The Future of Internal Audit: Dinosaurs, Chickens, and Data Divas

Want to find out how Richard Lee, Senior Director and Head of Internal Audit at Snap Inc., sees the future of audit? This article, originally delivered as a presentation at AuditBoard’s 2019 User Conference, explores how Lee built a next-gen internal audit function with a cutting-edge skill set, the social capital to boost collaboration and performance, and the data analytics capabilities to wow the CFO and Audit Committee —  with a healthy dose of dinos and chickens. 

The Future of Internal Audit

There’s no shortage of thought leadership on the future of internal audit, but it doesn’t always conjure the excitement it should given the inherent boundary-pushing, status-quo-overturning nature of the subject. This article is my attempt to take a dry topic and add some interest — read on to learn how to rethink the auditor skill set, team organization, and everyday work of audit by way of dinosaurs, super chickens, and Data Divas.

Dinosaurs Are Awesome — But Don’t Become One

What are some of the similarities between dinosaurs and internal auditors? To start with the obvious, both are awesome. Auditors protect the CFO from going to jail. We’re good at mitigating risks, and we do a lot of work to help our business partners and add value. Dinosaurs are particularly awesome. They ruled the Earth for millions of years, and during that time they had to mitigate a lot of risks. Dinosaurs, as well as audit as a profession, have both been around for a very long time. 

But as awesome as they were, dinosaurs became extinct — and internal audit is next. The profession hasn’t changed much in the 20 years I’ve been an auditor. We’re still doing our procedures in much the same way. We’re still making glossy 30 page internal audit decks that no one ever reads. I’ve had eight new iPhones in the time I’ve been an auditor, and I still test procure to pay the exact same way.

I want to challenge myself and others to adapt and prevent ourselves from stagnating. These are my top three methods to push myself and my team to avoid going the way of the dinosaur:

1. Continue to challenge the status quo 

I constantly encourage my team to think about how we can do things differently. Why do we test the same way we did last year? There’s got to be a better way! Snap is a tech company, but surprisingly our processes are not always technologically advanced. I tell my team to be creative and explore without fear of failure. We have a whole building full of engineers nearby — go build a relationship and see what you can bring back to make internal audit more efficient and less manual.

2. Cultivate insatiable learning

I’m not just talking about the new Standard 606 or the latest COSO framework. Get outside the narrow topics of internal audit, finance, and business to develop a broader intellectual curiosity. Learn about history, learn about black holes, learn about dinosaurs. Insatiable learning will increase your diversity of thought and potentially help you find creative solutions for your day to day problems. 

3. Identify and develop new relevant skills

Understand what skills are important to your organization and work to develop them. At a tech company like Snap, a big portion of our business relates to code, development, and data. The engineers eat, drink, and breathe code. You must speak their language to build a rapport with them, but most auditors who join our team don’t bring that type of knowledge or experience. I encourage my team to take the time to get familiar with Python and SQL so we can talk to our engineers about their processes and get them on our side. This example is from a tech perspective, and in other industries it might be a deep understanding of the revenue process, developing skills over your ERP, or learning new languages. Overall, stay hungry to learn the next big thing, and always be looking to add to your toolbox of skills. 

The Super Chicken Paradox

The future of internal audit as a value-add function depends in large part on becoming more productive in our day to day work. As a part of my own insatiable learning, I became interested in the super chicken paradox when I saw a recent TED Talk, and it’s pushed me to rethink some of my assumptions about workplace dynamics and team performance. 

The talk examined an experiment that a professor at Purdue University conducted to answer the question, “How do we make our teams more productive?” He wanted to compare how productive different chickens were at laying eggs, so he took a flock of chickens that were fairly productive — your run of the mill chicken — and he let those chickens propagate over six generations. He also created a super flock composed of the most productive chickens — a team made of the Jeff Bezos and Steve Jobs of chickens. After six generations, he compared the two flocks to see which had the highest egg production. The flock of normal chickens were plump, happy, and were producing a lot of eggs. In the flock of super chickens, most had pecked each other to death, and the few that remained were in very poor health. 

What lessons can we learn about human behavior from the super chickens? One of the general challenges — not just of internal audit, but of companies or firms in general — is that we can breed a culture of competition where your success be contingent on the failure of others. This leads to tension and resentment between peers and a catastrophic loss of productivity and creativity. Why would I want to share ideas with the person next to me if we’re competing to be the “best chicken” or get that next bonus? This is a terrible way to operate.

We can improve how internal audit teams function by thinking about how to prevent teams of super chickens. These are three practices I’ve implemented with my team in the past year to improve collaboration and performance:

1. Build social capital with your team members

Social capital is the trust quotient — how much you trust your team members. Only time can build social capital. Get to know your co-workers to really understand their interests, annoyances, what makes them laugh, and especially what motivates them. The best part is that it actually compounds as you spend it, building better and more high-performing teams over time.  

