# A Practical AI Upskilling Model for Auditors

An episode of [All Things Internal Audit](https://invisiblenetwork.ai/podcast/1758983201), 22 Jul 2026, 34 min.

Audio: https://traffic.libsyn.com/secure/1984d534-f92f-4772-a722-6ac47400e67e/ATIA_-_AI_Upskilling_-_Nancy_and_Bryant_V3_MP3.mp3?dest-id=3677289

The Institute of Internal Auditors Presents: All Things Internal Audit In this companion episode to the Global Best Practices' Internal Audit Upskilling for Critical AI Capabilities, Bryant Richards talks with Nancy Hom about how internal audit teams can build AI skills with intention, confidence, and discipline. Hom shares how her department has moved from broad AI awareness to practical, immersive learning that helps auditors both use AI in their work and audit it effectively. The conversation covers mindset, skill set, and tool set, along with real-world use cases, adoption challenges, human oversight, and why AI fluency may become a key differentiator for the future auditor • HOST: • Bryant Richards, CIA, CRMA, CMA, PhD Partner, Ucran & Company, LLC Associate Professor, Nichols College • GUEST: • Nancy Hom, CISA Vice President, Data, Analytics and AI, MetLife Global Audit KEY POINTS: • Introduction \[00:00-00:00:42\] • From AI Awareness to Immersive Learning \[00:00:43-00:02:29\] • Mindset, Skill Set, and Tool Set \[00:02:30-00:04:43\] • Building and Measuring an AI Learning Program \[00:04:44-00:07:41\] • Defining Appropriate Tasks and Maintaining Human Oversight \[00:07:42-00:09:38\] • Choosing AI Tools and Scaling the Audit Workflow \[00:09:39-00:13:15\] • Communication, Delegation, and Validation \[00:13:16-00:16:20\] • Using an AI Chatbot to Improve Issue Writing \[00:16:21-00:19:26\] • Keeping Pace With Changing Tools and Learning Needs \[00:19:27-00:22:20\] • Driving AI Adoption Across the Department \[00:22:21-00:24:34\] • Maintaining Skepticism, Judgment, and Accountability \[00:24:35-00:28:23\] • Expanding Internal Audit's Advisory Role \[00:28:24-00:31:33\] • Hiring and Developing AI-Fluent Auditors \[00:31:34-00:33:34\] • Final Thoughts \[00:33:35-00:34:07\] Visit The IIA's website or YouTube channel for related topics and more. IIA RELATED CONTENT: Interested in this topic? Visit the links below for more resources: • Global Best Practices: Internal Audit Upskilling for Critical AI Capabilities • Global Internal Audit Standards • Vison 2035 • Knowledge Center: Artificial Intelligence Follow All Things Internal Audit: • Apple Podcasts • Spotify • Libsyn • Deezer

## Transcript

[0:01] The Institute of Internal Auditors presents All Things Internal Audit Tech.
[0:06] In this companion episode to the global best practices Internal Audit
[0:10] Upskilling for Critical AI Capabilities, Bryant Richards talks with Nancy
[0:14] Hum about how internal audit teams can build AI skills with
[0:17] intention, confidence, and discipline.
[0:21] Hum shares how her department has moved from broad AI awareness
[0:25] to practical immersive learning that helps auditors both use AI in their
[0:29] work and audit it effectively. The conversation covers
[0:32] mindset, skill set, and tool set, along with real-world
[0:36] use cases, adoption challenges, and human
[0:39] oversight.
[0:43] Nancy, can you tell me how has your team's approach to learning and developing AI
[0:46] skills evolved over the past few years?
[0:50] Our company has been using AI and generative AI for the last few
[0:54] years, and so the question we had was, how do we get people
[0:58] prepared so that when AI is in production,
[1:02] we are confident in knowing how we audit it?
[1:05] But also, equally, we are part of our company
[1:08] strategy to also be committed to using AI as well.
[1:12] So I would say our journey has been where we wanted to make sure we
[1:17] create a baseline awareness
[1:19] across our audit department to really understand the benefits of
[1:23] AI, but equally important, the risk of AI.
[1:26] So we have provided very broad general awareness
[1:30] training to set the foundation the last two years, and
[1:34] we are pretty much in the process where that has shifted from broad
[1:38] awareness learning to more practical immersive
[1:42] learning so that it is relevant learning in terms of what we need
[1:46] to know to use AI in our audit work. But equally
[1:49] important, we also need to know enough to audit it with confidence.
