In today’s episode, we have George Graves who is here to share with us the things that he has learned and witnessed in the auditing field over the course of his 40 year career.
From the “magazine image of auditing” to best practices in internal audit functions this episode is JAM packed with tons of information that all auditors can learn from!
Listen in at: http://www.jasonmefford.com/jammingwithjason/
Transcript
1
00:00:01.319 –> 00:00:07.379
Jason Mefford: hey everybody, I am talking to George graves today and George is actually kind of a.
2
00:00:09.150 –> 00:00:17.250
Jason Mefford: blast from the past, if you will, we we knew each other way back in the days when we were both at Arthur Andersen together.
3
00:00:17.699 –> 00:00:24.900
Jason Mefford: And then moved KPMG in fact George was kind of one of my bosses back then so George is great it’s great to have you here.
4
00:00:25.470 –> 00:00:36.870
Jason Mefford: You know i’m excited to have you because I know you’ve had it’s about been about a 40 year career in public accounting just recently left KPMG so.
5
00:00:37.500 –> 00:00:51.060
Jason Mefford: i’m excited to have you here to reconnect but also to kind of talk about a lot of the things that you’ve kind of seen over time and maybe some of the things people need to hear more about so George welcome.
6
00:00:51.780 –> 00:00:57.600
George Graves: Sure thanks Jason it’s a it’s great to be here it’s just been a long, long strange trip.
7
00:00:58.020 –> 00:01:01.740
George Graves: As they say you know in this in this thing and.
8
00:01:02.400 –> 00:01:20.490
George Graves: You know, starting out, you know, an Anderson back in the back in the early 80s doing good old fashioned external auditing but taking that wonderful computer science minor that I had in school, which you know involved a lot of programming and fortran and cobalt.
9
00:01:21.540 –> 00:01:22.260
George Graves: For turn on.
10
00:01:22.290 –> 00:01:24.480
Jason Mefford: kobo those are words, a lot of the younger people.
11
00:01:24.510 –> 00:01:25.470
Jason Mefford: don’t know what they are.
12
00:01:26.220 –> 00:01:28.560
George Graves: Exactly punch cards and.
13
00:01:28.560 –> 00:01:32.580
George Graves: getting them out of order, and all that stuff but but taking that foundation.
14
00:01:33.090 –> 00:01:43.890
George Graves: Ultimately, then you know moving down the path at Arthur Andersen making a big shift in the mid 90s, when the firm got more involved in providing services.
15
00:01:44.430 –> 00:02:00.240
George Graves: To internal audit organizations, which you know 94 or five is when I made that that switch that ultimately then became came a career so i’ve had the good fortune of working with companies, large and small audit functions, large and small.
16
00:02:01.530 –> 00:02:04.470
George Graves: up and down the west coast some back in the Midwest.
17
00:02:06.000 –> 00:02:13.050
George Graves: Obviously, a lot of you know, one of the as I would put it, the best thing and the worst thing that ever happened to the profession is socks for for so.
18
00:02:13.320 –> 00:02:17.880
George Graves: You know, did did a ton of work around that and and kind of stunned.
19
00:02:18.270 –> 00:02:28.020
George Graves: That we still continue to do a lot of work around that to this day, but yeah I had a great journey have had good fortune of working with a lot of good mentors.
20
00:02:28.860 –> 00:02:46.560
George Graves: Now, if you use the College football analogy, I i’d say i’m part of the Bob hurts coaching and coaching three lot for Bob back in the Arthur Andersen days and he was very influential in the way that I think about audit risk value and things like that so it’s great to be with you.
21
00:02:47.280 –> 00:02:54.480
Jason Mefford: Well bob’s a great guy and I it’s funny because I football season right now right we’re getting close to the super bowl as we’re recording this so.
22
00:02:55.140 –> 00:03:11.370
Jason Mefford: um but yeah that coaching tree Bob Bob has had a huge impact on the profession, I mean, in general, you know he left and went to positivity when we went BMG but but yeah I mean he’s had a huge huge impact in the profession in general, so.
23
00:03:11.700 –> 00:03:13.020
George Graves: Right very much so.
24
00:03:13.080 –> 00:03:14.220
George Graves: Interesting to use a coach.
25
00:03:14.250 –> 00:03:15.900
Jason Mefford: coaching tree analogy, I love that.
26
00:03:17.430 –> 00:03:25.740
George Graves: Well, that was fun to drop KPMG when the Kosovo 13 came out and i’m like oh yeah I know I know the head guy in Kosovo guys So what do you.
27
00:03:27.990 –> 00:03:29.730
Jason Mefford: want me to get him on the phone got it.
28
00:03:29.790 –> 00:03:33.510
George Graves: yeah exactly you got a question about that I have a source yeah.
29
00:03:34.260 –> 00:03:41.820
Jason Mefford: Well, no, and you know before before we hit record, we were we were talking to kind of catching up and and and you know, especially maybe maybe this when I.
30
00:03:42.150 –> 00:03:49.500
Jason Mefford: Hopefully we’ll have you back again because you’ve just got a ton of experience and knowledge and thought leadership to share with people but.
31
00:03:50.100 –> 00:04:03.390
Jason Mefford: You know some of the things that we were talking about before that I kind of wanted to dial in a little bit is there seems to be this aspiration of what internal audit is supposed to look like.
32
00:04:03.630 –> 00:04:15.870
Jason Mefford: Right and so again this didn’t come out from thought leadership things from technology firms, I mean everybody’s putting stuff out there about what internal audit is supposed to be right.
33
00:04:17.190 –> 00:04:25.500
Jason Mefford: we’ve got standards we’ve got all kinds of stuff right but, but I wanted to talk a little bit about that because because, like you said.
34
00:04:27.090 –> 00:04:28.740
Jason Mefford: Internal Audit looks a little different.
35
00:04:29.160 –> 00:04:37.110
Jason Mefford: in different places, so maybe if we can kind of go through and talk about because you’ve seen lots of clients big small.
36
00:04:38.790 –> 00:04:47.100
Jason Mefford: You know all over the place, what is it that really actually makes an internal audit shop great or.
37
00:04:47.220 –> 00:04:49.500
Jason Mefford: add value in the organization.
