I am please to bring back Tom Harris for this week’s #jammingwithjason #internalauditpodcast episode where discuss lessons he’s learned from being a CAE. You’ll hear how Tom’s career brought him to be a CAE, and suggestions he has for those of you that aspire to become a CAE.
In an earlier episode I spoke with Tom about Internal Audit’s Role in System Implementations, so if you missed that one make sure to go back and take a listen.
Tom Harris, the Vice-President of Internal Audit for National CineMedia joins me to provide a case study on how he took an approach of embedding members of his internal audit team into the project team, and even helped drive the user-setup portion of the project. We explore the risks and benefits of taking different approaches. While embedding internal audit into the project team may limit objectivity and assurance projects for a time, it just may be one of the best way to provide long-term value to the organization and deepen relationships with management.
Jamming with Jason is the #1 #internalauditpodcast in the world has interviews and discussions (jam sessions) relevant to Chief Audit Executives and professionals in #internalaudit, risk management, and compliance.
Transcript
1
00:00:01.140 –> 00:00:04.140
Jason Mefford: Welcome to another episode of jamming with Jason
2
00:00:04.500 –> 00:00:06.750
Jason Mefford: Hey, welcome back. My friends, I am
3
00:00:07.259 –> 00:00:10.559
Jason Mefford: excited to be talking today with Tom Harris.
4
00:00:11.700 –> 00:00:20.970
Jason Mefford: And so it’s one of those episodes that I love to do, where we’re talking to a chief audit executive and just kind of understanding and learning, you know,
5
00:00:21.030 –> 00:00:21.990
13037924924: What it’s like to
6
00:00:22.020 –> 00:00:23.040
Jason Mefford: Become a chief audit.
7
00:00:23.040 –> 00:00:29.160
Jason Mefford: Executive and what it’s like to actually have the role. So, Tom, welcome aboard. How you doing today.
8
00:00:30.330 –> 00:00:33.120
13037924924: I’m doing well. Thank you. Thanks for having me on your show.
9
00:00:33.840 –> 00:00:36.270
Jason Mefford: Yeah, so, so maybe just just give people a little
10
00:00:36.270 –> 00:00:42.060
Jason Mefford: thumbnail sketch of, you know, kind of the way that you progress through your career.
11
00:00:42.420 –> 00:00:43.950
13037924924: And how you got to become a
12
00:00:43.950 –> 00:00:45.540
13037924924: Chief audit executive today.
13
00:00:45.690 –> 00:00:51.450
Jason Mefford: Because I think it’s, it’s always interesting for people to kind of understand the pathway that people took to get to get to where you’re at.
14
00:00:52.560 –> 00:00:59.910
13037924924: Sure, sure. Absolutely. Well, I guess my my education undergraduate in finance kind of got me.
15
00:01:01.290 –> 00:01:08.940
13037924924: Introduced to accounting and and I thought a lot of audit was about that. But as I got my first internal audit job in retail
16
00:01:10.230 –> 00:01:26.130
13037924924: began to realize it’s not really about accounting internal audit is very much about people very much about processes how things get done, why they should get done and how those kinds of things can impact the business’s success and the success of the people.
17
00:01:27.450 –> 00:01:37.950
13037924924: My first job was in retail, as I mentioned, I also moved into manufacturing or I learned quite a bit more about how things are made and how things are done.
18
00:01:38.820 –> 00:01:54.210
13037924924: spent probably six, seven years and audit and a couple of different roles and then moved into an operational role for a PC manufacturing company back in the 1990s and as a commodity manager. I spent a lot of time working with
19
00:01:57.060 –> 00:02:06.000
13037924924: The strategic suppliers who would build things based on specs that that marketing department came up with our sales said they wanted
20
00:02:07.290 –> 00:02:18.780
13037924924: What components we needed to buy so that we could manufacture things and sell them and do so in a high volume. So that was pretty interesting. From there I moved into a product marketing role.
21
00:02:19.320 –> 00:02:38.940
13037924924: Where I managed a category of third party peripherals. Some of those were branded for the company that worked for gateway at the time. Some of those were just straight up HP and Epson and that was pretty interesting. And then of course the the world came to an end. Sure.
22
00:02:40.560 –> 00:02:59.580
13037924924: I remember the century. Yeah, yeah, yeah. You know, we had the tech bubble. We had 911 and we had just a horrible recession that that caused me to move out of that operational role and I wanted to get back into audit. I found it. It was a good good time to make that move.
23
00:03:00.690 –> 00:03:08.550
13037924924: And at that point in time. It was kind of interesting because the my first six, eight years within audit. It was like, yeah, this is a job. I like
24
00:03:09.300 –> 00:03:19.620
13037924924: But I didn’t think I wanted to spend my career doing that when I came back to realize just how interesting of a job. It is how different it is
25
00:03:20.280 –> 00:03:37.920
13037924924: So I became a lot more serious about my profession. That’s when I sat in past the CIA exam. And then I also, you know, certified internal audit and then also pass the information systems audit exam couple years after the CIA and then two to three years after that.
26
00:03:39.060 –> 00:03:55.890
13037924924: Took and passed the CFP so with with some credentials, I was able to progress. My career a little bit more. And I think it’s not so much the letters after my name as it is learning the language of what these different specialties talk about right.
