Which centric approach are you following?
I’m speaking with the legendary Tim Leech about the difference between objective, risk, compliance, process, and control centric approaches … and centric is not the same as based.

Listen in at: http://www.jasonmefford.com/jammingwithjason/ and learn the difference so you can start improving the value you add to your organization.

Risk-based internal auditing is objective-centric when you actually link to key objectives … a critical step most in #internalaudit forget. “Risk ranking an audit universe based on another centric model, does not risk-based internal audit make.” Yoda 🙂

When you are ready to become objective-centric and risk-based check out how you can get the step-by-step process for getting started: https://ondemand.criskacademy.com/p/certified-risk-based-internal-auditor-crbia/?affcode=105582_jpp6czlf

Transcript

1
00:00:02.399 –> 00:00:14.549
Jason Mefford: Hey, I am very, very honored today to have Tim leech with me and I’m telling you, if you, if you don’t already know who Tim leeches. Then, shame on you.

2
00:00:14.940 –> 00:00:25.680
Jason Mefford: Because if you’ve been in this industry for any amount of time, you should know who he is and I wanted to bring Tim on today, you know, and kind of introduce him a little bit. He has been around.

3
00:00:26.970 –> 00:00:35.040
Jason Mefford: The industry for a long time. And one of the reasons that I love. Tim and wanted to talk to him is we both like the word contrarians

4
00:00:36.150 –> 00:00:45.300
Jason Mefford: Or we’re often kind of viewed as contrarians and I love the message that Tim brings and that he shares with people.

5
00:00:45.720 –> 00:00:51.000
Jason Mefford: And I’m hoping you know as we go through and talk today, because there’s a few things that I wanted to make sure that we talked about.

6
00:00:51.420 –> 00:01:00.930
Jason Mefford: That it will help many of you kind of understand and solidify and gel, some of these things that people like Tim have been talking about for 30 plus years.

7
00:01:01.350 –> 00:01:13.200
Jason Mefford: But people still aren’t getting it. Okay. So, Tim. Welcome, my friend. I am. I’m actually very honored as well to have. You with me so. How you doing, man.

8
00:01:13.680 –> 00:01:22.440
Tim Leech: Well, thanks for having me. And I appreciate you reaching out to find out about my quote on Prairie.

9
00:01:24.360 –> 00:01:25.050
Tim Leech: Yes.

10
00:01:25.500 –> 00:01:25.890
It’s

11
00:01:27.510 –> 00:01:34.410
Jason Mefford: I was gonna say it’s funny because there’s, there’s a few of us in the industry. You know, we were talking before about people like Norman to where

12
00:01:35.010 –> 00:01:44.220
Jason Mefford: It’s you. We say what’s on our mind and what we think people need to hear but it often doesn’t tow the party line, if you will.

13
00:01:45.120 –> 00:01:52.620
Jason Mefford: And so, you know, people that don’t, you know, preach the religion or tow the party line sometimes kind of get pushed off to the side.

14
00:01:53.340 –> 00:02:11.160
Jason Mefford: And but but the message that you have, you know, because you talk a lot about objective centric. And so, you know, I wanted to kind of get in and you know because you’ve also had enough time in your career that you’ve seen all of the history in the back in the fourth

15
00:02:12.690 –> 00:02:16.440
Jason Mefford: But maybe let’s kind of start off talking a little bit about, you know, what is

16
00:02:16.950 –> 00:02:25.770
Jason Mefford: An objective centric approach and I know you said before that sometimes talking about the other four centric approaches, because there’s kind of five approaches.

17
00:02:26.520 –> 00:02:36.300
Jason Mefford: helps people really kind of understand what the difference is with objective taking an objective centric approach versus some of these other approaches.

18
00:02:37.350 –> 00:02:45.480
Tim Leech: Yeah, I think the notion of, I’m happy to explain the notion of objective centric. But also, you know, introduce the others, but

19
00:02:46.620 –> 00:03:03.300
Tim Leech: It’s fair to say that my entire career has been focused on convincing the world that organizations, both public and private sector would be better off if they aspired to strong first line.

20
00:03:04.800 –> 00:03:14.970
Tim Leech: Objective centric assurance that integrates all of the efforts of the first, second, third,

21
00:03:15.480 –> 00:03:23.040
Tim Leech: And in the framework we promote we consider senior executives to be the fourth line and the board of directors to be the fifth line.

22
00:03:23.700 –> 00:03:32.670
Tim Leech: So I have actively if you were to Google five lines of insurance, you’d find all kinds of articles from Tim leach promoting five lines of insurance but

23
00:03:33.390 –> 00:03:44.670
Tim Leech: At a 30,000 foot level my whole career has been defined by the belief that organizations would run more effectively and

24
00:03:45.600 –> 00:03:56.190
Tim Leech: Be better for stakeholders, including shareholders. If all of the lines would coordinate their efforts around the most important objectives that the entity needs to achieve.

25
00:03:56.880 –> 00:04:07.170
Tim Leech: And that has been the the guiding principle, if you will, from 1985 on when we launched control self assessment at golf Canada.

26
00:04:08.970 –> 00:04:22.200
Tim Leech: So it’s not just about objective centric. The reason I’m so big on objective set centric is if you want. If you believe that management is responsible for managing risk.

27
00:04:23.280 –> 00:04:33.750
Tim Leech: I’ve always just said, how can you not believe that management should be able to assess whether their current choices right now or any good or not so

28
00:04:33.840 –> 00:04:35.370
Jason Mefford: In a part of the whole management.

29
00:04:35.370 –> 00:04:47.370
Tim Leech: Process. So, you know, very early on I would I you know I would sometimes make jokes at large conferences and I had clients that I would say to them.

30
00:04:47.880 –> 00:05:00.450
Tim Leech: Look, you know, I don’t mean this in an offensive way. But the reality is, the more in the better audits, you do the less management thinks they need to learn how to do an assessment of their own situation.

31
00:05:01.350 –> 00:05:12.330
Tim Leech: Somebody that you’re going to come along and do it for them. And you’re going to tell management, the parts you don’t like. And as long as you’re good with a week first line approach to risk management.

32
00:05:13.410 –> 00:05:23.730
Tim Leech: That’s what traditional auditing does is it assumes it literally assumes management has not done an assessment. Otherwise, the first question you would always ask

33
00:05:24.810 –> 00:05:28.260
Tim Leech: Is we’re here to audit topic x

34
00:05:29.490 –> 00:05:44.610
Tim Leech: We’ve decided it’s worth $100,000 internal audit. Fair enough. Wouldn’t you think management would have done a self assessment if if it’s that important to the company that audits going to spend resources.

35
00:05:45.030 –> 00:05:46.170
Jason Mefford: As it kind of look at it.

36
00:05:46.170 –> 00:05:57.360
Jason Mefford: Yeah yeah well and it’s interesting because, as you said it that way to it’s almost because I’m always interested in the psychology and the human behavior behind it, right, is that

37
00:05:58.230 –> 00:06:12.270
Jason Mefford: You know, in the eye has her three lines of defense. Now it’s a three lines model, whatever, blah, blah, blah. Right, that that actually internal audit subconsciously would probably prefer

38
00:06:13.350 –> 00:06:19.230
Jason Mefford: A weaker first line because it gives us a reason to have a job right.

39
00:06:20.610 –> 00:06:29.310
Tim Leech: Well, in the early days when we were promoting the mantra of control risk self assessment, which is fundamentally a strong first line model.

40
00:06:30.540 –> 00:06:42.570
Tim Leech: We would have old guard internal auditors that would literally get up right in the middle of the presentation and say this is nothing to do with why would I teach management how to do that.

41
00:06:43.050 –> 00:06:59.850
Tim Leech: What will there be for us to do. And I said, oh my god. These are people that are in chief internal audit positions that are are saying they actually prefer management to be unaware

42
00:07:00.120 –> 00:07:02.490
Tim Leech: So they’d have plenty of findings.

43
00:07:03.420 –> 00:07:05.340
Jason Mefford: I printed it sounds pretty silly that

44
00:07:05.850 –> 00:07:07.620
Jason Mefford: I did but that’s what they’re saying. Right.

45
00:07:07.740 –> 00:07:14.160
Tim Leech: I wasn’t. I’m not making the story up. It happened and I conferences and

46
00:07:15.600 –> 00:07:26.550
Tim Leech: It took quite a lot of convincing in the early 90s to convince the AIA that teaching management how to better manage

47
00:07:27.180 –> 00:07:41.670
Tim Leech: Risks to their most important objective should really be seen as a core part of internal audits job. It’s not seen as a core part of most internal lot of jobs.

48
00:07:42.330 –> 00:07:57.660
Tim Leech: And and so that’s what we proposed it at Gulf Canada and CEO bought into it and hundreds of clients around the world that I’ve worked with since I went into public practice in way back in

49
00:07:58.890 –> 00:08:09.000
Tim Leech: I guess 1987 I I came in set up the control and risk management services practice for Coopers and lybrand in Toronto.

50
00:08:09.660 –> 00:08:29.760
Tim Leech: And that practice was a mix of forensic accounting controllers self assessment fraud vulnerability ethics and but all of its it’s on that whole you know the I, I took a position for quite a while they set up the CCS a certification.

51
00:08:30.330 –> 00:08:33.090
Tim Leech: And actually did champion for a while.

52
00:08:33.210 –> 00:08:37.770
Tim Leech: But never really got any support and that designation is largely gone

53
00:08:38.340 –> 00:08:40.590
Jason Mefford: Well, it is gone now. They’re not offering it anymore.

54
00:08:40.620 –> 00:09:02.190
Tim Leech: Yeah. And what’s what’s been replaced by is the CRM. A but the CRM. A doesn’t teach them. If you go in and management is not trained not capable and isn’t doing self assessments of their own. You should give them a V report on the quality of their risk management framework.

55
00:09:03.270 –> 00:09:15.690
Tim Leech: I mean, how can you consider a risk management framework to be truly effective if management receives no training, how to identify risks is not expected to regularly.

56
00:09:16.410 –> 00:09:26.280
Tim Leech: Identify and actually write down what are the risks to their most important objectives and doesn’t know how to line up risk treatments with those

57
00:09:27.450 –> 00:09:43.200
Tim Leech: How can you consider a risk framework effective if that’s the case, and the reality is, is if you look at the AIA materials and you look at their most recent guidance on how to assess the effectiveness. They do proposing a maturity scale.

58
00:09:44.280 –> 00:09:57.570
Tim Leech: Go and read the maturity scale and you will realize that level four and five actually do say hey, these are scenarios where management actually knows how to assess

59
00:09:58.800 –> 00:10:08.850
Tim Leech: And is doing it. So that’s, that’s, you know, Level five is called optimized in that framework. So when the I put that out. I said to them, while

60
00:10:09.630 –> 00:10:23.400
Tim Leech: Help me out here. I’m a simple guy does that mean if you’re at level one and two, you have an ineffective control framework, can you have an in a truly effective framework.

61
00:10:24.210 –> 00:10:31.050
Tim Leech: That is that is at the lowest level of maturity. If it’s in a high change rate environment.

62
00:10:32.040 –> 00:10:44.220
Tim Leech: Nowhere in that guidance does it say so. It says, Okay, let’s forget about whether it’s effective or not. Let’s just report, whether it’s what level of maturity. And I said, No, no, no, no, no.

63
00:10:44.820 –> 00:10:54.630
Tim Leech: If I’m on the board of directors, I want to know, say we’re Level two is Level two effective or ineffective, not only

64
00:10:54.930 –> 00:10:57.900
Tim Leech: That I met Level two out of five doesn’t help me.

65
00:10:58.410 –> 00:11:07.890
Jason Mefford: Know, and that’s, that’s one of the problems of maturity models have in general, usually is, again, it’s like, well, is one. Okay, or is it not okay is

66
00:11:07.950 –> 00:11:09.870
Tim Leech: Like what we should aspire to.

67
00:11:10.020 –> 00:11:17.130
Jason Mefford: Or not. And again, so there there’s so nebulous in that way that that it doesn’t it doesn’t ever get back to the effectiveness, like you said,

68
00:11:17.400 –> 00:11:28.410
Tim Leech: Well, and if you read the guidance. It says, big motherhood, things like everybody should tailor their program for their unique search circumstances. But make no mistake standard

69
00:11:30.480 –> 00:11:39.690
Tim Leech: internal auditor should report on the effectiveness of the risk management process. It doesn’t say internal auditor should report what level of

70
00:11:40.050 –> 00:11:40.920
Clarity.

71
00:11:42.360 –> 00:11:44.010
Tim Leech: That’s not what it says.

72
00:11:44.130 –> 00:11:50.370
Tim Leech: Yeah, so you’re really side slipping the fundamental requirement in the standard by saying

73
00:11:50.910 –> 00:12:03.330
Tim Leech: You don’t have to actually say whether it’s effective or ineffective or appropriate or inappropriate. All you have to do is say it’s a two and a half out of five and show them on the little sliding scale how that works.

74
00:12:05.100 –> 00:12:13.050
Jason Mefford: Well, but even the two and a half out of five. It’s like, you know, again, it’s like 2.7 verses 2.8. No, it’s a five step scale. It’s one

75
00:12:13.830 –> 00:12:17.130
Tim Leech: You know, I like the credit where credit’s due and

76
00:12:17.310 –> 00:12:28.290
Tim Leech: Levels four and five are actually describing stronger and stronger first line risk management so implicitly, they are saying

77
00:12:29.190 –> 00:12:36.030
Tim Leech: Except they never actually said four and five is better. They just said that. It’s that it’s more mature.

78
00:12:36.690 –> 00:12:48.300
Tim Leech: So, so, and I, you know, I’m not talking out of school I write these comments directly to the AIA when I read exposure drafts and I regularly pound on these principles when I’m talking

79
00:12:48.870 –> 00:13:00.810
Tim Leech: I correspond I send my posts ALL THE TIME TO THIS YEAR’S global chairs and eat the john who did the working group Chair of the three, the new three lines model.

80
00:13:01.590 –> 00:13:11.940
Tim Leech: And the three lines model is the closest thing yet that the IAA has produced that says the first line should actually assess and report.

81
00:13:12.510 –> 00:13:21.180
Tim Leech: Yeah, but they said assessment report on risk and I wrote them and said I really wish you’d said certainty of achieving objectives.

82
00:13:22.020 –> 00:13:36.750
Jason Mefford: Well, because that’s that’s the point where you and I, you know, agree so much on this is that everybody just wants to use the word risk without really realizing what we’re trying to do when we’re managing risk which goes back to that uncertainty of objectives.

83
00:13:37.290 –> 00:13:50.010
Tim Leech: Right and Norman marks is has been banging that gone we really have not seen the I come out with any clarity and suggest that internal auditors should actually

84
00:13:50.610 –> 00:14:10.020
Tim Leech: Articulate and write down during the auditing planning process, just what are the most important objectives of the corporation and, most recently, I wrote a blog post, because they just issued a new way of doing assurance universes.

85
00:14:11.310 –> 00:14:11.820
Tim Leech: If

86
00:14:11.880 –> 00:14:17.040
Jason Mefford: They didn’t make sense. It does it start with the most important object now. They said they’re going to use risk.

87
00:14:17.190 –> 00:14:26.160
Jason Mefford: Categories. Yeah, well, and which is why, you know, again, I think maybe let’s kind of take us back to these five different centric approaches, because

88
00:14:26.640 –> 00:14:34.110
Jason Mefford: I think this is going to hopefully help people because it same thing when I when I read that document that you’re referring to.

89
00:14:34.890 –> 00:14:44.310
Jason Mefford: Yeah, there was some nice talk about about objectives in there a little bit from a risk standpoint, but then it’s just focusing on the risks not tying back to objectives.

90
00:14:44.760 –> 00:14:52.140
Jason Mefford: But it’s still going right back to a process level audit universe, and there’s no linkage between the two.

91
00:14:52.500 –> 00:15:03.150
Jason Mefford: So, so let’s kind of go through, because usually teach people and talk about five different centric kind of focused approaches. So let’s kind of go through those just talk a little bit about each one

92
00:15:03.600 –> 00:15:10.590
Jason Mefford: So people can really kind of understand the difference with what objective centric really means.

93
00:15:10.740 –> 00:15:33.240
Tim Leech: Sure. I think it’s a you know foundation building block for the last 25 years when I run training courses like I always include a module on on so that the people in the class. Get the idea of the different ways you can approach the task of giving assurance. So the five methods, very simply.

94
00:15:34.260 –> 00:15:40.230
Tim Leech: Are the oldest is compliant centric and organization rights rules rights policies.

95
00:15:41.730 –> 00:15:53.070
Tim Leech: Even back in the old days when I used to get an audit program to go out and audited a refinery either would be all set of things thou shalt do x

96
00:15:53.160 –> 00:15:55.800
Tim Leech: Okay, let’s go on it, whether they’re doing X.

97
00:15:56.100 –> 00:16:01.440
Tim Leech: Now, who decided they should do x. Well, there’s a policy that says they should do X, fair enough.

98
00:16:01.950 –> 00:16:17.040
Tim Leech: So that was the oldest form of auditing is you would go out and you set of rules that somebody had decided in their wisdom were important to do and the auditors would would verify that those rules were being followed. So that’s what I call compliance centric.

99
00:16:19.590 –> 00:16:36.630
Tim Leech: Process centric was when when I joined Coopers and lybrand in 1979 to become an external auditor Coopers and lybrand taught process centric auditing, they would taught taught you to study the revenue cycle the disbursement cycle.

100
00:16:37.830 –> 00:16:50.040
Tim Leech: They had all different ones that they would consider processes and you would work your way through the process flow chart it and you would identify what you called key controls in the process.

101
00:16:50.700 –> 00:17:01.170
Tim Leech: And so that was the earliest form. But the notion was is that no matter what you’re doing. So, you know, in your house at home, you have a process to acquire food.

102
00:17:01.740 –> 00:17:03.690
Tim Leech: You can think of that as a process.

103
00:17:03.690 –> 00:17:09.660
Tim Leech: Right, you could flow chart it. How do we did decide what we want to eat next week.

