We’ve been talking about agile auditing for years, so why are a few succeeding and others are reluctant to embrace it or failing in their implementation?
Agile doesn’t mean faster, and it doesn’t apply to just one part of the audit process. It is a paradigm shift and one of the most important changes to #internalaudit in many years.
I am talking with Toby DeRoche, who has spent the last several years understanding exactly how to apply the principles of agile into the whole audit process in a practical way. What works, what doesn’t, what organizations are really doing that are successful, and is here to share so you can make the shift to agile auditing and avoid the painful learning curve.
Listen in at: http://www.jasonmefford.com/jammingwithjason/
When you are ready for the step-by-step “how to” for agile auditing, learn more about the Certified Agile Auditor Professional (cAAP) course mentioned during this episode at: https://ondemand.criskacademy.com/p/caap/?affcode=105582_jpp6czlf/
Transcript
1
00:00:01.530 –> 00:00:10.349
Jason Mefford: Hey everybody, I’m back talking with Toby de Roche again and this today. This day this day would be the same as today. I think right so
2
00:00:11.400 –> 00:00:24.600
Jason Mefford: We’re going to be talking about agile auditing, because I know, I think, well, I know there’s some misconceptions out there about agile auditing what it is. And I know a lot of people are struggling to actually
3
00:00:25.230 –> 00:00:31.230
Jason Mefford: Put something in practice that works. And so we’re going to dig into that today because
4
00:00:31.650 –> 00:00:42.060
Jason Mefford: You know Toby’s you you’ve done some work a lot of work on this there’s kind of some common misconceptions that people have and some things that are missing.
5
00:00:42.690 –> 00:00:52.320
Jason Mefford: And when those things are missing or you have these misconceptions. It’s almost impossible for you to actually switch to an agile approach right
6
00:00:52.380 –> 00:00:52.980
Toby DeRoche: It is, yeah.
7
00:00:54.030 –> 00:01:07.290
Jason Mefford: Well, so let’s so let’s jump in because I wanted to talk maybe let’s talk first about some of the misconceptions in the first one that I kind of see, you know, as people think that agile auditing just means they’re auditing faster.
8
00:01:08.160 –> 00:01:09.060
Jason Mefford: Is that what it is.
9
00:01:09.570 –> 00:01:11.040
Toby DeRoche: It’s not at all. You know, it’s
10
00:01:11.880 –> 00:01:13.110
Jason Mefford: It’s oh
11
00:01:13.680 –> 00:01:15.120
Toby DeRoche: It’s wrong. Everybody’s wrong.
12
00:01:16.890 –> 00:01:22.500
Toby DeRoche: One of the first things people think is that they’re going to start having these really, really short, really, really fast audits.
13
00:01:23.070 –> 00:01:29.940
Toby DeRoche: You know, and I’ve even seen people posting on LinkedIn. Like, I’m so frustrated with this whole agile thing. How am I supposed to do an audit and six days.
14
00:01:30.600 –> 00:01:42.810
Toby DeRoche: Like, well, why in the world would you think you can do an audit and six days like that’s not the point of this, the whole point wasn’t for us to be able to audit pastor, the whole agility idea is that I’m honored in the things that matter right now.
15
00:01:43.770 –> 00:01:55.620
Toby DeRoche: Yeah. And so, like, you know, everybody should be aware of that right now this is this is we all just loved it. Right. We went through all of our audit planning at the end of 2019
16
00:01:56.820 –> 00:02:01.020
Toby DeRoche: And then at the beginning of 2023 year plan to trash because it didn’t make any sense at all anymore.
17
00:02:01.710 –> 00:02:04.980
Jason Mefford: Well, I think the same things going to happen with 2020 on a plans to
18
00:02:05.190 –> 00:02:15.180
Toby DeRoche: I think unfortunately we’re never going to stop this because our new reality is I need to be able to look ahead and a short time frame. I can’t say what’s going to happen a year from now.
19
00:02:15.840 –> 00:02:22.800
Toby DeRoche: Things changed with us and it’s hilarious because we’ve been having this conversation for years now about auditing its speed of risk.
20
00:02:25.260 –> 00:02:26.100
Toby DeRoche: We’re here, right.
21
00:02:26.340 –> 00:02:30.180
Jason Mefford: So we’ve been here for a long time just people, people aren’t getting it, you
22
00:02:30.240 –> 00:02:36.540
Toby DeRoche: Know, they’re not. And if you look at people’s a lot of plans and their full compliance and they’re full of socks. They’re full of other stuff.
23
00:02:37.590 –> 00:02:44.100
Toby DeRoche: And then they try to just squeeze in their risk based work, but that if that’s our focus if we’re truly risk based on it.
24
00:02:44.940 –> 00:02:55.620
Toby DeRoche: I can’t plan ahead. More than three months because three months from now, the world looks wildly different than it does right now. And so much has changed that things I thought were important back in December.
25
00:02:56.670 –> 00:03:07.530
Toby DeRoche: By the time I get to June, July, no, that makes any sense anymore, do I need to reevaluate. I need to think about what’s the new priority. So if I’m only planning stuff one quarter out
26
00:03:08.280 –> 00:03:11.970
Toby DeRoche: And I get into this regular cadence of saying, I’m going to audit plan for one quarter.
27
00:03:12.840 –> 00:03:18.960
Toby DeRoche: Right now, what’s important to management with their strategic objectives and what’s going on in the world. Here are my audit based on that.
28
00:03:19.650 –> 00:03:28.290
Toby DeRoche: And I’m do the same thing in March going to come up with the next set. I’m going to come up with the next three months after that and and my plan is that always updating
29
00:03:29.370 –> 00:03:34.500
Toby DeRoche: You kind of get into this holiday continuous planning mode continuous risk assessment.
30
00:03:35.550 –> 00:03:41.580
Toby DeRoche: To think i can’t i can’t project, realistically, so let me just say for right now I’m gonna take one work.
31
00:03:43.260 –> 00:03:53.370
Jason Mefford: Well, and I think, though, right, that, that, that kind of leads into one of the second myths that a lot of people have, which is, well, if I’m doing agile, a lot of things that I don’t do any
32
00:03:53.760 –> 00:04:08.550
Jason Mefford: Audit planning. Right. I mean, I think, again, that’s not quite right. Yeah, you’re not going to do annual cycles. But, so, how, how does it look different. It doesn’t mean that we just throw planning out completely, but how does planning look a little bit different.
33
00:04:08.910 –> 00:04:19.680
Toby DeRoche: Well, and this is even, you know, you say, we’re going to have quarterly plans in the financial services guys have a heart attack because they’re used to the regulators coming back and saying, show me your three year plan.
34
00:04:20.070 –> 00:04:34.530
Toby DeRoche: And, you know, and we can’t get out of this idea that I have to have a three year plan. So let’s say for most of us, right. We’ve got an annual there’s nothing wrong with still saying I have an annual plan because you’re going to have some compliance work. You just have to be
35
00:04:35.250 –> 00:04:38.280
Toby DeRoche: So maybe you’re starting with that and saying, so here’s when those
36
00:04:38.340 –> 00:04:46.710
Toby DeRoche: Required projects are going to happen, or I have these risk based ideas, but some of those audits have to happen at certain points in the year.
37
00:04:48.090 –> 00:04:51.630
Toby DeRoche: And the thing that’s going to change is going to be. So if I’m looking at Q1.