27
00:03:56.220 –> 00:04:04.560
13037924924: Right with systems on it. You have to be able to talk to the network people. You have to be able to talk to the CTOs and the CIOs in the language that relates to them.
28
00:04:05.040 –> 00:04:17.400
13037924924: And that’s, to me, I think, a really key part of success is being able to go into senior VP of Sales have a conversation with him in a way that that relates and connects and make sense.
29
00:04:18.210 –> 00:04:25.050
13037924924: Walk, walk down the hall step into the chief general counsel have a conversation with her in a way that makes sense about
30
00:04:25.320 –> 00:04:33.990
13037924924: Some of the same things, or maybe different things, but do it in a way that really connects with the people and let them know that you’re engaged with their business and that you’re concerned about
31
00:04:34.710 –> 00:04:38.580
13037924924: addressing the problems that they have in front of them at the at that time.
32
00:04:38.910 –> 00:04:47.670
13037924924: And so being able to essentially walk down the hallway at each of the C suites and talk in the language that connects with those senior managers.
33
00:04:47.940 –> 00:05:02.760
13037924924: Is absolutely critical. You’ve got to have all of this knowledge and about the business and how to solve these problems. But if you can’t really presented in a way that those senior managers connect with it doesn’t really matter. So
34
00:05:03.240 –> 00:05:17.850
13037924924: For those. Yeah. Yeah. So, those, those letters mean something. But it’s, it’s not really what a lot of people think about right, it’s not. They don’t think those letters mean being able to relate to people, they think it just means technical knowledge.
35
00:05:19.650 –> 00:05:30.270
Jason Mefford: Well, it’s funny because a lot of times, people just get, you know, the alphabet soup buying their name and sometimes there’s not even a lot of thought as to as to why they’re getting it, but I think you make some really, really.
36
00:05:30.270 –> 00:05:36.120
Jason Mefford: Good points because you know in things about like being able to talk the language and connect with people.
37
00:05:37.020 –> 00:05:48.810
Jason Mefford: I think that’s a huge, huge part of being internal audit, you know, as you were saying that I was remembering, you know, one of the companies where I was chief audit executive I used to have to translate
38
00:05:49.980 –> 00:06:03.870
Jason Mefford: meetings between our CIO and our general counsel because I spoke both legal ease and and tack. But the two of them could just never communicate together. And so there were a lot of times when I was in a meeting with the two of
39
00:06:04.980 –> 00:06:06.060
Jason Mefford: Just to translate
40
00:06:06.930 –> 00:06:09.270
Jason Mefford: You know, which, which seems a little funny.
41
00:06:09.840 –> 00:06:22.200
Jason Mefford: But like you said, you know, we all use language a little bit differently and and the more versatile. We can be understanding the language and being able to make the connections with these different groups.
42
00:06:22.710 –> 00:06:27.930
Jason Mefford: That’s one of the things is so fabulous about audit because we get that opportunity right
43
00:06:29.460 –> 00:06:30.510
13037924924: And you also brought up, you
44
00:06:30.510 –> 00:06:48.780
Jason Mefford: Know, hey auditing is not accounting. It’s really about people and processes. And again, I think that’s so important for us to remember. Great, great point is, you know, yeah, a lot of us have accounting or finance backgrounds. But that’s not what we do right that’s it’s very small
45
00:06:48.810 –> 00:06:50.370
13037924924: Small piece of what we do.
46
00:06:51.180 –> 00:06:58.500
Jason Mefford: The other thing. And again, you, you have a very similar experience to a lot of other CA’s that I know you you’ve had a broad
47
00:06:59.310 –> 00:07:10.110
Jason Mefford: Range of experience, right. So, from from being in not just different industries right retail and manufacturing, but also, and having different
48
00:07:10.530 –> 00:07:17.670
Jason Mefford: Roles, you know, where you moved into an operations role. You were in commodities for a while, you know, did some marketing.
49
00:07:18.450 –> 00:07:31.710
Jason Mefford: You know, in all of that. I’m sure has helped you. Now as you’ve moved back into audit. Right. I mean, what are some of the ways that that that that broad experience has actually helped you now in your audit profession.
50
00:07:33.330 –> 00:07:43.920
13037924924: Yeah. Well, when I returned to intralot it. I had a much different perspective on what the profession can do and how the business sees the profession.
51
00:07:45.120 –> 00:07:56.400
13037924924: And my expectations really changed about what you know what we’re intending with internal audit. Is it is it just the did we comply with this. Did we implement that.
52
00:07:56.850 –> 00:08:16.590
13037924924: Or is it much more about how do we get the business to do things that needs to do to be successful, that that is kind of a mindset change and I’m finding that after socks. We’ve we as a profession have moved back to this very compliance kind of rigid sort of thing.
53
00:08:17.790 –> 00:08:25.860
13037924924: And when I interviewed for this role, I was talking with the CFO and the audit committee chair about what their expectations were
54
00:08:26.520 –> 00:08:33.390
13037924924: And it became obvious that there were some opportunities here, particularly when it came to some of the strategic decisions.
55
00:08:34.110 –> 00:08:43.290
13037924924: With systems and how we’re going to use technology going forward that this role would need to be able to reach into those departments partner with
56
00:08:43.650 –> 00:08:54.090
13037924924: The people as we design processes future state processes and we implement that design into custom software that we’re very unique business.
57
00:08:54.630 –> 00:09:05.490
13037924924: How we deliver our content, how we manage our impressions and their inventory, how we record our revenue, particularly with with the new revenue recognition rules.