104
00:17:10.290 –> 00:17:23.310
Tim Leech: What are the steps and you could flow chart that and you could then decide are their flaws in the process. So, but the emphasis was on documenting the process.

105
00:17:23.970 –> 00:17:40.380
Tim Leech: And then risk centric, which has come into vogue the AIA uses the words risk centric regularly and has for the last 1520 years. The idea was, is we can be more than compliance police

106
00:17:41.160 –> 00:17:50.940
Tim Leech: We should, we should look at the biggest risks, the company. However, the process us to decide what are the biggest risk usually started in the audit room.

107
00:17:51.450 –> 00:17:53.550
Tim Leech: With a bunch of auditors sitting around

108
00:17:53.580 –> 00:18:07.500
Tim Leech: Saying, What do we think are the biggest risks process that they use to decide that rarely started by saying, first let’s agree with the company’s biggest and most important objectives are, it just did.

109
00:18:08.130 –> 00:18:22.290
Tim Leech: Dip so that’s risk centric risk centric is you go in a room and you ask a bunch of people in the room. What do you see as the biggest risks to the company to the department to the project.

110
00:18:23.370 –> 00:18:29.640
Tim Leech: People will make up in their own mind what they think the objectives are, and they’ll start telling you what they think risks are.

111
00:18:30.750 –> 00:18:44.070
Tim Leech: But it often does not start by saying before you answer that. Let’s write down what are the 10 most important objectives that must be accomplished by the company.

112
00:18:44.520 –> 00:18:57.900
Tim Leech: The department, the subsidiary, it does it rarely does that. So, so that’s risks entry and it’s done in all different ways but risk registers are the purest form.

113
00:18:58.680 –> 00:19:05.190
Tim Leech: Where you’re asking people this question. What do you see as the biggest risk 10 your parking them all in quote a register.

114
00:19:05.940 –> 00:19:20.820
Tim Leech: And then you’re putting red ambers and greens and you’re doing likelihood and consequences but rarely, is there an answer to which objectives are most quote at risk of not being achieved.

115
00:19:21.570 –> 00:19:30.210
Tim Leech: As a result of the way we’re managing the risks to an objective and so that’s risk centric.

116
00:19:30.720 –> 00:19:49.320
Tim Leech: Control centric. A lot of people haven’t had much experience with but it’s it’s actually evaluating your controls against an accepted control model and Canada built one in the 80s, called the criteria of control cocoa for short.

117
00:19:50.820 –> 00:20:04.170
Tim Leech: United States came along with the first Kosovo internal control financial reporting framework I the correct me if I’m wrong. I think it was around 2003

118
00:20:05.670 –> 00:20:08.580
Tim Leech: Was when Kosovo, let me think.

119
00:20:09.000 –> 00:20:10.380
Jason Mefford: Well, they did the original one in the

120
00:20:10.380 –> 00:20:11.460
Tim Leech: 90s.

121
00:20:11.670 –> 00:20:15.450
Jason Mefford: Yeah, I think they did the original Kosovo and 92

122
00:20:16.080 –> 00:20:17.400
Tim Leech: Well, there was a day.

123
00:20:17.700 –> 00:20:22.980
Jason Mefford: Yeah, but then they did the update with was a Tuesday I was like 2003 or something.

124
00:20:23.010 –> 00:20:35.460
Tim Leech: Yeah, they treat the history of Kosovo was Treadway Commission went and studied what went wrong. One of the Treadway Commission’s findings was that nobody agreed with the words internal control meant

125
00:20:36.870 –> 00:20:47.880
Tim Leech: So Treadway he became the sponsors of Treadway are in fact the founding members of Kosovo so Treadway morphed into Kosovo.

126
00:20:48.510 –> 00:20:59.190
Tim Leech: And Kosovo, then turned out the very first effort which in my mind was significantly less useful than the Canadian for Category 20 element model.

127
00:20:59.820 –> 00:21:20.070
Tim Leech: The first effort at coastal was a five category and a lot of people don’t know that the actual exposure draft of the first go so was a nine category model that was genius. The authors were Coopers and lybrand and it actually did say objectives were the most important category.

128
00:21:21.660 –> 00:21:22.980
Jason Mefford: Of lost to history.

129
00:21:23.430 –> 00:21:29.220
Tim Leech: In between, and I I’ve written about this at length, but I have all of the details like with the quotes and

130
00:21:29.610 –> 00:21:44.130
Tim Leech: So the original exposure draft of Kosovo actually said you should have objectives and you should measure whether you’re achieving them. The final five category framework that was released around whatever that date was

131
00:21:47.160 –> 00:21:57.240
Tim Leech: All gone. So we went back to old speak with words like control environment and and communication, which was vague.

132
00:21:58.170 –> 00:22:00.330
Tim Leech: It didn’t say you should measure anything and

133
00:22:00.330 –> 00:22:04.230
Tim Leech: Just said you should communicate stuff so so

134
00:22:05.310 –> 00:22:21.210
Tim Leech: But if you go back and you look at the exposure draft. I was so excited about that exposure. Now, I thought it was genuine breakthrough thinking and it got hammered back into audit speak. By the time the final product got released, but

135
00:22:22.290 –> 00:22:39.360
Tim Leech: So coco, coco, coco came out with a five category and the elements you actually had to try and figure out yourself that they were kind of written, but they weren’t nice and crisp and clear like the Canadian one was a fourth category 20 criteria.

136
00:22:39.360 –> 00:22:51.150
Tim Leech: In Kosovo was five categories know devote dodo boat bad but what were the sub elements of those five categories. It was kind of vague and I made them up.

137
00:22:51.660 –> 00:23:02.340
Tim Leech: So I actually converted it into a probably about a 70 or 80 element model under the five categories. So that’s what I call control.

138
00:23:03.060 –> 00:23:17.520
Tim Leech: centric you’re taking a framework that somebody says is good, but we can look at things like the Malcolm Baldrige Quality Framework, we can look at other models that even co bit

139
00:23:18.930 –> 00:23:41.490
Tim Leech: Is in essence a control centric framework. It’s saying you should be doing this bunch of stuff. So anybody that writes a framework that says you will look good. If you do these things. So now co when they updated the code causal framework. They did actually turn it into a 20 category.

140
00:23:41.730 –> 00:23:42.870
Tim Leech: Yeah, so let’s

141
00:23:44.070 –> 00:23:52.050
Tim Leech: Go now, but now it’s got principles. So the principles are the sub elements. And so that’s control criteria.

142
00:23:53.670 –> 00:24:00.090
Tim Leech: So if you were to use that you would actually describe to your audit committee, how you

143
00:24:00.840 –> 00:24:16.530
Tim Leech: Look, or don’t look like the model that you’re using as the framework to report against. So you’d say do we measure up against. So Sarbanes Oxley actually requires an opinion against the Kosovo internal control framework.

144
00:24:17.460 –> 00:24:31.560
Tim Leech: Now most auditor skip that step and never really give you one but it literally says in the words that they’re looking for an opinion against the suitable framework right they define what a suitable framework.

145
00:24:31.770 –> 00:24:37.560
Tim Leech: Is but everybody used coastal they said you could use to the Canadian framework.

146
00:24:37.590 –> 00:24:38.040
Jason Mefford: Well, because

147
00:24:38.220 –> 00:24:38.910
Tim Leech: Framework.

148
00:24:38.940 –> 00:24:51.150
Jason Mefford: But yeah, because in one I think paper one letter back from somebody at the SEC, they said well COSA is an example of one of them, like we mean And everybody’s like, oh, okay. Well, yeah, but you can use any of them.

149
00:24:51.450 –> 00:25:04.560
Tim Leech: Well, and the reality is, is, you know, the big four accounting firms are US centric and the requirement for Sarbanes Oxley to report an opinion against a control framework.

150
00:25:06.960 –> 00:25:12.780
Tim Leech: Required all of the largest companies in the world that access the US Securities Markets for capital.

151
00:25:13.620 –> 00:25:24.750
Tim Leech: To have opinions, whether they are not in accordance with coastal first from the CEO and CFO and then independently from the external auditor.

152
00:25:25.470 –> 00:25:36.300
Tim Leech: So that’s a control criteria model objective centric says let’s start by agreeing, what are the organizations or the department or the subsidiaries top

153
00:25:36.870 –> 00:25:43.200
Tim Leech: Most important value creation objectives. These are the things that are going to make us great drive us forward.

154
00:25:43.860 –> 00:25:53.100
Tim Leech: And what are the most important value preservation value preservation not going to make you great, but if you don’t do them well. It’ll take you into the ditch.

155
00:25:53.520 –> 00:26:04.500
Tim Leech: And destroy your value of your company and your shareholders. So nobody’s going to ever win the company of the year, because they published fabulous financial statements.

156
00:26:05.040 –> 00:26:08.850
Tim Leech: But if they published materially wrong financial statements.

157
00:26:09.330 –> 00:26:10.110
Jason Mefford: It’s not good.

158
00:26:10.470 –> 00:26:13.230
Tim Leech: It’s not good. And the same goes with data.

159
00:26:13.230 –> 00:26:27.060
Tim Leech: Security, you lose all your customers social security numbers and credit card numbers and all their personal health data. It’s bad. But, you know, protecting it wasn’t going to make you a great hospital.

160
00:26:29.010 –> 00:26:29.850
Tim Leech: So, so

161
00:26:30.180 –> 00:26:42.480
Tim Leech: That’s what objective centric is so we have encouraged people and on our website on the resources page, you can download a nice 15 page summary description of the five methods.

162
00:26:43.020 –> 00:26:53.820
Tim Leech: And we encourage people to actually inventory look is your internal audit department. So I actually encourage audit committee chairman to ask the CAE.

163
00:26:54.600 –> 00:27:03.840
Tim Leech: What percentage of these five methods do you use in doing your audit work. So I want you to take all of the hours that the audit department puts in

164
00:27:04.740 –> 00:27:16.860
Tim Leech: Which combination of these five methods are you using and the reality and most audit jobs, the one they use least or perhaps not at all is objective center.

165
00:27:18.120 –> 00:27:19.740
Jason Mefford: Yeah, well, I think, I think that’s a

166
00:27:20.940 –> 00:27:28.080
Jason Mefford: You know, I use a different term just because everybody’s been talking about risk based auditing. So I had been using the term risk based internal auditing, but it’s

167
00:27:28.560 –> 00:27:37.830
Jason Mefford: It’s really what you’re talking about, from the objective centric standpoint is what are the what are the key objectives and we go from there. Right. And everything that’s on your audit plan.

168
00:27:38.670 –> 00:27:45.930
Jason Mefford: In my opinion, should probably come from there. But I think it’s interesting how how you said here to that I want to kind of bring up for people is

169
00:27:46.620 –> 00:27:58.350
Jason Mefford: If you look at your audit plan. Right. How much of it is compliance centric. How much of it is process centric. How much of it is control centric or risk centric.

170
00:27:58.800 –> 00:28:07.500
Jason Mefford: Or really goes back to the objective because there. I mean, there is the reality is we have to do some compliance things we might have to do some control things

171
00:28:07.950 –> 00:28:20.850
Jason Mefford: Just as an expectation. But to me, you know, really, the process and risk even flows from the objective. Right. Is that is that if we really understand what our

172
00:28:21.480 –> 00:28:33.660
Jason Mefford: Most important value creation or value preservation objectives are, then the risks and the processes that we need to look at are going to flow from that.

173
00:28:34.620 –> 00:28:43.650
Tim Leech: Yeah. And one of the things that we make very clear is that one of this fundamental flaws and risk registers, is that they take.

174
00:28:44.250 –> 00:28:51.240
Tim Leech: Risks that relate to many, many objectives and they plug them into a register in isolation.

175
00:28:51.930 –> 00:28:59.130
Tim Leech: Well, if you took your home and you said one of the risk is that occupants are unaware of that there’s a fire.

176
00:28:59.850 –> 00:29:13.980
Tim Leech: And then you put it in a risk register and yeah but I mediums and low on it and you decide your there’s going to be a risk owner, but nobody in the house is responsible for safeguarding the health and safety of the occupants.

177
00:29:15.780 –> 00:29:17.340
Tim Leech: Against injury and death.

178
00:29:17.850 –> 00:29:25.860
Tim Leech: So, so, you know, unfortunately. And one of the things that I’ve done, I’ve actually done this, I go in a traditional

179
00:29:27.210 –> 00:29:48.120
Tim Leech: Company where the audit department has been doing 20 3050 100 audits, a year, you can reverse engineer them and you say, which objectives are implied in the work that was done on this audit. So your reverse engineer and say, well, you wouldn’t look at that you wouldn’t look at that control.

180
00:29:49.410 –> 00:29:52.740
Tim Leech: If there wasn’t an objective to do XYZ

181
00:29:53.940 –> 00:29:54.810
Jason Mefford: So also, you

182
00:29:55.140 –> 00:29:57.330
Tim Leech: You revert your immerse

183
00:29:57.480 –> 00:30:07.980
Tim Leech: The thing and then you and what those tests have always shown me is very few internal audit departments have gone anywhere near the most important value creation objectives.

184
00:30:08.310 –> 00:30:27.030
Tim Leech: Most of the audit plans are around value preservation and traditional type objectives. And when you say I, you know, look, I’ve just finished reading the strategic plan that went to the board. Show me what percentage of your internal life plan next year is specific on those objectives.

185
00:30:28.680 –> 00:30:31.920
Jason Mefford: Most of the time on. I’ve asked those it’s yeah it’s even zero

186
00:30:32.280 –> 00:30:44.100
Tim Leech: Yeah, I can be and and you know that, but my attitude is, you know, I’VE ALWAYS Promoted I’ve used the term supply driven most internal auditing done in the world is supply driven

187
00:30:44.850 –> 00:30:54.030
Tim Leech: The, the internal audit department walks up decides what they’re going to audit runs it by the audit committee who are busy and don’t really care. I

188
00:30:54.150 –> 00:30:57.630
Tim Leech: Hardly. If you know in the hundreds of clients I i

189
00:30:58.320 –> 00:31:11.370
Tim Leech: I’ve worked with over the years, the number of really insightful feedback from an audit committee or a senior leadership team on the audit planning is rarely

190
00:31:12.270 –> 00:31:24.930
Tim Leech: Much and I don’t blame them for that they’re busy people so they just sort of say on unless this is going to bother me a whole lot and inconvenience, my staff, you go ahead and do those audits.

191
00:31:25.980 –> 00:31:36.990
Tim Leech: And you know, I encourage audit committees to become demand driven. I say look at audit department, you’ve got cost 5 MILLION BUCKS.

192
00:31:38.130 –> 00:31:45.960
Tim Leech: Why don’t you actually take the time as an audit committee to agree what it is you want them to do in terms of outcomes.

193
00:31:47.520 –> 00:31:49.440
Tim Leech: Like let’s agree with those are

194
00:31:49.740 –> 00:31:55.440
Tim Leech: So before I try and assess the effectiveness of your $5 million internal audit department.

195
00:31:56.040 –> 00:32:19.260
Tim Leech: I want the customers to tell me what is it they most want from the $5 million in terms of outcomes. And the reality is, is if in fact the, the reality is, is they only want the audit department to pacify regulators and to pacify and keep the external auditors.

196
00:32:20.760 –> 00:32:28.260
Tim Leech: Okay, and they don’t really expect the internal audit department will ever go anywhere near the most important risk. Fair enough.

197
00:32:29.100 –> 00:32:40.950
Tim Leech: At least we’ve got it in black and white. That says internal audit department is not to look at the most important objectives of the company. It’s not your domain if that’s the decision that’s fine.

198
00:32:41.730 –> 00:32:50.340
Tim Leech: But don’t let the internal audit department saying continue saying they’re auditing the top risks when they’re not going anywhere near the top objectives.

199
00:32:51.480 –> 00:32:58.980
Jason Mefford: But I think it’s interesting the way you just put that is using supply driven and demand driven for your audit plans.

200
00:32:59.520 –> 00:33:04.410
Jason Mefford: I think it’s a great way that hopefully that kind of hits people to is

201
00:33:04.980 –> 00:33:13.740
Jason Mefford: You know when you’re just kind of picking and deciding what you think needs to be on the audit report or in the audit plan, you know, like we talked about. Usually it’s kind of an echo chamber.

202
00:33:14.220 –> 00:33:25.200
Jason Mefford: In ourselves. We might ask input from a few people. But we just pretty much put down what we want to do audit committee rubber stamps it that’s supply driven. That’s what we want to do.

203
00:33:26.040 –> 00:33:35.640
Jason Mefford: And actually getting the input and allowing the audit plan to be demand driven by what the executives and the board really want

204
00:33:36.240 –> 00:33:47.430
Jason Mefford: He has a totally, totally different thing. Now I know and that’s what I encourage people to do as well. It’s like if you want to be relevant, you’ll figure out what actually makes you relevant, it’s what the people need or want

205
00:33:48.060 –> 00:33:55.440
Jason Mefford: But I get a lot of people that push back and go, but if but if they’re telling me what to do. Then I’m no longer independent and objective.

206
00:33:55.800 –> 00:33:59.880
Tim Leech: Well, if in fact it is the board of directors, that’s

207
00:33:59.910 –> 00:34:05.820
Tim Leech: Telling what you what to do. I would I would counsel you not to be independent.

208
00:34:07.800 –> 00:34:07.980
Jason Mefford: There.

209
00:34:08.250 –> 00:34:13.230
Tim Leech: The Monday night, and I’m going to go do whatever I want. Regardless of what any of my customers.

210
00:34:13.920 –> 00:34:27.480
Tim Leech: Actually after they’ve been asked to think about it, but on our website on the resource page there’s there’s a five step overview of objective centric and the first step is to agree, what are the most important

211
00:34:28.140 –> 00:34:40.200
Tim Leech: Object, you know, value creation and now you preservation objectives and we want the leadership team to decide who who in management owns each of those objectives.

212
00:34:41.100 –> 00:34:55.050
Tim Leech: What level of risk assessment rigor. Do we want to analyze this the risk and the certainty of achieving those objectives. That’s what we call risk certainty assessment rigor.

