Ep 4: Insights from a Disruptive Leader

Welcome to Inspiring Women in Audit, the only podcast celebrating the achievements and journeys of women in the internal audit industry. In each episode, we spotlight the extraordinary stories, insights and expertise of these dynamic professionals. Our aim is to amplify their voices, inspiring a new generation of women auditors to share their knowledge, experiences and unique perspectives. Remember to check our show notes for links to our social media channels and to subscribe to the Inspiring Women in Audit newsletter. This podcast is brought to you by i4 Global Results Limited the audit communication experts dedicated to transforming your audit reporting and your audit results through communication, optimization and collaboration. Now let's dive in to this episode of Inspiring Women in Audit.

Welcome everyone to Inspiring Women in Audit, the podcast that is dedicated to empowering and uplifting women within the internal audit industry. By amplifying their voices, we aim to encourage women in the audit profession to share their knowledge, their experiences and their unique perspectives. I'm your host, Tracy Marquardt, and I'm excited today because I have Lynn Druang in the house with me now. Lynn is currently CAE of Internal audit at Enterprise Risk for North Texas Tollway Authority. She's an advisory board member at the University of North Texas and just announced this week, a finance chair and board member for the Noggin Educational Foundation. And also I picked up from your LinkedIn profile that you're an advisory board member for the Women's Venture Fund in New York, which I wanted to throw that in because I like everything that supports women, everything that we can do. So really, you seem very, very busy. But there are a couple more things that stood out for me as I looked at the bio in your book and as I was sorting through your LinkedIn profile. Right. So you've launched an internal audit function with three of your employers. This I find quite impressive. As the chief audit executive, you're a published author. So we're going to talk about your book as part of this interview. You're a professional speaker, you've spoken at many audit industry conferences, and you're an experienced trainer. You are the full package. So I want to for joining me and welcome you to the Inspiring Women in Honor Podcast.

Well, thank you so much, Tracy, for the fantastic introduction. You didn't miss a thing. It was perfect. And I'm just really excited about our chat today. You know, during our intro conversation, we found out that we had so much in common and we're kind of inspired by the same types of life, missions, etc. So I'm looking forward to the session and I think your audience will Get a lot out of it, I think.

Awesome. I think they will too. I think they will too. So I want to start, if it's okay with you, talking about your journey to internal audit, because I noticed on LinkedIn your first work experience that you have there is KPMG. I started at work Deloitte. So we're kind of with the big firms back in the day. I'm wondering what drew you to audits and what's kept you here after all these years.

Right. So it was really family. So my father was an auditor back in Vietnam before we left Vietnam. And growing up, I had two older sisters as role models. They both majored in accounting. And One of those two sisters became a CPA and worked for one of the big eight. At the time, PwC was with was the firm she worked for. And then she went into intro audit and traveled the world. So I kind of had, you know, those footsteps to follow. And the one story that stuck in my mind as far as knowing at the tender Age of 10, 11 years old I wanted to be an auditor, was listening to my father talk about his audit story of being in the middle of the Vietnamese jungle, you know, working for the US Government, the Department of Defense, making sure that money was being well spent over there, that there wasn't any waste, you know, inefficiencies and set fraud. And he did a payroll audit where he was watching in front of the. Where people came in to. To caulk in their time to start their work. And the US Government was using a lot of the locals to do a lot of the hard labor for them, clearing the jungles, et cetera. And he found that people were caulking in for their friends, even though the friends didn't show up. He looked at payroll records and saw people who are trying to book 23 hours of work in a day, which is humanly impossible. So he wrote them up and they lost their jobs. And my father was a target of an assassination attempt by the locals who got in trouble for cheating the US Government. And he was woken up in the middle of night by his supervisor, said, hey, here's a gun. You know, there's a plot to kill you. We need to get you out of the jungle. You know, the helicopter is coming, but in the meantime, you need to protect yourself. So when I heard this exciting story, it was almost like James Bond type of story. And I was thinking, my. My dad sacrificed life to do the right thing, and that's what I want to do when I grow up. And that's exactly what I did.

Wow. I mean, what a story. Number one for your dad to have that kind of courage. Because we always, we talk more and more these days about auditors having courage and, and that takes tremendous courage, what he went through back then. So that would be really an inspirational story and one for the books. And I'm glad he got through that.