58
00:09:05.970 –> 00:09:16.290
13037924924: All of those things required some leadership from internal audit that most departments, particularly these days. Just, just don’t see their role.
59
00:09:16.860 –> 00:09:28.020
13037924924: And after I’d been here for about a year and do my domain and review with the CFO. I asked her, so you know in she sat on boards. She actually was an interim CEO at a company
60
00:09:28.500 –> 00:09:33.540
13037924924: She’s probably got 10 years as a CFO very experienced. She’s a rock star in the Denver area.
61
00:09:34.350 –> 00:09:40.590
13037924924: I asked her. So throughout your career. What does internal audit done for you and she just kind of smiled and said, not much.
62
00:09:41.250 –> 00:09:48.690
13037924924: About compliance and check the box. And I’m like, are you kidding me. Wow. I mean, what an indictment for for our profession and what it’s become.
63
00:09:49.560 –> 00:09:56.220
13037924924: But what a encouraging thing it can be if we start changing expectations.
64
00:09:56.670 –> 00:10:05.280
13037924924: At at that sea level suite. And I think that starts with that broad based understanding of, you know, what are we about what are we trying to do right and I think
65
00:10:06.180 –> 00:10:20.760
13037924924: Eight years on the operational side, having been an oddity, having understood what those demands are that a lot of the decisions you make are going to have an impact on people you work with on customers.
66
00:10:21.390 –> 00:10:33.270
13037924924: On potential liabilities, how you approach those decisions really changes, once you kind of go through that and then you get back to. OK, now I’m an otter so
67
00:10:33.990 –> 00:10:44.250
13037924924: Have now how do you approach those kinds of decisions. So it is kind of an interesting mindset coming back into the profession. After, after that time in operations.
68
00:10:44.730 –> 00:10:59.010
Jason Mefford: Well, I think, like you said, it is kind of an indictment on our profession you know that a lot of people do. Just think of this has compliance, you know, and I, a lot of times I’ll end up talking about the history of audit, right, because I’m kind of a nerd that way. So,
69
00:11:00.120 –> 00:11:09.900
Jason Mefford: In its in its it’s when you understand some of the history, it’s easy to see why people have some of those perspectives. Because like you said you know in the in the
70
00:11:10.860 –> 00:11:18.660
Jason Mefford: Historically we’ve always been more that compliance kind of check the box group and then we started to get out of that in the 90s.
71
00:11:19.080 –> 00:11:28.890
Jason Mefford: And and do much more. You know, consultative type of work and then boom, you know, like you said, we got the early 2000s, the recession socks everything else.
72
00:11:29.490 –> 00:11:41.010
Jason Mefford: And as a stop gap, you know, management, just kind of threw us back into socks to try to help fill that gap and and even, you know, she said, it’s almost been 20 years now and
73
00:11:42.300 –> 00:11:52.560
Jason Mefford: I’ll feel like we’re getting that old Tom. But, you know, we’re talking about something you know 20 years ago that we both lived through it, you know, and it’s a it’s like it doesn’t seem like it’s been that long. But I guess it really has been.
74
00:11:53.130 –> 00:11:54.270
13037924924: That we’ve we’ve
75
00:11:54.300 –> 00:11:56.340
Jason Mefford: Been trying to come out but it’s
76
00:11:56.370 –> 00:12:04.260
Jason Mefford: It’s been again this this 20 plus years of people seeing us as check in the box and compliance and so
77
00:12:04.620 –> 00:12:10.770
Jason Mefford: Yeah. When your CFO looks at it. Well, you know, you guys really haven’t done much for me other than, you know, compliance that we have to do.
78
00:12:11.310 –> 00:12:20.160
Jason Mefford: I think it’s easy to see why people have have some of that perception of us, of being a cost center being a compliance. Check the box thing.
79
00:12:20.640 –> 00:12:26.130
Jason Mefford: And that’s why we’re always kind of fighting for budget. We’re always trying to prove our value because people aren’t
80
00:12:26.940 –> 00:12:33.510
Jason Mefford: aren’t seeing us the way we can be right and you have that perspective of coming back into audit.
81
00:12:33.900 –> 00:12:42.870
Jason Mefford: And you’ve done some really cool things there, you know, and so, maybe, maybe this is where we kind of jump in and and show you know when you have that discussion with your CFO.
82
00:12:43.350 –> 00:12:52.620
Jason Mefford: What are some things you’ve been you’ve been able to do there to show more of the value and really kind of elevate audit in your organization.
83
00:12:54.150 –> 00:13:01.590
13037924924: Yeah. And those are really good questions and that that’s really changed for me, how I approach, that just in the last year and a half, and I
84
00:13:03.270 –> 00:13:12.060
13037924924: I look for opportunities to communicate value and sometimes people will ask, you know, what have you done and sometimes you gotta tell him anyway right
85
00:13:13.620 –> 00:13:25.110
13037924924: We capture data points in terms of savings we we look at processes from really an efficiency and effectiveness standpoint, not, not just a, you know, not just
86
00:13:26.370 –> 00:13:33.240
13037924924: Do we, do we have enough things here, right, for instance, one project we did last year, we call it lean socks.
87
00:13:33.900 –> 00:13:38.580
13037924924: The control framework that had been in place at SEM at had been here for a while.