38
00:04:52.710 –> 00:04:54.210
Toby DeRoche: Then I’m going to put my plan together.
39
00:04:55.320 –> 00:05:08.670
Toby DeRoche: Q ones risk assessments as I should do these 10 audits based on the risk assessment now of those I have capacity to do five. So I’m going to pull those five and put that in the queue one because right now that’s what’s important.
40
00:05:09.720 –> 00:05:15.810
Toby DeRoche: But my capacity might be, you know, here’s what I can do. In total mind is what I know I have to do this quarter. Here’s what I have left.
41
00:05:16.500 –> 00:05:25.320
Toby DeRoche: So those five extra projects that I’m doing that’s, you know, part of the accumulation of everything that I could have done because everything is going to be based on your capacity.
42
00:05:27.090 –> 00:05:35.130
Jason Mefford: And I think that’s an important thing to remember, too, because again, you know, sometimes, like you said, compliance centric is
43
00:05:35.850 –> 00:05:51.630
Jason Mefford: Is just part of the job at some organizations, right, you still have to do some of those compliance things because you REGULATORS REQUIRE it or whatever else. Right. But in so it’s it’s being able to kind of marry together those two ideas.
44
00:05:52.710 –> 00:06:00.180
Jason Mefford: And focusing. It’s kind of like what we talked about. It’s not auditing faster, but it’s it’s auditing the things that really matter now.
45
00:06:00.360 –> 00:06:10.590
Toby DeRoche: Right. You know, it’s interesting. With this, as we’ve done this idea before because a lot of departments, especially as they get to be more mature, they start getting involved in those internal consulting engagements.
46
00:06:11.550 –> 00:06:17.550
Toby DeRoche: You do that right now because it matters right now. You know, we’re rolling out a new system, I need help, and
47
00:06:17.640 –> 00:06:20.370
Jason Mefford: We better do it right now. Yeah, we did after
48
00:06:20.550 –> 00:06:25.020
Toby DeRoche: Okay, I don’t need help, two years from now, I need it right now. And so we jump on and engagement like that.
49
00:06:25.650 –> 00:06:30.240
Toby DeRoche: And we make recommendations and we move on because today. That’s what mattered management.
50
00:06:30.780 –> 00:06:32.010
Toby DeRoche: So we’ve already got
51
00:06:32.250 –> 00:06:35.160
Toby DeRoche: Kind of a concept for this. We’re just taking it further.
52
00:06:35.790 –> 00:06:49.620
Jason Mefford: Okay well in other other kind of myths that are that are there, a little bit because I know you know sometimes people will say things like well you know I got a book on agile and I read the book. That’s all I need to know
53
00:06:49.800 –> 00:06:52.620
Jason Mefford: Yeah, right. But, but is that really is that really true.
54
00:06:53.490 –> 00:06:55.020
Toby DeRoche: Oh, God. Now, so I’ve got that book.
55
00:06:56.790 –> 00:07:08.940
Toby DeRoche: read that book I’ve read everything I can get my hands on around this whole idea and the books are good. If you’re just getting started and you’re trying to learn a whole lot about agile.
56
00:07:10.140 –> 00:07:17.370
Toby DeRoche: And this is where I went. So I got deep into it. I read everything I could read on agile, I went and got an agile certification.
57
00:07:18.180 –> 00:07:26.190
Toby DeRoche: And then immediately went back and said, Okay, now how do I turn this into an agile Otter process that really make sense. You know what I was talking with people who have done this.
58
00:07:27.180 –> 00:07:35.130
Toby DeRoche: People who, you know, former chief audit executives and directors of organizations who they went from traditional to agile and they could tell you the experience
59
00:07:36.120 –> 00:07:47.400
Toby DeRoche: And what they would tell you is so here’s why it failed you know if they all because we got hung up on all the vocabulary words failed because we were too focused on the theory.
60
00:07:48.900 –> 00:07:56.850
Toby DeRoche: You know, and then they start saying, Well, I tried can ban and I tried to save. And I tried this and I tried Scrum and like none of that stuff matters to us.
61
00:07:57.720 –> 00:08:07.650
Toby DeRoche: Because when you really take it all back and say, I’m trying to build an agile audit function. You’re not trying to turn your, your audit department into an Agile project management team.
62
00:08:08.700 –> 00:08:15.090
Toby DeRoche: You’re taking the best of what agile has and we make it work for us, because that’s really the spirit behind this whole idea.
63
00:08:15.660 –> 00:08:34.140
Toby DeRoche: You know the Agile purist will jump up and down and say Agile is a mindset. It’s not a methodology. It’s not a process. It’s a way of thinking as we have working, you’re absolutely right. And that’s why we can take the best parts of that idea and we just make it our own
64
00:08:35.190 –> 00:08:43.260
Toby DeRoche: We don’t have to be purists. We don’t have to say, I’m going to take every single bit of what I learned in that book and make it work for me.
65
00:08:43.920 –> 00:08:50.340
Toby DeRoche: Because your departments, different from another department, your, your organization’s different cultures, different
66
00:08:50.910 –> 00:09:03.300
Toby DeRoche: How much capacity you have that mix between risk and you know compliance is all of it is very unique to you. And so, taking the best pieces of it and making it work for you is really the way to go. Okay.
67
00:09:03.720 –> 00:09:10.920
Jason Mefford: Well, and I think that’s, that’s where, again, you know, like you said. Sometimes we get so caught up or worried about the words.
68
00:09:10.980 –> 00:09:14.310
Jason Mefford: And it becomes becomes kind of a substance over form.
69
00:09:14.550 –> 00:09:21.330
Jason Mefford: Kind of a deal right where it’s like, you know, and okay for some organizations that might be okay if your organization.
70
00:09:21.780 –> 00:09:32.220
Jason Mefford: You know, takes an agile mindset. And it’s kind of built into the culture and everybody’s using all of that terminology, then you probably better learn the terminology
71
00:09:32.820 –> 00:09:42.240
Jason Mefford: Right, so that you can speak to everybody else. But if if you’re not, then, you know, again, it just seems like people are going to look at you like you’re crazy.
72
00:09:43.080 –> 00:09:52.770
Jason Mefford: Because you’re trying to push something or again use words like we you know we use audit words already and confuse people. And now,
73
00:09:52.770 –> 00:09:54.900
Jason Mefford: You’re just throwing another
74
00:09:55.890 –> 00:10:13.830
Jason Mefford: Language, if you will, on top of in confusing people more right and like you said, I think it’s I’ve seen so many people just talking about the theory, but they don’t know how to actually put it into practice in internal auditing. Yeah.
75
00:10:14.280 –> 00:10:17.220
Toby DeRoche: And that’s, that’s really why I got focused on this a while back.
76
00:10:18.390 –> 00:10:22.380
Toby DeRoche: You know, for about three or four years now, we’ve been talking about this.
77
00:10:23.400 –> 00:10:37.440
Toby DeRoche: And all I hear is theory, all the time. You know, I’ve sat in on conference presentations and webinars and all you know and everybody has the best intentions with this. So I’m not trying to knock them at all. But it’s all very theoretical
78
00:10:38.400 –> 00:10:41.790
Toby DeRoche: And they’ll put up here’s a, here’s a diagram of how it should go.
79
00:10:43.050 –> 00:10:49.830
Toby DeRoche: Though they’re not telling you is, here’s what it looks like in real life, you know, and here’s here’s where it’s not going to work out the best for you.
