I am pleased to talk with Julio Tirado for this week’s #jammingwithjason #internalauditpodcast episode where discuss lessons he’s learned from being a CAE. You’ll hear how Julio’s career brought him to be a CAE, and suggestions he has for those of you that aspire to become a CAE.
It’s just me and Julio down at the school yard … jamming and talking shop (could help putting in the Paul Simon reference 🙂
We discuss many things including: how to put the user (i.e. our audit client) at the center of the relationship, the importance of every auditor having a basic understanding on IT and security, considering the consequences of our audit recommendations, the need for project management skills, and how all internal auditors have to spend a little time selling.
Julio Tirado is the CAE for Spirit Bank in Tulsa, OK.
Jamming with Jason is the #1 #internalauditpodcast in the world has interviews and discussions (jam sessions) relevant to Chief Audit Executives and professionals in #internalaudit, risk management, and compliance.
Transcript
1
00:00:00.840 –> 00:00:11.550
Jason Mefford: Welcome everybody to another episode of jamming with Jason. Hey. Today I am honored to be with Julio to Otto or Toronto. If you want to say it that way too.
2
00:00:11.610 –> 00:00:12.090
Julio Tirado: Well done.
3
00:00:12.360 –> 00:00:13.469
Jason Mefford: Well done. All right.
4
00:00:14.160 –> 00:00:17.130
Jason Mefford: So, you know, and I have to say to because my
5
00:00:17.130 –> 00:00:24.330
Jason Mefford: Mind just works a little funny, right. So again, when I knew that we were getting on the call today because I like to bring music and a little bit too.
6
00:00:24.690 –> 00:00:26.190
Jason Mefford: You know, so of course
7
00:00:26.190 –> 00:00:32.460
Jason Mefford: When I when I saw you know your name on my calendar to, you know, it’s like, I go to that Paul Simon song me and Julio down
8
00:00:32.460 –> 00:00:32.730
But
9
00:00:34.710 –> 00:00:37.110
Jason Mefford: So I had to listen to that this morning to and then it’s like
10
00:00:37.290 –> 00:00:37.710
Jason Mefford: You know those
11
00:00:37.950 –> 00:00:41.580
Jason Mefford: Kids really got in trouble. They got thrown in jail. We’re not gonna do anything like that today.
12
00:00:43.920 –> 00:00:56.130
Jason Mefford: But I’m glad I’m glad to have you with me today. So, Julio is the he’s the chief executive of spirit Bank, which is I think you guys are pretty much regional there, right, you’re in the Oklahoma area.
13
00:00:56.340 –> 00:01:04.050
Julio Tirado: We are. Yeah. We’re based out of Oklahoma just shy of 700 million in assets and five branches and entirely Oklahoma base.
14
00:01:04.800 –> 00:01:08.340
Jason Mefford: That’s pretty good though 700 million for five branches. That’s pretty good. Yeah.
15
00:01:09.060 –> 00:01:12.930
Jason Mefford: Pretty good size pretty good sized well you guys will keep growing. And of course, then you’re going to
16
00:01:12.930 –> 00:01:20.550
Jason Mefford: Start bumping up on those other limits that then create a whole bunch of compliance issues for you, but you’ll worry about that when you get to that point.
17
00:01:22.650 –> 00:01:28.320
Jason Mefford: But yeah, thanks. Thanks for joining me, you know, on hair because I wanted to, you know, maybe just give
18
00:01:28.800 –> 00:01:36.840
Jason Mefford: Give people at first because I know we talked before we started recording about a couple of points that we’d like to kind of bring up because I think that are important, but
19
00:01:37.290 –> 00:01:49.470
Jason Mefford: Just first maybe kind of give people a little sense of, you know what your career entailed how you’ve gotten to this point of being a chief audit executive because I always think it’s interesting for
20
00:01:49.470 –> 00:01:56.100
Jason Mefford: People to see the various pathways that people become the chief executive. Yeah.
21
00:01:56.370 –> 00:02:11.040
Julio Tirado: I’d be happy to. So the, the internal audit journey for me started in April 2007 the bank hire me as an internal auditor and actually it almost didn’t happen, kind of a quick story in late
22
00:02:11.910 –> 00:02:21.300
Julio Tirado: Late oh six early oh seven I was looking for a job. I was looking for a job in the investment world and couldn’t find anything in Oklahoma City, which is that at the time.
23
00:02:21.960 –> 00:02:30.720
Julio Tirado: And in early, early oh seven I decided to broaden the criteria and see what else is out there and came across this job called internal auditor gaviglio salary range and
24
00:02:31.080 –> 00:02:38.520
Julio Tirado: I said, Hey, I got a degree. I got a finance degree I match fit the box and applied to my surprise, I got a call instead of the interview.
25
00:02:39.300 –> 00:02:45.960
Julio Tirado: And the moment I hung up the call. I said to myself, what the heck did I just do had no idea what I mean it was one of several that I applied to
26
00:02:46.530 –> 00:02:51.870
Julio Tirado: So I did what any student would do I would do a little more homework and I bought a book. I think it was a Barnes and Nobles
27
00:02:52.740 –> 00:03:02.790
Julio Tirado: It was called something to the effect of the handbook or of internal audit and an hour into the book I dropped and I almost called the recruiter to cancel the interview.
28
00:03:03.840 –> 00:03:05.820
Jason Mefford: Like, I don’t want to give them to us at all right.
29
00:03:06.210 –> 00:03:10.110
Julio Tirado: That’s on the south coast. So this corporate government is that I had, I was clueless.
30
00:03:10.860 –> 00:03:16.350
Julio Tirado: But I kept the interview, and I’m not afraid of the unfamiliar. So, in hindsight, it was one of the best decisions I’ve ever made.
31
00:03:17.070 –> 00:03:27.060
Julio Tirado: learned so much. So I worked for spirit bank for six years. And then I decided to take the leap into a startup. Number two, I had done a start up before before spirit.
32
00:03:27.420 –> 00:03:35.910
Julio Tirado: And started a consulting company and the my own name. Joe dates right and associates did that for slightly over two years that was went very well have several clients.
33
00:03:36.210 –> 00:03:44.280
Julio Tirado: I was about the transition into the famine phase a feast and famine relationship and my wife had some develops medical issues. She had to quit working
34
00:03:44.670 –> 00:03:52.800
Julio Tirado: And long story short, it made more sense for me to go back to being a blowing. So at the time at the chance to go work at a technology company as a project manager role.
35
00:03:53.310 –> 00:04:05.610
Julio Tirado: And six months into it, the CEO Sberbank call. They said, Julio come back to the bank and they made me the the CRM risk off the CRM officer and the information security officer. And I did that for about a year.
36
00:04:06.540 –> 00:04:16.830
Julio Tirado: At which point I was asked to go back to audit where they need to be more and I’ve been doing that ever since. And you know that year in security and risk really informed my thinking. It helped me
37
00:04:17.610 –> 00:04:27.480
Julio Tirado: Appreciate the, the importance of the security side of the house. I know that one year I dove as deep as I could, I mean, as you know, as a as a finance major
38
00:04:27.840 –> 00:04:28.200
Julio Tirado: I had to
39
00:04:28.230 –> 00:04:36.600
Julio Tirado: Be caught up really quickly and and that I did to the best of my ability. So that informed me as a CA is internal auditor significantly. So I’ve used security.