[1:53] So that's been our shift in evolution in terms of department
[1:57] learning and making sure that we are teaching people the right things
[2:01] to use it, but also be able to audit it as well.
[2:05] Nancy, I love that answer. You've given me a lot to unpack.
[2:07] I'm going to
[2:09] explore a few things, if you don't mind.
[2:11] When we talk about this, I hear you very importantly saying
[2:15] we're using it, but we're also learning how to use it because we need to audit
[2:19] it, so we need to understand the risk side.
[2:22] In order to understand the risk side, we have to kind of have a hands-on approach.
[2:25] Can you talk a little specifically about that and maybe some examples if you
[2:29] can?
[2:30] Sure. Let me also take a step back to share with you even more specific
[2:34] on how we approach this. So I like to say that the recipe for
[2:37] success to upskill in this space for us
[2:41] has been where it's important to think about this in the three
[2:45] stool, like a three-pronged approach.
[2:48] So auditors do need the right mindset, the right skill set,
[2:52] and then the right tool set. So we like to think that those three
[2:56] parts are equally important to be successful and strong adopters of
[3:00] AI, but also equally important to be
[3:04] aware with experience and usage to audit it with
[3:07] confidence. So I would say those are the three ways we
[3:11] focus to help the individual auditor get the
[3:14] right learning and mindset to embrace and lean in
[3:18] to some of the things that I think when people hear about tools, it is
[3:22] intimidating, especially for business auditors in some
[3:25] cases. But I think we are promoting the right level of
[3:29] thinking, right level of curiosity through healthy
[3:33] exchange and learning, so that when we give people the
[3:36] tools, they also have the skills through the formal
[3:40] training I kind of described earlier.
[3:43] But also making sure that people are really openly embracing
[3:47] what's provided to them. And I think at the department level,
[3:51] we provide a lot of ways to create and
[3:55] foster sharing of actual ways people are using
[3:58] AI in the audit workflow. And I think people are able to
[4:02] do that because we've actually intentionally offered AI boot
[4:06] camps where, for example, we obviously as an
[4:10] organization and like many organizations, offered Copilot
[4:14] licenses, M365 Copilot licenses, so
[4:18] people now have the tools. And when they use it, we identify
[4:22] case studies where people have used these tools in a practical way
[4:26] to solve some of the audit task across the workflow.
[4:29] And it's through that sharing that I think is really fostering a very healthy
[4:33] level of confidence that if they see so-and-so do it, why can't I
[4:37] do it? And so it's really inspiring and motivated people as well to lean
[4:41] in through that type of natural healthy sharing.
[4:44] That's terrific, Nancy. I'm interested in how your organization is leading this as
[4:48] well. Am I right in saying that your team, sort of the IT
[4:53] data analytics type of team, is the leader within the group,
[4:57] and you're the ones who are sort of rolling this out in some fashion?
[4:59] And if not, could you help me understand kind of how you're going about it?
[5:02] Because it sounds like there's a heavy leadership role here.
[5:05] Yeah, and I think that's a great question.
[5:07] And what's unique about me and my team is that we are uniquely
[5:11] positioned to really be laser-focused to drive the
[5:15] enablement efforts, to your point.
[5:17] Because if there's not enough focus around the learning, the showing, I
[5:21] think if you leave it to chance and organic adoption, I don't
[5:25] think departments would really essentially see the speed in the learning
[5:29] curve and the accelerated adoption that's to be expected.
[5:33] So,
[5:34] myself and our team, and through some working group formats that we've
[5:38] established where we engage other auditors, we are kind of
[5:41] co-creating what that learning roadmap will look like for our department.
[5:46] We are also offering learning series throughout the whole year where
[5:49] we have a very set clear schedule on topics
[5:53] that we're going to learn about new tools that are emerging across enterprise,
[5:57] but also certain sessions we are also spotlighting certain auditors that can
[6:01] share their case studies too. And so it's a really heavily curated,
[6:06] I would say, dynamic, immersive learning throughout the year.
[6:09] Combined with structured formal learning that is required, and
[6:13] we look at that curriculum quite frequently to make sure it stays
[6:16] relevant. And then, the last part I would say is we also measure the
[6:20] usage too. So there's a level of discipline around, great, people should
[6:24] experiment, people now have the tools to use it, and we are sharing
[6:28] the success stories. The question is: Is our
[6:32] audit outcome and the quality of our work better?