80
00:10:50.370 –> 00:11:04.920
Toby DeRoche: And here’s how you would just do it and they don’t really lay it out in those terms of here’s how I do it. So everything that I’ve been doing for the last month has really been about showing. Here’s how you do it. So let’s stop with that theory. Let’s get down.
81
00:11:04.920 –> 00:11:05.520
Toby DeRoche: To the, you know,
82
00:11:05.790 –> 00:11:08.160
Toby DeRoche: The nitty gritty on this and say, Here’s what it does.
83
00:11:08.940 –> 00:11:17.250
Jason Mefford: Well, that’s why you know if you’re listening and you’ve gone to some of these same kind of presentations or you’ve read a book or you’ve, you know, heard something on a on a conference.
84
00:11:17.790 –> 00:11:23.220
Jason Mefford: And it’s still kind of confusing you and you’re like, how do we make this practical hold with us.
85
00:11:23.700 –> 00:11:40.410
Jason Mefford: And we’re because we’re going to share with you actually some ways that you can actually start making it very practical and give you exactly how to do that. No more theory BS. But actually, how to put it in practice.
86
00:11:41.670 –> 00:11:51.990
Jason Mefford: In finally move the conversation forward. Yeah, right. Instead of just talking about the theory for like we have been for three or four years, let’s actually get in and actually get some shit done.
87
00:11:52.890 –> 00:11:56.490
Toby DeRoche: And we’re done talking about it because the world won’t let us anymore.
88
00:11:56.640 –> 00:12:02.550
Toby DeRoche: No, no, we must have exchanged and you know anybody trying to put together an annual plan right now. It’s not going to work.
89
00:12:02.670 –> 00:12:03.990
Toby DeRoche: We really have to change now.
90
00:12:04.380 –> 00:12:11.910
Jason Mefford: Yeah, well, which is why some things around continuous planning continuous risk assessment. Those are some words, people are throwing out there.
91
00:12:12.300 –> 00:12:22.620
Jason Mefford: Which does fit in nicely with with Agile when you do it the right way as well. So let’s let’s talk now about because I know you know you’ve done a lot of
92
00:12:23.190 –> 00:12:35.010
Jason Mefford: Research, you’ve talked to a lot of people you know what’s working, what’s not working and tried to kind of come up with a better mousetrap, if you will, on, on how to actually do this so
93
00:12:35.520 –> 00:12:40.830
Jason Mefford: What are some of the things that most, in turn, a lot of groups are missing.
94
00:12:41.460 –> 00:12:51.690
Jason Mefford: that’s causing him to kind of fail or they they try this, maybe for a few months, or a half a year and then they like, they throw up their hands. I give up. I’m not going to do this, this doesn’t work.
95
00:12:51.990 –> 00:13:01.830
Jason Mefford: Yeah. What are because i think i’m guessing there must be some common things people are missing. And because they’re missing those that’s why they’re failing.
96
00:13:02.160 –> 00:13:02.520
Jason Mefford: Yes.
97
00:13:02.820 –> 00:13:19.590
Toby DeRoche: In the south. Absolutely. And, you know, part of it as part of it is just the fact that we’ve focused so much on theory. I think a lot of people go into it with really big ideas and they’ve got this big theoretical you know situation in their head that uses all of this agile language.
98
00:13:20.550 –> 00:13:32.790
Toby DeRoche: And you get so deep into these agile concepts that you you lose the point he was point, he was the focus you forget what it was that you were trying to do. And so I think just that one right off the bat is probably one of the biggest
99
00:13:33.960 –> 00:13:38.820
Toby DeRoche: The others, you know, one of the big ones is that people try to carve out the audit process.
100
00:13:40.290 –> 00:13:43.320
Toby DeRoche: And just turn one piece of it into an agile process.
101
00:13:43.680 –> 00:13:55.980
Jason Mefford: Okay, well I’m glad you. I’m glad you went there because, again, as I’ve heard people talking about this. It’s like people you don’t understand it’s not doing things faster doing part of what we do faster. It’s like into him.
102
00:13:56.190 –> 00:14:03.420
Toby DeRoche: And and it is absolutely the end to end. And, you know, one of the big places people fail is they try to turn people work into an agile process.
103
00:14:04.290 –> 00:14:17.580
Toby DeRoche: That’s not actually agile. That’s just making it better to work for him. Like, you’re, you’re not changing your process. And this is why people fail because they said well I took my my fieldwork. And I tried to make it agile, so they use all the words.
104
00:14:18.120 –> 00:14:21.120
Toby DeRoche: But they didn’t get the point. Right. And so they start talking about sprints.
105
00:14:21.600 –> 00:14:29.400
Toby DeRoche: And they start talking about Daily Scrum meetings and they they’re taking all of this ceremony that goes along with Agile stuff.
106
00:14:30.210 –> 00:14:38.100
Toby DeRoche: And they’re trying to force it on the audit instead of saying, well, if I if I looked from end to end, from a risk assessment or reporting.
107
00:14:39.060 –> 00:14:47.130
Toby DeRoche: Then I changed my whole process, then my risk assessment would achieve because it would have been risk based and not entity based way that we know so many people are doing it.
108
00:14:48.180 –> 00:14:57.810
Toby DeRoche: And then my audience would have been risk based not entity base and then I can take my audit and I can break it up into sprint based on risks and controls.
109
00:14:59.040 –> 00:15:01.620
Toby DeRoche: And not on some canned audit program that I found somewhere.
110
00:15:04.230 –> 00:15:09.360
Jason Mefford: If anybody’s listening and still using a canned audit program slap yourself. Right. Yeah.
111
00:15:09.720 –> 00:15:12.510
Toby DeRoche: And then call me and Jason, we’re going to talk you out of this.
112
00:15:13.170 –> 00:15:16.200
Jason Mefford: I will talk to you out of it will talk you off the cliff with them. Right.
113
00:15:16.980 –> 00:15:19.200
Toby DeRoche: And I’m happy to have that conversation all day.
114
00:15:21.510 –> 00:15:31.650
Toby DeRoche: But once once we change the whole process and the whole thing changes focus and focus now on management strategic objectives. I want to know the risks that I audit to those risks.
115
00:15:32.340 –> 00:15:38.610
Toby DeRoche: And because I’m doing this in an agile fashion. I’m worried about the risk better or most important highest priority for the export.
116
00:15:40.560 –> 00:15:44.910
Toby DeRoche: A complete my audit program in those iterations, but based on risk and controls.
117
00:15:46.020 –> 00:15:53.700
Toby DeRoche: And then when they get through all this. One of our goals is to no longer have that long dragged out press process for getting the audit report out
118
00:15:54.630 –> 00:16:02.940
Toby DeRoche: Because we actually bake in all of the review and all the conversation into the Agile field work process so that by the end of that audit. I am done.
119
00:16:04.080 –> 00:16:11.280
Toby DeRoche: And we don’t get caught up in this whole farm over substance nonsense where I’m fighting over every single word in every single issue in the report.
120
00:16:12.300 –> 00:16:18.060
Toby DeRoche: Because, and I’ll talk about this until I die. The standards don’t require you to make a report.
121
00:16:19.020 –> 00:16:20.520
Jason Mefford: Just communicate results.