38
00:04:50.520 –> 00:05:02.670
George Graves: yeah so you’re right, then one of the things I think if you draw a comparison right, so if i’m talking about external audit it’s everybody the end product exactly the same financial statements opinion.
39
00:05:03.270 –> 00:05:11.340
George Graves: All the work that goes into it is plus or minus 5% of all the other firms it’s all kind of the same and people kind of understand.
40
00:05:11.910 –> 00:05:23.580
George Graves: What it is so when you make reference to the external auditors, you know you generally know what they’re up to, but when it comes to internal audit and again, most of our constituency base that we have.
41
00:05:24.810 –> 00:05:30.330
George Graves: out their their their main familiarity with the word audit is the external audit.
42
00:05:30.630 –> 00:05:31.860
George Graves: Not the internal audit.
43
00:05:32.280 –> 00:05:41.760
George Graves: And so, when you talk about internal audit then that’s kind of where their brain goes or, alternatively, it goes to hey I worked for 10 years at xyz Co.
44
00:05:42.120 –> 00:05:53.820
George Graves: and internal audit at xyz co is this kind of an audit function and that’s that’s what they think it is because the presumption is every audit function is the same, or at least directionally.
45
00:05:55.050 –> 00:05:58.590
George Graves: The same, but when you get into it, it is.
46
00:05:59.880 –> 00:06:11.460
George Graves: dramatically different from A to B to C, I mean yes internal audit is required for a New York Stock Exchange company, something that they don’t say what they just said, you have to have it.
47
00:06:11.640 –> 00:06:12.120
Jason Mefford: Well, used.
48
00:06:12.270 –> 00:06:12.510
George Graves: To have.
49
00:06:12.540 –> 00:06:14.640
Jason Mefford: A person in charge of it right.
50
00:06:14.820 –> 00:06:19.080
Jason Mefford: somebody’s been say you have to have a department you’ve just got to have somebody responsible right.
51
00:06:19.110 –> 00:06:25.680
George Graves: Somebody doing something right NASDAQ no such requirement and I don’t remember, but a couple years ago NASDAQ had.
52
00:06:26.160 –> 00:06:32.580
George Graves: proposed that they would put in a requirement for it and companies were just screaming, no, no, we can’t.
53
00:06:33.120 –> 00:06:44.670
George Graves: We can’t afford it blah blah, you know they said Oh, by the way we have socks, you know, so you know as a surrogate for audit and in fact I talked to a number of companies NASDAQ companies that just said, well isn’t socks internal audit.
54
00:06:46.770 –> 00:06:47.250
George Graves: If they.
55
00:06:47.490 –> 00:06:49.350
Jason Mefford: don’t censor experience that’s what they.
56
00:06:49.350 –> 00:06:50.130
George Graves: know no so.
57
00:06:50.370 –> 00:06:54.600
George Graves: This is why bandwidth out there, and despite that wide bandwidth.
58
00:06:55.620 –> 00:07:05.460
George Graves: Virtually all those companies, probably have a charter an internal audit charter that says virtually these the same thing I cannot add anything anywhere anytime.
59
00:07:05.910 –> 00:07:12.480
George Graves: You know i’ve got the pipeline to the audit committee chair i’ve got I mean all this kind of stuff it’s it’s basically it’s basically the same and so.
60
00:07:12.810 –> 00:07:18.660
George Graves: You know I think a good question for company companies is to understand finance what your charter says.
61
00:07:19.260 –> 00:07:26.970
George Graves: what’s the real charter what’s what’s the real charter right, I mean you go into a lot of these companies and classic what I find is.
62
00:07:27.300 –> 00:07:32.340
George Graves: It okay fine i’m gonna go in and audit sales, you know the sales process or whatever happens to be.
63
00:07:32.970 –> 00:07:39.480
George Graves: Good luck with that um you can be 110% right in virtually everything that you’re doing.
64
00:07:40.110 –> 00:07:48.450
George Graves: And the pushback becomes well internal audit wants me to worry more about control so i’m going to miss my sales numbers, you know this quarter, you know and.
65
00:07:48.840 –> 00:07:56.340
George Graves: So then CEOs like oh God we don’t want that you know it’s just it’s a hard place not that you can’t do it, there are good examples where people have done it but by and large.
66
00:07:56.760 –> 00:08:03.240
George Graves: it’s a tough one, taxes and other one it’s just like you know, though you’ll go in there and really you’re really going to try it out attacks really.
67
00:08:05.220 –> 00:08:10.410
George Graves: You know, again you’re just you’re asking for for brain damage in in that particular space.
68
00:08:11.040 –> 00:08:22.170
George Graves: So I asked what’s the real charter, I mean we’re me if you’re saying you’ve got this risk, based on a plan, yet I look at your plan and it’s it’s all location based and i’m going and i’m doing the same kinda.
69
00:08:24.630 –> 00:08:35.220
George Graves: Audit program that every single one that kind of thing you know I mean, is it risk based well rob of the lean meats have some definition of risk based right like a.
70
00:08:35.220 –> 00:08:37.080
Jason Mefford: Risk Assessment a universe.
71
00:08:37.110 –> 00:08:39.030
Jason Mefford: But it’s not going to objective.
72
00:08:39.690 –> 00:08:47.310
George Graves: Right right exactly exactly so it’s just so I think there’s just a wide variety on that and to the extent that, then all this thought leadership is out there.
73
00:08:48.060 –> 00:08:55.680
George Graves: Now that the firms are all a big a big purveyor of thought leadership anybody that makes a software product that potentially fits.
74
00:08:56.100 –> 00:09:04.440
George Graves: In this space has thought leadership on how you’re going to do stuff and all that and it gets hard, because you as an audit exactly I think he began to think that.
75
00:09:05.040 –> 00:09:12.780
George Graves: God everybody’s doing this and everybody’s doing that and we can’t do this and you sort of feel like you should, but the reality is.
76
00:09:13.380 –> 00:09:19.290
George Graves: I mean God did an analytics I go to any shop right now and I asked him, are you doing data analytics yes.
77
00:09:19.980 –> 00:09:30.090
George Graves: you’re going to get a yes every single one is going to give you a yes, but then you look at it and you go well kind of looks to me like you’re doing what we did with acl 20 years ago so i’m not really sure.