Yeah. And so to the second part of your question. What has made me stay is, you know, intel audit the profession. Since I've been in it for so long, you know, more than 35 years now, I've seen it evolve over time from basic compliance auditing, process based auditing, you know, crossing T's dotting I's into more strategic and being business partners and you know, some of us have a seat on the C suite. Right. On the executive team. And we are now adding a lot of value, however you define that. Right. We are finding ways, I mean the new global standards, I think the major driving force for the IA change that was finding a way to, to keep the intra audit profession relevant and being considered valuable. And so I wanted to be along this journey and make an impact on how I can spread the word for other auditors within my profession, within this profession, our profession, to make an impact and be more valuable.

I certainly see your point. It has changed so much. I remember from the time that I was an internal auditor, we, we barely were welcomed into a department, barely were heard by the C suite and now it's a totally different environment that we live in and we are welcomed for the most part because we do add value and that's what we need to continue to show on a daily basis and be relevant and add that insight. And as Norman Marks keeps telling me, foresight for the business. Right.

So one of my intro heroes as well. So we have the same.

Absolutely, absolutely. I think, yeah, he's just a really, really interesting mind and I love reading his articles and things. So for anybody listening, if you have not followed Norman, I would definitely follow Norman as well and check out his blog. He's got some great video blogs too that are fantastic.

It's what I would call a disruptor and we need some disruptions.

He is. There are a few disruptors out there and I hope I'm one in some way as well.

Absolutely.

And I'm, I think you are too because, because I, I remember when we, we had our initial call just to talk about, you know, the possibilities of being in the podcast and I walked away saying, man, she's a firecracker. And I've got to have her on the podcast. So I'm super excited for you to be here. And I think we could go like two hours, but we can't because it's too long to upload anywhere. So let me. Let me jump to another person in the audit industry who is the reason that we met, and that's John Tabor. He has a podcast called Audit 15 Fun. Again, if you haven't connected with John on LinkedIn or you haven't listened to his podcast, you've got to do that. I've had the pleasure of being on it twice, and you were just on it and you were talking about your book and. And on that podcast, you were talking about auditing culture and why it's so critical. And the book is called Seven Deadly Sins of Organizational Lessons from Some of the Most Infamous Corporate Failures. So definitely check that out. We'll put a link in the show notes for that. But I've got a couple of questions around this. My first question, you know, kind of is, and you give our listeners just an idea of the book, because for me, I have to say, it was an easy, quick read and I wanted to keep reading. And I personally love the case studies. Good, good and bad. So can you just give us an idea of the shape of the book, if that makes sense.

The structure? Yeah. So the premise of the entire book is, what lessons can we learn from all these scandal of the Enrons and the Wells Fargos and the Torontos and on and on and on. Right. So even after SOPs, we still keep having these frauds. And I believe that beyond just SOPs controls and, you know, reconciliation, accounting controls, et cetera, really all that can be overridden. If you have the wrong culture, if you have a dysfunctional culture, then top leaders, even the CFO can walk up to an accountant and say, I need you to make this entry. And you don't need to have support documentation because I'm the cfo, so you need to make this. And so I think the root cause is the culture. And, you know, the traditional SOPS controls are all good, but it's kind of like going, I opened the book with going to the doctor and the doctor only looking at your blood pressure or only looking at your sugar levels or only looking at your bmi. Right. And then trying to give you a holistic diagnosis of how healthy you are or how unhealthy you are and what you need to do to get healthy again. So when you're just looking at financial controls, which is one type of risk in the overall risk environment, I don't think that you can conclude on the overall health of an organization's culture and therefore the organization's potential for people committing fraud. So if we start to incorporate assessing or auditing culture in our audits, day to day audits, we find kind of the fundamentals, the basics of what drives organizational behavior, what is being rewarded versus what is being punished, how do we hold people accountable, et cetera. And those are unlike testing JEs or testing logical access or change management transactions. Those are not as intuitive to assess or audit. And so in the book, I kind of provide a pathway for how we can do that by looking at the drivers behind culture. Reputation is a huge risk for all companies. And how do you audit reputation? Well, you start by what are the drivers of reputation? What are the types of things that could happen that could negatively impact our reputation? And then you tackle it down there in the layers underneath. And so same premise here is what are the drivers of culture? And then we can start to look at those processes and they become more auditable when you peel back the onion layers. So that's the premise of the book. And I write it in a way where I use case studies and these interesting headliner stories that are not as well known, right. Kind of digging deep into interviews with former employees and kind of point out some of those interesting stories that haven't been told. I think that keeps the book kind of more interesting and entertaining before you get to the technical part.