88
00:13:39.300 –> 00:13:49.290
13037924924: And whenever there was an exception, there would be a new control. So we had certain processes that had a ton of controls and we looked at them and go, you know what, what are we really doing here.
89
00:13:50.160 –> 00:14:04.020
13037924924: And we were able to remove the different controls and different processes and some of those controls. We had to have executed by third parties, because they were so highly technical, particularly on our, on our tech side.
90
00:14:05.340 –> 00:14:11.040
13037924924: Other controls. They were just redundant from earlier in the process. It was just doing the same thing over by a different person.
91
00:14:12.000 –> 00:14:20.550
13037924924: And the idea was to remove burden from operations to meet Sox compliance. Because at the end of the day. So x is just a compliance program.
92
00:14:21.420 –> 00:14:38.250
13037924924: It can add value. But once you meet that threshold of doing what it’s intended it doesn’t add value. It just adds cost. So the lean Sachs project was really to reduce the burden on operations and and and streamline what we do and how we do it.
93
00:14:39.930 –> 00:14:50.220
13037924924: Another approach that we’ve taken is looking at different areas of cost savings if we do things differently here. Where can we reduce
94
00:14:50.880 –> 00:15:04.530
13037924924: Operational burden and we’ve been pretty effective at identifying things in terms of how how the business does stuff, how they want to do stuff and then how they can do it in a way that’s more efficient or effective
95
00:15:06.450 –> 00:15:09.150
13037924924: With technology is really important with SEM.
96
00:15:10.230 –> 00:15:21.270
13037924924: As I mentioned earlier, very unique business model we have technology needs that that are individual or customized because nobody else does stuff. The way we do and
97
00:15:22.050 –> 00:15:32.970
13037924924: Partnering with the business in a way that helps those system development during the implementation, rather than six months after it’s completed it has been very critical.
98
00:15:33.960 –> 00:15:44.670
13037924924: Because it’s not just about we’ve done this better. And when we launch our new GL last May. It was ready to go. And it was a great success story for the organization.
99
00:15:45.120 –> 00:15:50.370
13037924924: Audit was part of that right we didn’t, we didn’t make that happen. But we were part of it and
100
00:15:50.880 –> 00:16:01.110
13037924924: When you go through that together and you have those battles in the heat of while you have to do this and the integration has to look like that. And your data conversion has to be validated this way.
101
00:16:01.710 –> 00:16:12.570
13037924924: You come out the other side and your external audit goes, wow, that’s one of the best we’ve seen and your CFO goes huh system implementation under budget.
102
00:16:13.260 –> 00:16:13.650
Why
103
00:16:15.270 –> 00:16:20.190
13037924924: Does that really happen, you know, three weeks slip on a multiple year project.
104
00:16:21.390 –> 00:16:31.050
13037924924: You know, you kind of look around and you go, yeah, we did it out. It was part of that we did it. It’s a different mentality with the organization.
105
00:16:31.530 –> 00:16:40.950
13037924924: Now you get people coming by. Hey, we’ve got this problem that’s developing, how do we fix that right not gee, I hope they don’t catch it. Let’s fix it now.
106
00:16:41.880 –> 00:16:50.160
13037924924: You get stuff like we have something happened in the third quarter or we stopped performing this control. And besides, we don’t like this control anyway because it doesn’t really do anything.
107
00:16:50.460 –> 00:16:54.510
13037924924: And now that we’re after a year end, we’ve got to fix it. What are we going to do
108
00:16:55.110 –> 00:17:03.150
13037924924: Oh, okay. So you sit down, you work through those things you come up with the control that actually does work that your external auditor looks at and goes, Okay, we can live with that.
109
00:17:03.870 –> 00:17:10.890
13037924924: And instead of that old control that was ineffective. That took a couple hours a week to do you end up with a
110
00:17:11.400 –> 00:17:22.890
13037924924: Month and control that, that takes an hour or two to perform and actually does something for the business. So having those conversations in that context, I think is very important.
111
00:17:23.730 –> 00:17:31.980
13037924924: To elevate the expectations for audit, because I think it starts with that. You know what, what do you expect from audit. Check the box compliance.
112
00:17:32.430 –> 00:17:44.310
13037924924: And reduce costs within your department or can you deliver value to other organizations in a way that they’re receptive to. So I think that those expectations that get set
113
00:17:44.700 –> 00:17:50.580
13037924924: at the board level at the C suite level and within the department. They have to be agreed upon. They have to be talked about.
114
00:17:51.360 –> 00:17:58.920
13037924924: And and from there. It’s really just, it gets a lot easier because the conversations are much more natural. You know, they’re not
115
00:17:59.730 –> 00:18:07.770
13037924924: They’re not designed to hide or of eight or whatever, even the little stuff. Right. It’s like the sales guy who doesn’t have the receipt for the expensive dinner. Yeah.
116
00:18:08.490 –> 00:18:19.260
13037924924: Call. How do I do this right like well write a note. Tell us who was there, right. You show show what you do have, you know, the, the credit card transaction or whatever.
117
00:18:19.680 –> 00:18:30.810
13037924924: And and just be open about it right through seems get lost. That’s what happens. Oh, okay. I guess I could have done that without asking. Well, yeah, but that’s okay. Well, but now you know next time you bought a house.