78
00:09:30.570 –> 00:09:39.630
George Graves: that’s what we really mean by data and analytics as an example, so point being there’s just there’s a lot of info out there, maybe it’s like you know magazines with that have.
79
00:09:39.900 –> 00:09:55.350
George Graves: You know models that don’t resemble any of us physically right and that the creating an image of what we’re all supposed to aspire to um but it’s hard it’s a challenge, and you have to kind of understand what your real chart is what your real permissions are in the company.
80
00:09:55.860 –> 00:09:57.840
George Graves: Before you begin to think about where you can go.
81
00:09:58.500 –> 00:10:10.200
Jason Mefford: yeah and I think that analogy that you just made with the magazines and the models right, you know it’s like the beer commercials everybody’s trim fit and healthy and in 20 something drinking beer right well that’s.
82
00:10:10.200 –> 00:10:15.210
Jason Mefford: Not that’s not been my experience, most people, I know that drink beer right they don’t look like.
83
00:10:15.210 –> 00:10:23.190
Jason Mefford: That and but but, again, because you hear that so much a lot of times people you know they get down on themselves.
84
00:10:24.000 –> 00:10:35.340
Jason Mefford: They think well i’m not good enough, I have to be like someone else and that ends up actually being pretty dangerous I mean i’m guessing you’ve seen that in your career, too, but i’ve.
85
00:10:35.700 –> 00:10:50.760
Jason Mefford: i’ve seen some you know chief executives, who are like Oh well, you know the it says i’m supposed to do this for the firm says i’m supposed to do this so i’m gonna force and drive my company to do this and.
86
00:10:50.820 –> 00:10:54.540
Jason Mefford: Almost every time it ends in disaster for that person.
87
00:10:54.930 –> 00:11:14.310
George Graves: I agree there’s a lot of a lot of people who ultimately become that our own worst enemies and not and not because of any sort of competency issue or anything like that it’s just to me it’s a failure to understand how internal audit is aligned in the organization right.
88
00:11:15.660 –> 00:11:21.180
George Graves: Extra lot as a good point right, because I do one of the things I did was I did a number of QA ours.
89
00:11:22.020 –> 00:11:31.350
George Graves: for companies and the most value you’re going to get out of that is not not just some sort of assurance that you’re aligning with audit standards but.
90
00:11:32.100 –> 00:11:40.260
George Graves: You know, doing that 360 where you’re talking to the constituency base of audit that’s out there, including audit committee chair and all that kind of stuff.
91
00:11:40.710 –> 00:11:49.650
George Graves: And when you do that, you can see real quickly, I mean not uncommon wall right so i’ve got you know, not a function that’s like yeah we’re we’re adding value we’re.
92
00:11:49.950 –> 00:11:57.600
George Graves: You know we’re putting people in the business we’re doing all this this great stuff you know and and value added and all this, these things.
93
00:11:58.110 –> 00:12:05.970
George Graves: When you talk to the audit committee chair and committee chairman, just like I just want him out there kicking in people’s but in controls and I don’t really care about.
94
00:12:06.390 –> 00:12:13.320
George Graves: All the rest of that stuff and then you talk to you know executives and they’re like well you know they need this, you know.
95
00:12:13.680 –> 00:12:19.860
George Graves: They kind of need to stay in their lane, but you know, and we want to support them, but you know, do they really have the skills to do.
96
00:12:20.250 –> 00:12:28.560
George Graves: You know kind of all this new stuff and one of the favorite things and things I suggest to your listeners to ask is that so when you get to that question about.
97
00:12:29.310 –> 00:12:44.790
George Graves: Internal Audit as a management training ground right everybody wants to say that I learned over time, the way that I can verify that is asked one simple question it’s like who’s the most famous alumni of internal audit in your organization.
98
00:12:46.620 –> 00:12:49.440
George Graves: just asked him that, and if there are.
99
00:12:51.930 –> 00:12:57.120
George Graves: You know, you know i’ll tell you know so, and so I was an assistant controller somewhere okay that’s not.
100
00:12:57.810 –> 00:13:04.530
George Graves: adding a lot of talent, whereas i’ve been to other places, and I was like well these three VP is all did time and internal audit and dutta dutta duh.
101
00:13:04.950 –> 00:13:18.600
George Graves: So you know you just it’s like it comes down one of the big the biggest things that I tried to put across to my team, and my clients is just you you’ve got to learn the art the fine art of intellectual honesty.
102
00:13:19.470 –> 00:13:26.130
George Graves: Because I think, deep down inside I think everybody knows I think they do, because I mean you have to.
103
00:13:27.750 –> 00:13:34.800
George Graves: And so, if you just sort of like Okay, you know, maybe we’re not being an internal audit.
104
00:13:35.460 –> 00:13:44.490
George Graves: In most CFO is right, because most of them administrative Lee report to a CFO right it’s maybe a little different but that’s the typical one, if you look at the CFO is cost centers.
105
00:13:45.240 –> 00:13:51.960
George Graves: that they have the finance function, they may have the it function, they may have all sorts of stuff reporting it.
106
00:13:53.070 –> 00:13:57.000
George Graves: internalize it is far and away the smallest costs.
107
00:13:58.530 –> 00:14:03.450
George Graves: That they have right, so you know when you’re in there, I Oh, you know I mean.
108
00:14:05.040 –> 00:14:15.780
George Graves: It doesn’t resonate right they’ve just got so many other things that are more important to them in the short run, so, then you as the audit function, I think, just need to be.
109
00:14:16.410 –> 00:14:21.390
George Graves: You need to be patient, you need to be persistent and.
110
00:14:22.170 –> 00:14:33.990
George Graves: talk to them about not just kind of I mean a you got to be awesome with what you’re delivering right you gotta be me and so so brutal when you get in there, and you know you’re you’re working with a company and then they’ve got.
111
00:14:34.650 –> 00:14:39.090
George Graves: You know communications that are three to six months old or worse.
112
00:14:39.990 –> 00:14:48.540
George Graves: For various reasons, a lot of times, not necessarily unreasonable reasons, but how does it make you look as the audit function no one’s gonna blame the oddity.