213
00:34:56.310 –> 00:35:06.990
Tim Leech: And do we want independent assurance from internal audit on the representation on the state of risk uncertainty from internal audit, the answer is no.

214
00:35:08.130 –> 00:35:19.890
Tim Leech: So that step literally defines the entire work plan for the risk department if there is one. And for the internal audit department, however.

215
00:35:20.760 –> 00:35:28.110
Tim Leech: It assumes that the company has accepted the business case for a strong first line because it’s saying

216
00:35:28.860 –> 00:35:37.650
Tim Leech: The primary assessor reporter will be the management that only objective, they will be the primary assessor reporters.

217
00:35:38.190 –> 00:35:47.310
Tim Leech: The risk department will help them do that and put some discipline over it and provide editorial comments on on the product.

218
00:35:48.210 –> 00:36:00.330
Tim Leech: And if it’s decided that internal audit has a role as an independent insurance provider. It’s not internal audits job to say whether they like the controls or not.

219
00:36:00.810 –> 00:36:15.750
Tim Leech: Its internal audits job to say has the representation been accurately described in terms of where the weaknesses are, where the strengths are and how that links to current performance being produced on those objectives so

220
00:36:16.770 –> 00:36:23.640
Tim Leech: It’s very simple diagram. It’s five steps in it literally defines what a demand driven

221
00:36:24.750 –> 00:36:33.900
Tim Leech: Process looks like and what an objective centric. So if you want strong first line if you believe that strong first line.

222
00:36:34.770 –> 00:36:44.910
Tim Leech: Risk governance will be more nimble more agile is a big word out there, everybody wants to say we’re agile. How can you be agile, if we’re waiting for the second and third line to

223
00:36:44.910 –> 00:36:46.260
Tim Leech: Report, there might be

224
00:36:46.290 –> 00:36:49.890
Jason Mefford: Problems. We can’t do so.

225
00:36:50.160 –> 00:36:58.080
Tim Leech: If you’re going to want to be an agile company, you better be a strong first line company. Well how you going to be a strong first line company.

226
00:36:58.290 –> 00:37:16.380
Tim Leech: You’re going to be a strong first line company if management believes they should are expected to be able to identify and measure the risks and think in a thoughtful way about how to respond to those risks to increase the certainty important objectives will be achieved. Yeah.

227
00:37:17.790 –> 00:37:26.970
Jason Mefford: Well, and I think it’s, you know, I want to be conscious of time, too, because we try to keep the podcasts. We could, I could talk to you for like two or three hours, man.

228
00:37:27.600 –> 00:37:34.530
Jason Mefford: But, but I wanted to maybe hit on on one other thing here. And then we’re going to probably have need to kind of wrap it up for today, but

229
00:37:35.220 –> 00:37:41.700
Jason Mefford: You know I get. I get a lot of people that you know when I’m talking about objective centric and I’m sure you’ve gotten this question.

230
00:37:42.600 –> 00:37:56.310
Jason Mefford: Over your whole career is, you know, we talked about how a lot of times, artists, staying away from it. Probably because they prefer to focus on what’s comfortable for them what they’ve done in the past, right, what the history has kind of been

231
00:37:56.940 –> 00:38:08.130
Jason Mefford: Instead of jumping in and looking at what really are the most important objectives in the organization and I get a lot of people that say, Well, I don’t do that because I don’t know what they are.

232
00:38:09.840 –> 00:38:15.300
Jason Mefford: Right. So, so what do you, what do you say to be I know again you’re laughing now. Okay. Right.

233
00:38:16.170 –> 00:38:25.020
Jason Mefford: But when an auditor says, well, but I don’t know what the objectives are, so how can I audit those objectives or when I find out what those objectives are

234
00:38:25.380 –> 00:38:33.870
Jason Mefford: I don’t know what to do with it. It’s too high level and I’m supposed to be auditing the processes. Right. I hear this all the time. So,

235
00:38:34.950 –> 00:38:35.130
Tim Leech: We

236
00:38:35.370 –> 00:38:43.020
Tim Leech: Like to give the orientation on on the methodologies to the senior leadership team and the audit committee and risk committees.

237
00:38:44.100 –> 00:38:52.980
Tim Leech: What do they want from internal audit. Do they want a bunch of compliance jacking on low level processes or do they want opinions and and input and help

238
00:38:53.820 –> 00:39:04.110
Tim Leech: Do they want, fundamentally, do they want internal audit to help management manage the certainty that the most important objectives will be achieved. And if the answer is yes.

239
00:39:05.250 –> 00:39:12.900
Tim Leech: Then audit has to radically change the way it’s done in a large number of organizations today. If the answer is no.

240
00:39:13.350 –> 00:39:30.900
Tim Leech: We just want to be able to say we have an audit department. I used to go in a $5 million audit budget, a year and they may be thinking about outsourcing it to Coopers and lybrand and I you know I, I’d say, Well, you know, what’s, what’s your budget is 5 million. And I’d say to them all.

241
00:39:32.400 –> 00:39:33.690
Tim Leech: I can do it for half

242
00:39:35.820 –> 00:39:44.400
Tim Leech: Client would sort of, what do you mean, how could you possibly say you haven’t even you don’t even know what they’re doing. I said,

243
00:39:45.540 –> 00:39:48.240
Tim Leech: It’s not so much whether I know what they’re doing.

244
00:39:49.200 –> 00:40:02.790
Tim Leech: It’s that I’m almost certain. You haven’t told them with any clarity, what outcomes you want from them. And as long as the primary reason for their existence is to say we have an audit department that does audits the right audit reports.

245
00:40:03.450 –> 00:40:14.250
Tim Leech: I can do audits and I can write on it reports for $2.5 million you’ve been paying five for people doing audits and doing audit reports.

246
00:40:15.180 –> 00:40:24.420
Tim Leech: I need you know you shouldn’t have been paying 10 because you don’t know and have not told them what specific things you want an opinion on

247
00:40:25.110 –> 00:40:44.100
Tim Leech: So, in the absence of clarity of what it is you want from that internal audit function, we could pay look if if you’re feeling you want even bigger savings. Let’s pare it down to 1,000,005 that’ll be a decent assignment for me will do just as many audit reports as they were doing before.

248
00:40:46.350 –> 00:40:59.460
Tim Leech: And you’ll be able to say Coopers and lybrand is now doing your audits and they’re a world class firm with incredibly deep resources that can be called to audit the most significant risks. A company can face.

249
00:41:00.240 –> 00:41:19.470
Tim Leech: So you know I don’t like to make fun of it. But the reality is, and when I have this discussion with audit committee chairs why often golf with and and socialize with, say, no, it’s true. So, but here’s the rub. What’s the biggest metric

250
00:41:20.730 –> 00:41:25.710
Tim Leech: That internal audit departments use percentage of audit plan covered

251
00:41:26.640 –> 00:41:36.660
Tim Leech: Well, how bad and outcome statement is that that that’s like measuring a salesman on the number and the quality of their sales calls but with

252
00:41:37.140 –> 00:41:49.620
Tim Leech: Without any clarity on how many sales. Do you want them to me. So, you know, one of the first things I do when I get called into audit to do an assessment of the effectiveness of an audit department.

253
00:41:50.070 –> 00:42:00.780
Tim Leech: I will spend the time and drive out of the, the senior leadership team and the board. What is it you want from the 5 MILLION BUCKS. You’re spending.

254
00:42:02.490 –> 00:42:10.140
Tim Leech: If you can define what it is you want I can give you an idea of how many resources, it will take to do it.

255
00:42:10.800 –> 00:42:25.440
Tim Leech: However, if you say I just want to be able to say we have an audit department, we have a chief audit executive and we do audits and the audience are reported to the leadership team and the board, pick a number, and we’ll all work to it.

256
00:42:26.580 –> 00:42:26.880
Tim Leech: Because

257
00:42:26.940 –> 00:42:35.580
Tim Leech: There’s no intellectual integrity around how many resources you need unless there is clarity on the outcome soft

258
00:42:36.240 –> 00:42:46.380
Jason Mefford: Ending ending right and that, and that’s the whole, you know, especially now. So anybody who’s listing that’s ahead of audit. So in place. Did you just hear how easy

259
00:42:46.830 –> 00:43:01.410
Jason Mefford: Tim made it sound to get your, your, your, your whole group outsourced and you out of the job if you’re not kind of answering that question is, what, what does the board and the executives really expect from internal audit.

260
00:43:03.180 –> 00:43:15.000
Jason Mefford: And, you know, again, this is it’s a it’s a difficult time for some people, for some organizations and they may choose to take the hey you know Tim come into it for 1.5 instead of five right

261
00:43:15.660 –> 00:43:26.880
Jason Mefford: And and ultimately it’s it’s the company’s prerogative on what to do, but I can tell you if if you’ve been doing a supply driven audit plan.

262
00:43:28.170 –> 00:43:29.190
Jason Mefford: You’re at risk.

263
00:43:30.720 –> 00:43:31.380
Jason Mefford: Risk

264
00:43:31.530 –> 00:43:34.290
Tim Leech: Be careful, doubt, it’ll be called a risk based

265
00:43:37.650 –> 00:43:55.980
Jason Mefford: Right and ran really to be relevant. We have to understand what the objectives are of the organization those top objectives and if and then start helping with them. Right. Because if not, I mean, we’re just checking the box somebody else can check the box.

266
00:43:57.180 –> 00:44:08.730
Jason Mefford: Much cheaper. In fact, today I was just reading an article about auditors is one of the jobs that the World Economic Forum expects to be outsourced to machines within about five or six years.

267
00:44:09.330 –> 00:44:12.030
Tim Leech: Well, certainly if its compliance centric, or even

268
00:44:12.030 –> 00:44:18.390
Tim Leech: Control centric though both of those methods are extremely amenable to artificial intelligence.

269
00:44:19.020 –> 00:44:34.860
Tim Leech: Risk Based, you can certainly use the software that I built, you could wire up key risk indicators and escalation triggers and all of those things. And all it would all be done by machines and set off alarms on dashboards.

270
00:44:35.910 –> 00:44:50.400
Tim Leech: All of that is possible, but you know what I believe is very difficult to do because it requires judgment on acceptability of certainty of achieving objectives is that

271
00:44:53.550 –> 00:44:55.350
Tim Leech: That really

272
00:44:56.550 –> 00:45:09.450
Tim Leech: If the audit department has been instructed by the leadership team in the board that they are to provide independent assurance on the reliability of information, they get on objectives number

273
00:45:09.930 –> 00:45:25.110
Tim Leech: 269 14 and 18 and they want medium level assurance on the reliability of those data sets. I think you can do a much more rational approach in terms of

274
00:45:26.340 –> 00:45:41.850
Tim Leech: How many resources do I need to do that. And in the absence of any clarity on what it is, the leadership and the board one. I mean, I’m speaking from experience I’ve had clients that they were outsourcing.

275
00:45:43.500 –> 00:45:47.610
Tim Leech: $250,000 to Deloitte, they would do a DOD. It’s a year.

276
00:45:48.690 –> 00:46:01.740
Tim Leech: And then they would say in their annual report, we have an internal audit department. They are doing risk based internal auditing and they’re delivering five reports they don’t actually mentioned five because it sounds bad, but

277
00:46:01.770 –> 00:46:03.360
Jason Mefford: Yeah, the reports.

278
00:46:03.660 –> 00:46:12.780
Tim Leech: Yeah, the reports to to that are going to the board and to the leadership team and management is taking appropriate actions as required.

279
00:46:13.800 –> 00:46:28.830
Tim Leech: Well, that’s fine, but you know, I’m going into a client right now that was outsourcing five audits, a year. So what I’m saying to them is if you go with a strong first line.

280
00:46:29.640 –> 00:46:44.910
Tim Leech: Objective centric, we can cover, far, far more objectives for the amount of money you were spending on five artists, because we’re going to go. We’re going to use training and facilitation as our primary

281
00:46:45.480 –> 00:47:00.870
Tim Leech: Vehicle to do this with some quality assurance. If it’s felt to be worthwhile by the leadership team and or the board. So this is all about making it demand driven. Once you know

282
00:47:02.430 –> 00:47:11.520
Tim Leech: Unfortunately, the vast majority of internal audit in the world is supply driven and it’s extremely vulnerable to being outsourced

283
00:47:11.940 –> 00:47:32.130
Tim Leech: Right now in a tough environment where the regulator hasn’t really defined with any clarity, what they want in the you can argue that some of the better financial regulators have at least some idea of what they expect as outcomes from internal audit, not usually. Very good, but

284
00:47:33.360 –> 00:47:41.550
Tim Leech: The point is, is to take the time clarify what outcomes you seek from whatever amount of money you’re going to spend on that activity.

285
00:47:42.390 –> 00:48:00.270
Tim Leech: And then work to the outcome resource it to the level of outcome. And if if that number is too high, change the specifications then delete objective number four and seven and just go with clarity, there is no independent insurance on those objectives.

286
00:48:01.590 –> 00:48:09.000
Tim Leech: Don’t. Don’t pretend that five audits, a year is going to really assure that the company has an effective risk and control framework.

287
00:48:10.140 –> 00:48:12.480
Jason Mefford: Yeah, it can’t it possibly can.

288
00:48:12.630 –> 00:48:31.680
Tim Leech: And, you know, and I see sometimes the the stuff out of the AIA talking about benchmarking how big your audit department is against the other departments. Well, all of that is irrelevant if none of them departments if define what it is they want from them in those companies.

289
00:48:32.040 –> 00:48:41.850
Jason Mefford: Yeah benchmarks are another one that I just, I don’t understand. It’s like little boys pulling out a tape measure, you know, and it’s like okay, it does give you signals.

290
00:48:42.360 –> 00:48:48.240
Tim Leech: Right, you know, back in my CL days, which is now P WC winning. You say, we can use our vast

291
00:48:48.810 –> 00:49:03.360
Tim Leech: Global resources and and and compare how you’re doing your internal auditing against the way other companies, but that’s not helpful if it turns out the whole of the internal auditing sector hasn’t been very effective.

292
00:49:03.750 –> 00:49:07.680
Tim Leech: And it has not been measuring outcomes. It’s been measuring inputs.

293
00:49:08.460 –> 00:49:15.090
Tim Leech: So you got to get out of. First you got to get agreement what outcomes do you seek from the investment in the function

294
00:49:15.870 –> 00:49:30.450
Tim Leech: And unfortunately, the I quality assurance review does not demand that as the first step of a QA review and I believe unequivocally insured. So you know that that’s key and

295
00:49:31.980 –> 00:49:33.360
Tim Leech: So demand driven

296
00:49:34.560 –> 00:49:46.110
Tim Leech: Objective centric with the philosophy that strong first line is a goal. Those are the my guiding principles and I just slide true decade after decade.

297
00:49:47.370 –> 00:49:49.290
Tim Leech: Those are things that are important.

298
00:49:49.710 –> 00:49:54.930
Tim Leech: But here’s, here’s the rub. Nobody has debated with me that I’m wrong.

299
00:49:56.910 –> 00:50:02.850
Tim Leech: Nobody’s marshalling arguments and saying, Oh, you’re far better with a week first line.

300
00:50:03.480 –> 00:50:17.790
Tim Leech: Second and Third lines will catch all that bad things that are going on out there that then you say, well, how did you decide how much second and third line, you’re going to engage to compensate for the week first line in a world is changing every month.

301
00:50:19.920 –> 00:50:30.930
Jason Mefford: Well, no, and nobody’s willing to debate you Tim because you’re right, you know, and it’s and the problem is they’re just not willing to accept it or come along with it so

302
00:50:31.560 –> 00:50:41.340
Jason Mefford: You know, that’s why I love. I’m trying to, to help out and push. I haven’t been doing it nearly as long as you have, but I’m going to keep pushing and keep being the contrary, and for people to

303
00:50:41.910 –> 00:50:49.680
Jason Mefford: You know, pull their head out of their ass and actually think about this in the right way and and realize that, you know, like you said,

304
00:50:50.070 –> 00:50:54.930
Jason Mefford: Most of these other centric approaches you can you can program the software to do it.

305
00:50:55.500 –> 00:51:03.660
Jason Mefford: But, you know, if you’re really going, you know, to have the clarity and and do the things that require the human judgment.

306
00:51:04.170 –> 00:51:20.580
Jason Mefford: And the actual human interaction right of actually being able to be intelligent emotionally with people and know how to use things like psychology and influence to actually develop relationships and work through some of this stuff, you know, the machines are going to take over.

307
00:51:20.640 –> 00:51:25.140
Tim Leech: And wait, you know, where’s the cognitive biases that work on the management side and

308
00:51:25.200 –> 00:51:26.340
Tim Leech: Oh, and I

309
00:51:27.600 –> 00:51:45.420
Tim Leech: expose some of them and get a better appreciation, but you know I don’t like to be all negative. I have to give kudos to Richard chambers CEO president of the AIA nominated me and put me on his 10 thought leaders of the decade.

310
00:51:46.410 –> 00:51:51.000
Tim Leech: And the write up those says every profession needs somebody like to

311
00:51:52.500 –> 00:51:53.640
Tim Leech: Continually

312
00:51:54.120 –> 00:51:54.750
harassing

313
00:51:56.670 –> 00:52:08.580
Tim Leech: There’s got to be better ways to do it. And I think one of the earmarks or one of the hallmarks of being a professional should be relentlessly looking is there better ways to

314
00:52:09.000 –> 00:52:19.350
Tim Leech: Actually satisfy what our customers want. And if the answer is, well, they haven’t bothered to tell us. Well, you better take the time and try and get it out of them, because

315
00:52:19.770 –> 00:52:28.710
Tim Leech: I’ll tell you if your customer doesn’t know exactly what it is they want you, for you are very vulnerable to getting rid of it.

316
00:52:29.190 –> 00:52:41.610
Jason Mefford: Well, exactly. Exactly. Well, Tim. Thank you. Thank you. Thank you. Thank you, love talking to you. So I’ll probably have to have you back in the future as well. But I really appreciate

317
00:52:42.690 –> 00:52:53.730
Jason Mefford: Like I said at the beginning, you have been one of those people in the profession. That’s always been kind of, you know, pushing it and and and asking us how we can do things different.