118
00:18:32.640 –> 00:18:45.570
13037924924: That’s right. Exactly so. So I think a lot of the framing of the dialogue and how that stuff happens. It is what I grew up with. Back in the 80s and 90s of audit and then when I got back to it.
119
00:18:46.500 –> 00:19:01.380
13037924924: It’s the generation of auditors that don’t know that our business internal audit business is about making the business better. That’s, that’s what we do. And it’s in the standards i mean it’s it’s
120
00:19:01.680 –> 00:19:02.910
Jason Mefford: It’s there. It’s just not
121
00:19:02.910 –> 00:19:03.600
13037924924: Practice.
122
00:19:03.720 –> 00:19:04.770
Jason Mefford: As much as it should be.
123
00:19:05.910 –> 00:19:12.510
13037924924: Yeah. Yeah, absolutely. And, and I’ve got so I’m doing this presentation with the Denver is a
124
00:19:15.660 –> 00:19:26.610
13037924924: writing all this, this fruit for stuff of God, it is and you don’t get don’t get used. The way we should. And I’m like, I wonder if this is actually written down somewhere, you know. Is it is it written down in the standard somewhere.
125
00:19:27.000 –> 00:19:36.510
13037924924: And and yeah you know if you download the PDF or the IPF white paper or the the PDF. The purpose of the standard right there at the top I
126
00:19:36.900 –> 00:19:52.410
13037924924: provide a framework for performing and promoting a broad range of value added internal audit services to foster improved organizational processes and operations. That’s, that’s what we’re about. And a lot of folks don’t see that. So we got to get that out.
127
00:19:52.980 –> 00:19:53.610
13037924924: Well, those are
128
00:19:53.640 –> 00:19:54.960
Jason Mefford: Those have been around. I mean, that
129
00:19:54.990 –> 00:19:57.450
Jason Mefford: That version of the IPF I mean they’ve made some
130
00:19:57.630 –> 00:20:06.570
Jason Mefford: minor changes to it, but really it was mid to late 90s when that kind of came out. And again, I mean it’s aging ourselves but folks that was 30 years ago.
131
00:20:06.840 –> 00:20:08.820
Jason Mefford: You know a lot of you that are listening to this.
132
00:20:08.850 –> 00:20:19.380
Jason Mefford: You know, may not even be 30 years old but it but it’s been there and and I want to highlight a couple things that you just said, because it’s really gold for people. Okay.
133
00:20:21.240 –> 00:20:29.880
Jason Mefford: This whole idea of the lean Sachs project that you guys did here, here’s an opportunity, everybody who’s listening this. This is the kind of thing.
134
00:20:30.300 –> 00:20:40.260
Jason Mefford: That you can start doing at your organization to really start showing value because you know the the the problem, if you will, that you were expressing
135
00:20:40.890 –> 00:20:51.570
Jason Mefford: Yeah, tends to happen, both with external and internal audit. We have a finding there’s something that comes up crap. Let’s put in a new control to fix it. Check that off.
136
00:20:51.930 –> 00:21:10.590
Jason Mefford: Right, we’ve got that out of fine being taken care of. And so what’s happened over time is all of our organizations have just continued to add more and more and more and more controls to eventually where, like you said operations is getting burdened
137
00:21:11.880 –> 00:21:14.700
Jason Mefford: And and if we step back and take a look at it, which
138
00:21:14.700 –> 00:21:21.390
Jason Mefford: Is what you guys did in this in this lean socks project is hold it. Do we have some duplicative controls here.
139
00:21:21.930 –> 00:21:27.090
Jason Mefford: Are there some things that may be really aren’t working that well that we could change the control, you know,
140
00:21:28.050 –> 00:21:37.800
Jason Mefford: I loved how you said that you know the person from the business came in and said, yeah, we kind of stopped doing that because we really don’t like that control anyway. And it’s not really effective how literally
141
00:21:37.890 –> 00:21:39.120
Pray is right.
142
00:21:40.470 –> 00:21:41.910
Jason Mefford: You know, okay, well let’s
143
00:21:41.910 –> 00:21:48.810
Jason Mefford: Figure out something that is actually effective that’s going to work for you and and reducing that burden.
144
00:21:49.350 –> 00:21:55.230
Jason Mefford: That’s cost savings to your organization that we should be capturing and I heard you kind of say that to where
145
00:21:55.650 –> 00:22:04.290
Jason Mefford: You’re actually kind of documenting and recording how you’re helping the business, right. So when your CFO comes to you and says, What do you do for me last year.
146
00:22:04.710 –> 00:22:13.740
Jason Mefford: You’ve got some kind of sheet. You can pull out and say, well, by the way we did this, this, this, this, and this, that had this kind of a savings to the organization. That’s great.
147
00:22:14.640 –> 00:22:15.720
Jason Mefford: But a lot of people aren’t doing
148
00:22:15.720 –> 00:22:16.890
Jason Mefford: It right
149
00:22:16.920 –> 00:22:18.000
Jason Mefford: A lot of people aren’t doing it.
150
00:22:20.220 –> 00:22:27.690
13037924924: Yep, absolutely. And, and even, you know, capture the small stuff. And that’s kind of where we started. We did a record retention audit and, you know,
151
00:22:28.110 –> 00:22:36.180
13037924924: It’s old dirty boxes stuck in a warehouse that nobody needs to look at. And we came up with $15,000 of cost savings.