113
00:14:49.200 –> 00:15:01.380
George Graves: they’re going to blame you and so again, are you adding value when the information that you’re talking about is nine months to a year old no it’s not value, even if it’s even if it’s right, I mean.
114
00:15:03.210 –> 00:15:08.910
Jason Mefford: Well, I want to go back to some of that aspiration stuff because you brought up to about you know internal audit is the training ground.
115
00:15:09.300 –> 00:15:13.050
Jason Mefford: Right and and there was GE was famous for that right, because they.
116
00:15:13.320 –> 00:15:17.910
Jason Mefford: They love to do that, what did they do, a few months ago hey new CFO in town and.
117
00:15:18.000 –> 00:15:24.420
Jason Mefford: we’re not going to do this anymore, so they stopped right so for a while it’s served management’s purpose, now it.
118
00:15:24.420 –> 00:15:35.910
Jason Mefford: doesn’t they’ve chosen to take a different route and I think it’s you know, but with with this aspiration, because I want everybody who’s listening to realize that if you’re not.
119
00:15:36.870 –> 00:15:45.420
Jason Mefford: You know this if you’re not at the aspirational level it doesn’t mean you’re not doing a good job right because because.
120
00:15:45.420 –> 00:15:56.550
Jason Mefford: Again, is like you know it’s easy for all these thought leadership aspirational things if you’ve got an audit staff of hundreds of people, you can do a lot of really cool shit.
121
00:15:57.210 –> 00:16:11.520
Jason Mefford: Okay, but if you’re like most audit groups that have five to maybe 20 people you’re not gonna be able to do these things, and it doesn’t mean that you’re a bad internal audit group either.
122
00:16:12.180 –> 00:16:25.830
George Graves: couldn’t agree more, I again my informal working definition of what is a best practice internal audit function and again it’s funny that you mentioned G that thing has been that has just been the what we all just sort of default to for.
123
00:16:26.310 –> 00:16:27.510
Jason Mefford: Years ever.
124
00:16:27.630 –> 00:16:36.810
George Graves: i’m around that whole thing and i’m not so sure it’s really been true for the last 1015 years to be I don’t know anybody g to verify that or not, but.
125
00:16:36.960 –> 00:16:44.790
George Graves: yeah you know the best audit functions to me, are the ones that best align with the company’s expectations.
126
00:16:45.240 –> 00:16:55.320
George Graves: For audit so as I mentioned to you before you i’ve had companies on both ends of the spectrum, you know very compliance oriented audit functions and very operationally oriented audit functions.
127
00:16:55.890 –> 00:17:04.710
George Graves: And both of them, you know management love what they were getting and what did more of what what they were getting and I couldn’t change the two it just.
128
00:17:05.100 –> 00:17:12.450
George Graves: You know I wouldn’t look at one or the other, so that’s what it really is so the to the extent that you going back to that informal charter okay.
129
00:17:12.900 –> 00:17:24.120
George Graves: But if that aligns with management’s expectations for how you’re sure because, again, there may be other captive risk management activities.
130
00:17:24.600 –> 00:17:37.080
George Graves: going on in the organization, particularly the larger ones they’re going to have risk groups embedded in the business out there, so just because audit doesn’t necessarily audit.
131
00:17:38.460 –> 00:17:53.730
George Graves: This particular activity through the audit committee governance chain doesn’t mean that the company isn’t somehow concerned about it or looking at it they’re just looking at it through a different lens they’re looking at it a different way, with a different governance structure.
132
00:17:54.990 –> 00:18:00.660
George Graves: around it, so it just be aware, be intellectually honest and to the extent and again.
133
00:18:01.980 –> 00:18:09.150
George Graves: there’s also some dynamics underneath thing you know, in terms of the HR component of this that are that are changing.
134
00:18:10.230 –> 00:18:20.820
George Graves: From what internal audit has historically had to deal with, and that may drive certain other changes that you have to make in the function, I guess what I mean by that is that.
135
00:18:22.350 –> 00:18:30.180
George Graves: A year ago, two years ago we were talking about some work that we were doing, and we were going to be shifting some of the work from very sexy kinds of stuff.
136
00:18:30.720 –> 00:18:34.740
George Graves: into more kind of real value added and turn a lot of that kind of stuff.
137
00:18:35.160 –> 00:18:44.370
George Graves: And i’ve been talking to the director and just say why are people are probably going to love this right, because it they’re gonna like this, a lot better to do this kind of stuff you learn a lot more and actually the directors like.
138
00:18:45.210 –> 00:18:51.060
George Graves: This you’d be surprised how many of our people just want to go lock themselves in a corner and and test socks controls.
139
00:18:53.970 –> 00:18:59.790
Jason Mefford: And that’s an unintended consequence that happens, a lot of times because I noticed that with myself right, as I had.
140
00:19:00.300 –> 00:19:09.270
Jason Mefford: When I when I was you know kind of moving to more risk based stuff because again at one of the companies, so a lot of the expectation was around the compliance he kind of things and.
141
00:19:09.300 –> 00:19:18.270
Jason Mefford: Some of the people that I inherited that they were really good at that, I mean you give them a compliance work program man they go lock themselves in the corner.
142
00:19:18.660 –> 00:19:30.540
Jason Mefford: They do their work they’re very good they’re very dedicated you know, but to ask them to start thinking differently in some of these risk based or value added things they just couldn’t do it, or they didn’t want to do it.
143
00:19:31.020 –> 00:19:32.460
George Graves: Right yeah that’s it just.
144
00:19:32.490 –> 00:19:33.750
Jason Mefford: Personnel issue too.
145
00:19:34.320 –> 00:19:42.660
George Graves: I really think one of the best characteristics that you can have for an internal auditor I mean there’s certainly a base level of technical competency.
146
00:19:43.590 –> 00:19:57.480
George Graves: That needs to be there and increasingly that now that’s also technology oriented, but really from a soft skills perspective it’s somebody who’s very comfortable dealing with ambiguity yeah taking what is an amorphous thing.
147
00:19:58.650 –> 00:20:06.480
George Graves: and turning it in understanding the risk developing an audit that’s responsive to that risk and then communicating back on.
148
00:20:06.930 –> 00:20:15.480
George Graves: How you how you think that’s being managed, I mean in an increasingly that’s hard, and it was why I guess, I should say this one.