318
00:52:54.390 –> 00:53:00.240
Jason Mefford: It’s metal meant a lot to me. I mean, again, in my development as well, kind of

319
00:53:01.080 –> 00:53:14.130
Jason Mefford: You know, hearing what you’ve been saying and thinking about it and doing my own research and my own playing with it but you know I keep coming back to the same thing where it’s like Tim. You’re right. Man, that’s why I’m saying the same thing to itself.

320
00:53:14.190 –> 00:53:14.520
Jason Mefford: So,

321
00:53:14.700 –> 00:53:28.980
Tim Leech: You know, I would encourage those of you that even if you only like some of the ideas. Consider following me on LinkedIn. I’ve got a LinkedIn discussion group called objective centric risk uncertainty management all my posts are there.

322
00:53:29.910 –> 00:53:44.520
Tim Leech: You become a member of it. You can you can read the two years of radical thinking about it and a lot of my posts i’m i’m just as focused on the second line as I am on the third line.

323
00:53:45.180 –> 00:53:53.400
Tim Leech: And all of it, though, is promoting the the business case for strong first line objective centric demand driven assurance.

324
00:53:53.820 –> 00:53:55.110
Tim Leech: Yep, absolutely.

325
00:53:55.680 –> 00:54:08.730
Jason Mefford: That’s a theme. Well, I’ll link up in the show notes for that and and just again, since this is usually audio. I’ll put it in the show notes, too. But what’s the, what’s the website. The best website for people because I know you refer to the resources.

326
00:54:09.240 –> 00:54:09.480
Well,

327
00:54:10.500 –> 00:54:12.750
Tim Leech: Risk oversight solutions com

328
00:54:13.650 –> 00:54:15.060
Jason Mefford: Risk oversight solutions.

329
00:54:16.560 –> 00:54:24.900
Jason Mefford: Alright, so go out and download some of the stuff asked to join the LinkedIn group and keep the discussion going.

330
00:54:26.370 –> 00:54:27.630
Jason Mefford: Well, Tim. Thanks again, man.

331
00:54:29.040 –> 00:54:32.460
Tim Leech: Appreciate it. That’s really the opportunity you have a good one.

332
00:54:32.790 –> 00:54:33.360
Jason Mefford: Thanks. You too.

How do you deliver difficult messages, without damaging relationships?

Have you ever tried to discuss something challenging with an audit client, and you get some type of condescending behavior or response?

Did the conversation just not go as you had expected?

Have you, unintentionally, disrupted a key relationship because you just didn’t see eye to eye?

I understand. We’ve all been there.

Conversation you were used to having in person are now done virtually. If you are like most people you are still trying to figure out the best way to have these conversations with your staff and stakeholders now that we are working remotely.

There are ways to deliver difficult messages, and not damage key relationships along the way. In fact, it’s EASY when you use Intuitive Leadership, Neural Influence, and Mental Mastery skills, which is what I’m talking about in this #jammingwithjason episode.

For more on this, join me for a free one-hour discussion where we will explain exactly how to make difficult conversations more comfortable and EASY.

Date: Tuesday, December 8, 2020 9:00 AM PST
Cost: FREE
Field: Personal Development
CPE: 1 hour

There is limited seating for this special event and it’s filling up quickly, so register now at: https://jasonmefford.mykajabi.com/difficultconversations2020-12-08

#internalaudit #leadership

Transcript

1
00:00:01.230 –> 00:00:08.670
Jason Mefford: Welcome to another episode of jamming with Jay said. I gotta get a little extra on

2
00:00:10.320 –> 00:00:19.950
Jason Mefford: This week, and it makes me laugh. So hopefully, it makes you laugh too. Hey, welcome back. My friend, we are on again. It’s a little solo episode again today.

3
00:00:20.490 –> 00:00:30.540
Jason Mefford: And before we get started into our discussion today if you’ve been a loyal listener, please share this with other people.

4
00:00:31.140 –> 00:00:35.880
Jason Mefford: Because if you’re, you know, I’m sure that you’re getting value out of this. And if you’re getting value out of this.

5
00:00:36.390 –> 00:00:44.790
Jason Mefford: Other people will get value out of the two, but they can only get value out of it. If they know that this podcast exists.

6
00:00:45.270 –> 00:00:52.560
Jason Mefford: So as I said, You know, I’m sure you’re enjoying these episodes. Please make sure and share with your friends.

7
00:00:53.430 –> 00:00:59.670
Jason Mefford: You can send them an email or a text and you can even, you know, post on social media, you can post right back to the link

8
00:01:00.180 –> 00:01:09.030
Jason Mefford: Here as well and say, hey, I’ve been listening and this is great. You know, everybody else, you should listen to and just help me by spreading the word and getting

9
00:01:09.570 –> 00:01:14.940
Jason Mefford: More out there so that we can help more people because that’s really why I show up and do this.

10
00:01:15.600 –> 00:01:24.420
Jason Mefford: You know, we’re up to two episodes a week right now. And that’s, that’s my goal is to help people in their life. So the more you share, the more we can help.

11
00:01:25.140 –> 00:01:35.520
Jason Mefford: Now today we’re going to talk about difficult conversations. And there’s a couple reasons for that, you know, towards the end of the year. A lot of times its annual review time

12
00:01:36.150 –> 00:01:47.280
Jason Mefford: And if that means that you are a leader of other people. You may have to give them a performance review and and sometimes those are some difficult conversations

13
00:01:47.760 –> 00:01:57.030
Jason Mefford: But we’re going to get into that more in today’s episode I’m going to go through and talk a little bit about why this has been such a big focus for me right now.

14
00:01:57.960 –> 00:02:05.430
Jason Mefford: And why I think it’s so important that we start thinking about thinking about these and doing some things a little bit different.

15
00:02:06.180 –> 00:02:17.130
Jason Mefford: So that conversations don’t become difficult or if they start to become difficult that we can move them back to where they’re not difficult, as well. Okay.

16
00:02:17.640 –> 00:02:31.200
Jason Mefford: Now I’ll remind you, at the end, but I wanted to at the beginning as well. This next week on December 8 i’m actually going into more depth on this. I’m doing a one hour free webinar.

17
00:02:31.650 –> 00:02:40.470
Jason Mefford: And so check the show notes, wherever you’re listening, whether it’s it’s on one of the podcast listeners or on the website. You should see the link

18
00:02:41.010 –> 00:02:50.670
Jason Mefford: In the show notes to be able to register for that free webinar that I’m doing next week where I’m getting deeper into this topic.

19
00:02:51.270 –> 00:03:02.730
Jason Mefford: And I’m going to share more with you than what I can on a shorter podcast episode like today. So again, just as a reminder, I’ll try to remind you again at the end of the episode.

20
00:03:03.420 –> 00:03:24.930
Jason Mefford: But you can sign up for that free webinar on December 8 just look in the show notes. There will be a link for you to be able to get to the registration page. Okay, so with that I wanted to just kind of start off here actually asking you a few questions. Okay.

21
00:03:26.040 –> 00:03:37.320
Jason Mefford: Have you ever tried to discuss something challenging with an audit client and you get some type of condescending behavior or response. Have you ever done that.

22
00:03:39.090 –> 00:03:44.940
Jason Mefford: You know, have you had conversations that just didn’t go as you had expected.

23
00:03:46.020 –> 00:03:58.230
Jason Mefford: And, you know, have you unintentionally may be disrupted or damage to key relationship because you didn’t see eye to eye with the other person and the conversation just went sideways.

24
00:03:58.710 –> 00:04:08.820
Jason Mefford: And all of a sudden there was a relationship crisis. Okay, now I understand because we’ve all been there, right, we’ve all had

25
00:04:09.390 –> 00:04:20.700
Jason Mefford: Conversations that afterwards we walk away and are like What the fuck just happened right i mean it’s like that was totally not what I was expecting. That was not what I was intending

26
00:04:21.090 –> 00:04:35.280
Jason Mefford: How did we ever actually get to that point in the conversation. And, you know, because the thing is, I mean, we have conversations with other human beings, all the time. And most of the time they’re not difficult.

27
00:04:36.240 –> 00:04:47.820
Jason Mefford: You know, but sometimes conversations become difficult or sometimes we have to deliver difficult messages as part of the conversation.

28
00:04:48.330 –> 00:04:55.200
Jason Mefford: And so again, if you’re an internal audit or if you’re a leader you know sometimes you do have to deliver difficult messages.

29
00:04:55.590 –> 00:05:05.190
Jason Mefford: You know, if you’re giving somebody a performance review, they just aren’t meeting expectations, you’re going to have to tell them that you’re going to have to be honest with that and deliver that message.

30
00:05:05.790 –> 00:05:15.660
Jason Mefford: But how do you deliver that difficult messages without damaging those relationships. Well, that’s what we’re going to talk about today on the podcast. And like I said,

31
00:05:15.990 –> 00:05:24.780
Jason Mefford: I’m getting deeper into that on the webinar on December 8 so make sure and join me for that. Okay.

32
00:05:25.530 –> 00:05:40.620
Jason Mefford: So why is this a big deal right now. And why am I, why am I spending time actually talking about this today instead of something else. Well, I’ve been seeing some things happening for a while and

33
00:05:41.790 –> 00:05:51.810
Jason Mefford: Has just sped things up. Okay. We were already moving in this direction, but really through all of

34
00:05:53.190 –> 00:06:01.860
Jason Mefford: We found ourselves in a much more remote work environment. And so what does that mean well you know sometimes we have

35
00:06:02.310 –> 00:06:11.610
Jason Mefford: kind of gotten used to or been comfortable having some of these conversations when we’re face to face, you know, two humans in the same room together.

36
00:06:12.510 –> 00:06:18.030
Jason Mefford: You know, we kind of learned how to do that. And now all of a sudden that we’re in a remote work environment.

37
00:06:18.690 –> 00:06:31.080
Jason Mefford: Some of those things that we could do when we were in person. Some of them still work. But some of them don’t. Right. And so, you know, how do we kind of modify or change what we’re doing.

38
00:06:32.190 –> 00:06:50.490
Jason Mefford: Especially when we have to deliver difficult messages okay you know another thing is, and we’ve been seeing this for a while but you know employees and people in general are becoming more emotionally intelligent they are they are

39
00:06:51.570 –> 00:06:58.530
Jason Mefford: Much more in tune with their emotions, realizing that other people have emotions. People are talking more about it.

40
00:06:59.160 –> 00:07:09.600
Jason Mefford: And so, you know, a lot of the traditional command and control military kind of leadership just doesn’t work today. It’s a broken model. Okay.

41
00:07:10.140 –> 00:07:16.470
Jason Mefford: Because people just don’t put up with that anymore. And you’ve seen some evidence of that for a while, you know, people

42
00:07:16.800 –> 00:07:23.460
Jason Mefford: especially younger generations, right, the older people, not that I’m getting older, but the older people like me.

43
00:07:23.880 –> 00:07:30.780
Jason Mefford: or older, you know, sometimes sit there and go, oh, you know, these, these young people, they’re just they’re just so emotional

44
00:07:31.050 –> 00:07:36.780
Jason Mefford: You know, they would they want to be kind of babies and things like that. Right. Different words that people throw out there.

45
00:07:37.200 –> 00:07:47.520
Jason Mefford: But when you peel back a lot of the layers. They just want to be treated like a human being. Okay, instead of a command and control, kind of, well, I’m the boss.

46
00:07:47.880 –> 00:07:55.710
Jason Mefford: You know I’m big your little I’m smart. You’re dumb. You know, I’m the boss. You’re the employees. So you’ve got to do what I tell you to do.

47
00:07:56.250 –> 00:08:06.840
Jason Mefford: That doesn’t work anymore. And I’m here to tell you, even if it’s still working for you. It ain’t gonna be working for you. Much longer because people just don’t put up with that.

48
00:08:07.560 –> 00:08:11.910
Jason Mefford: And so that’s another one of the reasons why we’re talking more about this.

49
00:08:12.450 –> 00:08:24.420
Jason Mefford: Now, the other thing is, especially you know in in this profession of internal auditing are those of you may be there listening that are in more of an analytical role.

50
00:08:24.900 –> 00:08:35.520
Jason Mefford: I’m going to tell you something that nobody’s probably told you before, but you think too much and you hear that, yes, think too much.

51
00:08:36.060 –> 00:08:46.920
Jason Mefford: Because the problem is is we get taught to be analytical, we believe that we can think our way out of problems, but we can’t do that.

52
00:08:47.400 –> 00:09:02.010
Jason Mefford: Right. In fact, the answers usually come from our heart, not from our head and our heart is feeling and our brain is thinking, right. So usually you pose a question in your brain.

53
00:09:02.460 –> 00:09:11.820
Jason Mefford: And where do you end up getting the answer in your heart. And that’s why I’m talking more about intuitive leadership that we’ll, we’ll get into a little bit more

54
00:09:12.570 –> 00:09:23.550
Jason Mefford: Maybe not miss episode but in, you know, I’m going to keep talking about it because it is important. Now let’s get in here. First, and just talk about you know some of the mistakes.

55
00:09:24.180 –> 00:09:33.060
Jason Mefford: That I see people making. And like I said, the these are some of the things that end up making conversations turn out to be difficult.

56
00:09:34.050 –> 00:09:44.520
Jason Mefford: The first one is, you know, a lot of times in conversations we want to tell people what to do, instead of using questions. Okay.

57
00:09:45.000 –> 00:09:53.190
Jason Mefford: And I don’t know if you’re like me, but I don’t really like being told what to do, even if it’s the boss or somebody else telling me.

58
00:09:53.700 –> 00:10:05.370
Jason Mefford: I would much rather come to the conclusion on my own. And so what that means is as a leader you need to get comfortable and learn, you know, kind of

59
00:10:05.880 –> 00:10:18.750
Jason Mefford: Through through some of this intuitive leadership and neural influence on how to actually ask better questions to move people and get the things done that you that you want to do.

60
00:10:19.140 –> 00:10:31.560
Jason Mefford: Because, again, a conversation can become difficult, very quickly when you start telling the other person what to do and they start digging in their heels. They start becoming defensive

61
00:10:32.250 –> 00:10:39.510
Jason Mefford: You know, maybe feel like you’re being condescending to them. And so they’re going to be condescending back to you. Okay.

62
00:10:40.290 –> 00:10:49.230
Jason Mefford: Another thing that I see often is people being inflexible. Now, you know, I’m sure you might be saying, well, I don’t do that.

63
00:10:49.680 –> 00:10:54.960
Jason Mefford: But again, especially an internal audit. A lot of times I see people

64
00:10:55.440 –> 00:11:06.090
Jason Mefford: telling people what to do and that there’s only one way to do it. There’s no compromise. This is the way we have to be have to do it. And in order to be ethical

65
00:11:06.390 –> 00:11:16.320
Jason Mefford: And a lot of people will stand up on that ethical high horse and try to say, nope, nope, nope. This is the way it has to be, it has to be this way. There’s no other way.

66
00:11:17.160 –> 00:11:29.820
Jason Mefford: And again, that’s that black and white thinking that we get trained and taught to do the world is not black and white, as far as I can tell there’s millions of colors out there.

67
00:11:30.210 –> 00:11:44.220
Jason Mefford: And so if you go around trying to be inflexible seeing things as black and white, and we have to do things my way your conversations are going to turn difficult. Okay.

68
00:11:45.450 –> 00:11:53.400
Jason Mefford: Another one that I see often is people not actually developing the relationship before they have the conversation.

69
00:11:53.910 –> 00:12:00.660
Jason Mefford: So, you know, again, they just pop into somebody and they start asking for something or start telling them something

70
00:12:01.470 –> 00:12:12.780
Jason Mefford: So again, let’s just let’s just do some crazy, crazy scenarios. Right. But I’m sure if you’re like me, some of these things have actually happened to you. Okay.

71
00:12:13.170 –> 00:12:19.920
Jason Mefford: So I’ve literally been at places like the grocery store just minding my own business, right.

72
00:12:20.430 –> 00:12:28.650
Jason Mefford: Getting the getting the things that I need to shopping in the store and some random stranger that I have never met before.

73
00:12:28.980 –> 00:12:41.730
Jason Mefford: Comes up and starts commenting or telling me or suggesting that I should do something different or that I handled some situation wrong. Okay.

74
00:12:42.150 –> 00:12:52.560
Jason Mefford: Now if some random stranger comes up to you and starts talking to you and telling you that you need to change or you need to do something different.

75
00:12:53.520 –> 00:13:05.010
Jason Mefford: What’s going to be your reaction. Well, it’s going to be one of defensiveness, right, like, who the hell are you and why are you actually, you know, trying to tell me what to do. I don’t know you from Adam

76
00:13:05.460 –> 00:13:17.070
Jason Mefford: Why are you here and why are you talking to me. And so again, sometimes the conversations that we have. If we, you know, don’t have a relationship or if we haven’t

77
00:13:17.550 –> 00:13:24.840
Jason Mefford: Developed that and I’ll give you a tip on doing that here in just a minute. But if we don’t have that relationship.

78
00:13:25.200 –> 00:13:36.000
Jason Mefford: Then, of course, the message is going to be received with defensiveness. Okay. Now, again, if, if, let’s say instead of some random stranger.

79
00:13:36.510 –> 00:13:48.930
Jason Mefford: If it was my best friend that I’ve known since I was a kid and he came up to me and delivered exactly the same message as that stranger did

80
00:13:49.500 –> 00:14:03.120
Jason Mefford: I would not react the same way why cuz he’s got credibility with me. We’ve got history we’ve got a relationship. And so that’s why, you know, even when people say things that are hurtful to you.

81
00:14:03.600 –> 00:14:12.090
Jason Mefford: If they’re a complete stranger. You just write them out of your life. But if it’s somebody that you love if it’s somebody that you’ve had a relationship with

82
00:14:12.600 –> 00:14:21.120
Jason Mefford: You know, you give them some of the benefit of the doubt and that one conversation doesn’t necessarily cause a relationship crisis.