122
00:16:20.610 –> 00:16:22.650
Toby DeRoche: Just communicate results so
123
00:16:23.310 –> 00:16:29.700
Jason Mefford: Well, and I think this must be one of the huge areas. Why, why people fail.
124
00:16:29.940 –> 00:16:32.160
Jason Mefford: It is like you said they tried to just
125
00:16:32.520 –> 00:16:37.410
Jason Mefford: Change the field work portion of it, but we’re still just as ineffective and planning.
126
00:16:37.890 –> 00:16:51.570
Jason Mefford: Yeah. Both, both in time, but also in knowing where to focus if you’re using an entity or compliance centric some other kind of audit universe approach. And then, and then we waste a bunch of time in the reporting.
127
00:16:52.050 –> 00:16:53.340
Jason Mefford: Process as well.
128
00:16:53.670 –> 00:17:06.960
Jason Mefford: And so, you know, they’re doing agile in the middle. It’s still taking them as much time or probably longer and they’re thinking, oh, well, agile doesn’t work. Yeah, it does. But not when you have acid and
129
00:17:07.260 –> 00:17:07.830
Jason Mefford: Be part of it.
130
00:17:08.250 –> 00:17:10.140
Toby DeRoche: We tried to piecemeal this thing and grab out
131
00:17:10.410 –> 00:17:13.290
Toby DeRoche: Some of the ideas that made sense to us. Good, we’re focused on
132
00:17:14.130 –> 00:17:18.840
Jason Mefford: Them. Okay, great. So, what, what other things are kind of missing.
133
00:17:19.950 –> 00:17:23.820
Jason Mefford: You know, from people being able to be successful in making this transition
134
00:17:24.270 –> 00:17:28.560
Toby DeRoche: So I’ll tell you one of them is something we it’s I’m going to blame the nature of who we are.
135
00:17:29.100 –> 00:17:29.580
Okay.
136
00:17:30.930 –> 00:17:31.140
Jason Mefford: Well,
137
00:17:31.830 –> 00:17:35.580
Jason Mefford: I think either way, though some of the better we can actually change right
138
00:17:35.580 –> 00:17:50.730
Toby DeRoche: That’s right. And I say this as an auditor who’s been doing this for a very long time. It’s just part of who we are. We’re by nature professions, you know, we don’t allow ourselves to make mistakes and we’ve got beaten into us that you’re never allowed to do anything wrong.
139
00:17:52.230 –> 00:18:00.330
Toby DeRoche: But with this. You’re changing. This is a massive change. Let’s not call it anything else, you’re probably this is the biggest change you’ve ever made to your audit program.
140
00:18:01.680 –> 00:18:10.020
Toby DeRoche: And so what we’re doing with it then is we’re making major changes and we have to allow ourselves to make mistakes and we have to allow things to bail.
141
00:18:10.740 –> 00:18:17.940
Toby DeRoche: So that we can then correct them. And we do that without judgment and we do that without holding ourselves, you know, like we’re
142
00:18:18.210 –> 00:18:27.060
Toby DeRoche: destroying the world and knowledge through the whole program out. Let’s go back to what we were doing, because we’re so horrible. It’s not that bad. You know, like one of the ones that comes up a lot.
143
00:18:28.410 –> 00:18:33.510
Toby DeRoche: And it’s one of the more common, you know, things known about Agile is that you have these days. These daily meetings.
144
00:18:35.160 –> 00:18:46.470
Toby DeRoche: We can call them Daily Scrum meetings daily stand up meetings, call them whatever you want. It doesn’t matter. It’s a quick conversation, you get the whole team together. Ideally, you’ve got one of the oddities there with you as well.
145
00:18:47.910 –> 00:19:00.060
Toby DeRoche: And in that meeting, you’re talking about what what’s holding us up what roadblocks. Do I have. That’s it. It’s such a simple concept to say, Let’s have a quick conversation about why I can’t do my job today.
146
00:19:01.200 –> 00:19:11.310
Toby DeRoche: You know, I can’t get documentation from Bob or, you know, I needed to have a conversation with Mary, but she’s on PTO for the next week. So who else could I talked to, well, I don’t know, because I don’t know this organization that well.
147
00:19:12.510 –> 00:19:19.380
Toby DeRoche: And but if I’ve got the oddity there with me. They can fix that for me, probably on the spot. Oh, marries out cool go talk to this on a person
148
00:19:20.700 –> 00:19:29.880
Toby DeRoche: And that meeting is set up to be something that facilitates progress because we’re on these shorter Sprint’s. So I have two weeks to get this work done.
149
00:19:31.020 –> 00:19:36.150
Toby DeRoche: And by the end of that two weeks, I need to be done, but if Mary’s out for a week. I’m stuck. I lost half my time.
150
00:19:37.740 –> 00:19:43.590
Toby DeRoche: One of the things that happens though is that meeting starts to change. And this is a very natural progression. It happens almost all the time.
151
00:19:44.160 –> 00:19:51.750
Toby DeRoche: It turns into a status update meeting. I’m looking backwards not forwards. I’m not talking about what’s holding me up. I’m saying, Well, here’s what I did yesterday.
152
00:19:52.890 –> 00:19:53.730
Toby DeRoche: And I think I’m done.
153
00:19:55.590 –> 00:19:59.610
Toby DeRoche: And so in this kind of natural falling apart progression that happens.
154
00:20:00.960 –> 00:20:08.550
Toby DeRoche: I started giving you status updates. And now I want to know why I’m here because I could have sent you an email for this. I don’t need to be in this meeting. So I’m going to stop coming. Because this is a waste of my time.
155
00:20:09.960 –> 00:20:15.750
Toby DeRoche: And it takes a strong person to say, you know, here’s what this meeting is about. Let’s stay on task. Don’t forget why we’re here.
156
00:20:16.740 –> 00:20:23.280
Toby DeRoche: And not let it slip back into some bad practices and I can almost bet money that this is going to happen to you.
157
00:20:24.030 –> 00:20:30.030
Toby DeRoche: Because every team is going to be doing this all of your auto groups and going to be doing this you have multiple people trying to pull this thing together.
158
00:20:30.600 –> 00:20:40.770
Toby DeRoche: And when they start to slip and it’s inevitable. You have to remind them, Hey, here’s what we’re doing. And so you have to have some coaching sessions to remind everybody, hey, here’s what we’re doing this meeting. This is for roadblocks.
159
00:20:41.940 –> 00:20:44.550
Toby DeRoche: This is not for status updates and
160
00:20:46.080 –> 00:20:52.110
Toby DeRoche: It falls apart. Whenever you don’t have enough coaching and guidance through this good consulting can get you through this
161
00:20:52.860 –> 00:21:05.370
Toby DeRoche: Good consulting sometimes hard to find, you know, a lot of a lot of those consultants come in with so much theory they forget this whole practical idea that people revert back to their old habits and need to be kept on task.
162
00:21:06.570 –> 00:21:11.640
Jason Mefford: But I think, I think this is important. And again, it’s, it’s a time for us to really kind of look in the mirror.
163
00:21:12.930 –> 00:21:20.910
Jason Mefford: Right. Because like you said, we just, just because of the personalities that technically the usually gravitate towards this profession.
164
00:21:21.630 –> 00:21:29.550
Jason Mefford: We tend to want to over plan and we over plan and we over plan so that there’s never any problems right
165
00:21:30.060 –> 00:21:37.530
Jason Mefford: And that’s exactly i mean that’s why when we talked at the beginning, you know, and some people say well Agile is a mindset, right, it has to be built another culture.