[6:35] So we are formulating some clear measures not just on usage, but on outcomes
[6:39] too. Which again, really kind of, to me, closes the loop on
[6:43] making sure that we're seeing the true expected value and benefits, right?
[6:47] And to me, that's the part that should not be
[6:50] forgotten in terms of the why. Why are we doing this?
[6:54] Yeah. Critical, and I'm glad you jumped into the outcomes, because why are we doing
[6:58] this? And ideally, every organization has its reasons, but audit
[7:02] quality has to be part of it, right?
[7:03] There definitely has to be a quality component to it.
[7:06] It's interesting, as I've spoken with a lot of folks in the field, when
[7:10] they start talking about AI, there's a conversation that sneaks up a
[7:14] little bit that starts talking about quality and how AI's
[7:18] doing things, particularly for younger staff that may not have the judgment and
[7:22] experience yet to really know how good
[7:25] AI is or isn't. How is your organization, if you don't mind,
[7:29] sort of perceiving the risk of
[7:32] thinking you know what's going on because you're using AI, but not
[7:35] necessarily adopting the expertise or skills that are needed for the role,
[7:39] particularly in those early positions?
[7:42] I would say that it's important for many of us in audit
[7:45] departments to really have clarity on what is the spectrum of audit
[7:49] task that we believe AI can play a role in, that's really going to deliver
[7:53] the quality and value, to your point, Brian.
[7:56] So what we've done here is that for our team, we've
[8:00] established a menu of those tasks so that it sets a bit of
[8:04] that clarity on what type of tasks that we believe all
[8:08] auditors, irrespective of their domain expertise,
[8:12] should be using Copilot or other AI tools for.
[8:15] And I think that really creates consistency so that
[8:19] people don't end up using AI for certain edge cases that we don't
[8:23] know. And so I think that allows us to also measure
[8:27] it with clarity against that menu of audit tasks.
[8:30] But to your point about junior auditors, I think there is
[8:34] still very much a human-in-the-loop aspect to how
[8:38] auditors are using AI in the audit workflow.
[8:40] I don't think that we're in the stage where we have
[8:44] delegated the whole workflow to AI at this point.
[8:47] And so I'm sure at some point in the future that could be the
[8:51] case in terms of how much it can be augmented with AI.
[8:55] But right now, even though, let's say a junior auditor is performing
[8:59] audit task, like drafting an issue, which is a very common
[9:03] one, I don't think junior auditors are blindly trusting the
[9:07] output. I think they would review the draft issue from Copilot
[9:11] and still make sure that it's the best draft at issue that their
[9:15] manager also needs to kind of review.
[9:17] So to me, I think that judgment and human in the loop and oversight is
[9:21] still necessary. However, I think we do need to unlock
[9:25] where, at some point, where are we comfortable to really delegate some of the
[9:29] decision-making to AI to really see the full value
[9:33] of how the audit workflow is delivered, right, with an AI first
[9:37] type of ability.
[9:39] Yeah. So as we're talking about AI and we're talking maybe more tool-focused,
[9:44] what types of tools have you deployed?
[9:48] What types have been successful, and what impacts are
[9:52] you seeing with any of them?
[9:54] I think the common one, as I've already mentioned, is definitely M365 Copilot.
[9:58] I think many departments already have this.
[10:01] I think there's some specialized tools that we use that allows
[10:05] us to do more analysis with unstructured data, and those are very
[10:09] specific niche vendor types of solution that we've deployed,
[10:13] which I think definitely is another level beyond what I think Copilot
[10:17] is able to deliver. So we've seen some really great success
[10:21] on a vendor tool that does that. And I think in
[10:24] terms of another common one I think that enterprises would have
[10:28] is the Power Platform suite of Power apps too.
[10:32] So we also are able to leverage a lot of those
[10:35] capabilities to do some automation and workflow automation as
[10:39] well to streamline how some of these tasks can be done
[10:43] more end-to-end. And I don't think having
[10:48] a lot of tools is really the recipe for success, Brian, in my mind.
[10:52] I think it's about having the right tools that can really help us do the right
[10:56] task is really where I think people will see truly
[11:00] the benefit of where AI can be incorporated.