Yeah, I mean it's, it's definitely interesting and entertaining. And I just, I loved reading like at the beginning of every chapter there's a, a case study gotten wrong, right? Something gone wrong. And then, and then in the chapters you intersperse with, you know, things or companies where things have gone right, like Patagonia or Southwest or, you know, those types of. And that's what I really enjoyed was the compare and contrast piece of it. And it was, it was an easy read. And I hope everybody buys the book because it's fantastic. I think, you know, when I think about my, my audit teams, and I know some of them are starting to think about auditing culture, number one, I think they should grab the book for the team. But you know, I was wondering from your perspective, an audit team wanting to audit culture for the first time, like, what are the top three things that they should think about to execute such an audit effectively or successfully?

Yeah, I think the one driver, or there are several, but one driver that comes to mind in terms of what's very intuitive to audit, it's more black and white. Is something like the policies, right? What is the organization's policy framework? What type of things are important, important enough to the leaders to actually put in the effort to write it. You develop a policy, formalize it, ratify it, approve it, communicate it to your employees. That will tell you a lot about the organization's kind of risk appetite. You know, do they have a procurement policy that talks about not whether you can bribe, you know, whether vendors can bribe you or whether vendors can take you out? Obviously they wouldn't say bribe, but whether the organization tolerates vendors taking you out on a three day hunting trip and spend $20,000 on you during the bidding process. If you don't have a policy like that. That says a lot about what leaders think, whether they feel the need to draw a bright red line, don't cross these lines, or are the leaders saying, you know what, we don't need to draw lines. You, you can go out as far in the pasture as you want. You know, we'll let you guess, based upon your individual background and experience, how far you want to go. So. So looking at the company's policy framework will tell you a lot. And that's very intuitive to audit. You know, do you have policies over certain types of areas that should have policies or not? You know, do you have a code of conduct, you know, do you have a T and E policy that tells you what you can run through what you can't, etc. So I would start with that. That's very intuitive.

As I listened to you when we're talking about corporate culture and auditing. Corporate culture, the word that just keeps coming to the front of my head is governance.

Yes, yes, absolutely.

Does that make sense?

Yeah. All these things overlap with a governance framework. And it just so happens that these high level leadership responsibilities of creating a good governance environment is in fact the types of things that drive the culture, the policies that you have. The other thing, one of the other drivers that I list is the enterprise risk management framework.

Yes.

Does the organization have one? How robust is it? Is it just check the box, you know, is there a risk appetite? Are there tolerance thresholds that are measurable, that are communicated to the employees? You know, if, if this, if you, the number of safety incidents reach this number, that's going to set up bells and whistles, you know what I mean?

Yeah.

And we're going to do something about it when those bells and whistles go off. And so that is something that's very auditable. There are frameworks out there. The COSO ERM framework will tell an auditor or anybody, a leader, what best practices in ERM is. Which means that if you don't have these things, that could be a potential opportunity. Right. A potential gap.

Yeah. So would you say that. That risk management is the most important of the seven deadly sins or. For me, what sticks in my mind is the transparency. Because you talk a lot about communication throughout the organization on that one. So is there one like if you had to pick one of the seven, that stands out?

There's definitely one by a long shot. For me, it's leadership. Why? Because it's the leaders of the organization that decide who walks through the door. Right. Talent management is one of the drivers. They decide the risk appetite. They decide how much whether to have an ERM and how well to implement it, how much resources they put into it. It's the leaders who decide what policies to have. It's leaders who decide what communication style is going to be the acceptable communication style. Is it more transparency or is it less transparency? So the leaders are the drivers of the drivers. You know, the leaders are the drivers of all the cultural drivers. So it starts with leadership.

Nice. I love that. Super. Well, I hope everyone reads the book Culture. Grab it. It's a superbook. And again, you can check the show notes and we'll have a link for that. And I, I wanted to kind of go from that into, you know, that sort of pre conversation that we had. We, you were talking about how you run your department and it was in a very empowering, energetic, passionate way. And we ended up talking about how you measure the success of what it is that you and your team do. And we talked about some, you know, KPI concepts and things. I was wondering if you would share that with our listeners.

