question to you is, from your experience, not just where you are now, but across those years of working in client service at EY, does management and the board believe that internal auditors should be agents of change?
Shannon Urban: One of the reasons I stayed in consulting for so long was the opportunity to interact with, learn from, and work with so many amazing companies. Based on my experience, I think management and boards value internal audit. The one challenge I see is that they expect us to show up a certain way. They expect us to come in and tell them everything they’ve done wrong. It was a very old school view, based on their past experiences.
But when we show up differently, when we come in talking about the business and the risks to the business and strategies and impacts and outcomes, and we’re bringing insights they haven’t contemplated yet coming out of our work, then we’re speaking their language— and they really welcome that.
So as long as we can pivot as internal audit to really be a business partner and speak the language of the business and bring that unique risk and control perspective to the table, in my experience, management and boards are very receptive to that.
Transforming to Meet the Needs of Our Stakeholders and Organizations
Richard Chambers: Now, in the book, I argue that before internal auditors can be seen as credible change agents in their organizations, they have to be willing to look at internal audit itself and implement transformative change where needed. Do you agree with that, and what are the areas that you think are the most ripe for enhancement in an internal audit function?
Shannon Urban: Richard, I completely agree. I’ve been saying this for a long time, just like it’s an imperative for the business to continually stay on top of change that’s impacting them and the need to adapt to meet the market, customer needs, increased competition, whatever the driver is — so do we, as internal audit, need to transform to meet the needs of our stakeholders and our organizations. We need to be innovative. We need to be thinking differently than we have before.
I used to work in consulting, and I joke sometimes that I’ve worked with internal audit functions that felt like I was jumping back to 1999 — some of the same practices that I had used early in my career. It’s quality work and great audits, but following dated practices that really weren’t in tune with the environment or what the organization needed. The need to transform can sometimes be a little bit threatening — it’s big word, right? It denotes major change, but we need to look at our ways of working in internal audit and challenge if it’s still fit for purpose and achieving the objectives that our organizations need from us.
Technology is one area that I know a lot of organizations are jumping into — data mining, data analytics, those kinds of things. Even things that are a little bit more straightforward, we’re taking a look at our processes, how we pull together audit reports, and what the content and structure of those reports are so that they’re more easily digested by management. It can be something as simple as that to help move the function forward.
Thinking Innovatively about Leveraging Powerful Tech Capabilities in Audit
Richard Chambers: Yes, you mention technology and certainly that’s a very important capacity multiplier that makes internal audit more efficient and effective. Are there any practices you’ve seen that really stand out from your years working with internal audit functions? What areas do you think are the most powerful for internal auditors to be looking at?
Shannon Urban: I think we can all agree that the power of data and being able to access data and turn that into information is an added capability for internal audit. We’re very used to only seeing a sample of the population, or a small subset of transactions across the business. When you can grasp all of that data and look at it holistically over not just three months or a year, but three years, multiple years — bringing all that together, it’s incredibly powerful. The data tells you a story about what’s happening across the organization, and if things are working the way they’re supposed to or not. That ability to do data mining, and even process mining, leveraging the capabilities in technology today is powerful. We’re not there yet at Hasbro, but we realize that that’s something we need to invest in over the short-term, pretty quickly.
Savviness Is a Key Attribute for Change Agents to Get Things Done
Richard Chambers: For the book, we reached out to chief audit executives like yourself to ask what are some of the attributes that they bring to the table? We narrowed it down to four broad attributes that powerful change agents share: business acumen, strategic mindset, innovative, and relationship-centric. Is that a list that resonates with you, and are there other things that you might add to it?
Shannon Urban: Yeah, I think those are absolutely four characteristics that anyone who wants to be a change agent needs. Change agents generally need to think like executives. We need to speak the language of the business. You need to make investments in relationships to be good business partners and constantly approach things with an eye toward, “what is the opportunity for change within the organization?”
I think change agents also understand that without those partnerships, nothing happens in an organization. You need to know how to socialize your ideas, how to gain support, and rally the right people and the right resources around any kind of idea toward change, whether it’s something we’re trying to do for ourselves within internal audit, or something we’re trying to promote out in the business. If I were to add anything to that list, I think it would be — call it an element of savviness, knowing how things get done, in many cases how things get funded in your organization. I’d also throw in the confidence to work that network of business partners and relationships to get things done.
Collaboration Boosts Internal Audit and the Organizational Success
Richard Chambers: One of the things that I recall from our years working together over at The IIA was that you were a huge proponent of collaboration — to borrow a phrase out of The IIA’s current Three Lines guidance, independence doesn’t mean isolation. I recall that your proponency of internal audit collaborating with the other lines created a powerful alliance that could benefit the organization. Any additional insights you might share, and do you think collaboration is important to be effective as a change agent?
Shannon Urban: Collaboration is critical, and I was very fortunate to be a member of the working group on the refresh of the Three Lines of Defense model. One of the things that we constantly talked about was, while it’s important for internal audit to be independent and objective, that doesn’t mean we operate in a bubble and don’t talk to anyone or don’t coordinate with anyone else across the organization. In fact, we’re better at what we do in internal audit when we have those relationships and when we do work with others. And the general reality is, for many internal audit functions, **we can’t cover all the risks we want to, and so we need to rely on others. **
We need to have partnerships with traditional second line roles like compliance, risk management, and quality assurance because they play vital roles in the organization as well. That concept of combined assurance — or just generally working together — to make sure somebody’s got their eye on the myriad of risks that any organization is facing on a global basis today is critically important.
We need that to be really successful and the organization needs it as well. If we’re all operating in our own little silos or swim lanes, not sharing information, not coordinating our work, there’s going to be overlaps in what we’re doing, which is completely inefficient, and there’s going to be gaps where risks fall through the cracks, and that’s the last thing we need to happen today.
Translating Data into Insight and Foresight for the Business
Richard Chambers: It’s not uncommon that I get asked, and I have over the years more times than I can remember, what do I see in the future for internal audit? And if I were to ask you to pull out your crystal ball and talk about what the challenges and opportunities are for the next 10 years for this profession, what would be the things that jump to mind?
Shannon Urban: The biggest challenge that we’re going to face will be staying ahead of risk. We have to build a core competency across all levels in internal audit to be able to constantly pull in data, external and internal information, insights, thought leadership, studies, you name it — and really analyze, understand, digest: what are those trends, those activities, whatever’s happening out there in the world.How is that going to impact our organization? And then helping to make sure that the organization’s paying attention to that as well.
I think that with the pace of change, the velocity of risks increasing at a multiple, year over year, this is going to become harder and harder to do. If we continue with our annual risk assessments, or just going out to the business and meeting with them a couple times a year, and saying tell me about your risks, I think we get closer and closer to being irrelevant for what the business really will need over the next 10 years and beyond.
If we’re successful, I think it creates a tremendous opportunity for us as well because it enables us to be forward looking, not just backward looking, and it’s hugely valuable to the business. If we can help the business sift through all that noise, translate all that data into insight and foresight, help them to look forward and see around the corner, then I think we’ve become more akin to being indispensable than irrelevant.
Stay tuned for more Agents of Change episodes featuring conversations about innovation in internal audit with forward-thinking leaders from some of the world’s most prominent organizations.