40
00:04:37.050 –> 00:04:50.040
Julio Tirado: from a slightly different perspective, because that year, but I’ve been in. So in in that role since 2016 and just working hard every day to upscale get caught up and continue to tackle this.
41
00:04:50.940 –> 00:04:57.330
Jason Mefford: One, I think it’s great you know because your, your experience is is very similar to many other people
42
00:04:57.900 –> 00:05:06.750
Jason Mefford: Right. I mean, I remember when I first, you know, because I got the accounting degree I got the CPA, I went to work at a couple of account big accounting firms.
43
00:05:07.380 –> 00:05:16.140
Jason Mefford: You know, laughed because one of my clients hired me to start an internal audit department as the chief audit executive, you know, hey, we need this come in, build it out.
44
00:05:17.070 –> 00:05:30.270
Jason Mefford: And I remember you know going to like my first III conference. And I think build the ship was still the president back then. And, you know, he’s like, I’m proud to be an internal auditor, you know, and all this kind of stuff. And Bill was just just kind of that way and and in
45
00:05:30.870 –> 00:05:33.210
Jason Mefford: You know, I grew up in the external side but
46
00:05:33.330 –> 00:05:44.490
Jason Mefford: But most of us, you know, end up in internal audit. I mean, there’s there’s very few people in internal audit the probably as a little kid were saying, I’m going to be an internal auditor. When I grow up.
47
00:05:45.540 –> 00:06:00.030
Jason Mefford: There’s more of those people now right but but you know in in the day we all just kind of fell into it. You know, like you said you got you got your finance degree you were looking for a job that’s thing internal audit and you get the job.
48
00:06:00.120 –> 00:06:01.590
Jason Mefford: Yeah, and then
49
00:06:01.770 –> 00:06:03.900
Jason Mefford: Obviously, you must have liked it. If you hung around for
50
00:06:03.900 –> 00:06:05.760
Jason Mefford: Six years to begin with. Right.
51
00:06:06.630 –> 00:06:21.300
Jason Mefford: So, so you kind of fell into it. But then you then, you know, like you said, you ended up kind of going off to do some other things right, some independent consulting to begin with. Go back to a tech company, but not as an internal auditor, but more in the PM. Oh.
52
00:06:21.330 –> 00:06:22.710
Julio Tirado: Yeah, yeah. That was, that was another
53
00:06:22.710 –> 00:06:23.280
Julio Tirado: Role
54
00:06:23.490 –> 00:06:27.240
Julio Tirado: Right. And then I was working with the audit team that was very interesting. Yeah.
55
00:06:27.330 –> 00:06:33.510
Jason Mefford: Yeah, so, so I think it’s it’s it’s interesting because I want to delve in a little bit to a couple of these other
56
00:06:35.460 –> 00:06:45.480
Jason Mefford: experiences that you’ve had. Because like you said, you know, you look at security and it a little bit different than maybe some other some auditors do
57
00:06:45.960 –> 00:07:01.110
Jason Mefford: Because you’ve actually have that job right and and so the more perspective and the differences that we have it. It really helps us is we actually talked about before we hit record about having empathy for other people.
58
00:07:01.380 –> 00:07:02.250
Jason Mefford: That’s the end that
59
00:07:02.280 –> 00:07:14.460
Jason Mefford: Actually makes us better auditors so i’m i’m interested, you know, to when you when you went back to that tech company in a project management role. Again, that was totally new for you.
60
00:07:14.760 –> 00:07:23.370
Jason Mefford: I mean, was that something again where you were like, hey, I should, you know, I need to improve my project management skills. So I’m gonna go find a job in project management or
61
00:07:23.370 –> 00:07:25.680
Jason Mefford: Did it kind of just fall into you. How did that work.
62
00:07:26.280 –> 00:07:33.120
Julio Tirado: Well, I was, I was very open minded about what jobs that was looking for because I had to time everything properly.
63
00:07:33.750 –> 00:07:43.740
Julio Tirado: And. And it just so happened that role was a was heavier toward it governance, but it was an IT governance slash project management role. So that was a really good fit.
64
00:07:44.220 –> 00:07:52.830
Julio Tirado: Yeah, but I went in there, excited about trying something new and I was planning to go for that PMT certification soak in. And as much as I could. PM wise.
65
00:07:53.310 –> 00:08:09.870
Julio Tirado: And and only did it for a little while, but that little while was very insightful learn so much about the technology departments working together from from an agency perspective, you know, hey, I’m feeling it disease from the other side, not the auditors. So that was very, uh huh.
66
00:08:09.960 –> 00:08:19.830
Jason Mefford: Well now you know those are areas that you’re audited, you know, effectively. And so again, you’ve seen it from both sides. So, so I think that’s interesting because, you know, I think a lot of times people
67
00:08:20.340 –> 00:08:25.710
Jason Mefford: You know, they kind of wonder and you know if you’re the chief audit executive and you’ve got to kind of come up with a team.
68
00:08:25.920 –> 00:08:26.220
Julio Tirado: Yeah.
69
00:08:26.340 –> 00:08:47.640
Jason Mefford: You know, in my opinion, if you’ve got a team of probably five or more, it’s probably a good idea to have some people in your team that actually have some of these project management skills, maybe hire somebody who’s a p MP, because what do we do every day. We’re doing projects are high.
70
00:08:48.030 –> 00:08:49.860
Jason Mefford: So actually understanding project.
71
00:08:49.860 –> 00:09:04.350
Jason Mefford: Management, how it works, how that translates in into the, into your organization because a lot of times we’re auditing things that our projects I think is actually a really good idea. So it’s interesting that you actually have that background.
72
00:09:05.820 –> 00:09:09.300
Jason Mefford: How do you think that’s helped you and you know now in your career going forward.
73
00:09:10.680 –> 00:09:15.600
Julio Tirado: Well as a part of that experience. I got to learn, for example, about age agile.
74
00:09:16.080 –> 00:09:16.320
Jason Mefford: Yep.
75
00:09:16.410 –> 00:09:20.700
Julio Tirado: Project management, which has, you know, is becoming a thing now in the audit and assurance space.
76
00:09:21.120 –> 00:09:27.120
Julio Tirado: So I love to see us think that way because you’re right, if you if you step back and look at the big picture.
77
00:09:27.390 –> 00:09:31.680
Julio Tirado: What is an internal audit operation, it’s a collection of a bunch of projects that have to be managed.
78
00:09:31.980 –> 00:09:40.590
Julio Tirado: So it makes sense if we take a project management methodology we are going to be more organized, hypothetically, more efficient therefore less stressed.
79
00:09:40.860 –> 00:09:49.080
Julio Tirado: So it’s very logical to think like a project manager in the audit whenever we’re thinking about what to do. What do you value which managed to organize with
80
00:09:49.710 –> 00:09:58.740
Julio Tirado: So that was synergistic and obviously, as I mentioned, now that you know Agile is a thing. People always talking about it. Every article has agile audit this
81
00:10:00.780 –> 00:10:02.100
Julio Tirado: Blending in the profession.