83
00:14:21.780 –> 00:14:31.500
Jason Mefford: And so that’s why, again, it’s so important that we actually develop relationships. Before we have some of these conversations

84
00:14:32.310 –> 00:14:40.470
Jason Mefford: And again, in the podcast format. I’m not going to be able to kind of get through and tell you how to do everything. We’re going to talk more about about that on the webinar.

85
00:14:40.770 –> 00:14:56.520
Jason Mefford: And I’ll point you to some other things to be able to help you there but but those are some of the mistakes that I commonly see people making. Okay, so what can we do or how can how can we do this different and especially in a remote environment. Okay.

86
00:14:57.780 –> 00:15:00.000
Jason Mefford: Well, the first thing is

87
00:15:01.200 –> 00:15:14.280
Jason Mefford: To choose the right medium. Okay. Now what does that mean, what is, what are you talking about by a medium that is the communication medium that we choose to use. Okay.

88
00:15:14.880 –> 00:15:29.220
Jason Mefford: We there’s lots of different ways that we can that we can do that and the mediums are kind of how the communication is received. So, for example, an email is a medium of communication.

89
00:15:29.700 –> 00:15:49.020
Jason Mefford: A telephone call is a medium of communication. You know, so are things like a handwritten letter, you know, something that’s hand written as opposed to like an email that’s typed. We have text messages we have you know slack and other kind of instant messaging.

90
00:15:50.430 –> 00:16:00.510
Jason Mefford: Things. We’ve got, you know, besides text messages we actually have voice texts you know that you can actually send somebody effectively like a little voicemail.

91
00:16:00.990 –> 00:16:16.140
Jason Mefford: Through their text or I think Facebook is doing that and some other ones like that are doing it as well. So that’s a different medium. Again, right, or we can have a video call right where we’re actually seeing each other on the screen.

92
00:16:18.120 –> 00:16:34.620
Jason Mefford: And so again, you know, even if we can’t be face to face. There are different of these mediums that we can use. And depending on the message that we’re delivering or the type of conversation that you’re actually doing.

93
00:16:35.310 –> 00:16:48.480
Jason Mefford: You need to pick the medium that matches the message that you’re delivering and what I’ll tell you just kind of one rule of thumb is the more important or

94
00:16:49.320 –> 00:16:57.210
Jason Mefford: critical to understanding of the conversation, that is, the more in person, it should be.

95
00:16:57.750 –> 00:17:08.730
Jason Mefford: So as an example, you know, if you’re giving somebody a performance review. Ideally, we would like to do that in person, you know, human to human in the same room.

96
00:17:09.420 –> 00:17:24.120
Jason Mefford: Now in a virtual environment. We can’t do that. And so what is the next best medium to use, it’s probably going to be video call because that way we can actually see the person as well.

97
00:17:25.230 –> 00:17:31.590
Jason Mefford: And it’s so important. The more important. The conversation is the more you want to see the other person.

98
00:17:32.130 –> 00:17:47.220
Jason Mefford: And the reason for that is you know study done by UCLA. A LONG TIME AGO ONLY ABOUT 7% seven what you know seven 7% of communication are the words.

99
00:17:47.910 –> 00:18:05.190
Jason Mefford: 93% of the conversation and the communication is other things. It’s your tone of voice right it is your body language. It is a lot of these other things that we need to be considering as well.

100
00:18:05.730 –> 00:18:13.860
Jason Mefford: And so that’s why you know as an example. You’ve probably done this, too, right where you’ve been, maybe texting or messaging back and forth with somebody

101
00:18:14.370 –> 00:18:22.440
Jason Mefford: You make some sarcastic comment that’s meant to be a joke, but the other person is offended.

102
00:18:23.040 –> 00:18:34.950
Jason Mefford: Why, because all they saw were the words they didn’t see you. Laughing As you said it, you know, again, if they had seen your face when you said those same words.

103
00:18:35.400 –> 00:18:50.460
Jason Mefford: They would have realized that that it was sarcasm that you were that you were trying to be funny, but because they don’t see that they don’t understand it. Okay, so one of the things is try to choose the right medium.

104
00:18:51.660 –> 00:19:04.110
Jason Mefford: Now the second thing that I want to talk to you about today is what I call making deposits. And so this goes back to the mistake that most people make, which is they don’t really establish or develop the relationship beforehand.

105
00:19:04.560 –> 00:19:13.290
Jason Mefford: They just start talking to people. Well, you can make deposits, you think, think of every interaction that you have with other people.

106
00:19:13.680 –> 00:19:27.000
Jason Mefford: As either being a deposit or a withdraw to that relationship. Okay. And so there’s a concept like I don’t know who coined it exactly, but I’ve heard it for many years, called

107
00:19:27.420 –> 00:19:35.640
Jason Mefford: The emotional bank account that I like to use. And so the way you can think about this as every interaction you have

108
00:19:36.150 –> 00:19:47.670
Jason Mefford: With another human being is either making a deposit. You know, so, so, lifting or raising the balance of your relationship building up your relationship.

109
00:19:48.180 –> 00:19:57.450
Jason Mefford: Or it is a withdraw and pulling down the balance in your relationship. Okay. And so that’s why again.

110
00:19:57.810 –> 00:20:05.730
Jason Mefford: Like I talked about before with the example. If it’s one of my best childhood friends. Well, he’s going to have to do a lot of stuff.

111
00:20:06.150 –> 00:20:10.440
Jason Mefford: Before that relationship is effectively bankrupt, right, because

112
00:20:10.980 –> 00:20:26.850
Jason Mefford: Over the years, we’ve made deposits with each other in our relationship. So even if he does something that pisses me off. It’s going to take away a little bit from the relationship, but it’s not going to put it in the negative or overdraft position.

113
00:20:27.930 –> 00:20:38.520
Jason Mefford: That’s why again when somebody you know a complete stranger comes up to you in the grocery store and starts going off, they’ve taken a withdrawal out of her relationship bank account.

114
00:20:38.940 –> 00:20:51.840
Jason Mefford: That started with zero because you had no relationship with them so obviously your first interaction. If it’s negative is going to bankrupt that account and that’s why you get defensive. That’s why you push back.

115
00:20:52.680 –> 00:21:02.550
Jason Mefford: So again, you know, with people that you’re communicating with, you know, what are you doing to make those deposits into the emotional bank account.

116
00:21:03.390 –> 00:21:09.990
Jason Mefford: Now the last one that I just kind of wanted to share with you today. And again, we don’t have a lot of time to get into this

117
00:21:10.590 –> 00:21:21.060
Jason Mefford: On the podcast but kind of want to share with you a what to be able to do. And then if you’re, you know, if you want more come over to the webinar on December 8

118
00:21:21.420 –> 00:21:33.960
Jason Mefford: And again, the link is down below and I’ll share with you there, a little bit more about how to do this and how you can actually get resources to support you along the way.

119
00:21:34.350 –> 00:21:42.690
Jason Mefford: Because this is also something that you know you can’t just listen to one podcast or go to one webinar and all of a sudden

120
00:21:43.080 –> 00:21:54.750
Jason Mefford: You have this down to where none of your conversations end up being difficult ever again. There’s a lot of things that you have to do and practice and a lot of things to be able to learn

121
00:21:55.260 –> 00:22:04.260
Jason Mefford: But you can do it, you can learn them these things usually people don’t talk about it. But I’m here to share with people because I want your life to be better.

122
00:22:05.910 –> 00:22:17.400
Jason Mefford: So the last one that I wanted to talk about today is about using rapport. Now in internal audit you know a lot of people that talk about kind of

123
00:22:17.820 –> 00:22:27.780
Jason Mefford: You know, if you if you hadn’t training on interviewing skills as an example. One of the things that they’ll put in there, as they say, you know, start off in building rapport.

124
00:22:28.290 –> 00:22:34.200
Jason Mefford: Now the problem is the people that usually teach those things only understand about a half an inch

125
00:22:34.680 –> 00:22:42.390
Jason Mefford: Of what rapport actually is. So usually what they’ll tell you is you know you you walk into somebody’s office.

126
00:22:43.260 –> 00:22:52.530
Jason Mefford: And you want to build rapport with them before you start the interview. So you look around their office, you try to see what’s what’s there.

127
00:22:53.040 –> 00:23:08.460
Jason Mefford: And you make some comment right like like again, you know, if you’re watching the video on this, you can see, you know, back over here. I’ve got a little Rodin statue called the thinker. Okay, bye bye Rodin

128
00:23:09.000 –> 00:23:28.560
Jason Mefford: And if you’re familiar with that piece of art, then you might look at that and go, oh, I see that you have Rodin’s thinker on on in your office here, you know, tell me about why, why do you have that, you know, I, or, or, Hey, you know, I saw that at the San Francisco Museum of Art. Right.

129
00:23:30.180 –> 00:23:39.360
Jason Mefford: Trying to remember which one it’s the one of them isn’t in San Francisco ones down here in in the LA area to that I saw as well. But anyway, I digress. I digress.

130
00:23:39.840 –> 00:23:59.460
Jason Mefford: But I could bring that up. Right. And all of a sudden see that that’s interaction is now starting to make a deposit in that relationship because it’s showing that, Hey, you like Rodin I like Rodin we have something in common. Therefore, you’re making a deposit right

131
00:24:00.570 –> 00:24:13.500
Jason Mefford: And again, as I said, most of the people in the Internal Audit space when they talk about rapport. That’s really all they talk about their like make chit chat for a minute on something that looks like you have in common, and then

132
00:24:14.010 –> 00:24:23.880
Jason Mefford: Get going into the interview, baby. You know, start asking the questions get what you need. That is just the very, very surface level of rapport.

133
00:24:24.390 –> 00:24:37.530
Jason Mefford: In fact there’s a whole psychology behind it. And that’s one of the reasons why I talk about neural influence on how to actually use rapport skills psychology

134
00:24:37.830 –> 00:24:50.880
Jason Mefford: Neuro linguistic programming and the principles of influence on how to actually develop rapport and use rapport, as you’re talking to people. Okay.

135
00:24:51.270 –> 00:25:00.480
Jason Mefford: And it’s, it’s in the way that you move the way that you use your body. It’s the way that you actually phrase certain things.

136
00:25:01.230 –> 00:25:05.160
Jason Mefford: Because there’s a whole bunch of things behind it like key, key word backtracking.

137
00:25:06.000 –> 00:25:18.750
Jason Mefford: And some other things like that that that once you understand those skills and you have more than the surface level, it makes it very easy for you to have a conversation with anybody.

138
00:25:19.230 –> 00:25:33.990
Jason Mefford: Even when the conversation starts to go difficult you’re able to bring people back to where they need to be so that the conversation just doesn’t go off the rails and at the end of it you walk away going, holy crap what just happened right

139
00:25:35.610 –> 00:25:43.620
Jason Mefford: And so like I said, there’s, there’s a whole bunch of stuff behind that. You know how you paste people you pay some along and then you lead

140
00:25:43.920 –> 00:25:54.510
Jason Mefford: And then you lead them to a certain place, and the way that you asked questions and the way that you hold your body and the way that you use your voice, the speed of your voice.

141
00:25:55.140 –> 00:26:12.390
Jason Mefford: The intonation of it. The words that you’re actually using the order in which you’re actually using those words. And when you really understand that and understand the ideas behind rapport and what’s really involved in having these neural influence skills.

142
00:26:13.470 –> 00:26:21.870
Jason Mefford: You can pretty much have a conversation with anybody and move the conversation to wherever you want it to go. It’s pretty amazing. Okay.

143
00:26:22.590 –> 00:26:31.950
Jason Mefford: So that’s another of the things that you can start working on now, again, you know, I’m sure that some of you are saying, Behold, I don’t really know what those things are.

144
00:26:32.310 –> 00:26:39.870
Jason Mefford: Well don’t worry, I’m going to tell you about them, right. This is just a kind of a, an order at the beginning of it to just kind of let you know.

145
00:26:40.470 –> 00:26:50.250
Jason Mefford: That these things are there. And the problem is, like I said, most people are not talking about this. And so I want to start talking about it for you because it’ll make your life.

146
00:26:50.640 –> 00:27:01.410
Jason Mefford: A lot easier, both at work as well as in your personal relationships as well. Okay, so make sure, again, you know, join me. Join me on that webinar.

147
00:27:01.980 –> 00:27:13.710
Jason Mefford: I’ll go into a little bit more depth on this and then I’ll also share with you how you can actually start developing these skills and make your life, way, way easier.

148
00:27:14.190 –> 00:27:20.400
Jason Mefford: Because I’m telling you, you know, as we wrap up for today. You know, we have conversations with people every day.

149
00:27:20.970 –> 00:27:28.410
Jason Mefford: And most of those conversations are just fine. They go you know exactly the way that we were intending for him to go and it was just fine.

150
00:27:28.800 –> 00:27:36.270
Jason Mefford: Sometimes those conversations end up becoming difficult, especially if there’s a difficult message that we have to deliver

151
00:27:36.630 –> 00:27:48.600
Jason Mefford: Or if we do something to kind of screw it up right because sometimes that ends up happening or maybe the other person does something to start screwing it up and we don’t know how to respond. And so it just goes off the rails.

152
00:27:49.110 –> 00:28:04.680
Jason Mefford: But I’m here to tell you that, you know, again, difficult conversations can actually be easy when you understand intuitive leadership neural influence and you have mental mastery skills around that.

153
00:28:06.930 –> 00:28:08.400
Jason Mefford: It can actually be quite easy.

154
00:28:09.660 –> 00:28:12.180
Jason Mefford: You just have to learn how to do it. Okay.

155
00:28:13.410 –> 00:28:23.130
Jason Mefford: And so again, I don’t have time to get into any more depth. Today I’ll be talking more about this on the podcast but again if you want more information, make sure to join me on that webinar.

156
00:28:23.700 –> 00:28:31.620
Jason Mefford: And follow some of the other stuff that I’m doing because I’m going to share with you you know more about how to actually do some of this stuff.

157
00:28:32.190 –> 00:28:33.930
Jason Mefford: Right. So again, if you’re sitting there going, hold it.

158
00:28:34.800 –> 00:28:45.990
Jason Mefford: You know, you’re talking about communication medium. I didn’t even write down what they were are trying to figure out which one is the right one. Well, don’t worry, I’ll tell you that there’s, there’s, there’s ways to do that same thing with report.

159
00:28:47.070 –> 00:28:55.650
Jason Mefford: I’m here to actually share that with you so that your life can be better as well. So without my friend. I am going to sign off.

160
00:28:56.430 –> 00:29:11.010
Jason Mefford: For this episode. And again, make sure and share this with other people that you know would also benefit from it and I’ll catch you on the next episode of jam with Jason. Have a great rest of your week. See ya.

We’ve been talking about agile auditing for years, so why are a few succeeding and others are reluctant to embrace it or failing in their implementation?

Agile doesn’t mean faster, and it doesn’t apply to just one part of the audit process. It is a paradigm shift and one of the most important changes to #internalaudit in many years.

I am talking with Toby DeRoche, who has spent the last several years understanding exactly how to apply the principles of agile into the whole audit process in a practical way. What works, what doesn’t, what organizations are really doing that are successful, and is here to share so you can make the shift to agile auditing and avoid the painful learning curve.

Listen in at: http://www.jasonmefford.com/jammingwithjason/

When you are ready for the step-by-step “how to” for agile auditing, learn more about the Certified Agile Auditor Professional (cAAP) course mentioned during this episode at: https://ondemand.criskacademy.com/p/caap/?affcode=105582_jpp6czlf/

Transcript

1
00:00:01.530 –> 00:00:10.349
Jason Mefford: Hey everybody, I’m back talking with Toby de Roche again and this today. This day this day would be the same as today. I think right so

2
00:00:11.400 –> 00:00:24.600
Jason Mefford: We’re going to be talking about agile auditing, because I know, I think, well, I know there’s some misconceptions out there about agile auditing what it is. And I know a lot of people are struggling to actually

3
00:00:25.230 –> 00:00:31.230
Jason Mefford: Put something in practice that works. And so we’re going to dig into that today because

4
00:00:31.650 –> 00:00:42.060
Jason Mefford: You know Toby’s you you’ve done some work a lot of work on this there’s kind of some common misconceptions that people have and some things that are missing.

5
00:00:42.690 –> 00:00:52.320
Jason Mefford: And when those things are missing or you have these misconceptions. It’s almost impossible for you to actually switch to an agile approach right

6
00:00:52.380 –> 00:00:52.980
Toby DeRoche: It is, yeah.

7
00:00:54.030 –> 00:01:07.290
Jason Mefford: Well, so let’s so let’s jump in because I wanted to talk maybe let’s talk first about some of the misconceptions in the first one that I kind of see, you know, as people think that agile auditing just means they’re auditing faster.

8
00:01:08.160 –> 00:01:09.060
Jason Mefford: Is that what it is.

9
00:01:09.570 –> 00:01:11.040
Toby DeRoche: It’s not at all. You know, it’s

10
00:01:11.880 –> 00:01:13.110
Jason Mefford: It’s oh

11
00:01:13.680 –> 00:01:15.120
Toby DeRoche: It’s wrong. Everybody’s wrong.

12
00:01:16.890 –> 00:01:22.500
Toby DeRoche: One of the first things people think is that they’re going to start having these really, really short, really, really fast audits.

13
00:01:23.070 –> 00:01:29.940
Toby DeRoche: You know, and I’ve even seen people posting on LinkedIn. Like, I’m so frustrated with this whole agile thing. How am I supposed to do an audit and six days.

14
00:01:30.600 –> 00:01:42.810
Toby DeRoche: Like, well, why in the world would you think you can do an audit and six days like that’s not the point of this, the whole point wasn’t for us to be able to audit pastor, the whole agility idea is that I’m honored in the things that matter right now.

15
00:01:43.770 –> 00:01:55.620
Toby DeRoche: Yeah. And so, like, you know, everybody should be aware of that right now this is this is we all just loved it. Right. We went through all of our audit planning at the end of 2019

16
00:01:56.820 –> 00:02:01.020
Toby DeRoche: And then at the beginning of 2023 year plan to trash because it didn’t make any sense at all anymore.