2. Forget the old school hierarchical structure

A flat organizational structure allows for faster thought sharing and velocity of action. Before innovation can happen in the hierarchical structure of a typical internal audit shop, the staff must ask their seniors, who ask the manager, and so on up the chain. My team has people with different titles and levels, but I try to instill the sense that we have a flat board structure. I want to hear ideas from everyone, not just my leadership. I’ve worked to build trust with my team members so I can go directly to a senior to ask a question, and that senior has the social capital to ask me one as well. It’s important that we share those questions so we can think together, have diversity of thought, and move faster. 

3. Prioritize each team member’s success above your own 

To me, this is common sense, but I’ve heard stories from others who tell me they don’t like working with or for other team members because they weren’t good, intelligent, etc. My first question is always, “What did you do? Did you ask how you could help them, or did you just throw them to the wolves?” I can’t succeed as the head of internal audit unless each one of my team members succeeds before me. I don’t have to work on looking good in front of the Audit Committee because I focus on my team — making sure they have the education, tools, and support they need to be successful. Then they each do good work, we build social capital, the team succeeds, and it reflects positively on the leader of that high performing team. 

I do have some data to back up these best practices. When I came to Snap Inc., they had just conducted a people survey of the internal audit team. The survey showed almost three quarters of the internal audit team felt “passion, satisfaction, and connection in the workplace” and self-reported a “likelihood to stay.” On the surface, these numbers are pretty good, but we still looked for ways to improve. I put the strategies outlined above into practice, and a survey six months later showed that 88% of our team feels satisfied in their work and general happiness, and 93% of my team feels like they’re here to stay. That’s a lot of ROI from building trust and supporting your team members! 

Become a Data Diva

A Data Diva, as I define it, is someone with intimate knowledge of the kinds of data in your organization, and how to obtain, organize, and interpret them. I chose the term “Data Divas” instead of “Data Dudes” or “Data People” because our internal audit metrics assurance team is entirely composed of women — and because I have two daughters, and I want to encourage more women to enter this field because we need that diversity of thought and inclusion on our teams. 

What do Data Divas do? Not unexpectedly, Data Divas are using data analytics. For instance, they’re finding creative and interesting ways to leverage a tool called Alteryx that automates workflows. This helps not only their own work, but they’re also figuring out how to streamline other team members’ work, and potentially help other teams leverage data as well. Data Divas also audit non-financial metrics, which has been a hot topic with Audit Committees for a while. Not everyone works at a tech company, but everyone has some sort of non-financial metric they can audit — the company serves X number of people, or there is Y amount of revenue per store. Our Data Divas are leveraging data and our engineering team to audit non-financial metrics, and our CFO and Audit Committee love it. 

Our Data Divas are also implementing continuous auditing techniques that improve coverage while saving time and resources. For example, at Snap engineers have access to run queries and potentially update our backend databases. As part of our change management process, there is an automated control that creates a JIRA ticket with Google logs appended whenever any engineer touches that database. The challenge is that last year alone we had 40,000 tickets — how do you test 40,000 tickets? 

• The first step is to understand what the engineers are doing. When we looked into it, 99% of the actions were just querying the data to run some analytics, which doesn’t update the database. 
• How are they making these queries? They’re using SQL, and because I’ve developed relevant new coding skills, I know that there are only seven SQL commands that allow an engineer to update data. 
• So, instead of selecting a random sample of 25 or 100 tickets to test, we got an engineer to help write a script that trolls the logs looking for those seven words. If those seven terms aren’t there, then we know that ticket is just for a query with no risk of updating data. 
• Now, we pull data quarterly, run this script, and have full, continuous coverage. We take a sample of one at the beginning of the quarter for a walkthrough to prove that control is still working, and then we do one in the middle and end of the year to make sure the control and process hasn’t changed. 
• Using data to our advantage in this way satisfies our control test and saves a lot of resources versus having to troll through all the data to test 25 samples. This is just one example — think of all the other ways you might rethink how you test SOX or get comfort in your operation reviews!

All this may sound daunting, and you may be wondering how you can acquire the knowledge to become a Data Diva too. I learned SQL and Python, which are the basics of data science, for $26 combined. There are lots of inexpensive resources, and they range from getting a certificate in Python to an actual online degree. For internal audit, you just need to put in the time to learn the basics. I could never replace an engineer at Snap, but I can speak intelligently to our engineers about their processes. A residual effect of this diversity of thought is that I now think about how I might write my own scripts to extract data, automate things, or tap into application programming interfaces (API)… and more! 

To Bring it Full Circle — Who is the Future Internal Auditor?

They aren’t a dinosaur because they’re constantly learning new skill sets and challenging the status quo. They haven’t succumbed to the super chicken paradox because they haven’t lost sight of the importance of leveraging strong teamwork to create a high-performing team. They’re a Data Diva who makes data a core part of their skill set to creatively improve how auditors do our work. They’re a person who is going to push internal audit forward as a profession — and not let it go extinct!