82
00:10:02.520 –> 00:10:12.420
Jason Mefford: Well, and it’s interesting. I don’t, I don’t know if if you get the same sense that I do, but a lot of people are talking about agile, but a lot of people don’t really get it.
83
00:10:12.960 –> 00:10:13.680
Julio Tirado: It’ll take a while.
84
00:10:14.010 –> 00:10:28.590
Jason Mefford: It’ll. It’ll take a while. And because because again it’s not just about doing audits fast or having stand up meetings during, during the thing. This is like a fundamental change to how we have historically
85
00:10:29.250 –> 00:10:47.190
Jason Mefford: The kind of documentation that we’ve done you know if we’re going to fully embrace an agile methodology. It’s pretty foundational folks in some of the changes that we’re going to have to do to really get to that point. But it but it’s, you know, like you said, and and
86
00:10:48.630 –> 00:10:52.620
Jason Mefford: It’s a concept. I think it’s here to stay. It makes a lot of sense.
87
00:10:52.620 –> 00:10:54.870
Jason Mefford: We should, we should incorporate more of it.
88
00:10:54.870 –> 00:11:00.720
Jason Mefford: Because, you know, honestly, if your company is using an agile methodology for its projects.
89
00:11:01.440 –> 00:11:06.990
Jason Mefford: Wouldn’t it make a lot of sense for us to do it more that way too. So it’s something that they’re used to as well.
90
00:11:07.440 –> 00:11:16.860
Jason Mefford: Plus, it gets more feedback from the customer quicker. They’re more involved in the process, which I think is important as well. But that’s going to have to a lot of auditors are going to have to
91
00:11:17.940 –> 00:11:26.700
Jason Mefford: Get used to that fact and realize we can get that kind of feedback from customers and it’s okay. And they can be more involved in the process. And it’s okay.
92
00:11:27.180 –> 00:11:27.600
Jason Mefford: So,
93
00:11:27.690 –> 00:11:34.860
Julio Tirado: When earlier about about empathy. You know this this forces, if we’re a small tech startup and when you were using agile to
94
00:11:35.280 –> 00:11:41.640
Julio Tirado: Develop and do what we do with the user is going to be at the center of the process. So, likewise, if we’re
95
00:11:42.060 –> 00:11:49.830
Julio Tirado: Treating putting the department heads the client, the company’s as the as the user in the center of the process, hypothetically, it would
96
00:11:50.070 –> 00:12:05.460
Julio Tirado: Lead to a better relationships, hypothetically, would lead to better communication and much less less stressing stressful. Exit meeting better audit committee meeting. So putting people in the center. Maybe one of those those buy products. I’ve got a job.
97
00:12:06.480 –> 00:12:16.110
Jason Mefford: But I’ll probably isn’t that’s actually going to that adds more value to right right and and again when we would deliver report or whatever our results are
98
00:12:16.530 –> 00:12:24.540
Jason Mefford: It’s going to be much more tailored to that particular user if we’re actually considering and thinking about them at the center of the relationship
99
00:12:25.140 –> 00:12:39.480
Jason Mefford: That’s right, as opposed to, hey, we’re this external group coming in and we’re doing all this stuff and then we’re going to flop, this report over to. Yeah. And you’ve got 30 recommendations you have to go implement and half of them you thinking, why are you even asking me to do this right
100
00:12:41.310 –> 00:12:42.840
Jason Mefford: So yeah, that’s a that’s
101
00:12:44.040 –> 00:12:55.590
Jason Mefford: Yeah, good experience. And so again, like I said, you know, having some of those skill sets are having people on your team that understand that I think makes makes us stronger team overall right
102
00:12:55.650 –> 00:13:03.180
Julio Tirado: Nothing but value add if you have that opportunity. Certainly, certainly do it. And I would say that there are so many resources when I
103
00:13:03.600 –> 00:13:13.050
Julio Tirado: When I think about what was available in 2007 when I started versus now if in 2007 you told me, hey, Julio, you should learn some project management for XYZ reasons.
104
00:13:13.530 –> 00:13:18.780
Julio Tirado: Well, then I might have been a little more uncertain what. Where do I go to what book. Bye. Bye now.
105
00:13:19.410 –> 00:13:23.610
Julio Tirado: These, these programs that you can leverage more variety resources. There are literally a button press away.
106
00:13:23.970 –> 00:13:37.680
Julio Tirado: To learn about anything you can one in this case particularly agile, so you may not have somebody in your team, who is a project manager wasn’t project manager, but he can gain these skills and implemented in it as best as make sense.
107
00:13:38.460 –> 00:13:40.740
Jason Mefford: Well, it’s interesting that you bring up 2007
108
00:13:41.190 –> 00:13:42.240
Julio Tirado: As well, right, because
109
00:13:42.240 –> 00:13:43.260
Jason Mefford: That was a
110
00:13:43.890 –> 00:13:51.900
Jason Mefford: I’ve heard a lot of people talk about this, and especially from a, from an IT perspective and we’re going to jump into kind of talking a little bit more about some of the tech and rescue
111
00:13:51.900 –> 00:13:52.380
Julio Tirado: Stuff.
112
00:13:52.410 –> 00:13:59.700
Jason Mefford: You know here soon. But 2007 was really kind of a seismic shift in
113
00:14:00.150 –> 00:14:00.720
Jason Mefford: The world.
114
00:14:01.230 –> 00:14:09.300
Jason Mefford: It will. It was tough year for banking because it was right, you know, right at the time of the financial collapse, but from a technology perspective.
115
00:14:09.840 –> 00:14:23.190
Jason Mefford: 2007 was there was some big seismic shifts, you know, the smartphone. The, the internet have been around, but really kind of the two point O side of it started really kind of coming in and so
116
00:14:23.580 –> 00:14:38.940
Jason Mefford: You know the world that we see ourselves in now and 2020 is largely shaped by a few of the events that happened in 2007 2008 so it’s kind of interesting. Again, that you bring that back because yeah if we were talking in 2004
117
00:14:39.390 –> 00:14:45.360
Jason Mefford: A lot of this stuff wouldn’t be as relevant because it hadn’t happened yet. And we and we don’t have some of that stuff. Right.
118
00:14:45.420 –> 00:14:49.530
Julio Tirado: It’s any interest employment, a lot has changed. And it seems like things are changing at a faster rate.
119
00:14:50.400 –> 00:14:57.420
Jason Mefford: They are in fact some of the other stuff that I’ve read, I’m trying to remember the name of the book. It’s going to escape me right now.
120
00:14:58.440 –> 00:14:59.400
Jason Mefford: The the
121
00:15:00.540 –> 00:15:09.630
Jason Mefford: The speed of change in it is quicker than as humans we can comprehend and
122
00:15:09.870 –> 00:15:12.210
Jason Mefford: Consider the implications of it.
123
00:15:12.750 –> 00:15:25.860
Jason Mefford: So that’s, that’s why a lot of people now are like well put the brakes on all this AI stuff because we really can’t figure out yet or process how this is really going to
124
00:15:25.890 –> 00:15:28.050
Julio Tirado: impact us yeah that’s that’s a big challenge.
125
00:15:28.140 –> 00:15:28.380
Julio Tirado: Right.