[11:03] And I think a strong adopter really understands that workflow.
[11:07] Like, what are the key steps to really get an audit done from end to end with
[11:11] speed, with better quality, and obviously achieving better
[11:14] efficiency too from productivity.
[11:17] So I think that's kind of our viewpoint.
[11:19] It's less about the tool, which is why I say toolset is really the last.
[11:22] It's always going to be the mindset and then the skills that you need to talk to
[11:26] AI to ultimately unlock what
[11:30] benefits it provides.
[11:32] So Nancy, this sets up an interesting question here in that you've had some
[11:35] success. It sounds like you've had some success, and you're on your journey for
[11:39] sure, which is better than many organizations already.
[11:42] When we talk about AI, we think of the LLMs, we think about typing things into
[11:46] Copilot. There are workflows and stuff.
[11:48] Where were your biggest success? Are they at the LLM level where you're
[11:52] shaping sort of task behavior, or is it at the automation level where you
[11:56] may have actually automated some compliance audits or
[12:00] really heavy workflows like a user access testing or something to that
[12:04] effect?
[12:05] I would say that the biggest value has been just a range across
[12:09] all the different audit tasks. So I think it's just really looking at the
[12:12] combination of tasks and where we maximize the auditor's ability
[12:15] to see, again, leveraging this menu of tasks and say, "This is
[12:19] where all these tasks should be done and performed using
[12:23] AI as my copilot." Right? Or as my assistants.
[12:27] Because that's the level of augmentation we want to see mature over time,
[12:31] Brian, for us to then start measuring, is it a better outcome?
[12:35] Are the quality of the work better? Are we finding better insights?
[12:38] Are we doing the work at a greater speed?
[12:40] Is our stakeholders saying that we're actually providing better audit
[12:44] assurance and insights too? So I think there's pockets of
[12:48] automation where we're seeing, but it's very pointed, right? More domain specific.
[12:52] So you're not really going to see the scale, I would say.
[12:55] The scale to us is really that whole end-to-end audit workflow
[12:59] where every auditor across the department can truly use AI in a
[13:03] system across a chain of those tasks.
[13:05] And hopefully every auditor can do that consistently, right?
[13:08] To really maximize what the benefits are going to be.
[13:11] That's where we're really seeing the scale and in value delivery.
[13:15] Okay. So that takes us really to skill set, as you've been
[13:18] focusing on here. So from a skill set standpoint, you've shared with us a
[13:22] nice plan of things that have gone well and how you've built skills.
[13:26] What particular skills, how would you describe what you're building
[13:30] amongst this team of internal auditors?
[13:33] And what's been the most successful or impactful?
[13:38] I would say that the skills, and this is a common question that guests get
[13:41] asked frequently, is, to me, it's yes, you do need some level of
[13:45] technical understanding of some of the model, like different
[13:49] models that exist. But I think a lot of that is kind of
[13:53] not as visible to an auditor that, that's necessary, I would say.
[13:57] I think the skills would be more of the things about like how do you talk to
[14:00] AI? We often say communication is really paramount
[14:04] in everything we do, which I still believe in that, but it really
[14:08] elevates to, even more importantly is it's not just talking to people.
[14:12] Like how do you talk to AI? And there's this prompt engineering and I think
[14:16] even that alone is evolving because apparently, two
[14:20] years ago, you have to structure your prompts, as we know, very clearly to give it
[14:24] context and clear instructions. But for those that have used more of the
[14:28] more recent AI tools, you don't need that formal structure as
[14:32] much as you did before. But you still need to give it the right
[14:36] goal as an objective. So to me, communication and how do you talk to AI
[14:40] is going to be really, really crucial so that you're going to get the
[14:44] best results from these tools. And secondly is
[14:48] delegation. I don't think this is something that we often talk about, but how do we
[14:52] comfortably delegate the work to AI, to me, is
[14:56] so important. And that's not something that most people embrace
[15:00] because we value the expertise we have.
[15:03] We like doing the work. But part of the real value is where are
[15:07] the right things to delegate to AI?
[15:09] That to me is a skill that I would like to see auditors strengthen
[15:13] more. And then lastly, I think is validation.
[15:16] It is something that I think is innate to auditors anyway, where we have this level
[15:20] of skepticism and questioning like, can I trust this?
[15:24] But to me, that also then gets even more important now with the AI
[15:28] output. I think you kind of mentioned some junior auditors, like no one should
[15:32] be blindly trusting the AI output now.