Absolutely. So when I first came here, I wanted to increase the value based upon my interviews with the board, the C suite, the CEO, the one common theme that they were craving from the audit department was value. Of course, you know, you can throw around that word all day long, but how do you define value? Right? So let's talk about how your executives, or the executives here at ncaa, let's define what that means to you. C suite. So I had to get that definition out of them. And here we define it as, look, we have our strategic goals, everyone is working towards those enterprise level strategic goals. And what could impede all of us from achieving any one of those strategic goals? Well, it's the risks, right. The risk of failure. Boil down is all the top 15 risks that come out of our enterprise risk management process. These are the things that could stop us from getting there. And we all want to get there. Right? We can all agree upon that. And so what can internal audit do to help leaders overcome those obstacles? Slash risks that could stop them from achieving their strategic goals? Well, we could align our audit plan to those very top risks. So every single one of the audits on our audit plan can be tied directly or indirectly to one of the top 15 risks. So we're helping leaders get to where they want to be, where we need to be as an organization by helping to reduce those risks. That could stop them from getting there by assessing, reviewing, auditing the processes behind those risks associated with those risks, and tightening up the controls so that it lowers the likelihood of a risk event from occurring, which could stop us from achieving our goals. So that was what was defined as valuable to them. So now my entire audit plan is lined up to what's important to them. You never have those conversations. When I was a staff auditor, we would have those awkward conversations of, well, these audit findings are accurate, we're not denying them. But these aren't important. The recommendations. We're not going to lift a finger to fix this because it's just simply not important. It's not worth our time, it's not worth our money. Yes, we, you know, you found two exceptions out of 100,000 things. It's, it's just, it's not worth the money to fix. With no more are we ever going to have that conversation because everything we audit is going to be important.

So now that you're, you're clear and you're aligned with the business, how do you measure your success?

But sorry, so, so to answer your question, so value is right now, we don't have a technical way to measure value other than we define at the front end of the audit, what are the objectives that this audit needs to achieve in order to add value. And so we agree with the senior leaders, these are going to be the objectives of the audit. Right. We're going to scope in processes A, B, C and xyz and we're going to identify any problem areas in those processes because these processes are key to addressing your risk. And so at the end of the audit, we make sure that we did indeed achieve those risks. So we send out post audit survey that says, do you one through five, do you completely disagree or do you strongly agree that we achieve the audit objectives? And so the higher the grade that we get, that's how we kind of measure but it's still somebody's opinion, right? Yeah, but it is matter of experts opinion. So that's value and then, and then relevance is how much of the top 15 risks we are covering with our audit plan. So you know, we, we strive for 100%. So there's a certain percentage that I commit to the board and to the executive team. So that's very measurable. And then lastly it's efficiency. So we went from. I cut the number of average audit hours spent per audit by half by implementing Agile Auditing, which could be a whole nother.

Yeah. A whole other conversation. We might do that.

Yeah. So and that's kind of a part of the John Tabor podcast. It made it to number two, the top five. So we were able to cut the number of audit hours in half by implementing Agile Auditing. We got it down to a one page audit report as part of Azure Auditing. But yeah. So if you find whatever works for you a measure for value, however you define that with your organization, efficiency and relevance, I think those three things will achieve kind of intel audit being held in honeyguard and esteem.

I love that you asked the folks you audited if you achieved your objectives in narrative because they. That's a great question. I don't know how many teens out there ask that specific question. I know a lot of teams have surveys, post audit surveys that go out, but I don't know if that is a question that they ask. I think it's a good one. I think it's a good one.

You have to wipe those objectives really, really strategically. Right.

Yeah.

So that it is as objective as you can be able to say yes. Based upon the work that we did and the things that we tested and the recommendations that we made, we did achieve. So that you're not sitting here going, well, I don't think you did, you know me or whatever.

Yeah. But you know, to me the word that pops up my head too is, is relationships. Like you have to build good, strong, trustful relationships with the business where they're also comfortable giving you their opinion that it's a, it's, it's real. It's not like oh well, we'll just check the box here. They're getting an actual valuable and work.

With 100% agree with you trust. Collaboration is so key. More key for the CAE role. As I rose up the ladder and I became an audit leader, that became more important than necessarily being the best auditor, knowing the best test procedures or having the best tools or having the best auditors. You can have a stable of really great auditors. But if you, if you don't have a trusting, collaborative relationship with your customers, your executives, they'll never see the light of day. Right. They'll never be able to shine because your internal audit function doesn't have credibility.

Right. And you know, in my youth, I used to say that internal audit had one product and it was an audit report. But as I've grown in my wisdom, I say internal audit has two products really. It's relationships and reporting. Right. It's, it's filling those relationships and then communicating those results in whatever way, you know, each department or each team decides to do it. Which leads me back to something you said, which is near and dear to my heart, as everyone listening knows, is audit reporting. You have a one page audit report. You have to tell us about it.

Well, at the risk of duplicating one of the podcasts with John Tabor, but, but just, you know, for the, the sake of, of this podcast, I would say that everywhere I've gone, the audit report has, has been, has left something to, you know, something to be desired. Exactly. And a lot of the comments I get is, it's too long. You know, we don't know what to, where to look, you know, tell us what's important. So the executive summary, that what used to be a one page executive summary of a 20 page, 20 PowerPoint page presentation of our audit report. I just removed the details and we tweaked the executive summary to be the audit report. It was so funny because I think when we first moved to a one pager. And the board loves it, by the way, the partner at our public accounting firm, because they get a copy of all our art.