126
00:15:28.710 –> 00:15:36.000
Jason Mefford: You’ve seen the same thing with with compliance issues other stuff because we will jump into information security because we have kind of a
127
00:15:37.590 –> 00:15:39.330
Jason Mefford: Common commonality there as well. Right.
128
00:15:39.330 –> 00:15:50.220
Jason Mefford: We were both kind of head of information security and privacy and security is one of those things where the regulations can’t keep up with the technology because
129
00:15:50.550 –> 00:15:51.750
Jason Mefford: We don’t understand the
130
00:15:51.750 –> 00:15:56.640
Jason Mefford: Implications of some of the technology until a few years later, and by that time.
131
00:15:57.000 –> 00:16:03.660
Jason Mefford: We’re trying to regulate something that was three or four years old. But there’s something new that’s completely different. Right.
132
00:16:04.530 –> 00:16:19.920
Jason Mefford: So, so, yeah. So you go from kind of this CMO role in back to the bank in era. And it’s kind of the sea. So, so, you know what, what kind of stuff, I guess. Did you learn from that experience because I think you were
133
00:16:21.480 –> 00:16:22.920
Jason Mefford: You were in that role for a year or so.
134
00:16:22.920 –> 00:16:23.610
Jason Mefford: Before you
135
00:16:23.640 –> 00:16:29.970
Jason Mefford: Move back over to the audit. Right. Okay. So, so what kind of stuff did you learn, you know, during that
136
00:16:29.970 –> 00:16:32.580
Jason Mefford: Phase of your career. That’s kind of translated over
137
00:16:34.500 –> 00:16:46.650
Julio Tirado: I would say that the, the number one thing that I got out of that experience was a greater sense of empathy and not to be redundant here a greater appreciation for the, the consequences of an audit recommendation.
138
00:16:48.090 –> 00:16:49.620
Julio Tirado: All the folks across the bank.
139
00:16:50.700 –> 00:16:58.770
Julio Tirado: on the security side, I felt the impact of the recommendations on the RM side, I had a more transparent discussion.
140
00:16:59.130 –> 00:17:09.180
Julio Tirado: With managers all across the bank, because the RM component required. I mean with everybody and talk about risk issues in a very proactive way, you know, in a very team oriented way because in that moment, those moments.
141
00:17:09.510 –> 00:17:17.250
Julio Tirado: I was in the auditor asking for things I was the guy said, Hey, I’m thinking risk you’re thinking risk. Let’s work together. What can go wrong. Let’s make sense of the world a little bit
142
00:17:18.600 –> 00:17:28.770
Julio Tirado: Or that gave me an appreciation for for being on the other side of the discussion and be more sensitive to the impact and I’m in the very beginning like anybody who’s brand new to intern audit.
143
00:17:29.280 –> 00:17:40.020
Julio Tirado: Women are probably more focused on being good at what we do, understanding the issues, probably not thinking a whole lot about OB the consequences of this recommendation terms of resources in time and so on.
144
00:17:40.470 –> 00:17:49.320
Julio Tirado: So that made me more flexible, more flexible in, in the, the recommendation more flexible in the follow up process. For example,
145
00:17:50.160 –> 00:17:56.970
Julio Tirado: From a very risk based perspective, somebody may I may have an auto recommendation. Now, they may pertain to policy or procedure, a written document.
146
00:17:57.360 –> 00:18:15.600
Julio Tirado: And I would be more than happy to wait for months for that to be done as opposed to a higher risk issue, which is a promise action within a week within two weeks. So a risk based approach to audit follow up Kim out of the exposure to the risk of security side.
147
00:18:17.160 –> 00:18:25.830
Julio Tirado: And on the security side, you know, I remember what I had learned pertaining to security before that rolled it was very, very
148
00:18:27.390 –> 00:18:27.990
Julio Tirado: Shallow
149
00:18:28.500 –> 00:18:30.480
Julio Tirado: I just didn’t understand enough
150
00:18:30.930 –> 00:18:42.780
Julio Tirado: All the moving parts. And the way that I could think about it now is with security. I am a I mean imagine. Imagine Jason you’re taking care of a mansion of 65,000 doors and windows.
151
00:18:43.320 –> 00:18:53.520
Julio Tirado: Your job is to control every door every window keep track of everybody who has a key when the kids lost you get reissued maintain the roof and so on. And someone and someone, someone, someone
152
00:18:54.000 –> 00:18:57.300
Julio Tirado: That is your job as the maintenance as a person who owns that mansion.
153
00:18:57.750 –> 00:19:06.180
Julio Tirado: You’re the CEO, you’re the IT director. So you got all these different places that were attackers can attack, whereas the attacker just needs one window one door.
154
00:19:06.900 –> 00:19:19.320
Julio Tirado: So I get a whole lot more appreciation for how difficult that challenges absolutely influence how perform security audit what ask what is reasonable, what isn’t reasonable what’s effective what isn’t effective
155
00:19:19.740 –> 00:19:27.300
Julio Tirado: It forced me to learn about certain control frameworks, like the CIS top 20 security controls framework, the NIST cybersecurity framework.
156
00:19:28.020 –> 00:19:35.460
Julio Tirado: And and so since that exposure. I’m going to continually putting pressure to up my knowledge of the security side.
157
00:19:35.730 –> 00:19:44.460
Julio Tirado: Because as you know, the attackers are getting more advanced attacks themselves getting more advanced. It’s a cat and mouse game. So who’s you know how behind. Are we gonna be no so
158
00:19:45.420 –> 00:19:58.920
Jason Mefford: When your analogy of that big mansion is is great to try to put it into perspective, right, not only do you have all those doors and windows and everything on the outside, but you got people on the inside of the mansion right and and how many of the security.
159
00:19:59.520 –> 00:20:07.620
Jason Mefford: Issues have come because, you know, again, the CIO, the sea. So they’re worried about, you know, usually. First off, external kind of stuff.
160
00:20:07.650 –> 00:20:09.420
Jason Mefford: Right, because that’s, again, where it’s like we
161
00:20:09.420 –> 00:20:12.840
Jason Mefford: Don’t want you know anonymous to
162
00:20:13.200 –> 00:20:13.710
Jason Mefford: You know,
163
00:20:14.070 –> 00:20:14.820
Julio Tirado: Well, that’s good.
164
00:20:14.850 –> 00:20:20.790
Jason Mefford: News. Yeah, that’s right. So so so that’s that’s where there’s a lot of the abuse but there’s a lot of stuff coming inside to right it’s like
165
00:20:21.210 –> 00:20:31.860
Jason Mefford: I don’t even have to attack you on the outside. I’m just going to have you know a mole hired in your organization and your IT department and I’m gonna let them sit there dormant for a year, whatever. Right.
166
00:20:32.250 –> 00:20:43.650
Jason Mefford: Till I figure out what’s going on. And then I’m going to do an attack from inside. And most of the time, people don’t even realize or maybe they get through the window. Now they’re inside they close the window.
167
00:20:43.920 –> 00:20:45.810
Jason Mefford: Nobody really knows they were there.
168
00:20:46.050 –> 00:20:47.850
Jason Mefford: But they’re inside the house for a
169
00:20:47.850 –> 00:20:52.080
Jason Mefford: Year and a half, and then they pull the trigger on on the security.