17
00:02:01.710 –> 00:02:04.980
Jason Mefford: Well, I think the same things going to happen with 2020 on a plans to

18
00:02:05.190 –> 00:02:15.180
Toby DeRoche: I think unfortunately we’re never going to stop this because our new reality is I need to be able to look ahead and a short time frame. I can’t say what’s going to happen a year from now.

19
00:02:15.840 –> 00:02:22.800
Toby DeRoche: Things changed with us and it’s hilarious because we’ve been having this conversation for years now about auditing its speed of risk.

20
00:02:25.260 –> 00:02:26.100
Toby DeRoche: We’re here, right.

21
00:02:26.340 –> 00:02:30.180
Jason Mefford: So we’ve been here for a long time just people, people aren’t getting it, you

22
00:02:30.240 –> 00:02:36.540
Toby DeRoche: Know, they’re not. And if you look at people’s a lot of plans and their full compliance and they’re full of socks. They’re full of other stuff.

23
00:02:37.590 –> 00:02:44.100
Toby DeRoche: And then they try to just squeeze in their risk based work, but that if that’s our focus if we’re truly risk based on it.

24
00:02:44.940 –> 00:02:55.620
Toby DeRoche: I can’t plan ahead. More than three months because three months from now, the world looks wildly different than it does right now. And so much has changed that things I thought were important back in December.

25
00:02:56.670 –> 00:03:07.530
Toby DeRoche: By the time I get to June, July, no, that makes any sense anymore, do I need to reevaluate. I need to think about what’s the new priority. So if I’m only planning stuff one quarter out

26
00:03:08.280 –> 00:03:11.970
Toby DeRoche: And I get into this regular cadence of saying, I’m going to audit plan for one quarter.

27
00:03:12.840 –> 00:03:18.960
Toby DeRoche: Right now, what’s important to management with their strategic objectives and what’s going on in the world. Here are my audit based on that.

28
00:03:19.650 –> 00:03:28.290
Toby DeRoche: And I’m do the same thing in March going to come up with the next set. I’m going to come up with the next three months after that and and my plan is that always updating

29
00:03:29.370 –> 00:03:34.500
Toby DeRoche: You kind of get into this holiday continuous planning mode continuous risk assessment.

30
00:03:35.550 –> 00:03:41.580
Toby DeRoche: To think i can’t i can’t project, realistically, so let me just say for right now I’m gonna take one work.

31
00:03:43.260 –> 00:03:53.370
Jason Mefford: Well, and I think, though, right, that, that, that kind of leads into one of the second myths that a lot of people have, which is, well, if I’m doing agile, a lot of things that I don’t do any

32
00:03:53.760 –> 00:04:08.550
Jason Mefford: Audit planning. Right. I mean, I think, again, that’s not quite right. Yeah, you’re not going to do annual cycles. But, so, how, how does it look different. It doesn’t mean that we just throw planning out completely, but how does planning look a little bit different.

33
00:04:08.910 –> 00:04:19.680
Toby DeRoche: Well, and this is even, you know, you say, we’re going to have quarterly plans in the financial services guys have a heart attack because they’re used to the regulators coming back and saying, show me your three year plan.

34
00:04:20.070 –> 00:04:34.530
Toby DeRoche: And, you know, and we can’t get out of this idea that I have to have a three year plan. So let’s say for most of us, right. We’ve got an annual there’s nothing wrong with still saying I have an annual plan because you’re going to have some compliance work. You just have to be

35
00:04:35.250 –> 00:04:38.280
Toby DeRoche: So maybe you’re starting with that and saying, so here’s when those

36
00:04:38.340 –> 00:04:46.710
Toby DeRoche: Required projects are going to happen, or I have these risk based ideas, but some of those audits have to happen at certain points in the year.

37
00:04:48.090 –> 00:04:51.630
Toby DeRoche: And the thing that’s going to change is going to be. So if I’m looking at Q1.

38
00:04:52.710 –> 00:04:54.210
Toby DeRoche: Then I’m going to put my plan together.

39
00:04:55.320 –> 00:05:08.670
Toby DeRoche: Q ones risk assessments as I should do these 10 audits based on the risk assessment now of those I have capacity to do five. So I’m going to pull those five and put that in the queue one because right now that’s what’s important.

40
00:05:09.720 –> 00:05:15.810
Toby DeRoche: But my capacity might be, you know, here’s what I can do. In total mind is what I know I have to do this quarter. Here’s what I have left.

41
00:05:16.500 –> 00:05:25.320
Toby DeRoche: So those five extra projects that I’m doing that’s, you know, part of the accumulation of everything that I could have done because everything is going to be based on your capacity.

42
00:05:27.090 –> 00:05:35.130
Jason Mefford: And I think that’s an important thing to remember, too, because again, you know, sometimes, like you said, compliance centric is

43
00:05:35.850 –> 00:05:51.630
Jason Mefford: Is just part of the job at some organizations, right, you still have to do some of those compliance things because you REGULATORS REQUIRE it or whatever else. Right. But in so it’s it’s being able to kind of marry together those two ideas.

44
00:05:52.710 –> 00:06:00.180
Jason Mefford: And focusing. It’s kind of like what we talked about. It’s not auditing faster, but it’s it’s auditing the things that really matter now.

45
00:06:00.360 –> 00:06:10.590
Toby DeRoche: Right. You know, it’s interesting. With this, as we’ve done this idea before because a lot of departments, especially as they get to be more mature, they start getting involved in those internal consulting engagements.

46
00:06:11.550 –> 00:06:17.550
Toby DeRoche: You do that right now because it matters right now. You know, we’re rolling out a new system, I need help, and

47
00:06:17.640 –> 00:06:20.370
Jason Mefford: We better do it right now. Yeah, we did after

48
00:06:20.550 –> 00:06:25.020
Toby DeRoche: Okay, I don’t need help, two years from now, I need it right now. And so we jump on and engagement like that.

49
00:06:25.650 –> 00:06:30.240
Toby DeRoche: And we make recommendations and we move on because today. That’s what mattered management.

50
00:06:30.780 –> 00:06:32.010
Toby DeRoche: So we’ve already got

51
00:06:32.250 –> 00:06:35.160
Toby DeRoche: Kind of a concept for this. We’re just taking it further.

52
00:06:35.790 –> 00:06:49.620
Jason Mefford: Okay well in other other kind of myths that are that are there, a little bit because I know you know sometimes people will say things like well you know I got a book on agile and I read the book. That’s all I need to know

53
00:06:49.800 –> 00:06:52.620
Jason Mefford: Yeah, right. But, but is that really is that really true.

54
00:06:53.490 –> 00:06:55.020
Toby DeRoche: Oh, God. Now, so I’ve got that book.

55
00:06:56.790 –> 00:07:08.940
Toby DeRoche: read that book I’ve read everything I can get my hands on around this whole idea and the books are good. If you’re just getting started and you’re trying to learn a whole lot about agile.

56
00:07:10.140 –> 00:07:17.370
Toby DeRoche: And this is where I went. So I got deep into it. I read everything I could read on agile, I went and got an agile certification.

57
00:07:18.180 –> 00:07:26.190
Toby DeRoche: And then immediately went back and said, Okay, now how do I turn this into an agile Otter process that really make sense. You know what I was talking with people who have done this.

58
00:07:27.180 –> 00:07:35.130
Toby DeRoche: People who, you know, former chief audit executives and directors of organizations who they went from traditional to agile and they could tell you the experience

59
00:07:36.120 –> 00:07:47.400
Toby DeRoche: And what they would tell you is so here’s why it failed you know if they all because we got hung up on all the vocabulary words failed because we were too focused on the theory.

60
00:07:48.900 –> 00:07:56.850
Toby DeRoche: You know, and then they start saying, Well, I tried can ban and I tried to save. And I tried this and I tried Scrum and like none of that stuff matters to us.

61
00:07:57.720 –> 00:08:07.650
Toby DeRoche: Because when you really take it all back and say, I’m trying to build an agile audit function. You’re not trying to turn your, your audit department into an Agile project management team.

62
00:08:08.700 –> 00:08:15.090
Toby DeRoche: You’re taking the best of what agile has and we make it work for us, because that’s really the spirit behind this whole idea.

63
00:08:15.660 –> 00:08:34.140
Toby DeRoche: You know the Agile purist will jump up and down and say Agile is a mindset. It’s not a methodology. It’s not a process. It’s a way of thinking as we have working, you’re absolutely right. And that’s why we can take the best parts of that idea and we just make it our own

64
00:08:35.190 –> 00:08:43.260
Toby DeRoche: We don’t have to be purists. We don’t have to say, I’m going to take every single bit of what I learned in that book and make it work for me.

65
00:08:43.920 –> 00:08:50.340
Toby DeRoche: Because your departments, different from another department, your, your organization’s different cultures, different

66
00:08:50.910 –> 00:09:03.300
Toby DeRoche: How much capacity you have that mix between risk and you know compliance is all of it is very unique to you. And so, taking the best pieces of it and making it work for you is really the way to go. Okay.

67
00:09:03.720 –> 00:09:10.920
Jason Mefford: Well, and I think that’s, that’s where, again, you know, like you said. Sometimes we get so caught up or worried about the words.

68
00:09:10.980 –> 00:09:14.310
Jason Mefford: And it becomes becomes kind of a substance over form.

69
00:09:14.550 –> 00:09:21.330
Jason Mefford: Kind of a deal right where it’s like, you know, and okay for some organizations that might be okay if your organization.

70
00:09:21.780 –> 00:09:32.220
Jason Mefford: You know, takes an agile mindset. And it’s kind of built into the culture and everybody’s using all of that terminology, then you probably better learn the terminology

71
00:09:32.820 –> 00:09:42.240
Jason Mefford: Right, so that you can speak to everybody else. But if if you’re not, then, you know, again, it just seems like people are going to look at you like you’re crazy.

72
00:09:43.080 –> 00:09:52.770
Jason Mefford: Because you’re trying to push something or again use words like we you know we use audit words already and confuse people. And now,

73
00:09:52.770 –> 00:09:54.900
Jason Mefford: You’re just throwing another

74
00:09:55.890 –> 00:10:13.830
Jason Mefford: Language, if you will, on top of in confusing people more right and like you said, I think it’s I’ve seen so many people just talking about the theory, but they don’t know how to actually put it into practice in internal auditing. Yeah.

75
00:10:14.280 –> 00:10:17.220
Toby DeRoche: And that’s, that’s really why I got focused on this a while back.

76
00:10:18.390 –> 00:10:22.380
Toby DeRoche: You know, for about three or four years now, we’ve been talking about this.

77
00:10:23.400 –> 00:10:37.440
Toby DeRoche: And all I hear is theory, all the time. You know, I’ve sat in on conference presentations and webinars and all you know and everybody has the best intentions with this. So I’m not trying to knock them at all. But it’s all very theoretical

78
00:10:38.400 –> 00:10:41.790
Toby DeRoche: And they’ll put up here’s a, here’s a diagram of how it should go.

79
00:10:43.050 –> 00:10:49.830
Toby DeRoche: Though they’re not telling you is, here’s what it looks like in real life, you know, and here’s here’s where it’s not going to work out the best for you.

80
00:10:50.370 –> 00:11:04.920
Toby DeRoche: And here’s how you would just do it and they don’t really lay it out in those terms of here’s how I do it. So everything that I’ve been doing for the last month has really been about showing. Here’s how you do it. So let’s stop with that theory. Let’s get down.

81
00:11:04.920 –> 00:11:05.520
Toby DeRoche: To the, you know,

82
00:11:05.790 –> 00:11:08.160
Toby DeRoche: The nitty gritty on this and say, Here’s what it does.

83
00:11:08.940 –> 00:11:17.250
Jason Mefford: Well, that’s why you know if you’re listening and you’ve gone to some of these same kind of presentations or you’ve read a book or you’ve, you know, heard something on a on a conference.

84
00:11:17.790 –> 00:11:23.220
Jason Mefford: And it’s still kind of confusing you and you’re like, how do we make this practical hold with us.

85
00:11:23.700 –> 00:11:40.410
Jason Mefford: And we’re because we’re going to share with you actually some ways that you can actually start making it very practical and give you exactly how to do that. No more theory BS. But actually, how to put it in practice.

86
00:11:41.670 –> 00:11:51.990
Jason Mefford: In finally move the conversation forward. Yeah, right. Instead of just talking about the theory for like we have been for three or four years, let’s actually get in and actually get some shit done.

87
00:11:52.890 –> 00:11:56.490
Toby DeRoche: And we’re done talking about it because the world won’t let us anymore.

88
00:11:56.640 –> 00:12:02.550
Toby DeRoche: No, no, we must have exchanged and you know anybody trying to put together an annual plan right now. It’s not going to work.

89
00:12:02.670 –> 00:12:03.990
Toby DeRoche: We really have to change now.

90
00:12:04.380 –> 00:12:11.910
Jason Mefford: Yeah, well, which is why some things around continuous planning continuous risk assessment. Those are some words, people are throwing out there.

91
00:12:12.300 –> 00:12:22.620
Jason Mefford: Which does fit in nicely with with Agile when you do it the right way as well. So let’s let’s talk now about because I know you know you’ve done a lot of

92
00:12:23.190 –> 00:12:35.010
Jason Mefford: Research, you’ve talked to a lot of people you know what’s working, what’s not working and tried to kind of come up with a better mousetrap, if you will, on, on how to actually do this so

93
00:12:35.520 –> 00:12:40.830
Jason Mefford: What are some of the things that most, in turn, a lot of groups are missing.

94
00:12:41.460 –> 00:12:51.690
Jason Mefford: that’s causing him to kind of fail or they they try this, maybe for a few months, or a half a year and then they like, they throw up their hands. I give up. I’m not going to do this, this doesn’t work.

95
00:12:51.990 –> 00:13:01.830
Jason Mefford: Yeah. What are because i think i’m guessing there must be some common things people are missing. And because they’re missing those that’s why they’re failing.

96
00:13:02.160 –> 00:13:02.520
Jason Mefford: Yes.

97
00:13:02.820 –> 00:13:19.590
Toby DeRoche: In the south. Absolutely. And, you know, part of it as part of it is just the fact that we’ve focused so much on theory. I think a lot of people go into it with really big ideas and they’ve got this big theoretical you know situation in their head that uses all of this agile language.

98
00:13:20.550 –> 00:13:32.790
Toby DeRoche: And you get so deep into these agile concepts that you you lose the point he was point, he was the focus you forget what it was that you were trying to do. And so I think just that one right off the bat is probably one of the biggest

99
00:13:33.960 –> 00:13:38.820
Toby DeRoche: The others, you know, one of the big ones is that people try to carve out the audit process.

100
00:13:40.290 –> 00:13:43.320
Toby DeRoche: And just turn one piece of it into an agile process.

101
00:13:43.680 –> 00:13:55.980
Jason Mefford: Okay, well I’m glad you. I’m glad you went there because, again, as I’ve heard people talking about this. It’s like people you don’t understand it’s not doing things faster doing part of what we do faster. It’s like into him.

102
00:13:56.190 –> 00:14:03.420
Toby DeRoche: And and it is absolutely the end to end. And, you know, one of the big places people fail is they try to turn people work into an agile process.

103
00:14:04.290 –> 00:14:17.580
Toby DeRoche: That’s not actually agile. That’s just making it better to work for him. Like, you’re, you’re not changing your process. And this is why people fail because they said well I took my my fieldwork. And I tried to make it agile, so they use all the words.

104
00:14:18.120 –> 00:14:21.120
Toby DeRoche: But they didn’t get the point. Right. And so they start talking about sprints.

105
00:14:21.600 –> 00:14:29.400
Toby DeRoche: And they start talking about Daily Scrum meetings and they they’re taking all of this ceremony that goes along with Agile stuff.

106
00:14:30.210 –> 00:14:38.100
Toby DeRoche: And they’re trying to force it on the audit instead of saying, well, if I if I looked from end to end, from a risk assessment or reporting.

107
00:14:39.060 –> 00:14:47.130
Toby DeRoche: Then I changed my whole process, then my risk assessment would achieve because it would have been risk based and not entity based way that we know so many people are doing it.

108
00:14:48.180 –> 00:14:57.810
Toby DeRoche: And then my audience would have been risk based not entity base and then I can take my audit and I can break it up into sprint based on risks and controls.

109
00:14:59.040 –> 00:15:01.620
Toby DeRoche: And not on some canned audit program that I found somewhere.

110
00:15:04.230 –> 00:15:09.360
Jason Mefford: If anybody’s listening and still using a canned audit program slap yourself. Right. Yeah.

111
00:15:09.720 –> 00:15:12.510
Toby DeRoche: And then call me and Jason, we’re going to talk you out of this.

112
00:15:13.170 –> 00:15:16.200
Jason Mefford: I will talk to you out of it will talk you off the cliff with them. Right.

113
00:15:16.980 –> 00:15:19.200
Toby DeRoche: And I’m happy to have that conversation all day.

114
00:15:21.510 –> 00:15:31.650
Toby DeRoche: But once once we change the whole process and the whole thing changes focus and focus now on management strategic objectives. I want to know the risks that I audit to those risks.

115
00:15:32.340 –> 00:15:38.610
Toby DeRoche: And because I’m doing this in an agile fashion. I’m worried about the risk better or most important highest priority for the export.

116
00:15:40.560 –> 00:15:44.910
Toby DeRoche: A complete my audit program in those iterations, but based on risk and controls.

117
00:15:46.020 –> 00:15:53.700
Toby DeRoche: And then when they get through all this. One of our goals is to no longer have that long dragged out press process for getting the audit report out

118
00:15:54.630 –> 00:16:02.940
Toby DeRoche: Because we actually bake in all of the review and all the conversation into the Agile field work process so that by the end of that audit. I am done.

119
00:16:04.080 –> 00:16:11.280
Toby DeRoche: And we don’t get caught up in this whole farm over substance nonsense where I’m fighting over every single word in every single issue in the report.

120
00:16:12.300 –> 00:16:18.060
Toby DeRoche: Because, and I’ll talk about this until I die. The standards don’t require you to make a report.

121
00:16:19.020 –> 00:16:20.520
Jason Mefford: Just communicate results.