149
00:20:15.990 –> 00:20:21.480
George Graves: And there was actually easy to begin with, I think some of us, particularly those of us that were diving in in the early days we didn’t have a choice you know.
150
00:20:22.320 –> 00:20:29.640
George Graves: They throw you into the deep end of the pool, and you have to figure out how to swim really quick and today there’s just so much more infrastructure, support.
151
00:20:30.690 –> 00:20:38.340
George Graves: Potentially tools and things like that right and and so people don’t want to do the whole i’m giving you a blank sheet of paper go figure it out.
152
00:20:40.110 –> 00:20:44.430
George Graves: Now that’s what I think makes a really good audit or somebody who can really deal with that kind of ambiguity.
153
00:20:45.780 –> 00:20:46.080
yeah.
154
00:20:47.100 –> 00:20:50.730
Jason Mefford: Well then, I guess, just because because I wanted to I always like to kind of give.
155
00:20:53.760 –> 00:21:00.240
Jason Mefford: Some context or frame around thing so so as we as we’ve been talking about kind of this aspirational thing you know is.
156
00:21:00.750 –> 00:21:08.490
Jason Mefford: is again if you if you think about like here in the US, we have the the fortune 500 right the 500 biggest companies in the country.
157
00:21:09.300 –> 00:21:17.310
Jason Mefford: And they’re the ones that get all the press they’re the ones that everybody knows about apple Google IBM right, I mean all these names that everybody knows about.
158
00:21:18.000 –> 00:21:29.790
Jason Mefford: And in a lot of times people think Oh well, you know we’ve got a company like walmart that has I don’t know what they’re to now a million or 2 million employees oh my gosh that’s a huge company.
159
00:21:30.240 –> 00:21:39.570
Jason Mefford: yeah but we forget that there’s 10s of millions of other businesses here in the US that are not in the fortune 500.
160
00:21:40.110 –> 00:21:52.020
Jason Mefford: Right, in fact, a lot of the economy is driven by these other organizations, I mean here in California, as an example, I can’t even remember how many fortune 500 companies, we have headquartered here.
161
00:21:52.530 –> 00:22:06.300
Jason Mefford: Right, you have a huge huge mid level amount of organizations here and so to kind of you know, translate this back to the aspirational you know, everybody hears about the big audit shops.
162
00:22:07.140 –> 00:22:27.270
Jason Mefford: You know the things like that, but i’ve kind of got a number in my head, but i’m just kind of curious from from your experience to you don’t how many audit shops have maybe 50 or 100 or more are out there, compared to the number that have that 20 or less.
163
00:22:28.650 –> 00:22:30.210
George Graves: Oh, I mean it’s.
164
00:22:31.440 –> 00:22:37.050
George Graves: Really, I mean again so you said fortune 500 I probably call it more like fortune 100.
165
00:22:38.160 –> 00:22:38.340
Jason Mefford: You.
166
00:22:38.610 –> 00:22:41.640
Jason Mefford: you’ve got to get to about that level probably before you’re going to have.
167
00:22:41.670 –> 00:22:46.290
George Graves: You got to get to a level of complexity right which typically means.
168
00:22:46.950 –> 00:22:52.290
George Graves: billions in revenue probably global in scope.
169
00:22:53.520 –> 00:22:59.190
George Graves: Probably definitely doing business in the BRICS Brazil, Russia, India, China.
170
00:23:00.570 –> 00:23:03.060
George Graves: You know, things of that nature before you’re going to get.
171
00:23:04.830 –> 00:23:22.050
George Graves: people’s attention that they’re nervous enough that they may be deemed to have an independent assurance activity that’s going on in that space or, alternatively, maybe, if you in certain regulatory scenarios, you may wind up maybe not being as big or having as big of a footprint.
172
00:23:23.310 –> 00:23:32.040
George Graves: It still having a relatively large audit team just because that’s the expectation of the regulator to cover to cover the way that I boy.
173
00:23:32.580 –> 00:23:41.640
George Graves: Jason exact numbers is is is brutal because I mean freaking out, I mean I know a fortune 100 that has not a team of 20.
174
00:23:42.570 –> 00:23:52.260
George Graves: You know, and that doesn’t mean that they don’t care about risk it goes back to what I said about captive risk management activity, they that’s the way they choose to.
175
00:23:53.070 –> 00:24:00.240
George Graves: monitor detect and correct out there, as they have that that doesn’t necessarily roll up little bits of data coming so it’s a small fraction.
176
00:24:00.540 –> 00:24:02.160
George Graves: it’s yeah it’s as.
177
00:24:02.850 –> 00:24:14.010
Jason Mefford: Well, so that’s why again if we go back to kind of what you brought up before right, it would be silly for me as a middle aged man to sit there and look at some professional athletes body.
178
00:24:16.020 –> 00:24:21.750
Jason Mefford: and go oh i’m i’m i’m fat i’m stupid i’m whatever because I don’t have.
179
00:24:22.230 –> 00:24:25.620
Jason Mefford: That 20 something professional athletes body right.
180
00:24:26.370 –> 00:24:44.820
Jason Mefford: it’s very, very few in between, and so that person’s idea of health and physique and fitness and the fact that that person probably gets paid to work out eight hours a day right i’m never gonna have that same body and it’s okay right it’s.
181
00:24:44.880 –> 00:24:45.810
Jason Mefford: Okay.
182
00:24:46.230 –> 00:25:04.860
Jason Mefford: So everybody that’s out there right that’s thinking Oh well, i’ll never be like xyz maybe you should quit comparing yourself to everybody else and just focus on what I love that you said right the the the whether you are most most closely aligned with management’s expectations.
183
00:25:04.950 –> 00:25:05.310
George Graves: yeah.
184
00:25:05.970 –> 00:25:12.900
Jason Mefford: If you’re doing what what they’re what they’re wanting you to do if they’re happy we should be happy right.
185
00:25:13.440 –> 00:25:31.920
George Graves: yeah, but let me add, give give a little bit of a caveat and a cautionary tale to that a little bit one of the things that I see on that I think people have to be very careful about, so this is more to your shop of 10 or less right.
186
00:25:33.150 –> 00:25:43.560
George Graves: And that is making sure that you’re not giving the Audit Committee or the executives a false sense of comfort.