170
00:20:53.340 –> 00:21:01.230
Jason Mefford: That happens all the time. And this this this intruder now has an invisibility cloak for about nine months going throughout your mansion. You don’t even know that they’re
171
00:21:01.410 –> 00:21:06.750
Jason Mefford: You know the 35,000 square foot mansion. Right. There’s lots of drapes. They can hide behind or whatever.
172
00:21:07.110 –> 00:21:08.130
Jason Mefford: Well, I don’t even know their, their
173
00:21:08.250 –> 00:21:17.730
Julio Tirado: Sizes. I mean, I know that’s that’s a silly analogy, sometimes, but it just highlights how difficult the challenges is for a lot of organizations. So we have to we have to step on a game.
174
00:21:18.510 –> 00:21:28.440
Jason Mefford: Well, and I think to that’s, that’s where again some of this empathy comes back is because, you know, we’ll go in. We have maybe a very narrow scope on what our audit might be
175
00:21:28.920 –> 00:21:38.940
Jason Mefford: And we come back and say, well, you know, NIST says you’re supposed to have a cyber security policy, and you don’t have one. So our recommendation is go write a policy.
176
00:21:39.540 –> 00:21:49.530
Jason Mefford: And you hand that, you know, to the CIO, or the sea. So, and they look at it and say, well, I’ll get to your policy, but first off, I’ve got all these guys outside like really suspicious.
177
00:21:50.130 –> 00:21:53.220
Jason Mefford: And I got to worry about them first before I worry about your piece.
178
00:21:53.220 –> 00:21:53.760
Jason Mefford: Of paper.
179
00:21:53.940 –> 00:21:55.440
Julio Tirado: That’s not all. And it’s absolutely
180
00:21:57.210 –> 00:22:13.980
Jason Mefford: And and so we just have to be under understanding of that or what you said, the consequence of our other recommendations, because I think I think sometimes will love a recommendation over without realizing how much time and money.
181
00:22:14.310 –> 00:22:25.950
Jason Mefford: It’s actually going to take and without this is what I’m trying to push people to do now to is you know before you make a recommendation. Why don’t you kind of do a little ROI thing for people
182
00:22:26.490 –> 00:22:36.690
Jason Mefford: So that they can understand because if I’m the manager, if I’m the CEO of a company and you come to me and asked me to do something that’s going to cost me $100,000 let’s say
183
00:22:37.860 –> 00:22:40.890
Jason Mefford: I’m going to look at that and say, what do I get
184
00:22:41.460 –> 00:22:42.840
Julio Tirado: For my hundred thousand dollars.
185
00:22:43.770 –> 00:22:49.080
Jason Mefford: And and even though you tell me, well, it’s best practice or its compliance. We have to do it well.
186
00:22:49.470 –> 00:22:57.180
Jason Mefford: If I don’t do this. What’s it going to cost me. Well, you’re gonna get in trouble. How much am I gonna get in trouble for well you might get fined $20,000
187
00:22:57.660 –> 00:23:06.240
Jason Mefford: Well you know what, I’m not gonna do it. I’m, I’m, I’m at that point, I’m going to say, okay, well, that’s nice. But I’m not going to spend $100,000 to avoid 20
188
00:23:07.050 –> 00:23:17.910
Julio Tirado: I’m just gonna throw a rational. Absolutely. And that that discussion, you know, being being in that situation will hurt your relationship with the manager. Oh, yeah. So it’s and we need to have with us.
189
00:23:18.510 –> 00:23:27.330
Jason Mefford: Yeah, and so we can we can start to think more about what really are the consequences. Now, if it’s, you know, if it’s compliance based
190
00:23:27.900 –> 00:23:41.550
Jason Mefford: I get it right, we have to say, you know, regulation 1234 or five says we have to do it. We’re not doing it. We should probably do it right and then it’s management’s decision at that point. But companies decide all the time, not to be compliant with certain things.
191
00:23:42.690 –> 00:23:57.090
Jason Mefford: But the one where to, you know, that we should really be conscious of these consequences are the ones that we think the company should do or its best practice. So we should do it. Those you better really have thought through, because
192
00:23:58.080 –> 00:24:07.530
Jason Mefford: If you come up with a BS you know recommendation that just costs money without much benefit that’s going to significantly damaged your relations.
193
00:24:07.560 –> 00:24:23.700
Julio Tirado: I, well, I think, as a rule, you just want to generally be informed, whatever you put on a piece of paper, whatever you convey to a manager, you have to be informed what data supports your conclusion I want one of the things that I make sure I do during an engagement is
194
00:24:24.720 –> 00:24:32.310
Julio Tirado: Commit to all the managers that have a there’s any high risk medium risk issue, even just remotely I immediately call say hey,
195
00:24:32.700 –> 00:24:39.630
Julio Tirado: Whomever. What do you think about this, am I headed the right direction. This is a real concern by the time we get to the end of an engagement.
196
00:24:40.020 –> 00:24:50.490
Julio Tirado: There will be no surprises. No, no, no uncertainty about whether in a recommendation, you’re making make sense. You should flush that out throughout the engagement, it’s, it’s sort of kind of very agile.
197
00:24:50.730 –> 00:25:03.090
Julio Tirado: You know, in between, you’re talking to your manager multiple times. But if you’re if you’re in a position where you’re you’re hoping that you your recommendation is going to make sense that tells you you haven’t done your homework, you have to
198
00:25:05.100 –> 00:25:07.980
Jason Mefford: If you’re hoping it probably doesn’t better do your homework.
199
00:25:08.430 –> 00:25:23.850
Jason Mefford: And Don’t. And Don’t just I remember I worked for a manager one time and and at the beginning of this engagement, the manager told me I want you to give me seven recommendations on this project I want at least seven recommendations.
200
00:25:25.650 –> 00:25:31.320
Jason Mefford: Like, where the hell does seven come from anyway, right, I mean, it’s like, that’s just some arbitrary number my
201
00:25:31.800 –> 00:25:32.910
Julio Tirado: Lucky number right it’s
202
00:25:32.910 –> 00:25:34.380
Jason Mefford: Election. It’s a lucky number
203
00:25:35.820 –> 00:25:41.610
Jason Mefford: But it’s, it’s, you know, we don’t. We shouldn’t go into any of the engagements thinking that either.
204
00:25:41.640 –> 00:25:43.350
Julio Tirado: Having some preconceived notion
205
00:25:43.380 –> 00:25:51.930
Jason Mefford: We should only be providing recommendations if they’re actually useful if we’ve thought about if you’re just hoping or trying to
206
00:25:53.010 –> 00:25:59.670
Jason Mefford: You know, if you have a belief that the number of recommendations you give equates to the value you’re providing
207
00:25:59.730 –> 00:26:01.020
Julio Tirado: You need to stop thinking that
208
00:26:01.020 –> 00:26:01.560
Jason Mefford: Right away.