Yeah.

When we had a meeting, they asked me, what's the rest of the article? I got the executive summary, but what's the rest of it? I said, no, no, no, that is the audit report. There's no other page. And they're like, oh, and it's got everything right. It's got, it's got a list of the risks, the top 15 risks that the audit is addressing, so that we know immediately it's relevant to the top risk that's concerning the company. It's got an overall comment section that talks about like, how is this audit relevant to all the strategic initiatives that are going on, you know, tying that together. It's got like an excerpt of the top audit procedures or all audit objectives. Right. And then the results of it in, you know, either a green check mark for no exceptions, a Yellow check mark if there are exceptions but a control is in place. And then a red acts if the control is not even in place. And then a blue check mark if there were no exceptions found. But we found a, we have a recommendation on how to improve the control even though we didn't find it. So that's a blue check.

Yeah.

So boom, boom, boom. You know, there are colors there that will tell the reader if they see red, it's bad, you know, just like any other art report. It's bad, you know, if it's yellow, that's not great, but not as bad as a red. And then green and blue is like, you know, we're doing pretty good, everybody. So it's got all the pieces that would be important to any board, we think. And you know, they have asked for like, hey, can you add this? And we have accommodated, but we're still kind of. I forced my team to find a way to convey their love.

I absolutely love it. But here's the thing. So, you know, I spend a lot of time talking about audit reporting. I teach audit reporting week in, week out around the world. There are a lot of teams that aren't ready for a one pager. And there maybe, maybe some of them, I don't want to say all of them, you know, but some of them are kind of in that traditional mindset. And is there a risk to you of going to a one page report?

Yes, there are pros and cons. I wouldn't call it risks. I would call them pros and cons. And one of the cons for me, for the CAE and go to one pager is you don't get to use the details of a 20 page art report as your crutch. Right. You can't say if, if an audit board, if a board member says, oh, tell me more about this thing on, on the front page. And you're like, well, okay, let me go look on page 19 for the details. It's got to be here.

Yeah, right.

You got to know about the details. And you know, obviously you get to, you are allowed to say, I don't have the information with me right now. Let me get with my team and get back with you. I haven't had to do that yet, but I know I have that card to play if I have to. But for the most part, and I'm not in the day to day, I attend the opening meeting, I attend the exit meeting, I attend the status meetings every week, which is 30 minutes. And so I stay high level, but I Make sure that I have enough conversations and meetings and details with my team leading up to the board meetings so that I'm prepared for questions. And you know, what I'll do is I'll write a bunch of questions that I think the board may ask and then I make sure I get those answers from my team before I walk in there.

But that's perfect. I mean, that's what I teach everyone is anticipate what the questions will be and to anticipate where the push, pushback will be, where the objections the resistance might come from and be ready for that. It's just like you said, you know, you don't want to be flipping through a 20 page report saying, let me just find that detail. You got to know it inside or you have to have someone who does know it with you. Right.

Like your number two person. So my assistant director, you know, I'm grinning this person to be the mean, you know, right. As responsible caes you need to have. And so it's a great opportunity whether you need them or not. It's a great excuse to bring them along and say, hey, I want this person. Just in case, you know, that the board asked me some, put some details that I don't have. This is the person that's closer to the action. He or she can be there to answer. Plus, you know, it's a win, win, win. Because then they can have exposure to being in a board meeting which they haven't had.

Yeah. I told more than one CAE when I'm, when I'm coaching their next level down and I'll say, you know, if it's Bob or Mary that I'm coaching, I'll say to the chief audit executive, I'm like, why don't you call in sick on the day of the board meeting? Just send in one of your pokes and give them a shot.

Right.

And seeing what it, what it takes. Or you can do the kind thing and tell them a couple days before that you'd like them to step in for you, you know, so that they can be well prepared. But, but I do think that taking that next level with you and training them up and coaching them and having them see what it is important. But I digress from this report writing because I have just one.

Okay.

I mean, you, it's. What does your, your audit client say when you say here's a one report. Now I know you have all the status meetings, so they should be getting detail then. Do they get any other documentation besides the onepage? Can I ask you that or is that too confidential?