122
00:16:20.610 –> 00:16:22.650
Toby DeRoche: Just communicate results so

123
00:16:23.310 –> 00:16:29.700
Jason Mefford: Well, and I think this must be one of the huge areas. Why, why people fail.

124
00:16:29.940 –> 00:16:32.160
Jason Mefford: It is like you said they tried to just

125
00:16:32.520 –> 00:16:37.410
Jason Mefford: Change the field work portion of it, but we’re still just as ineffective and planning.

126
00:16:37.890 –> 00:16:51.570
Jason Mefford: Yeah. Both, both in time, but also in knowing where to focus if you’re using an entity or compliance centric some other kind of audit universe approach. And then, and then we waste a bunch of time in the reporting.

127
00:16:52.050 –> 00:16:53.340
Jason Mefford: Process as well.

128
00:16:53.670 –> 00:17:06.960
Jason Mefford: And so, you know, they’re doing agile in the middle. It’s still taking them as much time or probably longer and they’re thinking, oh, well, agile doesn’t work. Yeah, it does. But not when you have acid and

129
00:17:07.260 –> 00:17:07.830
Jason Mefford: Be part of it.

130
00:17:08.250 –> 00:17:10.140
Toby DeRoche: We tried to piecemeal this thing and grab out

131
00:17:10.410 –> 00:17:13.290
Toby DeRoche: Some of the ideas that made sense to us. Good, we’re focused on

132
00:17:14.130 –> 00:17:18.840
Jason Mefford: Them. Okay, great. So, what, what other things are kind of missing.

133
00:17:19.950 –> 00:17:23.820
Jason Mefford: You know, from people being able to be successful in making this transition

134
00:17:24.270 –> 00:17:28.560
Toby DeRoche: So I’ll tell you one of them is something we it’s I’m going to blame the nature of who we are.

135
00:17:29.100 –> 00:17:29.580
Okay.

136
00:17:30.930 –> 00:17:31.140
Jason Mefford: Well,

137
00:17:31.830 –> 00:17:35.580
Jason Mefford: I think either way, though some of the better we can actually change right

138
00:17:35.580 –> 00:17:50.730
Toby DeRoche: That’s right. And I say this as an auditor who’s been doing this for a very long time. It’s just part of who we are. We’re by nature professions, you know, we don’t allow ourselves to make mistakes and we’ve got beaten into us that you’re never allowed to do anything wrong.

139
00:17:52.230 –> 00:18:00.330
Toby DeRoche: But with this. You’re changing. This is a massive change. Let’s not call it anything else, you’re probably this is the biggest change you’ve ever made to your audit program.

140
00:18:01.680 –> 00:18:10.020
Toby DeRoche: And so what we’re doing with it then is we’re making major changes and we have to allow ourselves to make mistakes and we have to allow things to bail.

141
00:18:10.740 –> 00:18:17.940
Toby DeRoche: So that we can then correct them. And we do that without judgment and we do that without holding ourselves, you know, like we’re

142
00:18:18.210 –> 00:18:27.060
Toby DeRoche: destroying the world and knowledge through the whole program out. Let’s go back to what we were doing, because we’re so horrible. It’s not that bad. You know, like one of the ones that comes up a lot.

143
00:18:28.410 –> 00:18:33.510
Toby DeRoche: And it’s one of the more common, you know, things known about Agile is that you have these days. These daily meetings.

144
00:18:35.160 –> 00:18:46.470
Toby DeRoche: We can call them Daily Scrum meetings daily stand up meetings, call them whatever you want. It doesn’t matter. It’s a quick conversation, you get the whole team together. Ideally, you’ve got one of the oddities there with you as well.

145
00:18:47.910 –> 00:19:00.060
Toby DeRoche: And in that meeting, you’re talking about what what’s holding us up what roadblocks. Do I have. That’s it. It’s such a simple concept to say, Let’s have a quick conversation about why I can’t do my job today.

146
00:19:01.200 –> 00:19:11.310
Toby DeRoche: You know, I can’t get documentation from Bob or, you know, I needed to have a conversation with Mary, but she’s on PTO for the next week. So who else could I talked to, well, I don’t know, because I don’t know this organization that well.

147
00:19:12.510 –> 00:19:19.380
Toby DeRoche: And but if I’ve got the oddity there with me. They can fix that for me, probably on the spot. Oh, marries out cool go talk to this on a person

148
00:19:20.700 –> 00:19:29.880
Toby DeRoche: And that meeting is set up to be something that facilitates progress because we’re on these shorter Sprint’s. So I have two weeks to get this work done.

149
00:19:31.020 –> 00:19:36.150
Toby DeRoche: And by the end of that two weeks, I need to be done, but if Mary’s out for a week. I’m stuck. I lost half my time.

150
00:19:37.740 –> 00:19:43.590
Toby DeRoche: One of the things that happens though is that meeting starts to change. And this is a very natural progression. It happens almost all the time.

151
00:19:44.160 –> 00:19:51.750
Toby DeRoche: It turns into a status update meeting. I’m looking backwards not forwards. I’m not talking about what’s holding me up. I’m saying, Well, here’s what I did yesterday.

152
00:19:52.890 –> 00:19:53.730
Toby DeRoche: And I think I’m done.

153
00:19:55.590 –> 00:19:59.610
Toby DeRoche: And so in this kind of natural falling apart progression that happens.

154
00:20:00.960 –> 00:20:08.550
Toby DeRoche: I started giving you status updates. And now I want to know why I’m here because I could have sent you an email for this. I don’t need to be in this meeting. So I’m going to stop coming. Because this is a waste of my time.

155
00:20:09.960 –> 00:20:15.750
Toby DeRoche: And it takes a strong person to say, you know, here’s what this meeting is about. Let’s stay on task. Don’t forget why we’re here.

156
00:20:16.740 –> 00:20:23.280
Toby DeRoche: And not let it slip back into some bad practices and I can almost bet money that this is going to happen to you.

157
00:20:24.030 –> 00:20:30.030
Toby DeRoche: Because every team is going to be doing this all of your auto groups and going to be doing this you have multiple people trying to pull this thing together.

158
00:20:30.600 –> 00:20:40.770
Toby DeRoche: And when they start to slip and it’s inevitable. You have to remind them, Hey, here’s what we’re doing. And so you have to have some coaching sessions to remind everybody, hey, here’s what we’re doing this meeting. This is for roadblocks.

159
00:20:41.940 –> 00:20:44.550
Toby DeRoche: This is not for status updates and

160
00:20:46.080 –> 00:20:52.110
Toby DeRoche: It falls apart. Whenever you don’t have enough coaching and guidance through this good consulting can get you through this

161
00:20:52.860 –> 00:21:05.370
Toby DeRoche: Good consulting sometimes hard to find, you know, a lot of a lot of those consultants come in with so much theory they forget this whole practical idea that people revert back to their old habits and need to be kept on task.

162
00:21:06.570 –> 00:21:11.640
Jason Mefford: But I think, I think this is important. And again, it’s, it’s a time for us to really kind of look in the mirror.

163
00:21:12.930 –> 00:21:20.910
Jason Mefford: Right. Because like you said, we just, just because of the personalities that technically the usually gravitate towards this profession.

164
00:21:21.630 –> 00:21:29.550
Jason Mefford: We tend to want to over plan and we over plan and we over plan so that there’s never any problems right

165
00:21:30.060 –> 00:21:37.530
Jason Mefford: And that’s exactly i mean that’s why when we talked at the beginning, you know, and some people say well Agile is a mindset, right, it has to be built another culture.

166
00:21:38.010 –> 00:21:50.820
Jason Mefford: Part of that is, we’ve got to kind of change and realize it’s okay to make mistakes. The reason we’re saving time is because we’re not spending so much over planning at the beginning. Right.

167
00:21:51.420 –> 00:22:02.190
Jason Mefford: And then like you said actually staying true to what it is that we’re actually doing these, you know, these daily stand up meetings. It’s not new for most of your organization’s

168
00:22:02.550 –> 00:22:15.270
Jason Mefford: I mean most of my experience was in manufacturing. Guess what happened every day at a certain time right all the supervisors and managers in the plan to come together for about 15 minutes

169
00:22:16.050 –> 00:22:28.740
Jason Mefford: To talk about what’s on the schedule and what are the roadblocks, or what did we learn from yesterday that are roadblocks for us today and how can we get past that so that the lines don’t go down. Yeah.

170
00:22:28.860 –> 00:22:32.130
Toby DeRoche: I worked. I worked in retail or felt like forever.

171
00:22:33.840 –> 00:22:40.560
Toby DeRoche: But I worked all through college. I worked in stores I after college. He went into management in stores. So I was in retail

172
00:22:41.010 –> 00:22:55.380
Toby DeRoche: In an actual like selling stuff for about 10 years and then spent four years in corporate working in retail and I guarantee you, every store out there you know it doesn’t matter who they are, what brand. They are every single store out there, they start their day this one.

173
00:22:57.000 –> 00:22:57.870
Toby DeRoche: This is not new.

174
00:22:58.380 –> 00:22:58.620
Yeah.

175
00:23:00.000 –> 00:23:09.240
Jason Mefford: Okay, so that’s, you know, that’s, that’s one of the things that that usually is missing, you know, what are, what are some other ones. I’m guessing to, you know, that

176
00:23:11.670 –> 00:23:15.480
Jason Mefford: Some of the other things that are that are missing when people are are trying to do this.

177
00:23:17.280 –> 00:23:22.320
Toby DeRoche: Yeah, one of the big ones. I think that’s left as we don’t really treat it as a true project.

178
00:23:23.670 –> 00:23:34.830
Toby DeRoche: You know, we’re transforming our department. And this is something that’s going to involve a lot of people, a lot of time. It’s not something you can just say I’m doing and you know expected to happen overnight.

179
00:23:35.850 –> 00:23:48.420
Toby DeRoche: It may take a good three months to pull this off from start to finish, because there’s a lot of training involved. There’s going to be some piloting and then coming back and talking about it and then you know tweaking the process.

180
00:23:49.650 –> 00:24:05.610
Toby DeRoche: So, you know, in the plan that I’ve put together around all this, it really is just taking it piece by piece. So, you know, when we, when we tackle the planning process of how we’re going to start going into a quarterly planning cadence and starting a quarterly risk assessment.

181
00:24:06.900 –> 00:24:10.530
Toby DeRoche: So we take that piece as a pilot and I’m going to run it through. And I’m going to try it.

182
00:24:11.580 –> 00:24:18.930
Toby DeRoche: And I know it’s not going to be perfect. The first go around. So we treat it like a true project and we say, let’s do it. Then let’s come back and talk about it.

183
00:24:20.100 –> 00:24:26.940
Toby DeRoche: And then we work through it and then we move on to the next page. Let’s take field work. Let’s build it all out. Now I have to train the otters.

184
00:24:27.420 –> 00:24:31.950
Toby DeRoche: Because they really weren’t involved in a lot of the beginning part right they probably don’t see a lot of the risk of us.

185
00:24:32.700 –> 00:24:43.080
Toby DeRoche: And now I need to train them on what what the impact is going to be to them. I’m training will call them Scrum leaders, right, the audit leads the people that are going to be leading those daily meetings and having a lot of that that

186
00:24:44.160 –> 00:24:51.420
Toby DeRoche: Bigger leadership aspect to this and teach them what they’re doing. I can’t just say, Hey, this is your job. I have to show up and teach them.

187
00:24:52.530 –> 00:25:01.740
Toby DeRoche: Same thing with reporting my reporting is going to James I gotta start prepping the audit committee for a different format and getting them ready for this, especially if you weren’t doing quarterly meetings with them.

188
00:25:04.020 –> 00:25:12.990
Toby DeRoche: The next phase one because this can continue to progress. One of our goals with this isn’t to have quarterly meetings with the audit committee on demand reporting.

189
00:25:14.250 –> 00:25:22.680
Toby DeRoche: So that at any point ever if the audit committee anyone came to you and said, hey, where we stand on blah, blah, blah. You could say, give me five minutes, I’ll tell you.

190
00:25:23.520 –> 00:25:36.390
Toby DeRoche: And you can tell them, because all of your work is happening on a regular cadence. It’s never more than two weeks old, you know, everything is always there. And so, as your as you’re producing this for them. You can do it in real time.

191
00:25:37.440 –> 00:25:44.520
Toby DeRoche: And part of this, I gotta tell you, this is probably one of the biggest things that I’m having a hard time getting audit departments to really go ass.

192
00:25:45.930 –> 00:25:58.170
Toby DeRoche: Is that, that’s our actual product. It’s audit committee insights. That’s what we do because probably 90% of the auditors when I ask them, hey, what do you guys make all of them, the otter reports.

193
00:25:59.940 –> 00:26:02.640
Jason Mefford: Yeah, but it’s not it’s not the report is the insight to the audit.

194
00:26:02.640 –> 00:26:04.950
Jason Mefford: Committee and to management in general.

195
00:26:05.610 –> 00:26:15.810
Toby DeRoche: The whole point of doing those audit reports that wishes to close out that one job right, that that documented to say here’s what we found. But here, here’s the overall results, it’s not even just here’s the issues we found

196
00:26:16.890 –> 00:26:20.190
Toby DeRoche: That’s why the standards are always telling us acknowledge what was done well.

197
00:26:21.390 –> 00:26:29.010
Toby DeRoche: And communicate what needs to be needs to be corrected because all of those insights are good that helps us focus on both sides of the coin.

198
00:26:30.120 –> 00:26:34.590
Toby DeRoche: And then the audit committee report is the accumulation of all those things that happened in the last quarter.

199
00:26:35.970 –> 00:26:40.560
Toby DeRoche: But if we start to push away from this whole formal audit report concept.

200
00:26:41.670 –> 00:26:50.220
Toby DeRoche: Then, well, here’s what I found this week, stick it in whatever system I track this thing and move on. It doesn’t really matter. I don’t even need that formal report.

201
00:26:50.850 –> 00:27:01.260
Toby DeRoche: And now I’ve moved everything into a centralized location. And now I can start to give you pastor reporting. So all of these pieces just fit together. But it’s a matter of us taking the whole project on

202
00:27:03.120 –> 00:27:13.890
Jason Mefford: Well, because that’s the thing we do have to go into and grad. It’s got to be in the planning, it’s going to be in the field work. It’s got to be on the reporting and the follow up afterwards as well. And like we said at the beginning, that’s one of the mistakes.

203
00:27:14.190 –> 00:27:24.240
Jason Mefford: Mistakes like people are making is there just focusing on one one particular area. But I wanted to dig in a little bit deeper into something that you that you said just a few minutes ago because I think

204
00:27:24.810 –> 00:27:44.220
Jason Mefford: I think, again, this is one of those areas probably why so many people are probably struggling is somebody on the audit team reads a book or goes to a webinar. And they’re like, All right, now we’re going to do agile and everybody get in tow. And let’s just start doing

205
00:27:44.370 –> 00:27:55.710
Jason Mefford: Right. And they start throwing out these terms and everybody’s looking around, like, Okay, what are we doing right it’s it’s one of those where we tell them what we’re going to do, but we never show them how

206
00:27:56.160 –> 00:28:02.820
Jason Mefford: Badly that they’re actually going to do it right. And I think, again, that’s why you know one person in your team.

207
00:28:03.480 –> 00:28:19.590
Jason Mefford: Reading a book isn’t going to get it done right. Actually, you know, you’ve got to have pretty much everybody in your team actually trained up on what to do in just reading the book is not the training. Right.

208
00:28:19.950 –> 00:28:23.310
Toby DeRoche: It’s not, it’s not at all. You know, think about what we do.

209
00:28:24.420 –> 00:28:27.480
Toby DeRoche: Everybody in your department. They all have a different role.

210
00:28:28.500 –> 00:28:42.030
Toby DeRoche: And there’s going to be very specific training for, you know, chief executives and directors, because they’re going to have more influence from, you know, sort of the book ends. They’re going to be the ones focusing primarily on risk assessments build and then report that stuff out.

211
00:28:43.260 –> 00:28:50.820
Toby DeRoche: The team itself. The bulk of the audit department, they’re going to be more focused on the field work aspect, but now they need to know how did they get there.

212
00:28:51.510 –> 00:28:57.270
Toby DeRoche: From the audit plan and now they need to know where that’s going from an audit report because they need to feed into those other areas.

213
00:28:58.020 –> 00:29:06.210
Toby DeRoche: The part of us to think about it like we’re doing continuous Chris when i doing field work and stuff flows right back into the risk assessment for the next quarter.

214
00:29:07.320 –> 00:29:13.260
Toby DeRoche: So there’s this continual cycle that flows into these things. And so there’s going to be different types of training for everyone.

215
00:29:14.250 –> 00:29:24.480
Toby DeRoche: And as we were starting to put this stuff together we can break them down into those different pieces but there’s absolutely going to be training you do for every single person on the team, and it’s not as simple as, let me just go read a book.

216
00:29:25.440 –> 00:29:34.710
Jason Mefford: No. Well in it. And it’s, you know, again, I mean, how long have you been working in this area in reading the books and trying to apply everything

217
00:29:34.830 –> 00:29:36.390
Toby DeRoche: It’s been like three years, it’s not

218
00:29:36.630 –> 00:29:45.360
Jason Mefford: It’s only been like three years. Right. Okay. So, so again, folks, you know, here because I know a lot of you that are listening are probably gone. Yeah. Yeah. Yeah, but how do I do it.

219
00:29:46.110 –> 00:29:58.440
Jason Mefford: Well, guess what Toby’s figured out exactly what to do and the how of doing it right. I mean, he spent three years going through all this stuff.

220
00:29:58.950 –> 00:30:04.020
Jason Mefford: And figuring out how to actually apply it to internal audit in a practical way.

221
00:30:04.560 –> 00:30:22.770
Jason Mefford: Right. So again, I guess you got a choice, right. You can spend three or four years trying to figure it out. Going to different webinars or conferences and reading different books and trying to figure it out yourself or you can just let Toby tell you exactly how to do it.