209
00:26:02.550 –> 00:26:09.180
Julio Tirado: I think you said it really well, you know, listen to your latest podcasts on independence and you had you had mentioned
210
00:26:09.840 –> 00:26:21.120
Julio Tirado: how critical it is for us to to add value they have to remember that we’re not 100% independent and that we are in a way that work for a company x are paid about company x to perform audits, a company x
211
00:26:21.810 –> 00:26:29.280
Julio Tirado: It’s important to feel that pressure that we constantly are valuable now feeling title to be the auditor. I remember
212
00:26:29.910 –> 00:26:44.130
Julio Tirado: I forgot how many years ago. But you know when Danny Brandon was a chairperson of the IAA his team have a real I believe was was being relevant or something to the effect of being relevant. Yeah. And when that came out today must have been relevant that’s not so sexy right so it’s
213
00:26:45.660 –> 00:26:59.910
Julio Tirado: But after you think about it for a minute, it’s so critical. So, fundamental if you’re not relevant than why would you continue to be in that position. So if we continuously ask ourselves, are we adding value at this is this pushing your company organization forward.
214
00:27:01.230 –> 00:27:08.010
Julio Tirado: Hopefully we’ll avoid you know those scenarios of having a fixed number of findings or being uncertain about what you’re delivering
215
00:27:08.790 –> 00:27:15.000
Jason Mefford: Well, and I think it’s, you know, that idea of relevance is really important and its relevance to whom
216
00:27:15.600 –> 00:27:24.360
Jason Mefford: relevance to the company relevance to the client that we’re working with. That’s why you know the the idea of agile and having the user at the center is important because
217
00:27:24.870 –> 00:27:36.390
Jason Mefford: If we’re not being relevant to them, then at some point. And I’ve seen this happen over and over again, at some point, the CFO is going to get tasked with cutting costs.
218
00:27:37.710 –> 00:27:43.860
Jason Mefford: And they’re going to turn around and they’re going to go you know that internal audit department isn’t really that relevant to us.
219
00:27:44.490 –> 00:27:54.780
Jason Mefford: And if they feel that way if they don’t feel like you’re relevant. I don’t care if you feel like you’re relevant no damn it. You know, we’ve got to have an internal audit department because every great company has an internal audit department and we’re
220
00:27:55.170 –> 00:27:58.860
Jason Mefford: We’re a key component to governance, but we believe that
221
00:27:59.280 –> 00:28:07.890
Jason Mefford: We preach that as a profession, but it’s what the other people believe that’s really important. And if they don’t think you’re relevant, you’re going to be one of the first places to get cut
222
00:28:08.550 –> 00:28:17.730
Julio Tirado: That’s, that’s a valid point i what I’ve told some folks that I’ve talked to that were interested in getting an internal audit already in it for a little bit.
223
00:28:18.510 –> 00:28:26.580
Julio Tirado: Was I wish I was told, early on that when you’re in internal auditor 80% of the time you put on the analytical hat and 20% you put on the sales hat.
224
00:28:27.480 –> 00:28:34.500
Julio Tirado: You may say, well, sales had you’re an author, you’re not supposed to be selling anything. Well, you kind of are you selling confidence, you’re selling ideas.
225
00:28:34.920 –> 00:28:42.630
Julio Tirado: You’re selling wisdom, you know, if I want to share something, you know, I work for a financial institution. We care a lot about emerging trends emerging risks. You mentioned
226
00:28:42.960 –> 00:28:56.250
Julio Tirado: At one point, AI, a very hot topic very fancy buzzer. We care about those fancy buzzwords, we want to be ready as much as possible so we can be a source of wisdom to share with our folks. So we have to sell confidence so
227
00:28:57.690 –> 00:29:12.900
Julio Tirado: The the the perception that what we say makes sense that what we say is that have driven the was as informed so has to be part of the equation. I don’t know if it’s at 20 or 6040 they’re selling has to be part of the equation.
228
00:29:13.800 –> 00:29:25.230
Jason Mefford: Well, and it’s probably because this is maybe a good distinguish or because actually I don’t know that I’ve talked to anybody in this way before. So I want to, I just want to kind of dig into this just a little bit more is
229
00:29:26.220 –> 00:29:47.580
Jason Mefford: That I think the further up you go in the Internal Audit organization, the more that may be changes to right so so yeah at the lower level. Maybe it’s something like 8020 right and this will give people a little peel behind as far as what is he, he actually does right in your role.
230
00:29:48.960 –> 00:29:54.240
Jason Mefford: Are you still at 20 or I’m guessing that the sales number is much higher.
231
00:29:54.720 –> 00:29:56.160
Julio Tirado: Right, if it was
232
00:29:56.220 –> 00:29:58.740
Jason Mefford: Like it would like it was for me. Right, so
233
00:29:59.220 –> 00:30:06.630
Jason Mefford: The further up we go in the organization, the more we have to manage those relationships we have to sell yourself sell our
234
00:30:07.320 –> 00:30:18.060
Jason Mefford: Sell the function sell the value that we’re doing. Right. And a lot of your job ends up doing that. I don’t know. You know, if you were to put numbers on it. Where would you put it as a
235
00:30:19.590 –> 00:30:19.980
Fifth,
236
00:30:22.920 –> 00:30:23.610
Jason Mefford: The other way.
237
00:30:25.380 –> 00:30:36.870
Julio Tirado: In my case is probably closer to 6040 or 7030 but the, you know, the important part, or that sells but I know selling that word can be really dirty very, very, very unfriendly.
238
00:30:37.530 –> 00:30:53.040
Julio Tirado: But you just replace it with being having good we’re having to relationships. And that’s the, that’s the issue. You will have good relationships with people so we can all collectively address the issue. I have to maintain objectivity. There’s 100%, you know, non negotiable. I get that.
239
00:30:54.270 –> 00:31:00.120
Julio Tirado: But that doesn’t mean I can’t have good relationships with people that can’t mean doesn’t mean I cannot be open with folks and vice versa.
240
00:31:00.390 –> 00:31:03.720
Julio Tirado: And the way to test whether you have a good relationship, in my opinion.
241
00:31:04.080 –> 00:31:11.730
Julio Tirado: Is if you are told by the order department manager. Hey, can you add this thing or this SEC this two or three things your Otter program.
242
00:31:12.030 –> 00:31:25.740
Julio Tirado: I need independent brains to double check this or maybe this is the political issue. I’m not getting support Julio hook me up. You know when you when you have that. Or maybe phrase it I know in order to shouldn’t be told us. But that’s when you know i think you make
243
00:31:27.150 –> 00:31:29.040
Jason Mefford: Yeah, I know. I normally wouldn’t tell the auditor.
244
00:31:29.040 –> 00:31:35.700
Jason Mefford: But I like you. I know you’re a cool guy. Right. Yeah. They it’s just about recognizing we’re part of the same organization. Yeah.
245
00:31:35.970 –> 00:31:38.040
Julio Tirado: Let’s just keep that in mind whenever we do everything.
246
00:31:39.030 –> 00:31:47.310
Jason Mefford: Well, and I think I agree with you totally on that you know that a lot of times, people talk about. I want to be a trusted advisor. I want to be a trusted advisor.
247
00:31:47.310 –> 00:31:50.430
Jason Mefford: Well, you can tell if you’re already are, or if you’re not
248
00:31:50.760 –> 00:31:57.270
Jason Mefford: And like you said, if, if the audit clients, you know, coming to you at the beginning, or I remember a call that I got from
249
00:31:58.680 –> 00:32:17.070
Jason Mefford: My last company where I was CA. It was one of our controllers or one of our factories and he called me and he said, Now I know you guys haven’t been out here for for a couple of years. Right. And so I know I’m probably going to be up on the schedule soon I’m just guessing. Right.