152
00:22:36.600 –> 00:22:46.320
13037924924: And it was one of the first times we captured cost savings and an audit report and, and I felt kind of like, you know, gasps 15 grand. What does that mean, right.
153
00:22:46.770 –> 00:23:03.990
13037924924: But the reception was you guys actually do that you guys actually look for cost savings and it was not so much about it wasn’t much. It was about. Yeah, we do that and then did another auditor, about six months later, where we were able to restructure some things using a third party provider.
154
00:23:05.010 –> 00:23:10.950
13037924924: And it saved us you know 60 or 80 grand and then two years out, it’s going to save us over 100
155
00:23:12.300 –> 00:23:23.970
13037924924: Now you’re starting to talk about more a pattern of will. This is part of what audit does. Yeah. And yeah, you can be sure that shows up at the during the, the, the annual review. I mean, that’s that.
156
00:23:24.360 –> 00:23:33.930
13037924924: I stick that in there. And if it’s 15 K. Great. If it’s more even better. But the idea is we’re on the lookout for this. This is part of what we do.
157
00:23:34.470 –> 00:23:45.480
13037924924: And the best part is, it’s not well so and so spent this and it wasn’t in compliance. No, it was let’s change our processes. This way, and we just have less money. We have to spend
158
00:23:46.230 –> 00:23:51.660
13037924924: So it’s, you know, establishing that expectation, particularly when it comes to these kinds of things I think is important.
159
00:23:52.740 –> 00:23:53.460
13037924924: Well, yeah. And it does
160
00:23:53.490 –> 00:24:00.090
Jason Mefford: It does two things for you when you when you take that kind of mindset, right. It’s like you said, even if it’s only 15 grand
161
00:24:00.630 –> 00:24:15.300
Jason Mefford: But you know the people in the business said what you mean internal audit does this kind of stuff. Yeah. And you do that a couple of times and all of a sudden that perception is going to start to change, right, like you said at the beginning.
162
00:24:15.300 –> 00:24:17.130
Jason Mefford: You know, the CFO was kind of like, well, audit.
163
00:24:17.130 –> 00:24:31.890
Jason Mefford: Really hasn’t done anything for us, other than, you know, check the boxes. Now all of a sudden she and others in the organization ARE SAYING. BUT HOLD IT NOW internal audit also help save us money. They’re looking for cost savings, right. This is a part of their job.
164
00:24:31.920 –> 00:24:32.310
13037924924: Too.
165
00:24:32.760 –> 00:24:36.120
Jason Mefford: And you start yelling that a couple of times that starts to change their
166
00:24:36.120 –> 00:24:47.160
Jason Mefford: Perspective, but it also helps you from a budget standpoint and trying to justify your existence, if you will. I mean, there’s a lot of I hear
167
00:24:47.190 –> 00:24:48.360
Jason Mefford: From a lot of CFE
168
00:24:48.360 –> 00:24:48.570
13037924924: Is
169
00:24:48.780 –> 00:24:59.730
Jason Mefford: There CA’s they’re there, they’re really, you know, under pressure for budget having to kind of each year justify you know their budget.
170
00:25:00.540 –> 00:25:12.360
Jason Mefford: In their head count and all this other kind of stuff. Well, having these kind of sheet showing the cost savings that you’re doing well that that makes it so much easier. Right. Like, I remember one one time.
171
00:25:13.980 –> 00:25:24.990
Jason Mefford: external auditors wanted to increase our fees. So I went back to, and it was going to be pretty sizable and I went back to them and said, Look guys, come on, you know, the company’s not really, is there anything we can do
172
00:25:25.680 –> 00:25:35.940
Jason Mefford: To help so that we don’t have this kind of an increase. And they said, well, if you’d start doing these two different compliance tests for us, so we don’t have to do it.
173
00:25:36.570 –> 00:25:51.180
Jason Mefford: Then instead of raising the fees, we’ll just keep them flat because it means there’s less work we have to do. And so I kind of put pencil to paper and I went, Okay. Sure, I’ll do that. Well, you know, spending three weeks of one person in my department.
174
00:25:53.070 –> 00:26:06.570
Jason Mefford: Was like three times that person salary and cost savings on our external audit. Well, that that’s the kind of stuff like you’re talking about those little things. And those things that you start adding to the list to where now all of a sudden were
175
00:26:06.570 –> 00:26:07.350
13037924924: Justifying
176
00:26:07.380 –> 00:26:18.570
Jason Mefford: And we’re seen as an investment instead of a cost center right because money that’s being invested in internal audit is coming back to the company. That’s what CFO.
177
00:26:18.630 –> 00:26:19.140
13037924924: Want to see
178
00:26:20.280 –> 00:26:26.820
13037924924: Yeah. Yeah, absolutely. Even if it’s, you know, a negative ROI. Right. You know, it’s not 100% negative
179
00:26:26.880 –> 00:26:31.920
13037924924: Because they’re starting to see returns. You know, so maybe you returned half of your budget to the business.
180
00:26:32.460 –> 00:26:38.670
13037924924: Ideally, you want to return all of it right but if you can just start capturing how much you return
181
00:26:39.120 –> 00:26:50.040
13037924924: Even if it doesn’t meet the budget, you can still make an argument over it is an investment because you have to put a cost. You have to put a price on on Sox compliance. You have to put a price on
182
00:26:50.850 –> 00:27:02.190
13037924924: You know, the, the, the, the governance and the tone of top and those kinds of things which are hard right but if you can bring in hard cost savings that actually impact.