222
00:30:23.280 –> 00:30:25.170
Toby DeRoche: You guys really want to read this stuff. I can give you

223
00:30:25.680 –> 00:30:25.920
Jason Mefford: Or

224
00:30:26.490 –> 00:30:28.710
Toby DeRoche: I can skip to the end and I can just show you

225
00:30:29.250 –> 00:30:31.680
Jason Mefford: Yeah, you know, and I think that’s where

226
00:30:32.070 –> 00:30:46.500
Jason Mefford: You know, again, I’ve got to assume a lot of people are at that point now where it’s like we’ve been talking about this for how long, but how do I actually do it right, which is why I’m so excited. You know, for us to be be talking again to

227
00:30:47.970 –> 00:30:49.080
Jason Mefford: That you’ve actually done that.

228
00:30:49.500 –> 00:31:03.390
Jason Mefford: And you put everything exactly together for people so they can get the training, but they don’t just get the training, they actually get all the little templates and the other stuff of exactly

229
00:31:03.780 –> 00:31:16.260
Jason Mefford: How to do it. It’s not just, again, you know, like we said at the beginning, a lot of people are kind of throwing theory out there, but you’re giving people practical stuff they can actually apply and start doing today.

230
00:31:16.530 –> 00:31:30.780
Toby DeRoche: Yeah, and I tried to keep it just as straightforward as possible. You know, so even when we start putting together in this training that we that we built out the actual agile terminology it’s immediately followed by here. So we actually

231
00:31:33.420 –> 00:31:37.590
Jason Mefford: Right, so, so it’s like, I mean, it’s almost like learning another language. Right.

232
00:31:37.590 –> 00:31:38.310
Jason Mefford: Was like

233
00:31:38.340 –> 00:31:56.820
Jason Mefford: Yeah, okay. Well, what is this word. What am I used to seeing this word as right. So part of it is learning some of the the nomenclature. But, but, making it easy, right, like this is what agile calls it, this is a term you’re used to probably hearing. So when you hear this thing fat right

234
00:31:56.850 –> 00:32:00.420
Toby DeRoche: And then, and then all throughout the training as we start to like refer to people.

235
00:32:01.260 –> 00:32:14.970
Toby DeRoche: Oh, you’re going to hear Scrum Master a lot right clad agile. People love Scrum Master as a term. It’s just something that it’s a very big role. It’s a very important job duty. So what I’ve done is every time we use it as a scrum master, who is the audit lead

236
00:32:15.450 –> 00:32:16.200
Toby DeRoche: You know, like

237
00:32:16.500 –> 00:32:22.350
Toby DeRoche: Trying to keep it back. I don’t want to hide from this language, but I also don’t want to become the focus

238
00:32:22.770 –> 00:32:37.050
Toby DeRoche: I don’t want you to get so hung up on using this terminology that that’s all you’re thinking about want you to know it that way. If you do have other people in your organization who are who are agile now and they start using these words. I want you to know what they’re talking about.

239
00:32:38.220 –> 00:32:45.420
Toby DeRoche: But I don’t want that to be the focus of the training because watch a webinar for that stuff. This is really meant to be guided

240
00:32:45.930 –> 00:32:53.160
Toby DeRoche: All the way through from start to finish. How do you go about capacity planning to do this to figure out what I have to give to my plan.

241
00:32:53.670 –> 00:33:00.030
Toby DeRoche: How do I go about the risk assessment, what should I include in my risk assessment. How does your workbook.

242
00:33:00.660 –> 00:33:07.290
Toby DeRoche: And I’ve built in templates. I’ve even shown examples of using different types of software, things that are free, that are out there.

243
00:33:07.890 –> 00:33:16.830
Toby DeRoche: There’s templates that are baked into it. Again, there’s a workbook that’s included that even takes you as far as guiding you through the letter to write to your audit committee.

244
00:33:19.110 –> 00:33:22.800
Toby DeRoche: That you can explain this to them because you probably going to need to let them know

245
00:33:23.010 –> 00:33:31.500
Toby DeRoche: This is a pretty big change that. Here’s what we’re planning on do that even when you follow this out and it builds that out like a maturity model to show you, here’s where I am.

246
00:33:32.310 –> 00:33:41.400
Toby DeRoche: And then helps you form that into a letter that says here’s what I’m doing now. And here’s what I do. I tried to just guide you through it. Every step of the way.

247
00:33:42.210 –> 00:34:00.210
Jason Mefford: Well, because that’s, that’s why I think this is this to me and I’ve been feeling this way for probably a year or so is this is probably the biggest seismic shift to internal audit you know we’ve been talking about risk based agile actually is a way to

248
00:34:01.710 –> 00:34:08.370
Jason Mefford: Hopefully, get people past them saying, or thinking they’re doing risk based but they’re still just doing the old bullshit right

249
00:34:08.610 –> 00:34:13.170
Jason Mefford: Yeah, and actually get them to doing it kind of the right way.

250
00:34:13.530 –> 00:34:20.880
Jason Mefford: And I love what you said is, you know, if you remember when we talked, we were talking about some of the mistakes, right. A lot of people just try to apply this on fieldwork know

251
00:34:21.270 –> 00:34:27.150
Jason Mefford: You’ve actually shown people. Exactly. So how does your planning changed how does your risk assessment change.

252
00:34:27.450 –> 00:34:36.780
Jason Mefford: Right. How do you go from a one year plan to with, you know, a one year forecast with a three year rolling kind of a three month rolling out three year rolling. Hello.

253
00:34:37.680 –> 00:34:46.410
Jason Mefford: Three months rolling how you actually implement it in fieldwork, but then also how you change the reporting at the end of it, right. So again, if people just

254
00:34:46.740 –> 00:34:55.590
Jason Mefford: Follow the process, walk, you know, step by step through the process that you’ve laid out there going to be successful in doing this right and

255
00:34:55.590 –> 00:35:03.750
Toby DeRoche: Moving I truly believe that they will be and the program is built so that no matter how big or small, you are this works.

256
00:35:04.470 –> 00:35:11.910
Toby DeRoche: So if you’re a smaller group. And you’re thinking, well, I don’t need this because I only have, you know, three or five people. Yeah, absolutely. Do you probably need it more

257
00:35:12.960 –> 00:35:20.580
Toby DeRoche: Because you’re going to be in a better position to have an actual impact on that organization, the really big departments.

258
00:35:21.120 –> 00:35:28.830
Toby DeRoche: Same kind of thing goes, they’re going to have the ability to go from what they’re doing that traditional model to agile, but there’s a whole lot more people involved.

259
00:35:29.610 –> 00:35:37.800
Toby DeRoche: So they may need to break this thing up a bit more and do it in pieces, but they’re just going to do the same process and laying it out. They just many to do a few more phases.

260
00:35:39.510 –> 00:35:52.530
Toby DeRoche: But this is something that’s going to apply to every single audit department doesn’t matter what industry you’re in, really does have any impact of, you know, where in the world you are what we want to work in this is something that’s going to hit every single one of us.

261
00:35:53.670 –> 00:35:56.340
Jason Mefford: Well in 2020 is only sped up the process to

262
00:35:56.640 –> 00:35:59.940
Jason Mefford: It i mean it’s it’s made it’s made it

263
00:36:00.420 –> 00:36:08.550
Jason Mefford: More necessary right now that we actually, you know, kind of jump into this and that’s why I’m I mean I’m so glad

264
00:36:09.690 –> 00:36:17.220
Jason Mefford: That you took these three years. And again, people, three years it took him three years to come up with all this stuff. Right. So don’t think you can go shortcut it

265
00:36:17.640 –> 00:36:24.750
Jason Mefford: In like a month by reading a book just use what he’s actually already put together from over three years.

266
00:36:25.110 –> 00:36:32.790
Jason Mefford: Of studying of talking, you know, with people figuring out what works, what doesn’t work because here’s the beauty of this right

267
00:36:33.270 –> 00:36:48.660
Jason Mefford: You don’t you’re afraid to make mistakes. You don’t have to make some of the same stupid mistakes. Other people are making because he’s heard you learn what most of the people have been doing wrong. So you just follow the process. You don’t have to make some of those same mistakes.

268
00:36:48.870 –> 00:36:56.820
Toby DeRoche: And, you know, this is, this is where we take our own medicine. We would never allow somebody else to say, well, I’m going to keep doing this way because it’s the way I’ve always done it.

269
00:36:58.080 –> 00:37:01.710
Toby DeRoche: We’re in that position right now. You know, the way we’ve always done it doesn’t work.

270
00:37:02.250 –> 00:37:13.080
Toby DeRoche: It’s it’s a broken model that just doesn’t work anymore and we already had a lot of the pieces ready for us. You know, there was enough research that had been done there was enough that have been written on it. It was tons of theory.

271
00:37:13.980 –> 00:37:19.560
Toby DeRoche: But now, now we need to move right this is our call to action. We have to do this now. Yeah.

272
00:37:20.670 –> 00:37:30.150
Jason Mefford: Well, for those of you that have been sitting here is you’ve been listening to this and you’re like, Come on, tell me where can I get it. How can I do, what do I do what, where do I go. Where do I go, Well, Toby.

273
00:37:31.140 –> 00:37:39.360
Jason Mefford: Has put together a course certified right so it’s got certified in front of a to. We’ll talk about that in just a minute but certified agile auditor professional

274
00:37:40.320 –> 00:37:52.890
Jason Mefford: As well, a full course that walks you through step by step exactly what you need to do, along with the templates and other things like that. So you hit the ground running right now.

275
00:37:53.370 –> 00:38:04.920
Jason Mefford: And like we talked about this isn’t, this isn’t just something for like one person in your department to get this is something that really, if you’re going to be serious about doing agile and not just dip your toe in it. But if you’re going

276
00:38:04.920 –> 00:38:05.970
Jason Mefford: To be serious.

277
00:38:06.450 –> 00:38:14.040
Jason Mefford: This is something that you should consider probably your whole team actually going through and learning. If you really want to be successful in

278
00:38:15.300 –> 00:38:20.400
Toby DeRoche: Absolutely. You know, because if you’ve got a group sitting there and you need them all on a common vocabulary.

279
00:38:21.570 –> 00:38:22.980
Toby DeRoche: They all need to go through this training.

280
00:38:24.030 –> 00:38:31.350
Toby DeRoche: This the training is really designed to cover the full audit lifecycle end to end. And now everyone needs to know all pieces.

281
00:38:32.100 –> 00:38:39.540
Toby DeRoche: Because we’re all going to have some sort of a play inside of it, your audit staff is going to need to know how they got to that point. How did the audit get to me.

282
00:38:40.530 –> 00:38:42.330
Toby DeRoche: She needs to know the risk assessment process.

283
00:38:42.390 –> 00:38:49.740
Toby DeRoche: And they’re going to be feeding things under the reporting that you’re going to be using from a management point of view, to send to the audit committee. So there’s really no

284
00:38:50.730 –> 00:38:56.340
Toby DeRoche: There’s no piece that we can say, well, the audit team needs to know this, but they don’t need to know the rest of it. Everyone needs to know the false prophets

285
00:38:57.510 –> 00:39:09.540
Jason Mefford: Well into kind of the, the other side from it is you know we’ve talked before and there’s there’s research out there, one of the three big areas that people are looking to change and to do something different on one of them is agile right

286
00:39:10.140 –> 00:39:16.260
Jason Mefford: And so, you know, the other thing that this course does for you is you get a certification.

287
00:39:17.160 –> 00:39:27.810
Jason Mefford: In this as well. So what does that mean, right, like, Well, why do I need a certification this well. There are lots of Chief audit executives looking for people

288
00:39:28.440 –> 00:39:37.800
Jason Mefford: Who know how to do this. Right. So yeah, you can go get your Scrum Master, you can go do some other stuff, but it still doesn’t help you

289
00:39:38.370 –> 00:39:48.870
Jason Mefford: Translate that into doing on it. Right. That’s what Toby has been doing for three years. But this actually certifies and proves to other people.

290
00:39:49.230 –> 00:40:07.350
Jason Mefford: That you know what you’re talking about. When it comes to Agile auditing which from a personal career standpoint is a huge plus because what you’re going to see, again, is she founded executives are looking for people with a skill set, but those people do not exist.

291
00:40:07.470 –> 00:40:09.000
Jason Mefford: In the marketplace right now.

292
00:40:09.300 –> 00:40:16.350
Jason Mefford: So going through getting a certification like this actually proves to a future employer.

293
00:40:16.800 –> 00:40:24.270
Jason Mefford: That you actually know what you’re talking about. Because it’s a real certification. You got to take a test, you got to prove that you actually understand it.

294
00:40:24.810 –> 00:40:38.790
Jason Mefford: But you also have all the tools that go along with it. So you can actually perform and implemented as well. It’s not just a theoretical you know piece of paper, you can actually do it. Yeah.

295
00:40:38.880 –> 00:40:47.790
Toby DeRoche: Think about it like this, if you’re out there and you’re putting yourself out in the market and there’s an apartment, who has already made the transition to Agile

296
00:40:49.020 –> 00:40:56.670
Toby DeRoche: And they’re looking at a big stack of paper, all these resumes and when they’re looking through that they’re thinking this is all fantastic and I’m going to bring this person in

297
00:40:57.030 –> 00:41:06.690
Toby DeRoche: Not only do I have to train them and what my department does my company culture. I also got to break them have all these old habits now of being a traditional process based on Twitter.

298
00:41:07.170 –> 00:41:13.740
Toby DeRoche: Don’t but if you walk in with a certification. You just save them a whole lot of time because now you already know how to do this.

299
00:41:14.130 –> 00:41:17.280
Toby DeRoche: So you’re not you’re walking in with a huge advantage over everybody

300
00:41:17.310 –> 00:41:27.180
Toby DeRoche: Who’s really still stuck in that traditional way of work because you’re walking in knowing the concept, knowing how to do it all the ins and outs from end to end. And it’s a huge advantage.

301
00:41:28.050 –> 00:41:36.540
Jason Mefford: It makes it much easier. Having hired lots of people over the years, that’s one of those things that sticks out and especially. So again, like you said, whether

302
00:41:36.900 –> 00:41:42.960
Jason Mefford: Whether the department has already taken that and they’re already doing it. So now they want to hire people that already know it.

303
00:41:43.800 –> 00:41:53.100
Jason Mefford: Or if they’re in the process of trying to change or move that way, usually on new hires, they’re going to be looking for people

304
00:41:53.700 –> 00:42:06.240
Jason Mefford: That have this skill set and we see it in data analytics already, I think, I think I’ll get the numbers right I think about 1010 or what was it 10% of the people in audit have audit.

305
00:42:06.960 –> 00:42:20.010
Jason Mefford: And data analytics background 30% of the jobs are asking for people with internal audit and data right same thing is going to happen with Agile auditing.

306
00:42:20.550 –> 00:42:36.660
Jason Mefford: The, the number of job postings and other things, requesting or having, you know, requiring, if you will, that is going to go up as well, which again for your career is a great place to be in. If you already have it.

307
00:42:37.200 –> 00:42:43.680
Toby DeRoche: This is, this is one of the things I expect to start seeing popping up on job descriptions, though, you know, right now we start to see

308
00:42:44.220 –> 00:42:50.790
Toby DeRoche: They’re looking for people who have this many years and I’m looking for somebody who has CIA or assist or whatever other certification.

309
00:42:51.300 –> 00:42:58.620
Toby DeRoche: I fully expect to start seeing I’m looking for people certified an agile, because this is something that is massive. I mean,

310
00:42:59.490 –> 00:43:03.660
Toby DeRoche: This is we cannot stress enough. One of the biggest shifts we’ve ever seen happen in order

311
00:43:04.230 –> 00:43:14.970
Toby DeRoche: I mean this is as big as going from what we used to be checklist, your risk based now we’re we’re moving from traditional to an agile process it’s it’s a massive undertaking and this is a chance for us to get ahead of it.

312
00:43:16.110 –> 00:43:28.470
Jason Mefford: Well, it is and Toby, you know, again, I know we got to kind of wrap up for today but but thank you for actually putting this out there and, you know, glad to be here trying to help spread the message as well because

313
00:43:29.670 –> 00:43:30.240
Jason Mefford: Like I said,

314
00:43:31.290 –> 00:43:43.500
Jason Mefford: Clearly, I think, I think personally that this is one of the biggest seismic shifts when done right, but you have to understand how to do it right. This isn’t something you can half ass.

315
00:43:43.950 –> 00:43:51.030
Jason Mefford: And go read a book and think that you’re actually going to doing doing it, you’re going to make some of those same mistakes. Other people have

316
00:43:51.360 –> 00:44:04.170
Jason Mefford: After three to six months, you’re going to throw your hand up and say, I can’t do this, but you can do it if you actually follow the process and just, just take the course get certified

317
00:44:04.320 –> 00:44:06.930
Jason Mefford: Do exactly what’s Toby showing you to do.

318
00:44:07.290 –> 00:44:09.630
Jason Mefford: You’re gonna be successful in it.

319
00:44:11.010 –> 00:44:20.940
Jason Mefford: Yeah. So tell me, thank you for taking the time today and you know again. So we talked a little bit about the program will make sure down in the show notes is a link to it.

320
00:44:21.660 –> 00:44:31.860
Jason Mefford: But, you know, whatever you do choices. Up to you. But whatever you do, this is the future. And so you really need to get in jump in with both feet.

321
00:44:32.220 –> 00:44:44.700
Jason Mefford: And and actually learn how to do it. Get out of the theory and actually learn the step by step on exactly how to do this. And thank you, Toby for putting that together so people can actually do that.

322
00:44:44.880 –> 00:44:52.140
Toby DeRoche: Now, it was an absolute privilege to get to do it. So I’m just hoping that we can influence. Lots of people get them out ahead of us.

323
00:44:52.770 –> 00:44:54.810
Jason Mefford: Well, and help them do their job easier to

324
00:44:54.900 –> 00:44:56.520
Toby DeRoche: Hang out and do their jobs better. Yeah.

325
00:44:56.760 –> 00:45:00.540
Jason Mefford: Exactly. All right. Well, thanks. Toby will have to have you on. Again, I’m sure.

326
00:45:01.680 –> 00:45:02.970
Jason Mefford: Thank you. Thank you.