250
00:32:17.790 –> 00:32:22.170
Jason Mefford: And I’m like, Well, you know, maybe I mean it was one of our better controlled
251
00:32:22.320 –> 00:32:36.030
Jason Mefford: Activities, so we weren’t as concerned about them as we were some other ones, but he calls me anyway kind of says that he says because I’m thinking about, or I want to kind of change some of our processes out here, but I’d rather talk to you.
252
00:32:36.600 –> 00:32:37.980
Jason Mefford: And kind of work.
253
00:32:37.980 –> 00:32:45.330
Jason Mefford: Through what I’m thinking and the changes with you before I make them to make sure that we’re doing it right.
254
00:32:45.930 –> 00:32:54.810
Jason Mefford: That’s your that’s your test when people call you when they ask you, those kinds of things, then it’s like, cool, I must be providing some
255
00:32:54.810 –> 00:33:01.500
Jason Mefford: Value right they must trust me, if somebody walks in and like you said, they’re like I normally wouldn’t tell the auditor this but
256
00:33:01.920 –> 00:33:02.970
Jason Mefford: And they tell you
257
00:33:03.690 –> 00:33:06.180
Jason Mefford: you’ve established some relationships.
258
00:33:06.180 –> 00:33:19.350
Jason Mefford: And trust with them that they’re actually asking for your advice. See trusted advisor. They trust you and they want your advice if people are not asking you for advice.
259
00:33:20.730 –> 00:33:21.900
Jason Mefford: You’re not a trusted advisor.
260
00:33:22.260 –> 00:33:38.820
Julio Tirado: That’s, that’s an opportunity for improvement. That’s that one yeah i i suspect part of the equation is recognizing that in our jobs. We can contribute to anxiety. I think my time is an internal auditor is kind of a part time honorary psychology degree that
261
00:33:40.320 –> 00:33:41.940
Julio Tirado: Is that why I’ve been studying psychology
262
00:33:43.500 –> 00:33:43.830
Jason Mefford: Yeah.
263
00:33:43.980 –> 00:33:52.170
Julio Tirado: Honestly, tell me the truth is truth to the people that aren’t familiar with this jobs about are going to feel anxious about the audits right so
264
00:33:52.530 –> 00:34:02.040
Julio Tirado: We have to do everything we can, within reason to minimize the potential anxiety, which means in the very beginning of an engagement being open about the objective is about the order plan.
265
00:34:02.310 –> 00:34:18.150
Julio Tirado: Being open about what are your concerns having a very friendly discussion. So if we minimize that anxiety. That’s good. That’s, I would think that’s a required condition to get us closer to the trusted advisor condition, you have to not having data between the client and who we are.
266
00:34:19.200 –> 00:34:33.390
Jason Mefford: Well, yeah. Because if they’re feeling anxiety, it’s going to be difficult to get the work done to. And so there is and that’s where, you know, again, we use the word psychology here. But, you know, again, folks. When I talk about technical and soft skills.
267
00:34:33.420 –> 00:34:33.780
Julio Tirado: High
268
00:34:34.050 –> 00:34:40.950
Jason Mefford: You know, a lot of time a lot of some of those skills in the soft area are some of the psychology. It’s not just how you write your report.
269
00:34:41.400 –> 00:34:51.330
Jason Mefford: It’s not just how you give your PowerPoint presentation to management. It’s a lot of this other stuff. There’s a lot of stuff to the soft skills and we are not spending enough time.
270
00:34:51.780 –> 00:35:04.080
Jason Mefford: Focusing on those. And that’s leading to some, some of the some of the trouble because you’ve got to reduce that anxiety and build those relationships. There’s soft skill ways of doing that. And we need to spend more time doing that.
271
00:35:04.530 –> 00:35:15.660
Julio Tirado: And that’s been an issue as far as I recall. Since 2007 soft skills being in the top of skills and we need folks and assurance to really make their competency. So hopefully we can move the needle.
272
00:35:15.720 –> 00:35:17.190
Jason Mefford: I hope we’re listening, you know, again,
273
00:35:17.970 –> 00:35:22.710
Jason Mefford: The older I get 2007 doesn’t seem that long ago to me that that was 13 years for
274
00:35:23.430 –> 00:35:26.610
Jason Mefford: Many of my people listening to this, we’re still, it could have been in grade.
275
00:35:26.610 –> 00:35:28.350
Jason Mefford: School, you know, at that point, still
276
00:35:29.970 –> 00:35:37.080
Jason Mefford: But yeah, we’ve been talking about it, but we need to get off our butts and actually do something more about it, instead of just just talking about it so
277
00:35:37.620 –> 00:35:42.810
Jason Mefford: Now this is. But again, like normal. We just kind of blow through time. So we’re going to have to kind of wrap up.
278
00:35:43.740 –> 00:35:51.330
Jason Mefford: For today, but we’ll probably have to go deeper on a future episode. But I wanted to kind of ask you to that I always like to ask CA’s you know is if
279
00:35:51.930 –> 00:36:01.860
Jason Mefford: If you were. I mean, could you got people on your team and other people that if you’re kind of mentoring them or trying to help them you know if if
280
00:36:02.520 –> 00:36:10.770
Jason Mefford: There’s that old Rod Stewart song. You know, I wish that I knew you know now what I knew then I kind of a thing. I said that wrong, but anyway.
281
00:36:11.250 –> 00:36:19.860
Jason Mefford: It can’t sing the song right now because my brain is going somewhere else. But you know so much of the time the older we get, we wished we had learned certain things.
282
00:36:19.890 –> 00:36:20.970
Julio Tirado: Earlier in our career.
283
00:36:21.810 –> 00:36:31.680
Jason Mefford: So maybe you know what’s maybe one suggestion that you give to people that are kind of moving up in their career. And, you know, maybe someday aspire to be a CA.
284
00:36:32.340 –> 00:36:41.550
Jason Mefford: What, what do you wish you would have known or learned maybe earlier in your career that you’d kind of impart wisdom to other people.
285
00:36:42.090 –> 00:36:43.350
Julio Tirado: Well, it has a great question.
286
00:36:44.970 –> 00:36:45.510
Julio Tirado: So,
287
00:36:46.800 –> 00:36:57.090
Julio Tirado: I would say two things. The first one be is if you had to choose between learning to be a great leader.
288
00:36:58.230 –> 00:37:03.660
Julio Tirado: When before you need to become a great leader versus learning it when you’re in the middle of fires all over the place.
289
00:37:04.380 –> 00:37:14.130
Julio Tirado: Properly right so we all in our, in our business degrees may have a leadership class, you take the class you’ll get a good grade that may may go out in one ear out the other.
290
00:37:14.430 –> 00:37:20.910
Julio Tirado: But if you’re planning on becoming a good at putting yourself in eligible someday. Take your time to study the books.
291
00:37:21.480 –> 00:37:32.220
Julio Tirado: Pick your pick your, your leader, lots of books out there. Do your homework, prepare in advance for that. Just like you prepare for the CPA exam or the CIA exam. I thought that was so critical.