187
00:25:44.550 –> 00:25:58.230
George Graves: On something because i’ve seen, for example, right in it i’ve seen it communicated this way data commit let’s say i’m out and i’ve got a small team and some part of that I decide hey i’m going to grow up on it, the.
188
00:25:59.340 –> 00:26:05.100
George Graves: Shared services Center that’s that’s out there, then then maybe processes say revenue transactions.
189
00:26:05.940 –> 00:26:20.370
George Graves: So they go out and they do some some some work, maybe do a sample of you know 2025 transactions or something like that, and then they come out and they tell the audit committee that they audited $10 billion in revenue.
190
00:26:22.200 –> 00:26:24.810
George Graves: it’s like no you didn’t.
191
00:26:24.960 –> 00:26:26.760
Jason Mefford: You took a sample of the 10 billion.
192
00:26:28.530 –> 00:26:35.370
George Graves: And so that’s that’s the hard part because I mean they’re talking about you know this one cup as we’re kind of trying to unpack everything it’s like.
193
00:26:35.790 –> 00:26:49.560
George Graves: You got a team of like six and you’re telling me you’ve covered billions of dollars here and billions of dollars there and then, when you look at what was done my God, I mean the likelihood of something going sideways.
194
00:26:51.030 –> 00:27:05.070
George Graves: That you didn’t touch on pretty darn high and so that’s it making sure that you’re not somehow or alternate either okay here’s a here’s a bad one, to you know if you’re going out and you’re doing work and i’ve seen plenty of others, they go out and maybe the outer Program.
195
00:27:06.540 –> 00:27:20.820
George Graves: Is 100% you got enough time to do 80% of that work right and somehow you cut it short you don’t do the other 20% but then you issue the audit data communication around that.
196
00:27:22.890 –> 00:27:30.870
George Graves: false sense of comfort and what happens when you know some weight our warranty reserve was all messed up didn’t you guys look at that, oh no we didn’t have enough.
197
00:27:31.920 –> 00:27:35.520
George Graves: Right, so I i’m a big believer in.
198
00:27:35.820 –> 00:27:42.540
George Graves: It despite that, in the communication don’t say what you didn’t do say what you did do and just.
199
00:27:43.050 –> 00:27:55.410
George Graves: Make make sure services, so the smaller groups, because I think I think it goes back to what we’re talking about you’ve got all this this information out there be big be value added be comprehensive, be this all be all you can be your fight.
200
00:27:56.700 –> 00:28:12.300
George Graves: um but then somehow you just don’t you don’t have the bandwidth you don’t have the depth you maybe don’t have the it skill set whatever it happens to be fine dumb issue or report that could potentially be misconstrued into what you covered versus what you did.
201
00:28:13.500 –> 00:28:18.810
Jason Mefford: yeah because you know again there’s the wind when when we’re small, we like to puff ourself up or make.
202
00:28:18.810 –> 00:28:27.660
Jason Mefford: people think that we’re doing more than we’re doing to prove our value, but like you said that that other term that you came up that I heard you say intellectual honesty.
203
00:28:28.230 –> 00:28:31.710
Jason Mefford: Right that’s that’s what we’re talking about here too right is it’s like.
204
00:28:32.100 –> 00:28:38.910
Jason Mefford: You know if you don’t have or you can’t do some of these other things again it doesn’t mean that you’re wrong which bad that you’re whatever.
205
00:28:39.270 –> 00:28:48.480
Jason Mefford: But just be honest about what you did or did not do, and not try to give that false sense of assurance, because yeah that’ll come back to bite you in the butt quicker than anything.
206
00:28:48.720 –> 00:28:52.950
George Graves: Precisely and then we’ve we’ve we’ve seen it, you know, and you know, frankly, I mean i’ve.
207
00:28:53.430 –> 00:29:09.930
George Graves: experienced it with some of my teams over the years right we’re all of a sudden, you thought something was done and then you get into it you’re like oh great we didn’t really Russell that one to the ground, did we you know and so it’s it’s tough just brilliant yeah that’s the best part.
208
00:29:10.410 –> 00:29:12.360
Jason Mefford: yeah well and it’s.
209
00:29:13.380 –> 00:29:15.660
Jason Mefford: You know I mean this is this has been great it’s it’s.
210
00:29:16.770 –> 00:29:23.430
Jason Mefford: You know I want to dig into so much more, and obviously we can’t we can’t make these three hours, some people actually have three hour podcast, can you imagine.
211
00:29:23.430 –> 00:29:24.570
Jason Mefford: sitting and listening to the.
212
00:29:24.570 –> 00:29:26.070
Jason Mefford: 63 hours.
213
00:29:27.090 –> 00:29:31.650
George Graves: But it’s a ways to go to become Joe rogan Okay, I know I know.
214
00:29:32.430 –> 00:29:34.380
Jason Mefford: I don’t have my joint over here either right.
215
00:29:37.710 –> 00:29:44.340
Jason Mefford: Anyway, all right, but no, I mean this is this has been great George because I think again it’s it’s.
216
00:29:45.150 –> 00:29:54.630
Jason Mefford: You know because I would love to have you back in the future because there’s there’s lots more where we can go to on this too, but you know, especially as we were talking and and.
217
00:29:55.230 –> 00:30:05.640
Jason Mefford: To make sure that people understand like you said right there’s these aspirations out there there’s the Charter there’s what’s written on the piece of paper, but then there’s the real charter.
218
00:30:06.000 –> 00:30:17.760
Jason Mefford: there’s typically what you do there’s really the authority that you have right it’s the same thing I keep badmouthing independence and objectivity, not because they’re a bad thing, but.
219
00:30:17.790 –> 00:30:25.080
Jason Mefford: yeah as people think they’re independent and they think their objective and they’re not.
220
00:30:25.740 –> 00:30:34.410
Jason Mefford: right because objectivity is skewed based on cognitive biases subconscious we don’t mean to do it, but we’re not as objective as we think we are.
221
00:30:34.950 –> 00:30:44.070
Jason Mefford: and well, nobody I mean again we go back to this very, very small group of chief executives, who were truly independent.