166
00:21:38.010 –> 00:21:50.820
Jason Mefford: Part of that is, we’ve got to kind of change and realize it’s okay to make mistakes. The reason we’re saving time is because we’re not spending so much over planning at the beginning. Right.
167
00:21:51.420 –> 00:22:02.190
Jason Mefford: And then like you said actually staying true to what it is that we’re actually doing these, you know, these daily stand up meetings. It’s not new for most of your organization’s
168
00:22:02.550 –> 00:22:15.270
Jason Mefford: I mean most of my experience was in manufacturing. Guess what happened every day at a certain time right all the supervisors and managers in the plan to come together for about 15 minutes
169
00:22:16.050 –> 00:22:28.740
Jason Mefford: To talk about what’s on the schedule and what are the roadblocks, or what did we learn from yesterday that are roadblocks for us today and how can we get past that so that the lines don’t go down. Yeah.
170
00:22:28.860 –> 00:22:32.130
Toby DeRoche: I worked. I worked in retail or felt like forever.
171
00:22:33.840 –> 00:22:40.560
Toby DeRoche: But I worked all through college. I worked in stores I after college. He went into management in stores. So I was in retail
172
00:22:41.010 –> 00:22:55.380
Toby DeRoche: In an actual like selling stuff for about 10 years and then spent four years in corporate working in retail and I guarantee you, every store out there you know it doesn’t matter who they are, what brand. They are every single store out there, they start their day this one.
173
00:22:57.000 –> 00:22:57.870
Toby DeRoche: This is not new.
174
00:22:58.380 –> 00:22:58.620
Yeah.
175
00:23:00.000 –> 00:23:09.240
Jason Mefford: Okay, so that’s, you know, that’s, that’s one of the things that that usually is missing, you know, what are, what are some other ones. I’m guessing to, you know, that
176
00:23:11.670 –> 00:23:15.480
Jason Mefford: Some of the other things that are that are missing when people are are trying to do this.
177
00:23:17.280 –> 00:23:22.320
Toby DeRoche: Yeah, one of the big ones. I think that’s left as we don’t really treat it as a true project.
178
00:23:23.670 –> 00:23:34.830
Toby DeRoche: You know, we’re transforming our department. And this is something that’s going to involve a lot of people, a lot of time. It’s not something you can just say I’m doing and you know expected to happen overnight.
179
00:23:35.850 –> 00:23:48.420
Toby DeRoche: It may take a good three months to pull this off from start to finish, because there’s a lot of training involved. There’s going to be some piloting and then coming back and talking about it and then you know tweaking the process.
180
00:23:49.650 –> 00:24:05.610
Toby DeRoche: So, you know, in the plan that I’ve put together around all this, it really is just taking it piece by piece. So, you know, when we, when we tackle the planning process of how we’re going to start going into a quarterly planning cadence and starting a quarterly risk assessment.
181
00:24:06.900 –> 00:24:10.530
Toby DeRoche: So we take that piece as a pilot and I’m going to run it through. And I’m going to try it.
182
00:24:11.580 –> 00:24:18.930
Toby DeRoche: And I know it’s not going to be perfect. The first go around. So we treat it like a true project and we say, let’s do it. Then let’s come back and talk about it.
183
00:24:20.100 –> 00:24:26.940
Toby DeRoche: And then we work through it and then we move on to the next page. Let’s take field work. Let’s build it all out. Now I have to train the otters.
184
00:24:27.420 –> 00:24:31.950
Toby DeRoche: Because they really weren’t involved in a lot of the beginning part right they probably don’t see a lot of the risk of us.
185
00:24:32.700 –> 00:24:43.080
Toby DeRoche: And now I need to train them on what what the impact is going to be to them. I’m training will call them Scrum leaders, right, the audit leads the people that are going to be leading those daily meetings and having a lot of that that
186
00:24:44.160 –> 00:24:51.420
Toby DeRoche: Bigger leadership aspect to this and teach them what they’re doing. I can’t just say, Hey, this is your job. I have to show up and teach them.
187
00:24:52.530 –> 00:25:01.740
Toby DeRoche: Same thing with reporting my reporting is going to James I gotta start prepping the audit committee for a different format and getting them ready for this, especially if you weren’t doing quarterly meetings with them.
188
00:25:04.020 –> 00:25:12.990
Toby DeRoche: The next phase one because this can continue to progress. One of our goals with this isn’t to have quarterly meetings with the audit committee on demand reporting.
189
00:25:14.250 –> 00:25:22.680
Toby DeRoche: So that at any point ever if the audit committee anyone came to you and said, hey, where we stand on blah, blah, blah. You could say, give me five minutes, I’ll tell you.
190
00:25:23.520 –> 00:25:36.390
Toby DeRoche: And you can tell them, because all of your work is happening on a regular cadence. It’s never more than two weeks old, you know, everything is always there. And so, as your as you’re producing this for them. You can do it in real time.
191
00:25:37.440 –> 00:25:44.520
Toby DeRoche: And part of this, I gotta tell you, this is probably one of the biggest things that I’m having a hard time getting audit departments to really go ass.
192
00:25:45.930 –> 00:25:58.170
Toby DeRoche: Is that, that’s our actual product. It’s audit committee insights. That’s what we do because probably 90% of the auditors when I ask them, hey, what do you guys make all of them, the otter reports.
193
00:25:59.940 –> 00:26:02.640
Jason Mefford: Yeah, but it’s not it’s not the report is the insight to the audit.
194
00:26:02.640 –> 00:26:04.950
Jason Mefford: Committee and to management in general.
195
00:26:05.610 –> 00:26:15.810
Toby DeRoche: The whole point of doing those audit reports that wishes to close out that one job right, that that documented to say here’s what we found. But here, here’s the overall results, it’s not even just here’s the issues we found
196
00:26:16.890 –> 00:26:20.190
Toby DeRoche: That’s why the standards are always telling us acknowledge what was done well.
197
00:26:21.390 –> 00:26:29.010
Toby DeRoche: And communicate what needs to be needs to be corrected because all of those insights are good that helps us focus on both sides of the coin.
198
00:26:30.120 –> 00:26:34.590
Toby DeRoche: And then the audit committee report is the accumulation of all those things that happened in the last quarter.
199
00:26:35.970 –> 00:26:40.560
Toby DeRoche: But if we start to push away from this whole formal audit report concept.
200
00:26:41.670 –> 00:26:50.220
Toby DeRoche: Then, well, here’s what I found this week, stick it in whatever system I track this thing and move on. It doesn’t really matter. I don’t even need that formal report.
201
00:26:50.850 –> 00:27:01.260
Toby DeRoche: And now I’ve moved everything into a centralized location. And now I can start to give you pastor reporting. So all of these pieces just fit together. But it’s a matter of us taking the whole project on
202
00:27:03.120 –> 00:27:13.890
Jason Mefford: Well, because that’s the thing we do have to go into and grad. It’s got to be in the planning, it’s going to be in the field work. It’s got to be on the reporting and the follow up afterwards as well. And like we said at the beginning, that’s one of the mistakes.