292
00:37:32.970 –> 00:37:40.410
Julio Tirado: So building leadership skills. Early on, makes a lot of sense. I think a big challenge folks that are in the sea level has to be
293
00:37:40.980 –> 00:37:51.180
Julio Tirado: What may be the bombarding of all these emerging concepts and issues that are coming at us. So if you’re brand new to internal audit and you’re envisioning some they getting to management.
294
00:37:51.600 –> 00:38:00.240
Julio Tirado: Why not take some of that time and build some foundations in technology because the world is becoming more interconnected. That’s completely undeniable. There’s
295
00:38:00.750 –> 00:38:06.420
Julio Tirado: You’re going to have a bazillion IoT devices in people’s homes. Everyone’s gonna have Amazon Echo
296
00:38:07.140 –> 00:38:14.940
Julio Tirado: You know, we’ll have autonomous cars on the road, you know, things are changing. So, the earlier you can expose yourself to the technology fundamental security fundamentals.
297
00:38:15.390 –> 00:38:22.800
Julio Tirado: As you progress in your career, you’re going to have opportunities to build on that, as opposed to wait until you absolutely need it so preparing
298
00:38:23.340 –> 00:38:31.590
Julio Tirado: For tablet technology competency and building on some leadership skills early on. So when you can when the opportunity strikes you can be ready to pull the trigger.
299
00:38:32.730 –> 00:38:35.100
Jason Mefford: Now, that’s great wisdom because again you know it’s
300
00:38:36.570 –> 00:38:43.680
Jason Mefford: If, if we want to be, to the next level. Right. You have to act like you’re already at the next level, right. That’s good. That’s going to help
301
00:38:43.680 –> 00:38:52.890
Jason Mefford: get you there. So like you said, you know, the, the better we can be at being a leader earlier on, the more likely it’s going to be that we will actually will be that leader someday.
302
00:38:53.400 –> 00:39:05.700
Jason Mefford: And and i think it’s good to what you what you’re saying here about technology because I’ve seen this. I mean, I’ve helped you know, hundreds, thousands of people try to pass the CPA exam. And one of the big topics that a lot of people really struggle with is it
303
00:39:06.510 –> 00:39:13.080
Jason Mefford: You know, in the past, you know, especially the CIA exam because of how it kind of started and
304
00:39:13.590 –> 00:39:31.230
Jason Mefford: You know, trying to make CIA similar to CPA from a professional standpoint, there was a whole bunch of finance and accounting stuff on there. There still is right, but in my opinion you know that stuff doesn’t matter so much. Now as the it stuff does
305
00:39:31.920 –> 00:39:37.740
Jason Mefford: If you don’t have a basic understanding of it you know in kind of, you know,
306
00:39:38.250 –> 00:39:56.370
Jason Mefford: General controls level, all of that kind of stuff. How the applications, you know, and the hardware interacts with each other and some of the technical controls that might be in there. If you don’t, if you can’t stand back and really kind of understand in general how the technology is working.
307
00:39:57.390 –> 00:40:03.570
Jason Mefford: It’s going to be really difficult to almost audit anything in the future because everything has an IT component to it.
308
00:40:04.050 –> 00:40:10.740
Julio Tirado: That’s a valid point. I would love to see folks getting finance and accounting degrees also doing a a minor name is
309
00:40:11.100 –> 00:40:27.000
Julio Tirado: Or I may just have a regular degree getting a a Coursera specialization in some somewhere in technology security Cisco, whatever. There are lots of ways to supplement your business background. So the early we can make that part of who we are, for sure. The better off we’ll be out
310
00:40:27.480 –> 00:40:42.660
Jason Mefford: Oh yeah, well, and because it really there’s there’s sometimes if we don’t have some of that basic background, right, like I was, you know, I was talking with somebody and there was a client that they’re dealing with that they had some reporting issues.
311
00:40:44.400 –> 00:40:50.610
Jason Mefford: And it got missed by audit okay and and understandable.
312
00:40:51.840 –> 00:40:59.880
Jason Mefford: When, when you kind of, you know, step back as armchair quarterbacking is always like, well, you should have known. Well, I understand why they probably didn’t catch it, but
313
00:41:00.480 –> 00:41:14.070
Jason Mefford: If, if some of those people on that team maybe had a better understanding of it, they would have realized that this this link there. They’re all these transactions over here, we’re never making it to the report.
314
00:41:15.270 –> 00:41:26.700
Jason Mefford: And why was that it was it was a system issue, it was a it was a PM. Oh issue with with a system upgrade and a very large percentage of transactions that never got pulled over.
315
00:41:27.960 –> 00:41:32.490
Jason Mefford: Somebody missed. Right, so it project should have caught it.
316
00:41:34.920 –> 00:41:44.070
Jason Mefford: Internal Audit should have caught it. Right. But again, it’s like it’s it’s having these people with these different perspectives, having a basic knowledge and understanding of some of these things.
317
00:41:44.520 –> 00:41:59.550
Jason Mefford: Somebody over the course of this 10 year period should have gone. Uh, what about these things. Right. And so, you know, like you said, I love that you brought that up about technology, because I think every auditor needs to have a basic understanding of technology.
318
00:42:00.060 –> 00:42:03.210
Jason Mefford: It doesn’t mean everybody’s got to go get a cease and, you know, or
319
00:42:03.540 –> 00:42:12.990
Jason Mefford: Or, like you said, but even some of these other things like a Coursera certification, you know, other other courses that you can take that teach you a little bit more about it.
320
00:42:14.580 –> 00:42:16.410
Jason Mefford: Going to benefit you way in the future.
321
00:42:16.440 –> 00:42:26.490
Julio Tirado: The resources are everywhere. The biggest challenge now isn’t what’s accessible to me it’s, which one do I pick which resource, do I choose over the other. Yeah, no.
322
00:42:27.390 –> 00:42:31.920
Jason Mefford: Good stuff. Good stuff. All right, we got to wrap up for today, but I want to keep going.
323
00:42:34.350 –> 00:42:34.650
Jason Mefford: Or
324
00:42:34.830 –> 00:42:42.870
Jason Mefford: He was a pleasure. Well, thank you, Julio for coming on. I really appreciate you taking the time. And I know you’ve been a loyal listener. So I appreciate always getting that
325
00:42:42.870 –> 00:42:50.850
Jason Mefford: Feedback to so everybody else is out there listening because again I don’t I don’t get the direct feedback because I don’t get to see your face as you’re watching
326
00:42:51.240 –> 00:42:57.540
Jason Mefford: Or listening to these things. So, you know, please reach out to me, LinkedIn, email me, whatever, just kind of let me know.
327
00:42:57.930 –> 00:43:12.180
Jason Mefford: If you’re enjoying what you’re liking the most so I can do more of that because I’m really here to serve and try to get some of this information out here today and I really appreciate Julio coming on, because you gave some really good information for people that were listening so
328
00:43:12.210 –> 00:43:12.750
Julio Tirado: You’ve asked me.
329
00:43:13.230 –> 00:43:19.770
Jason Mefford: Well thank you and everybody go out, have a great week and we’ll catch you on the next gentleman with Jason episode so yeah