[15:35] So what is the level of validation that you
[15:39] need to perform? And there's going to be a spectrum of the two, depending on the
[15:43] task, and the consequence of the output that's being used for certain purposes.
[15:47] So, in a nutshell, I think to me, the three key
[15:51] critical skills to be successful in using AI to drive
[15:55] better outcomes is communication, delegation, and validation.
[15:59] So really the talk,
[16:01] the task, and then the trust, like the three Ts, would be another
[16:05] way I would say it.
[16:06] Love it. So can you give us an example then?
[16:09] You've been training some folks in your organization where you've seen
[16:13] that go very well and maybe a specific case where some folks have
[16:16] picked up on this and what have they done with it and what outcomes came from that?
[16:21] Yeah. I can spotlight a really cool use case
[16:24] where it's one of those use case that cuts across the
[16:27] organization, and many auditors actually contributed to this
[16:31] use case too, as we partner with even the second line,
[16:35] in risk and compliance where when you think about organization, how they
[16:39] manage risk and mitigate risk, obviously as they're
[16:42] evaluating the risk and the controls that exist to mitigate those risks,
[16:47] sometimes those controls don't always function and therefore, what do we have?
[16:50] We have issues. And there's this idea of issues that are
[16:54] self-identified as well as issues identified by audit.
[16:57] And so where we saw the opportunity with AI is
[17:01] obviously AI can now draft content, create content
[17:05] for you. And so issue in drafting and writing issues is actually a
[17:09] real pain point in many organizations, including ours.
[17:13] The consistency in how you write an issue with clarity that
[17:17] meets what was the cause of this issue?
[17:19] What's the impact in terms of consequence, right?
[17:21] So there's a specific framework that every organization have to make sure
[17:25] there's a clear issue statement written to drive the right remediation
[17:29] steps. So what we did is we actually partnered even with
[17:33] IT to come up with an enterprise solution that
[17:37] leverages generative AI capability in a
[17:40] chatbot format that actually
[17:44] converses with the auditor or converses with compliance and
[17:48] risk, or even people in the business.
[17:50] And everyone goes to the same chatbot in order to
[17:54] explore, help me write a clear issue.
[17:58] And so we've deployed this for over a year and a half now, seen some really
[18:02] positive results. And the question is, why does this matter, right?
[18:05] It matters because if you don't have a clear issue written, you
[18:09] may not be fixing the right problem.
[18:12] And that actually costs,
[18:15] from a compliance, non-compliance, or even just putting
[18:19] the resources to work on the wrong things, right?
[18:21] From operational risk and cost. So I think the
[18:25] outcome that we've been trying to measure is what's the quality of these
[18:29] issues? And we've been able to actually measure a positive
[18:33] trend in terms of issues across the company, but issues that audit
[18:37] also creates. What's the quality score overall to
[18:41] kind of justify the existence of a solution like this?
[18:44] So happy to share that this AI chatbot is doing what it
[18:49] needs to do to drive the
[18:52] awareness of writing the right issues, but also making sure that it's
[18:56] driving the right remediation and that we can have an active
[18:59] pulse over the quality of these issues to then ultimately
[19:03] have better insights, right? When these issues are written well across the
[19:07] company. So I feel like we're just in the start of it, Brian, and
[19:11] we see endless possibilities in what this foundation can actually take
[19:15] us into the near future as a company.
[19:18] So really exciting use case that audit was able to drive
[19:22] in partnership and collaboration with other teams across the
[19:26] organization.
[19:27] So it's great to hear your successes. I'm glad you've started. You've been on this.
[19:31] You've got wins. Good for you. Lots of folks in industry are having
[19:35] challenges as well. Would you care to share what I'm sure are a
[19:39] fair number of challenges or maybe the most impactful one about
[19:43] upskilling your internal audit team?
[19:46] Sure. I think the biggest challenge is really keeping up with the
[19:50] pace, quite frankly. As I talked about mindsets, skills, and the
[19:54] tool set, I think the variable here in terms of change is really
[19:58] the tool set. So as much as everyone's going to be eager to embrace this
[20:02] and ready to use it, I would say that some of the tools continue to change so
[20:06] rapidly that the tools we used last year, and even the issue
[20:10] chatbot that I described to you and shared as an example, we
[20:14] already know that there's better tools out there today that can do what that
[20:17] chatbot can do a year and a half ago.