Yes, actually that's a very important piece of information to fill in. So the one pager is what we deliver to the board. But okay, but for the closing meeting we have a lot more detail and it's. That level of detail is needed at the executive level. Process owner. Right, right. Because they want to know, well how many did you pull to test and how many of it did we fail and why did we fail? You know, five out of the 20 or whatever. And so they need to understand that so that they can do root cause analysis, inform them in how to fix the problem, you know, so it doesn't happen again and allow my team enough detail to follow up. Because with a one pager really all, all the management team has room to say is we concur with intel audit and we will fix it. You know, by doing ABC high level by X date you don't have a whole lot of room. Right. And I had. Discourages management from trying to go into the excuses realm. Right. Well this happened because. Yes, like no, no, the board just wants to know whether you agree with me and if you're going to fix it, when and when you're going to fix it. Right. Save the excuses for like if they ask, you know. But I would advise leaders not to get, go down the path of making excuses. Let's just look forward. How are we going to fix it? Right. We get better. And so we had to kind of. So I offered what can I write in the overall comments to make you feel better and not feel the need to write up excuses?

This.

And you know, if you like include that then I won't feel the need to explain myself as much and you know, we can focus more on what we're going to do. I said okay, well that, that sounds reasonable. I'll make those changes. So it is a very collaborative effort.

And it sounds a bit, it sounds a bit like there's like board reportable issues and then everything else.

Not to mention that. Yes. So, so the spreadsheet that we. Well, we're on audit board now but the closing meeting will have a list of like maybe 10 things to improve on and then we decide, well, which one of these is board reportable? Right. So it could be anything from zero to. I think the most I've ever had was four, four reportable items and that's all that fits. To be honest with you.

There needs to be a cut off somewhere.

Right? Yeah. I mean if you've got 10 reportable things, you've got bigger problems than trying to fit it into one page. Right. So, but, but thankfully I work in an organization that's quite robust and quite, quite mature. And so we, we never have more than four reportable items.

Okay. So that's a, that's exciting and I appreciate you sharing that with my audience. And I'm gonna, I'm gonna ping Norman in the, in a, in a message and say, hey, we're talking about the one pager in episode four. You gotta check it out. But I, I, I truly believe that that is an excellent way to go. There needs to be some other kind of sub reporting, if you will, that goes to the audit client. So whether it's, you know, a simplified presentation or whatever it is, but I really believe the days of book report, audit reports are over. And you know, it's, how do we get everyone away from those and into something that is quick hits, value added, you know, and maybe, you know, goes back to, and I know I'm digressing, but it goes to things like even. Are we looking at the right scope for, for each of these audits? Yeah, like do we need to be covering so much? Is that is everything as risky? Or we just do we need to kind of rethink that a little bit and be, you know, audit with a little more agility, right down to our annual planning and the scope for each audit and all those kinds of things.

You hit it on the dot right there. Agile auditing is about continually, continually like just filtering out the, the most important audits to do. And then when you start to plan, filtering out only the most key processes that would impact the risk, the most impactful processes tied to the risk. And so only focusing on those handful of processes and then as you start to test, only testing the controls that are key. You know, we have the concept of key controls and SOPs, but we're not using that same concept in internal audits. Like what are the key things? And just test those. And the trick is finding out right what's key.

Absolutely.

Last thing I'll say on the one pager is this. It should really be used as a discussion document. It's not meant to be all, be all, you know, in the all you can get all your information and questions answered on, on this one page of note. It's meant as, I mean, we're writing in bullet format. We're not even writing complete sentences, you know, so the bullets will cause the discussion that's needed to be had in that.

Yeah, I, I think it would definitely do that because I do Know that in. In some of the reports that I see, the bullet points, they need an explanation. Some you need to help them, I think, connect those dots. Right? Literally and figuratively. So fantastic. I look forward to seeing one pager one day.

Be happy to send you the template.

That'd be great. Hey, listen, you know, and I appreciate that discussion on audit reporting, but I've got so many more topics I want to touch on with you before we go. And one of those is the mentoring work you do. I really admire that, you know, you work within the system, so to say, you work with the IAE on mentoring, and then you do some other mentoring on the side. And can you just help us understand a little bit about that mentoring and then what it means for you and for your mentees?