222
00:30:44.730 –> 00:30:55.980
Jason Mefford: The way the Charter, the way the standards, you know, try to put that aspiration out there, because at the end of the day I don’t know many CEOs who don’t have to ask for time off.
223
00:30:56.760 –> 00:31:05.340
Jason Mefford: Who don’t have their admin you know reporting responsibilities, the person who gives them their their salary and their bonus right.
224
00:31:05.580 –> 00:31:10.290
Jason Mefford: Well, and so you know we’re not as independent as we think we are.
225
00:31:10.710 –> 00:31:18.480
Jason Mefford: yeah but you know if we want to add value how’s the best way to do that, I think, is what you said, most closely aligned with what management actually wants.
226
00:31:19.200 –> 00:31:20.190
George Graves: To get there, by the way.
227
00:31:20.550 –> 00:31:27.120
George Graves: Right yeah use the word, the key there is being objective that’s what you have to do, particularly in you know 2020 where.
228
00:31:27.630 –> 00:31:38.760
George Graves: Companies are going through unprecedented you know stress, you know Okay, maybe the best way to use audit is in some fashion that maybe doesn’t align exactly with your audit plan.
229
00:31:39.360 –> 00:31:51.450
George Graves: um don’t hide behind independence as a reason not to do that, I mean it’s you know you got to help the or somehow, and you can manage all these things, I mean they’re they’re manageable.
230
00:31:52.020 –> 00:32:02.310
George Graves: um but just be willing to take a chance, I mean I just one thing i’ve done a number of times here you notice I haven’t I tried not to use the word report.
231
00:32:04.230 –> 00:32:06.150
George Graves: And instead use the word communication.
232
00:32:07.350 –> 00:32:23.670
George Graves: A because communication is what the standard say, but I just people just box themselves in because they’ve got this whole report thing with readings in grades and and it just your your you know.
233
00:32:24.090 –> 00:32:29.430
George Graves: it’s like getting you know, a holding penalty on first and 10 yeah now it’s first and 20.
234
00:32:29.880 –> 00:32:41.430
George Graves: Just because you know we have to do that so to me it’s like it’s a communication guys, there is a group standards allow for a great deal of flexibility in what you communicate.
235
00:32:42.120 –> 00:32:58.980
George Graves: And, and how you communicate it so don’t be afraid to do something different, I mean heck even even if even if you issue report some landscape and portrait because what people who look at them some weight sounds different here.
236
00:33:00.870 –> 00:33:07.920
Jason Mefford: But I think, is that that brings up the point you know that we were kind of talking about before we even got started was you know both of us have been around long enough to have.
237
00:33:07.920 –> 00:33:25.620
Jason Mefford: Seen and it ain’t that much different than what we were seeing 3040 years ago right because, again, you take something like the audit report and we have, in general, it seems like a lot of people believe that the product of internal audit is a report.
238
00:33:26.250 –> 00:33:37.410
Jason Mefford: And so, that is, the product I deliver that’s the the value that I provide to the organization, in fact, you know when when my kids were little they asked me dad What do you do right.
239
00:33:37.950 –> 00:33:44.400
Jason Mefford: And so again naive Lee and trying to you know, make it so a five year old can understand it, I said well.
240
00:33:45.030 –> 00:33:51.750
Jason Mefford: I kind of write reports and I write books, you know for for people right, but again, that was that was the wrong.
241
00:33:52.680 –> 00:34:02.730
Jason Mefford: The wrong way of thinking about it too is it’s like we’re not delivering a report as a product we’re helping the organization be more successful.
242
00:34:03.120 –> 00:34:17.190
Jason Mefford: Be more likely to achieve their objectives, reduce those risks that stand in the way of meeting those objectives or help them with the compliance issues that could be a big kick in the butt if you get a billion dollar fine.
243
00:34:17.310 –> 00:34:18.330
George Graves: To an organization.
244
00:34:18.810 –> 00:34:20.040
Jason Mefford: If you’re breaking the law right.
245
00:34:20.760 –> 00:34:32.220
Jason Mefford: And if we kind of shift and change it around and again hopefully we’ve been talking about this for a lot of years people still aren’t getting it, but I hope I hope they will.
246
00:34:33.270 –> 00:34:43.710
George Graves: yeah you know it’s just all about I just I all among us i’m sure i’ve had this experience right like you go out you do your audit i’m probably looking at data.
247
00:34:44.340 –> 00:34:52.260
George Graves: three to six months old as I do the audit and then classic auditor rolls on to another audit they don’t finish that audit and then it ended up you know.
248
00:34:52.560 –> 00:34:57.300
George Graves: takes forever to write the report nice thing so bottom line ultimately you issue this report.
249
00:34:58.230 –> 00:35:13.950
George Graves: Whatever six to nine months later, and everything with data that’s up to a year old, and it goes up to the top executives of the company, then somebody reads this and it’s like I thought we dealt with that problem you know they.
250
00:35:14.100 –> 00:35:16.380
Jason Mefford: Because they had we did we dealt with it, nine months ago right.
251
00:35:17.430 –> 00:35:23.820
George Graves: They expect it to be more real time, you know and then we’re we’re a historical reporting activity, and I think.
252
00:35:24.180 –> 00:35:40.560
George Graves: People just have again goes back to him being intellectually honest, is this really adding value, yes or now, and I think there’s ways to combat that I mean if you do get into one of those circumstances where your way after the fact.
253
00:35:41.790 –> 00:35:47.640
George Graves: Okay, maybe what I should do is hit pause on issuing that particular communication.
254
00:35:48.120 –> 00:36:00.780
George Graves: Go out confirm that it’s been fixed or do something else, while i’m there and then sort of do something that’s more current in addition to the backdrop that that’s all there and then people Okay, it becomes a good story.
255
00:36:01.440 –> 00:36:13.080
George Graves: And people begin to see some benefit to the activity as opposed to yeah I took I took my lashes six months ago, and now i’m taking them again for the same thing so.
256
00:36:13.410 –> 00:36:15.990
Jason Mefford: Well, because we don’t like to be punished twice for the same Sam.
257
00:36:16.740 –> 00:36:24.150
George Graves: And by the way the to the other thing I think people should keep taking consideration right, so you know we do this quote unquote risk based.