[20:20] And now you kind of in this position is like, do we pivot to this better
[20:24] tool and rebuild what we had deployed a year and a half
[20:27] ago? And so this constant reevaluation and knowing that the
[20:31] options are endless is a real challenge
[20:34] because the traditional technology solutions we deployed in the past,
[20:39] they can have lasting where they can be in production for many years.
[20:42] But now some of these AI tools you could be changing them in
[20:46] months. And I think that gets us quite uncomfortable, I would
[20:50] say, in terms of keeping up with the change of the tool set.
[20:53] Because in the end, you need a bit of stability, but you also know
[20:57] that better features are going to come out that will be cheaper,
[21:01] faster,
[21:02] and all of the above too. So that's something that's been hard to keep
[21:06] up. But I think the other challenge too is the learning
[21:10] part, is maintaining a relevant learning
[21:13] curriculum and curating relevant, timely
[21:17] topics dynamically throughout the year for audit is something that I think
[21:21] requires dedication and focus. So I don't
[21:24] think that's a capacity that most teams have the luxury to
[21:28] offer, but I would strongly advise that if
[21:32] audit shops do want to see a stronger AI adoption,
[21:36] really invest the time to develop the necessary learning
[21:40] and make it required for your people.
[21:43] But do it in a way that's encouraging and positive, right?
[21:46] So this is not like a mandate that you shall, or if not,
[21:50] then something happens to you. But doing it in a very positive,
[21:54] encouraging way that the learning that people are going to take is an
[21:57] investment to their career to remain relevant for the
[22:00] future of how audit work needs to be delivered in the next few
[22:04] years. So that would be the second thing I would say in terms of making the time to
[22:08] invest and having a strong learning plan.
[22:11] That's a real challenge if you don't make that investment up front, because you
[22:14] leave it up to chance that your people are going to make the time on the weekends
[22:18] to learn these things, and most people will not have that time.
[22:21] So you're going to have folks in your organization who have adopted this more
[22:25] quickly than others. You're going to have some folks who might be resisting or not
[22:28] resisting. Can you tell me a little bit about what the differences
[22:32] in your organization are between those who are adopting more
[22:36] quickly and more successfully than the others?
[22:39] There are definitely super users or strong adopters, to your point,
[22:43] and that's to be expected because you always have a bit of that curve
[22:47] where people are going to jump right in without being
[22:51] told, and you're going to have the strong middle that through healthy
[22:55] encouragement, they come along. But then you're going to have a bit of the laggers
[22:59] right behind. And I like to say that I think it's a
[23:03] healthy curve. It's what we expect.
[23:05] And some of the forums I share with you where we foster
[23:09] showcasing case studies and where people have used it successfully,
[23:14] but I think we also temper it with the fact that, hey, there's some real use cases
[23:17] where we say it was challenging. And so when we
[23:21] bring some of those laggers to those forums, I think
[23:25] it allows them to kind of hear both sides, that this is not all
[23:29] rainbows and sunshine. We like to see more of that, of course, but
[23:33] it's healthy that it could be a bit intimidating, and sometimes it is not
[23:38] always easy to use, but we shouldn't give up.
[23:40] And so I think it's through those forums that hopefully
[23:44] will convert some of the laggers. But I also want to say that
[23:48] we have also a very strong commitment and tone at the top in our
[23:51] leadership, in our department that's very committed
[23:55] to foster the learning, support the learning, but
[23:58] also accountable to demonstrate through their
[24:01] team that there is going to be a strong adoption in the right places
[24:05] and the right task, and be able to kind of tell the story on the
[24:09] outcomes. Has this made the work easier to deliver?
[24:13] And has the quality improved when we use AI?
[24:16] So every leader is accountable to kind of really showcase that story over
[24:20] time on that progress. So I would say there's a bit of a
[24:24] top-down, bottom-up approach that we're doing that I think is
[24:27] helping really move the needle so that we can really move a lot of the laggers to
[24:31] the middle to be adopters in that sense.
[24:35] So it sounds like a sort of a classic implementation playbook, right?
[24:38] An organizational change, make sure to educate, make sure to bring people
[24:42] along at the right pace, keep it positive in a lot of ways, tone at the top.
[24:46] All this sounds very sort of textbook right things to
[24:50] do. At the same time, AI is different.