203
00:27:14.190 –> 00:27:24.240
Jason Mefford: Mistakes like people are making is there just focusing on one one particular area. But I wanted to dig in a little bit deeper into something that you that you said just a few minutes ago because I think
204
00:27:24.810 –> 00:27:44.220
Jason Mefford: I think, again, this is one of those areas probably why so many people are probably struggling is somebody on the audit team reads a book or goes to a webinar. And they’re like, All right, now we’re going to do agile and everybody get in tow. And let’s just start doing
205
00:27:44.370 –> 00:27:55.710
Jason Mefford: Right. And they start throwing out these terms and everybody’s looking around, like, Okay, what are we doing right it’s it’s one of those where we tell them what we’re going to do, but we never show them how
206
00:27:56.160 –> 00:28:02.820
Jason Mefford: Badly that they’re actually going to do it right. And I think, again, that’s why you know one person in your team.
207
00:28:03.480 –> 00:28:19.590
Jason Mefford: Reading a book isn’t going to get it done right. Actually, you know, you’ve got to have pretty much everybody in your team actually trained up on what to do in just reading the book is not the training. Right.
208
00:28:19.950 –> 00:28:23.310
Toby DeRoche: It’s not, it’s not at all. You know, think about what we do.
209
00:28:24.420 –> 00:28:27.480
Toby DeRoche: Everybody in your department. They all have a different role.
210
00:28:28.500 –> 00:28:42.030
Toby DeRoche: And there’s going to be very specific training for, you know, chief executives and directors, because they’re going to have more influence from, you know, sort of the book ends. They’re going to be the ones focusing primarily on risk assessments build and then report that stuff out.
211
00:28:43.260 –> 00:28:50.820
Toby DeRoche: The team itself. The bulk of the audit department, they’re going to be more focused on the field work aspect, but now they need to know how did they get there.
212
00:28:51.510 –> 00:28:57.270
Toby DeRoche: From the audit plan and now they need to know where that’s going from an audit report because they need to feed into those other areas.
213
00:28:58.020 –> 00:29:06.210
Toby DeRoche: The part of us to think about it like we’re doing continuous Chris when i doing field work and stuff flows right back into the risk assessment for the next quarter.
214
00:29:07.320 –> 00:29:13.260
Toby DeRoche: So there’s this continual cycle that flows into these things. And so there’s going to be different types of training for everyone.
215
00:29:14.250 –> 00:29:24.480
Toby DeRoche: And as we were starting to put this stuff together we can break them down into those different pieces but there’s absolutely going to be training you do for every single person on the team, and it’s not as simple as, let me just go read a book.
216
00:29:25.440 –> 00:29:34.710
Jason Mefford: No. Well in it. And it’s, you know, again, I mean, how long have you been working in this area in reading the books and trying to apply everything
217
00:29:34.830 –> 00:29:36.390
Toby DeRoche: It’s been like three years, it’s not
218
00:29:36.630 –> 00:29:45.360
Jason Mefford: It’s only been like three years. Right. Okay. So, so again, folks, you know, here because I know a lot of you that are listening are probably gone. Yeah. Yeah. Yeah, but how do I do it.
219
00:29:46.110 –> 00:29:58.440
Jason Mefford: Well, guess what Toby’s figured out exactly what to do and the how of doing it right. I mean, he spent three years going through all this stuff.
220
00:29:58.950 –> 00:30:04.020
Jason Mefford: And figuring out how to actually apply it to internal audit in a practical way.
221
00:30:04.560 –> 00:30:22.770
Jason Mefford: Right. So again, I guess you got a choice, right. You can spend three or four years trying to figure it out. Going to different webinars or conferences and reading different books and trying to figure it out yourself or you can just let Toby tell you exactly how to do it.
222
00:30:23.280 –> 00:30:25.170
Toby DeRoche: You guys really want to read this stuff. I can give you
223
00:30:25.680 –> 00:30:25.920
Jason Mefford: Or
224
00:30:26.490 –> 00:30:28.710
Toby DeRoche: I can skip to the end and I can just show you
225
00:30:29.250 –> 00:30:31.680
Jason Mefford: Yeah, you know, and I think that’s where
226
00:30:32.070 –> 00:30:46.500
Jason Mefford: You know, again, I’ve got to assume a lot of people are at that point now where it’s like we’ve been talking about this for how long, but how do I actually do it right, which is why I’m so excited. You know, for us to be be talking again to
227
00:30:47.970 –> 00:30:49.080
Jason Mefford: That you’ve actually done that.
228
00:30:49.500 –> 00:31:03.390
Jason Mefford: And you put everything exactly together for people so they can get the training, but they don’t just get the training, they actually get all the little templates and the other stuff of exactly
229
00:31:03.780 –> 00:31:16.260
Jason Mefford: How to do it. It’s not just, again, you know, like we said at the beginning, a lot of people are kind of throwing theory out there, but you’re giving people practical stuff they can actually apply and start doing today.
230
00:31:16.530 –> 00:31:30.780
Toby DeRoche: Yeah, and I tried to keep it just as straightforward as possible. You know, so even when we start putting together in this training that we that we built out the actual agile terminology it’s immediately followed by here. So we actually
231
00:31:33.420 –> 00:31:37.590
Jason Mefford: Right, so, so it’s like, I mean, it’s almost like learning another language. Right.
232
00:31:37.590 –> 00:31:38.310
Jason Mefford: Was like
233
00:31:38.340 –> 00:31:56.820
Jason Mefford: Yeah, okay. Well, what is this word. What am I used to seeing this word as right. So part of it is learning some of the the nomenclature. But, but, making it easy, right, like this is what agile calls it, this is a term you’re used to probably hearing. So when you hear this thing fat right
234
00:31:56.850 –> 00:32:00.420
Toby DeRoche: And then, and then all throughout the training as we start to like refer to people.
235
00:32:01.260 –> 00:32:14.970
Toby DeRoche: Oh, you’re going to hear Scrum Master a lot right clad agile. People love Scrum Master as a term. It’s just something that it’s a very big role. It’s a very important job duty. So what I’ve done is every time we use it as a scrum master, who is the audit lead
236
00:32:15.450 –> 00:32:16.200
Toby DeRoche: You know, like
237
00:32:16.500 –> 00:32:22.350
Toby DeRoche: Trying to keep it back. I don’t want to hide from this language, but I also don’t want to become the focus
238
00:32:22.770 –> 00:32:37.050
Toby DeRoche: I don’t want you to get so hung up on using this terminology that that’s all you’re thinking about want you to know it that way. If you do have other people in your organization who are who are agile now and they start using these words. I want you to know what they’re talking about.
239
00:32:38.220 –> 00:32:45.420
Toby DeRoche: But I don’t want that to be the focus of the training because watch a webinar for that stuff. This is really meant to be guided
240
00:32:45.930 –> 00:32:53.160
Toby DeRoche: All the way through from start to finish. How do you go about capacity planning to do this to figure out what I have to give to my plan.
241
00:32:53.670 –> 00:33:00.030
Toby DeRoche: How do I go about the risk assessment, what should I include in my risk assessment. How does your workbook.
242
00:33:00.660 –> 00:33:07.290
Toby DeRoche: And I’ve built in templates. I’ve even shown examples of using different types of software, things that are free, that are out there.
243
00:33:07.890 –> 00:33:16.830
Toby DeRoche: There’s templates that are baked into it. Again, there’s a workbook that’s included that even takes you as far as guiding you through the letter to write to your audit committee.