258
00:36:24.720 –> 00:36:33.570
George Graves: Selection right and I, and I go out and i’m doing things and maybe i’ve got whatever a controller or some sort of a manager as an owner of that particular on it.
259
00:36:34.560 –> 00:36:45.660
George Graves: And you don’t well, the reality is have we ever thought about from the perspective of that specific person how high on the radar screen is what i’m auditing.
260
00:36:46.440 –> 00:36:58.020
George Graves: Right, I mean they may have a half dozen things that they’re involved in that are strategically more important than what it is i’m auditing so okay.
261
00:36:58.590 –> 00:37:05.130
George Graves: You should think, why is that do I have now do I have that alignment issue that I should worry about, but at the same time.
262
00:37:05.430 –> 00:37:18.390
George Graves: get some appreciation as to why you’re not getting the time and attention that you need right and then and then, if somebody banging on that guy you need to respond to internal audit it’s like well pick your poison right i’ve got.
263
00:37:20.220 –> 00:37:34.890
George Graves: I got this new system that’s going live in two weeks and i’ve got him so there’s just a lot of dynamics around the classic way and turn a lot of approaches life that I think we quite frankly I think we’re our own worst enemies i’m in and how we do things often.
264
00:37:37.260 –> 00:37:40.890
Jason Mefford: yeah I would agree with you on that, because it’s it’s.
265
00:37:42.150 –> 00:37:46.440
Jason Mefford: You know that’s why, if if people just actually start asking some more questions.
266
00:37:47.100 –> 00:37:59.520
Jason Mefford: So I I love, like the question that you, you know so so learn from some of the questions that we’ve been asking here and start asking some of these yourself right like like the internal lot of training okay well who’s who’s your most popular alumni.
267
00:38:00.300 –> 00:38:00.660
George Graves: Right.
268
00:38:00.690 –> 00:38:13.710
Jason Mefford: We don’t have one, well then maybe you really don’t have that right if if management is kind of ignoring you and they’re not getting back to you on the audit that you’re performing well what are their priorities.
269
00:38:14.730 –> 00:38:26.880
Jason Mefford: And if we’re not auditing or helping them with their priorities if we’re doing some little thing right it’s like that idea of like hey everybody, we found $100,000 over here and the managers like I don’t give a shit.
270
00:38:26.910 –> 00:38:28.560
Jason Mefford: i’ve got a $50 million.
271
00:38:28.590 –> 00:38:31.290
Jason Mefford: issue over here i’m dealing with right it’s like.
272
00:38:32.520 –> 00:38:42.150
Jason Mefford: how’s it so you know if if you’re getting ignored like that then again maybe some of those questions need to be of what are their highest priorities and.
273
00:38:42.630 –> 00:38:55.260
Jason Mefford: If we’re not auditing or somehow aligned with that then we’re probably not adding the value that gets back to your thing you know the best audit groups are the ones that are most closely aligned with expectations.
274
00:38:55.830 –> 00:39:05.760
George Graves: You know it’s a it’s amazing to me Jason how many times, you might go around and you’re doing you know your classic risk assessment, you know kinds of conversations and things like that and.
275
00:39:06.300 –> 00:39:11.700
George Graves: and doing whatever and people are like oh yeah, we need to worry about X, Y or Z I mean I this.
276
00:39:12.480 –> 00:39:24.720
George Graves: cruiser circumstance i’m going around talking about to finance people and they’re you know they’re pointing the finger like I think the risk is over here, and I think the risk is over there right four doors down and her company accounts are out of balance for a billion dollars.
277
00:39:27.360 –> 00:39:33.660
George Graves: You know it’s like guys, you know and, by the way, if you want intercom auditing inner company.
278
00:39:34.980 –> 00:39:57.060
George Graves: If you’ve got the patience and the the sort of the expertise to sort of get into that you will learn more about the company, you will touch on all kinds of potential value added issues, but it will also be the biggest rat’s nest that you’ve ever tried to get through so.
279
00:39:58.320 –> 00:39:58.920
Jason Mefford: I hear you.
280
00:39:59.970 –> 00:40:05.640
Jason Mefford: Well, George Thank you like, I said I mean it’s this has been great, and I know it’s going to be really.
281
00:40:06.960 –> 00:40:18.210
Jason Mefford: valuable for everybody who listens because you’ve you’ve seen it you’ve been there you’ve seen the good the bad the big and the small and really have a good perspective on.
282
00:40:18.840 –> 00:40:36.960
Jason Mefford: You know, helping again, the majority of the people I mean probably 90% of the audit shops out there are never going to meet the aspirational things that are put out there, because you just you can’t you don’t have the resources, you can so quit trying to compare yourself right.
283
00:40:37.350 –> 00:40:45.150
Jason Mefford: And just to align closely with adding value to the organization which is by meeting management expectations right.
284
00:40:45.450 –> 00:40:56.040
George Graves: yep exactly I mean it’s it’s all okay just you know, is certainly again if you are going to ask for for for more resources will make sure you’re educating people as to.
285
00:40:56.640 –> 00:41:01.020
George Graves: What you’re going to do with it, just like just like anything else right, so if you’ve got.
286
00:41:01.740 –> 00:41:09.360
George Graves: it’s a horrible analogy values in any way it’s like so if you’re if you’re a government you don’t want to put in a new tax right and you’re going to the voters for attack.
287
00:41:10.260 –> 00:41:16.200
George Graves: pretty much got to educate people what you’re going to do with with the resources or the money or what kind of a problem you’re going to tackle with it right.
288
00:41:16.620 –> 00:41:19.530
George Graves: Then, if you go to a lot and go well yeah I need two more headcount.
289
00:41:20.460 –> 00:41:21.150
George Graves: we’re gonna do with it.
290
00:41:22.590 –> 00:41:35.970
George Graves: Probably need to be able to articulate the whole thing right and and get there, so now Jason it’s been awesome to talk to you and and i’m happy to chat anytime just reach out right right now I have plenty of time on my end.
291
00:41:36.690 –> 00:41:44.490
Jason Mefford: I know you’re transitioning into retirement clause I whatever you’re going to do in this next phase of your life I I appreciate you taking the time with me today, though.
292
00:41:44.730 –> 00:41:47.880
George Graves: No worries i’m happy to chat anytime thanks.