183
00:27:03.390 –> 00:27:13.830
13037924924: The, the bottom line, even if it doesn’t meet your budget, it still shows an attitude and approach difference really that you’re making with a business. Yeah.
184
00:27:14.610 –> 00:27:29.310
Jason Mefford: Well, I think that’s, excuse me, that’s, that’s the important part. You know, like you’re talking about is if you’re going to change the perspective of people, you’ve got to be doing some of these things. And so again, I mean, you’ve, you’ve been there for now for quite a while.
185
00:27:30.570 –> 00:27:33.870
Jason Mefford: First first year was everything Rosie and everything changed.
186
00:27:34.440 –> 00:27:36.060
13037924924: In just one year. No.
187
00:27:36.510 –> 00:27:37.470
Jason Mefford: No, no.
188
00:27:38.250 –> 00:27:46.260
13037924924: No, not at all. And we still have our struggles right now. You know, it’s trying to find a good it auditor, it kind of
189
00:27:47.280 –> 00:28:01.080
13037924924: That was a tough one. We finally have one on board right now she’s been on board for a couple months now, and she’s top shelf, but we had to go through. We had to go through a couple of different things to get there. And it turns out it was a
190
00:28:02.100 –> 00:28:15.780
13037924924: It audit manager that I’d worked with before I knew we shared values. She’s got a great approach, all of this, the hard skills technical skills soft skills that you would need. So we finally finally got ourselves a good it auditor.
191
00:28:16.920 –> 00:28:24.810
13037924924: Additionally, you know, within a couple months of me starting here senior and internal auditor who’d been with the company for about 10 years decided that
192
00:28:25.410 –> 00:28:33.870
13037924924: It’s just too much change. So she wanted to move into a different role with a different company, it’s like okay but you know that was at year end that was
193
00:28:34.410 –> 00:28:43.200
13037924924: You know, mid November when she left, and we have year end stuff that we need to take care of. So having the conversations with the CFO and the
194
00:28:44.070 –> 00:28:55.440
13037924924: And the audit committee chair about how we’re going to manage that were interesting because, you know, it’s a budget hit right you save money on payroll, but you gotta go find a third party provider who’s get the work done. Yeah.
195
00:28:56.640 –> 00:29:12.120
13037924924: So a lot of those kinds of things and and additionally introducing new ideas, integrating with a system development, implementation, brand new idea of the organization. Never thought internal audit should ever be involved in any of that kind of stuff. So there were a lot of headwinds
196
00:29:13.350 –> 00:29:19.890
13037924924: In those areas and we still have other challenges right now, how we approach different kinds of things. We have a different take.
197
00:29:20.400 –> 00:29:27.990
13037924924: It’s much more value add collaborative consultative and we’re haven’t gotten to all of the organization.
198
00:29:28.500 –> 00:29:38.190
13037924924: But as we pick up projects and dress things we’re gaining advocates and I think that’s really the important thing is when you approach.
199
00:29:38.700 –> 00:29:46.410
13037924924: A project to do it in a way that you’re looking for an advocate, so that when the project is over and moved on that person that senior
200
00:29:46.920 –> 00:29:56.670
13037924924: Management team that that those stakeholders can tell their peers. It’s like, no, you probably ought to give, give them a chance, you know, give them a chance to do it this way it because
201
00:29:57.060 –> 00:30:07.320
13037924924: Our experience was. And then they’ll tell you know this was our experience. This is what we saw. So yeah, give them a chance. So I think that’s, that’s kind of important. And just how you approach it.
202
00:30:08.310 –> 00:30:09.690
Jason Mefford: Well, and it does take
203
00:30:09.690 –> 00:30:15.270
Jason Mefford: Some time and like you said you’ve got to have the small wins that will end up leading to the bigger wins.
204
00:30:15.750 –> 00:30:22.560
Jason Mefford: But that social proof you know of that other executive saying, You know what, just, just give them a chance, you know,
205
00:30:23.160 –> 00:30:34.770
Jason Mefford: Maybe I was skeptical at first, too. But man, you know, they, they did a great job for me. Just, just give them a chance that that goes a long way in in helping to change some of those perspectives.
206
00:30:35.160 –> 00:30:44.610
Jason Mefford: And you’ve been doing that now for four years there and and i think that you know we didn’t, we didn’t have a lot of time because we’re bumping up on time, of course, but
207
00:30:45.330 –> 00:30:52.560
Jason Mefford: Talk about some of the system implementation, you know, work that you did because like you said, you know, originally they kind of thought, well,
208
00:30:53.070 –> 00:30:58.710
Jason Mefford: Does internal audit really belong here. You know, in doing some more of this real time kind of stuff, but
209
00:30:59.220 –> 00:31:08.670
Jason Mefford: You know, the proof is in the pudding, if you will, right, that at the end of the day, a multi year project, you said what have three, three weeks of slippage and a couple year project and you
210
00:31:08.670 –> 00:31:10.530
Jason Mefford: Came in under budget.
211
00:31:11.070 –> 00:31:13.290
Jason Mefford: And wow, wow.
212
00:31:13.980 –> 00:31:14.670
Jason Mefford: That just doesn’t have
213
00:31:14.700 –> 00:31:31.080
13037924924: And and yeah, you’re right. And that was under budget after we took the budget down quite a bit, because we removed risks. So we reduced the contingency. We brought in a different vendor who who so I mean this, it was, it was a really good experience. But anyway, yeah. Yeah.