Most of my mentees, like probably 95% of my mentees, whether it's part of the IA or informally, are women. And it's not like I purposely only picking women, but it's women that approach me and seek me out and ask for mentoring. Wrong, wide or indifferent. That's just how it's come to be. And I've never said no to anybody. I've never ever said no to anybody, men or women who've asked me to mentor them. And I think the reason why I get a lot more women approach me, and I'm completely fine with that because I think we are part of a minority that needs more help, right? I mean, it hasn't been that long ago that we weren't able to vote or, you know, have our credit card or whatever. So we're not the only group that's been, you know, marginalized or have been behind. And so I think just from that harm, women do need extra help. And the other reason I think that I'm getting approached by the vast majority are women is because they struggle with the balance, right? How do I progress in my career? But also, you know, I have a baby at home, you know, and I'm expected to care for the baby, too, and manage the household and all that. So for all those reasons and more, they are needing more help. And so some of that help comes in the form of mentoring. You know, how did you get that here? How did you balance family? And, you know, it's very disheartening to me to know some of the statistics where 60, something like 62% of people in the accounting finance who enter the accounting finance profession are women. But. But when. When you get to the leadership percentages, it drops to like 32%. So only half of, of the 60% of women who enter the profession, accounting, slash auditing, become leaders. And so the fact that it starts out being a majority tells me that there's something about, you know, women that makes it conducive for them to, to be, you know, good accountants and auditors because, you know, you walk into the big four, I think so, like the vast majority are, you know, women. And then you talk to the partner and it's men. You know, so it's like the staff and the seniors are women. And then you talk to the partner and it's men. And so it's disheartening to me that would kind of fall off the ladder like that.

So look what we're doing. Look what we're doing, Lynn. I mean, look what you're doing. Mentoring. We have this podcast that I've started to, you know, I'm going to say it out there, trying to change the world. And you know, I'm, I'm, I'm now working with, you know, one of my, my newest clients is, I think she's 32 or 34 years old as head of audit. Right. Quite young. Wow. Yeah. Fantastic. So, so we're, we're, you know, I'm, I'm, I'm, you know, coaching and consulting a little bit on her. I've, I've hooked her up with someone in the industry in her region who is also ahead of auto, with tons of years of experience and who's just, you know, been on the IAE board in that country. And you know, and they're. So she's really reached out and she's mining that network. And to be honest, the conversations she and I've had are about the women that she's going to not want to make this anti men because that's not what we're doing here. No, no, we are looking at just, you know, she, for her women, supporting women and, and sharing that expertise and, and through all of that, we're going to raise everyone. No matter what gender or non gender we have out there, we're going to raise everyone. And I think it's just so important. So I really admire what you're doing.

Thank you. And you know, it's ironic because specific to our profession, Tracy, having been at CAE now for 15 years or more, actually at four different companies, I have come to find that the three most important, important qualities to be successful in this role because it's such a political role, is communication, collaboration, and empathy. Well, guess what? Those three qualities are typically very, again, not comparing to men. But there's. Those are typically very strong in females. And so those can be our superpowers. You know what I mean? Those are our superpowers. And yes, I speak about our profession, but I'm sure those three qualities will get you far in any profession, but.

In any in life, basically.

Yeah, right, exactly.

No matter who you are, no matter where you work, those three qualities, I'm going to repeat them because they're so important. Communication, collaboration and empathy. That's what's going to take us all forward and lift us all up.

Exactly right.

And it takes a village, not. It's not just one of us, it's reaching out a hand to help others, it's being of service and it's not being afraid to ask for help when we need it as well.

Yeah. And it's also who your partner is at home. That is a major reason why I'm able to be where I am today is because my spouse and my extended family have been able to support me. You know, they, they are my village, you know. Absolutely. Yeah.

Because, because we all want work life balance. I, I feel like me for myself at where I am at this stage in life. I'm finally, finally finding work life balance. I mean, I've had my own business for. It's 11 years now. Right. And, and for all the years before, I was busting my butt for someone else and now I'm finally just thinking, wow, this is good, you know.

Oh my God, me too.

I took a lot on the weekend and I was kind of celebrating that I didn't work on the weekend.

You know, it's only been since like maybe three, four years ago that I have found work life balance. And you know, I'm going to date myself. But so that means that I've only found. I've only reached work life balance in my early 50s, which is crazy, you know, that it took that long for me to get here. But I got here and I think it's fantastic.

And I think, you know, back when we were starting out our careers, we didn't really have role models in this position. And now you can be a role model for others who are striving. And I won't say men or women or any gender for just for others who are striving for that work life balance. It's creating it for yourself. It's who you have at home. It takes that village, extended family, all of all of those different things. And it takes, I'm going to say, valuing yourself enough.

Yes.

To put yourself first. Sometimes even if that means being with family or something. But you're putting those decisions first. I remember when I was a kid, you know, I had, you know, an absolute parent quite often because they were working so much. And, and so I'm happy that we can. That maybe we're just even a little bit ahead. I don't know how many years. A little bit ahead.