244
00:33:19.110 –> 00:33:22.800
Toby DeRoche: That you can explain this to them because you probably going to need to let them know
245
00:33:23.010 –> 00:33:31.500
Toby DeRoche: This is a pretty big change that. Here’s what we’re planning on do that even when you follow this out and it builds that out like a maturity model to show you, here’s where I am.
246
00:33:32.310 –> 00:33:41.400
Toby DeRoche: And then helps you form that into a letter that says here’s what I’m doing now. And here’s what I do. I tried to just guide you through it. Every step of the way.
247
00:33:42.210 –> 00:34:00.210
Jason Mefford: Well, because that’s, that’s why I think this is this to me and I’ve been feeling this way for probably a year or so is this is probably the biggest seismic shift to internal audit you know we’ve been talking about risk based agile actually is a way to
248
00:34:01.710 –> 00:34:08.370
Jason Mefford: Hopefully, get people past them saying, or thinking they’re doing risk based but they’re still just doing the old bullshit right
249
00:34:08.610 –> 00:34:13.170
Jason Mefford: Yeah, and actually get them to doing it kind of the right way.
250
00:34:13.530 –> 00:34:20.880
Jason Mefford: And I love what you said is, you know, if you remember when we talked, we were talking about some of the mistakes, right. A lot of people just try to apply this on fieldwork know
251
00:34:21.270 –> 00:34:27.150
Jason Mefford: You’ve actually shown people. Exactly. So how does your planning changed how does your risk assessment change.
252
00:34:27.450 –> 00:34:36.780
Jason Mefford: Right. How do you go from a one year plan to with, you know, a one year forecast with a three year rolling kind of a three month rolling out three year rolling. Hello.
253
00:34:37.680 –> 00:34:46.410
Jason Mefford: Three months rolling how you actually implement it in fieldwork, but then also how you change the reporting at the end of it, right. So again, if people just
254
00:34:46.740 –> 00:34:55.590
Jason Mefford: Follow the process, walk, you know, step by step through the process that you’ve laid out there going to be successful in doing this right and
255
00:34:55.590 –> 00:35:03.750
Toby DeRoche: Moving I truly believe that they will be and the program is built so that no matter how big or small, you are this works.
256
00:35:04.470 –> 00:35:11.910
Toby DeRoche: So if you’re a smaller group. And you’re thinking, well, I don’t need this because I only have, you know, three or five people. Yeah, absolutely. Do you probably need it more
257
00:35:12.960 –> 00:35:20.580
Toby DeRoche: Because you’re going to be in a better position to have an actual impact on that organization, the really big departments.
258
00:35:21.120 –> 00:35:28.830
Toby DeRoche: Same kind of thing goes, they’re going to have the ability to go from what they’re doing that traditional model to agile, but there’s a whole lot more people involved.
259
00:35:29.610 –> 00:35:37.800
Toby DeRoche: So they may need to break this thing up a bit more and do it in pieces, but they’re just going to do the same process and laying it out. They just many to do a few more phases.
260
00:35:39.510 –> 00:35:52.530
Toby DeRoche: But this is something that’s going to apply to every single audit department doesn’t matter what industry you’re in, really does have any impact of, you know, where in the world you are what we want to work in this is something that’s going to hit every single one of us.
261
00:35:53.670 –> 00:35:56.340
Jason Mefford: Well in 2020 is only sped up the process to
262
00:35:56.640 –> 00:35:59.940
Jason Mefford: It i mean it’s it’s made it’s made it
263
00:36:00.420 –> 00:36:08.550
Jason Mefford: More necessary right now that we actually, you know, kind of jump into this and that’s why I’m I mean I’m so glad
264
00:36:09.690 –> 00:36:17.220
Jason Mefford: That you took these three years. And again, people, three years it took him three years to come up with all this stuff. Right. So don’t think you can go shortcut it
265
00:36:17.640 –> 00:36:24.750
Jason Mefford: In like a month by reading a book just use what he’s actually already put together from over three years.
266
00:36:25.110 –> 00:36:32.790
Jason Mefford: Of studying of talking, you know, with people figuring out what works, what doesn’t work because here’s the beauty of this right
267
00:36:33.270 –> 00:36:48.660
Jason Mefford: You don’t you’re afraid to make mistakes. You don’t have to make some of the same stupid mistakes. Other people are making because he’s heard you learn what most of the people have been doing wrong. So you just follow the process. You don’t have to make some of those same mistakes.
268
00:36:48.870 –> 00:36:56.820
Toby DeRoche: And, you know, this is, this is where we take our own medicine. We would never allow somebody else to say, well, I’m going to keep doing this way because it’s the way I’ve always done it.
269
00:36:58.080 –> 00:37:01.710
Toby DeRoche: We’re in that position right now. You know, the way we’ve always done it doesn’t work.
270
00:37:02.250 –> 00:37:13.080
Toby DeRoche: It’s it’s a broken model that just doesn’t work anymore and we already had a lot of the pieces ready for us. You know, there was enough research that had been done there was enough that have been written on it. It was tons of theory.
271
00:37:13.980 –> 00:37:19.560
Toby DeRoche: But now, now we need to move right this is our call to action. We have to do this now. Yeah.
272
00:37:20.670 –> 00:37:30.150
Jason Mefford: Well, for those of you that have been sitting here is you’ve been listening to this and you’re like, Come on, tell me where can I get it. How can I do, what do I do what, where do I go. Where do I go, Well, Toby.
273
00:37:31.140 –> 00:37:39.360
Jason Mefford: Has put together a course certified right so it’s got certified in front of a to. We’ll talk about that in just a minute but certified agile auditor professional
274
00:37:40.320 –> 00:37:52.890
Jason Mefford: As well, a full course that walks you through step by step exactly what you need to do, along with the templates and other things like that. So you hit the ground running right now.
275
00:37:53.370 –> 00:38:04.920
Jason Mefford: And like we talked about this isn’t, this isn’t just something for like one person in your department to get this is something that really, if you’re going to be serious about doing agile and not just dip your toe in it. But if you’re going
276
00:38:04.920 –> 00:38:05.970
Jason Mefford: To be serious.
277
00:38:06.450 –> 00:38:14.040
Jason Mefford: This is something that you should consider probably your whole team actually going through and learning. If you really want to be successful in
278
00:38:15.300 –> 00:38:20.400
Toby DeRoche: Absolutely. You know, because if you’ve got a group sitting there and you need them all on a common vocabulary.
279
00:38:21.570 –> 00:38:22.980
Toby DeRoche: They all need to go through this training.
280
00:38:24.030 –> 00:38:31.350
Toby DeRoche: This the training is really designed to cover the full audit lifecycle end to end. And now everyone needs to know all pieces.
281
00:38:32.100 –> 00:38:39.540
Toby DeRoche: Because we’re all going to have some sort of a play inside of it, your audit staff is going to need to know how they got to that point. How did the audit get to me.
282
00:38:40.530 –> 00:38:42.330
Toby DeRoche: She needs to know the risk assessment process.
283
00:38:42.390 –> 00:38:49.740
Toby DeRoche: And they’re going to be feeding things under the reporting that you’re going to be using from a management point of view, to send to the audit committee. So there’s really no
284
00:38:50.730 –> 00:38:56.340
Toby DeRoche: There’s no piece that we can say, well, the audit team needs to know this, but they don’t need to know the rest of it. Everyone needs to know the false prophets
285
00:38:57.510 –> 00:39:09.540
Jason Mefford: Well into kind of the, the other side from it is you know we’ve talked before and there’s there’s research out there, one of the three big areas that people are looking to change and to do something different on one of them is agile right
286
00:39:10.140 –> 00:39:16.260
Jason Mefford: And so, you know, the other thing that this course does for you is you get a certification.