[24:53] It's
[24:54] just so different, Nancy. And your answers to these questions have
[24:58] been terrific. I'm really curious as we explore
[25:02] this, and if I can push you down the years a little bit,
[25:05] where AI is so good at what it does that it's very
[25:10] easy to assume it's right.
[25:13] How are we or how are you planning on keeping your team
[25:17] to maintain its skepticism, to maintain accountability, that not just
[25:21] the human in the loop, but the true judgment of what we do?
[25:24] What is being built in from a skill set standpoint in your training?
[25:28] Or just what do you think should happen to make sure that we don't
[25:32] fundamentally just turn over this profession to the AI at some point, even
[25:36] if-
[25:36] It's a great point, and I feel like, at least for us, we
[25:40] are in now this phase where we do need to invest
[25:44] more on thinking through more thoughtfully on
[25:48] exactly what you just said, is how do we not end up
[25:52] in a place where people just kind of trust it
[25:56] is what it is, and we need to get the work done, and we do think that
[26:00] AI is doing a pretty decent job, right?
[26:02] And so how do we avoid potential errors in the output we
[26:06] consume that will have a bit of a consequence?
[26:09] I do think that's why I kind of keep going back to that,
[26:12] we have to be clear on those tasks that we
[26:16] believe AI is doing right well. And
[26:20] I think through feedback loop and also
[26:24] storytelling, I think it gives us some good insight in terms
[26:28] of where our auditors are feeling less
[26:31] comfortable on some of the output for certain tasks that they are
[26:35] applied or experimenting. And to me, I don't think there's
[26:39] a silver bullet ultimately in terms of like, hey, where
[26:43] can we trust and where we can't trust?
[26:44] The only way we're going to have to find out is we're going to have to dip our toes
[26:47] into the water and really actively get
[26:51] feedback and stories from people in terms of like,
[26:54] okay,
[26:55] where it has not worked, what's the lesson there, and could
[26:59] we make it work? Right? Because in the end, this is kind of the tension
[27:03] between we want to be users, and I think there's
[27:07] commitment to do that because there's really no big downside, I would
[27:11] say, because there is a lot of potential.
[27:14] There's probably more risk to not using AI in the audit work because in the
[27:18] end, I think enterprise expects everyone to kind of get aligned.
[27:22] And I think we just have to be diligent on knowing
[27:26] where are we comfortable to play at, and where are we
[27:30] comfortable get over time to stretch and push the boundaries.
[27:34] And I feel like as leaders of the audit profession, that's a
[27:39] discomfort level that
[27:41] we need to get a little bit more comfortable, to be frank.
[27:44] And I think for us, while it does sound like a bit of a textbook playbook in terms
[27:48] of adopting new technology, I think
[27:52] the difference for us is we're so laser-focused.
[27:56] We have people dedicated to drive the enablement, and we have people
[27:59] dedicated to make sure that we have a way to measure this.
[28:03] And to me, just like any strategy, Brian, is that
[28:07] it comes down to execution, and how do you sustain the execution and keep
[28:11] up with it, to me, is where I feel like we're just
[28:15] so focused on the execution and not missing a beat
[28:18] is why I believe that we are seeing some really good healthy
[28:22] momentum all around.
[28:24] That's terrific. So Nancy, as we talk about the future,
[28:28] and you've mentioned communication, delegation, and
[28:31] validation, which great framework, but I've also heard you
[28:35] say exploratory or flexibility,
[28:40] and I can see the first three going pretty well.
[28:43] I can see flexibility and exploratory being a little out of
[28:47] character for the profession in a lot of ways, and yet having
[28:51] such new skills and powerful tools to enable greater
[28:54] flexibility and exploration. Do you see anything from
[28:58] a skill set standpoint that you think will need to change or
[29:02] you'd want to encourage more to make sure that you get the most out of these tools
[29:06] in the future?
[29:08] I think that the profession overall is evolving.
[29:12] That yes, we do a lot of the core assurance work, which to me is
[29:15] absolutely valuable and will have its place.
[29:19] Where I think AI is now enabling us to now unlock is
[29:22] really the advisory. So, auditors obviously like to think
[29:26] like control by control. We come in and test, and it's very black and white.