Yeah, I, I. To all the women out there, again, you know, not to exclude the men, but because your podcast is called Women in Audit, I'm going to speak specifically to the women. Our time is now because. Because of this terrible pandemic. Right? Terrible, horrible pandemic. The one nugget of like, you know, the one kind of lemonade that you can make that is that it forced leaders and companies everywhere to admit that you can work remotely. Right. You can be effective and successful working remotely for the most part. I'm sure there are exceptions. So, number one, that has helped with work arrangements that can be conducive to women having both a family and a career. And number two, it used to be that some of the. More, I hate to say masculine qualities, but it used to be taking risks and being aggressive were highly valued to get ahead and be successful in life. Wall street, greed is good, blah, blah, blah. But now you're seeing all the, the training and leadership development is in being empathetic and, you know, all these things, skills, inclusivity, you know, so, so now is the time for those strengths that I know women, you know, have strengths in those areas. Collaboration, communication, empathy. Those are now being prioritized when leaders are looking to fill roles. And so I feel like the time is right, right now, post pandemic, and then an emphasis and focus and prioritization on empathy and, you know, those kind of qualities. Collaboration, communication. Yeah, let's strike while the, the fires, you know.

Yeah.

But, yeah, I would encourage all women to, to shoot for the stars.

Yeah. Yeah, absolutely. All right, well, given all of that, I feel like it's time for me to ask you my final question.

Okay.

Which is, what legacy do you hope to leave in the field of internal audit? And what impact do you hope to have on future generations of auditors, especially women?

Well, the legacy I'd like to leave behind is, is because I've been in this profession for so long, and I've seen it, you know, transition from where it was 35 years ago to now is to keep spreading my ideas, thoughts, experience success stories in how to make audit more impactful and value add because it, because intro audit has been my career for so long, it kind of hurts whenever I hear people making fun of audit and you know, calling us the police or hello value, et cetera, et cetera. So it's. I would hope that my, one of my legacy would be that I made a small impact, no matter how small in influence, influencing people, spreading the word on how to transform into audit to be more impactful, to be more value add. So that's the legacy I'd like to leave behind. And then for future leaders with a focus on women, but just future leaders in general, we kind of did the pow wow for women specifically, now is our time. But just leaders in this field, I would just say that you don't have to commit to Internal Audit for the rest of your life or the rest of your career. Internal audit is one of those unique professions that gives you exposure to all different aspects of the company. So it could launch another career. Right. It could be such an enabler to help you evolve as a profession and you can even come back to it. Right. I've kind of left Intel Audit for a couple years and came back and reinvented myself and had a new spin to it. So, so that's what I would tell future leaders, women, you know, you, you can grow and evolve with Intel Audit and you can leave it and come back, reinvent it, etc. But I just find that Intro Audit has been so valuable to me as a professional in my career because I've done teaching and training and speaking. Right. Which is kind of adjacent to Intro Audit, but it is a different profession to be a speaker rather than doing it. So I think Intel Audit just opens so many doors for you and really has, has allowed me, and I'm sure it will allow others to really evolve and grow with, with that profession and, and spit potentially spin off into a completely new profession.

I mean, I'm, I'm with you 100%, number one. I'm, I, I hope that I can support you in some small way with this podcast and helping you create that legacy already. But I also believe that once an auditor, always an auditor. So I left Internal audit for about 10 years and I don't audit anymore. But I teach, train, consult. I've been with them every day of my waking breath because I believe in them so much and I really believe that Internal audit is perfectly positioned to facilitate positive change within organizations. And that's, I hope in some way, however we say it, whichever words we use it, that that's something that we're all striving for. In this community.

I wish we could change the name of our profession because really, internal audit is just a scary word for continuous business improvement. Nice business process. That's all it is, but nice. I'm proud to be an auditor. I haven't regretted a day of it.

Me too. Listen, Lynn, I can't thank you enough for coming on to the podcast and sharing all your insights and perspectives and experiences with us. It's been really valuable and fulfilling for me and I know it will be for the listeners of the podcast as well. And I look forward to staying in touch and you are welcome back anytime.

Well, thank you. Maybe we talk about agile auditing next, but no, the honor is mine. Thank you so much for having me on and I really enjoyed this session. You really teased out a lot of the messages that I hope to leave with a lot of fellow auditors in our profession, so thank you for the opportunity.

Hi everyone. Thank you for joining us on this episode of the Inspiring Women in Audit podcast. We'd love for you to stay part of our growing community, so subscribe wherever you're listening. If you're enjoying our content on platforms like itunes or Spotify, a quick five star rating from you would mean the world to us. It's a small action that supports our mission immensely. Don't forget to explore the show notes for various links and join our vibrant community on all our social media platforms. Your interaction and support play a crucial role in amplifying the voices of Inspiring Women in Audit and spreading their inspiring stories even further. Thank you for being a part of our journey and we'll catch you in the next episode of the Inspiring Women in Audit podcast.