287
00:39:17.160 –> 00:39:27.810
Jason Mefford: In this as well. So what does that mean, right, like, Well, why do I need a certification this well. There are lots of Chief audit executives looking for people
288
00:39:28.440 –> 00:39:37.800
Jason Mefford: Who know how to do this. Right. So yeah, you can go get your Scrum Master, you can go do some other stuff, but it still doesn’t help you
289
00:39:38.370 –> 00:39:48.870
Jason Mefford: Translate that into doing on it. Right. That’s what Toby has been doing for three years. But this actually certifies and proves to other people.
290
00:39:49.230 –> 00:40:07.350
Jason Mefford: That you know what you’re talking about. When it comes to Agile auditing which from a personal career standpoint is a huge plus because what you’re going to see, again, is she founded executives are looking for people with a skill set, but those people do not exist.
291
00:40:07.470 –> 00:40:09.000
Jason Mefford: In the marketplace right now.
292
00:40:09.300 –> 00:40:16.350
Jason Mefford: So going through getting a certification like this actually proves to a future employer.
293
00:40:16.800 –> 00:40:24.270
Jason Mefford: That you actually know what you’re talking about. Because it’s a real certification. You got to take a test, you got to prove that you actually understand it.
294
00:40:24.810 –> 00:40:38.790
Jason Mefford: But you also have all the tools that go along with it. So you can actually perform and implemented as well. It’s not just a theoretical you know piece of paper, you can actually do it. Yeah.
295
00:40:38.880 –> 00:40:47.790
Toby DeRoche: Think about it like this, if you’re out there and you’re putting yourself out in the market and there’s an apartment, who has already made the transition to Agile
296
00:40:49.020 –> 00:40:56.670
Toby DeRoche: And they’re looking at a big stack of paper, all these resumes and when they’re looking through that they’re thinking this is all fantastic and I’m going to bring this person in
297
00:40:57.030 –> 00:41:06.690
Toby DeRoche: Not only do I have to train them and what my department does my company culture. I also got to break them have all these old habits now of being a traditional process based on Twitter.
298
00:41:07.170 –> 00:41:13.740
Toby DeRoche: Don’t but if you walk in with a certification. You just save them a whole lot of time because now you already know how to do this.
299
00:41:14.130 –> 00:41:17.280
Toby DeRoche: So you’re not you’re walking in with a huge advantage over everybody
300
00:41:17.310 –> 00:41:27.180
Toby DeRoche: Who’s really still stuck in that traditional way of work because you’re walking in knowing the concept, knowing how to do it all the ins and outs from end to end. And it’s a huge advantage.
301
00:41:28.050 –> 00:41:36.540
Jason Mefford: It makes it much easier. Having hired lots of people over the years, that’s one of those things that sticks out and especially. So again, like you said, whether
302
00:41:36.900 –> 00:41:42.960
Jason Mefford: Whether the department has already taken that and they’re already doing it. So now they want to hire people that already know it.
303
00:41:43.800 –> 00:41:53.100
Jason Mefford: Or if they’re in the process of trying to change or move that way, usually on new hires, they’re going to be looking for people
304
00:41:53.700 –> 00:42:06.240
Jason Mefford: That have this skill set and we see it in data analytics already, I think, I think I’ll get the numbers right I think about 1010 or what was it 10% of the people in audit have audit.
305
00:42:06.960 –> 00:42:20.010
Jason Mefford: And data analytics background 30% of the jobs are asking for people with internal audit and data right same thing is going to happen with Agile auditing.
306
00:42:20.550 –> 00:42:36.660
Jason Mefford: The, the number of job postings and other things, requesting or having, you know, requiring, if you will, that is going to go up as well, which again for your career is a great place to be in. If you already have it.
307
00:42:37.200 –> 00:42:43.680
Toby DeRoche: This is, this is one of the things I expect to start seeing popping up on job descriptions, though, you know, right now we start to see
308
00:42:44.220 –> 00:42:50.790
Toby DeRoche: They’re looking for people who have this many years and I’m looking for somebody who has CIA or assist or whatever other certification.
309
00:42:51.300 –> 00:42:58.620
Toby DeRoche: I fully expect to start seeing I’m looking for people certified an agile, because this is something that is massive. I mean,
310
00:42:59.490 –> 00:43:03.660
Toby DeRoche: This is we cannot stress enough. One of the biggest shifts we’ve ever seen happen in order
311
00:43:04.230 –> 00:43:14.970
Toby DeRoche: I mean this is as big as going from what we used to be checklist, your risk based now we’re we’re moving from traditional to an agile process it’s it’s a massive undertaking and this is a chance for us to get ahead of it.
312
00:43:16.110 –> 00:43:28.470
Jason Mefford: Well, it is and Toby, you know, again, I know we got to kind of wrap up for today but but thank you for actually putting this out there and, you know, glad to be here trying to help spread the message as well because
313
00:43:29.670 –> 00:43:30.240
Jason Mefford: Like I said,
314
00:43:31.290 –> 00:43:43.500
Jason Mefford: Clearly, I think, I think personally that this is one of the biggest seismic shifts when done right, but you have to understand how to do it right. This isn’t something you can half ass.
315
00:43:43.950 –> 00:43:51.030
Jason Mefford: And go read a book and think that you’re actually going to doing doing it, you’re going to make some of those same mistakes. Other people have
316
00:43:51.360 –> 00:44:04.170
Jason Mefford: After three to six months, you’re going to throw your hand up and say, I can’t do this, but you can do it if you actually follow the process and just, just take the course get certified
317
00:44:04.320 –> 00:44:06.930
Jason Mefford: Do exactly what’s Toby showing you to do.
318
00:44:07.290 –> 00:44:09.630
Jason Mefford: You’re gonna be successful in it.
319
00:44:11.010 –> 00:44:20.940
Jason Mefford: Yeah. So tell me, thank you for taking the time today and you know again. So we talked a little bit about the program will make sure down in the show notes is a link to it.
320
00:44:21.660 –> 00:44:31.860
Jason Mefford: But, you know, whatever you do choices. Up to you. But whatever you do, this is the future. And so you really need to get in jump in with both feet.
321
00:44:32.220 –> 00:44:44.700
Jason Mefford: And and actually learn how to do it. Get out of the theory and actually learn the step by step on exactly how to do this. And thank you, Toby for putting that together so people can actually do that.
322
00:44:44.880 –> 00:44:52.140
Toby DeRoche: Now, it was an absolute privilege to get to do it. So I’m just hoping that we can influence. Lots of people get them out ahead of us.
323
00:44:52.770 –> 00:44:54.810
Jason Mefford: Well, and help them do their job easier to
324
00:44:54.900 –> 00:44:56.520
Toby DeRoche: Hang out and do their jobs better. Yeah.
325
00:44:56.760 –> 00:45:00.540
Jason Mefford: Exactly. All right. Well, thanks. Toby will have to have you on. Again, I’m sure.
326
00:45:01.680 –> 00:45:02.970
Jason Mefford: Thank you. Thank you.