[29:30] It failed, or it passed. Right? But when we're going to be more
[29:34] playing an advisory role, which is again, how do we
[29:38] get engaged early on strategic initiatives or implementation
[29:42] work where the business is using AI, and where do we get the right
[29:45] insights to give them the right observations or recommendations early
[29:50] so they don't miss certain controls when it goes live?
[29:53] And it sounds like very traditional and pre-implementation work, Brian, probably,
[29:57] as you would agree. But I think historically, we're not able to do
[30:01] advisory because it's very limited to the conversations we
[30:04] had with people. The artifacts that we're able to have access
[30:08] to. We didn't always have access to external research.
[30:12] We would have to get that through a consulting firm, and we have to pay for the
[30:16] expertise in terms of getting the outside-in view.
[30:19] But we all know AI can do some great research for you now,
[30:23] obviously cautioning that it has to come from the right source.
[30:26] So I think the new skill or the uniqueness of the skills and how
[30:30] a profession is changing to deliver more value in addition to
[30:34] advisory and doing more advisory is the insights.
[30:37] And so how do we not just become this
[30:42] core auditor, but
[30:43] Internal consultants, I would say.
[30:46] So to me, we're going to be wearing the auditor hat, but also
[30:50] internal consultants to advise, and we can only do that
[30:53] effectively, in my mind, if we have better tools that allow us to do
[30:57] better research, more timely. Really understand
[31:01] industry signals to bring that in, to also understand how does
[31:05] the company navigate through some of those external
[31:09] factors and incorporating that to fine-tuning our
[31:13] strategy, given things that we can't control, but it impacts us in how we
[31:17] lead our business. That to me is kind of a new realm of where we
[31:21] need to operate as auditors, and some people may not be comfortable with that,
[31:24] quite frankly. But it's a skill that we need to really
[31:27] broaden, again, insights both inside that we know, but also
[31:31] insights that we have to gather from outside in.
[31:34] I think you've made a case, from what I'm hearing from you, is that the profession
[31:38] is going to change in some fundamental ways.
[31:41] I'd like to follow up with a question to try to get more at this more deeply of
[31:45] will you change who you'll hire in the future based
[31:49] off their skillsets because of AI?
[31:53] Will you be looking for a different type of person?
[31:56] And if so, what will be different about them?
[31:59] I think the profile of an auditor in terms of, again,
[32:02] responsibilities we expect and how they get the work done, I think we will all
[32:06] agree that will change naturally, to be expected.
[32:10] In terms of how people demonstrate some of those skills to meet
[32:14] those new responsibilities, I think that there will be a
[32:18] new profile. And this is why I tell everyone, even
[32:22] as I recruit for new hires, is lean in.
[32:26] Just like if you think about many years ago, when data analytics was very
[32:30] much the thing where we want people to be data literate, we want people to
[32:35] be very analytical. To me, it's the same thing, where I think
[32:38] everybody needs to see these skills as something that is part
[32:42] of the common skill stack. And this is why
[32:46] I mention and emphasize that how do we remain relevant
[32:51] in the age of AI? And it's not just being literate with
[32:55] AI in terms of what the possibilities and risk are in the tools,
[32:59] but it's about AI fluency too. Which to me is very
[33:03] different than just being literate.
[33:05] Fluency is when you know all of those things, but you also know how to
[33:08] apply it effectively in the work. That to me is very
[33:13] distinctly different. And to me, the future auditor
[33:17] should be much more AI fluent, and that to
[33:21] me is going to be a differentiator in terms of the recruitment, the
[33:25] workforce, and remaining relevant.
[33:28] Being part of an audit shop is to me is really the fluency of
[33:32] some of the skills I shared. Will be very important.
[33:35] And what a way to cap things off here.
[33:37] Nancy, thank you so much for sharing not only thoughts of today and
[33:41] the successes and challenges you're having, but also a peek into the
[33:45] future, which
[33:47] not only sounds interesting but sort of compelling for the profession if we
[33:51] can keep up. Thank you so much.
[33:53] Thank you so much, Brian, for having me. Appreciate it.
[33:57] If you like this podcast, please subscribe and rate us.
[34:00] You can subscribe wherever you get your podcasts.
[34:02] You can also catch other episodes on YouTube or at theiia.org.
[34:07] That's theiia.org.

Shows are listed from Apple Podcasts' charts and directory, and Podcast Index where it is used. Every show and episode belongs to its publisher and plays from the publisher's own feed; this site hosts none of them.