214
00:31:31.800 –> 00:31:37.350
Jason Mefford: Well, perfect. Well, hey, I know we’re kind of coming up on the end of our little half our time. But, you know,
215
00:31:37.530 –> 00:31:46.950
Jason Mefford: Tom before we, before we take off, you know, maybe just kind of any, any final, you know, bits of wisdom for people either that are kind of moving up into this role of
216
00:31:47.340 –> 00:31:58.770
Jason Mefford: You know how to prepare how to how to get into the mindset, what they need to do, you know, to be successful in their career and become a chief audit executive SOMEDAY, IF THAT’S if that’s kind of what they want to do.
217
00:32:00.390 –> 00:32:08.070
13037924924: Yeah, I think that you hit on some of it already is. Go for the little wins and and then build upon them and
218
00:32:08.970 –> 00:32:19.020
13037924924: When you do have opportunities and or you see opportunities, even if you’re the only one that sees it have the courage to pursue that. And don’t be afraid to fail.
219
00:32:19.980 –> 00:32:24.270
13037924924: You know, you take chances, you’re not always going to be successful, but that’s okay.
220
00:32:25.080 –> 00:32:31.470
13037924924: While I’ve spoken a lot about the early wins and successes in my, in my last year and a half or so here
221
00:32:32.010 –> 00:32:41.940
13037924924: There’s some other projects that didn’t work out the way we intended different innovative approach to doing kinds of things that we look back on. I go, Well, I didn’t really work the way we expected it.
222
00:32:42.810 –> 00:32:49.350
13037924924: Having the support from those stakeholders to say, yeah, it’s not really what we expected. However,
223
00:32:49.770 –> 00:33:04.080
13037924924: There are some wins coming out of it. And a lot of those are just relational relational because of the way we manage the project, the way we were we were open to their ideas and implemented their stuff. So we’ll call it a little win right
224
00:33:05.490 –> 00:33:07.860
13037924924: Didn’t didn’t get the expectations that we wanted.
225
00:33:08.370 –> 00:33:24.210
13037924924: Some people would say it was a failed project because of whatever reason. And I’d have to agree with that. But it was also successful for other reasons. So have had the courage to take those chances, be smart about the chances you take right but have the courage to
226
00:33:25.260 –> 00:33:36.330
13037924924: Take the risks smart risks and do it in a way that you build relationships because win or lose, that’s what’s going to define success in the long term.
227
00:33:37.410 –> 00:33:53.820
Jason Mefford: Well, I think that’s, that’s, again, it is probably one of the biggest keys is building those relationships and relationships take time and we just like with any relationship sometimes things don’t go quite the way you expected.
228
00:33:54.960 –> 00:34:10.920
Jason Mefford: But it’s how you respond on whether or not that relationship ends up being improved. Right. So again, even though you know sometimes we have some fails, you know, one of my favorite sayings is there is no failure. There’s only feedback you know that if we
229
00:34:10.920 –> 00:34:12.390
Jason Mefford: If we choose to learn
230
00:34:12.390 –> 00:34:23.070
Jason Mefford: From the feedback that we get from what are often perceived as those failures and we do things different. We’re open. We’re transparent. We’re trying to work on the relationship
231
00:34:23.550 –> 00:34:31.980
Jason Mefford: Even those failures can strengthen the relationships which lead to the future wins and even just developing the relationship is a win.
232
00:34:33.390 –> 00:34:33.690
13037924924: You know,
233
00:34:33.750 –> 00:34:35.280
Jason Mefford: Because it’s it’s the long game.
234
00:34:35.490 –> 00:34:36.360
Jason Mefford: I mean you’re not
235
00:34:37.410 –> 00:34:45.900
Jason Mefford: You know, anytime we do things that are kind of short sighted for the short term benefit. It usually burns us in the long term and so
236
00:34:45.990 –> 00:34:48.810
Jason Mefford: I know, like you said, I love you know have the courage to just
237
00:34:49.110 –> 00:34:58.140
Jason Mefford: Stick in their pursuit, do the things that you need to do learn along the way. But most importantly, build those relationships.
238
00:34:58.980 –> 00:35:04.920
Jason Mefford: Because when you do that, that’s how perceptions change. That’s how you know again like we kind of started off at the beginning.
239
00:35:05.400 –> 00:35:19.530
Jason Mefford: Really we’re here. It’s not about accounting, it’s about people and processes and trying to help our organizations, improve get better reduce costs, make it easier for them so that we can ultimately go out and achieve our objectives.
240
00:35:20.940 –> 00:35:21.840
Jason Mefford: Yep, I would agree.
241
00:35:22.860 –> 00:35:26.730
Jason Mefford: Well, Tom. Thank you for coming on and yeah
242
00:35:26.760 –> 00:35:28.650
Jason Mefford: We’ll have to talk to you. I think because there’s
243
00:35:29.010 –> 00:35:32.220
Jason Mefford: There’s, there’s, there’s a lot of stuff you guys have been doing there. That’s actually
244
00:35:32.940 –> 00:35:44.280
Jason Mefford: Really, really cool that I think people, people need to hear about. So, but with that everybody else we’re going to sign off for this week and we’ll catch you on a future episode of jamming with Jason
