# Why Shadow IT Might Be Your Strongest Control

An episode of [All Things Internal Audit](https://invisiblenetwork.ai/podcast/1758983201), 17 Mar 2026, 51 min.

Audio: https://traffic.libsyn.com/secure/1984d534-f92f-4772-a722-6ac47400e67e/AI_Tech_-_Shadow_IT_V7_MP3_1.mp3?dest-id=3677289

The Institute of Internal Auditors Presents: All Things Internal Audit Tech In this episode, Daniel McCarville speaks with Bill Bensing about shadow IT and why it continues to emerge inside organizations. They explore how shadow IT often signals innovation rather than just risk, and how internal auditors can help organizations balance experimentation, governance, and operational control. The conversation also introduces a practical framework for understanding how ideas move from exploration to validation and ultimately into formal operations. • HOST: • Daniel McCarville Associate Vice President of Internal Audit Arch Capital • GUEST: • Bill Bensing Chief Technologist and Co-Founder Attestify KEY POINTS: • Introduction \[00:00:02-00:00:39\] • What Is Shadow IT? \[00:00:39-00:01:56\] • Why Shadow IT Exists in Organizations \[00:02:13-00:05:08\] • Shadow IT as a Source of Innovation \[00:05:33-00:08:03\] • Why Small Internal Solutions Can Deliver Big Value \[00:06:10-00:07:33\] • The Role of Shadow IT in Validating Ideas \[00:09:14-00:10:56\] • Why Innovation Often Fails to Take Hold \[00:12:41-00:14:00\] • How Leaders Can Enable Innovation Safely \[00:14:00-00:16:54\] • Building Communities and Internal Flywheels of Innovation \[00:17:00-00:18:55\] • Developing Internal Innovation Teams \[00:19:08-00:21:24\] • Why Experimentation and Imperfection Are Necessary for Innovation \[00:21:59-00:22:59\] • How Auditors Should Rethink Shadow IT Risk \[00:23:02-00:24:17\] • The Exploration-Validation-Operation Model \[00:24:17-00:28:07\] • Internal Audit's Role Across the Innovation Lifecycle \[00:28:07-00:31:11\] • Addressing Shadow IT Risks Without Stifling Innovation \[00:32:29-00:35:32\] • Why Building Tools Strengthens Career Growth \[00:37:11-00:39:04\] • Learning Principles vs. Learning Tools \[00:39:21-00:41:51\] • How Auditors Can Encourage Innovation While Maintaining Controls \[00:41:59-00:46:30\] • Final Thoughts: Enabling Coordination Across the Three Lines \[00:47:39-00:50:14\] Visit The IIA's website or YouTube channel for related topics and more. IIA RELATED CONTENT: Interested in this topic? Visit the links below for more resources: • Global Internal Audit Standards • IIA Certificates: IT General Controls Certificate • Knowledge Centers: Artificial Intelligence • Vison 2035 • Become a Certified Internal Auditor (CIA) • IIA Courses: Fundamentals of IT Auditing • Combined Assurance • 2026 Analytics, Automation and AI Virtual Conference • The Big Idea: Shadow AI Isn't Just a Sign of Control Gaps Follow All Things Internal Audit: • Apple Podcasts • Spotify • Libsyn • Deezer

## Transcript

[0:02] The Institute of Internal Auditors presents All Things Internal Audit
[0:05] Tech. In this episode, Daniel McCarville speaks with Bill
[0:09] Bensing about shadow IT and why it continues to emerge inside
[0:13] organizations. They explore how shadow IT often signals
[0:17] innovation rather than just risk, and how internal auditors
[0:21] can help organizations balance experimentation, governance, and
[0:25] operational control. The conversation also introduces a practical
[0:29] framework for understanding how ideas move from exploration to
[0:32] validation, and ultimately into formal
[0:35] operations.
[0:39] One of the things that I know you're really interested in is the world of shadow
[0:43] IT. Just to set the stage for what we're gonna be talking
[0:47] about, what is shadow IT?
[0:49] I'll give my definition of it. It's anybody
[0:53] that's in an organization that's not inside of a, we'll call it
[0:56] blessed IT. Now I'm assuming this organization is not a software or
[1:00] information technology organization, right?
[1:02] So it could be s- your standard bank, it could be some type of manufacturing.
[1:06] They don't build, their inherent product isn't software, for
[1:09] example. So these folks inside of these types of companies who
[1:13] have competencies to build information technology systems,
[1:17] doing it outside of the formal constraints of what their
[1:21] internal tech- their, their IT organization allows and
[1:24] provides. That's what I call shadow IT, everybody's like, they're in the shadows,
[1:28] right? So it could be they, like me, my former organization when I, at Boeing, I
[1:32] was a procurement agent, and I was writing these small little pieces of software
[1:35] outside of IT for procurement agents, and I was
[1:38] shadow IT. What I realized too is when you look at something like a big thing like
[1:42] a Google or like even a Red Hat, like to a large degree there's not a
[1:45] concept of shadow IT because that whole organization is valued
[1:49] on everybody delivering capabilities when it comes down to software.
[1:53] So when I say shadow IT, that's what I specifically look at there is these
[1:57] organizations, and I don't wanna use the word traditional, but these organizations
[1:59] where software is not the main thing that they sell, and people in there are
[2:03] building software outside of the, the blessed or the, the, the, the,
[2:07] the formally recognized constraints of where, how software gets built in
[2:11] those organizations.
[2:13] So for a lot of people out there who are presumably internal auditors, compliance
[2:17] professionals, they may have analytics teams within
[2:20] internal audit or within their compliance organization, and it sounds like those
[2:24] are examples of shadow IT. They are people doing development of various
[2:28] kinds who are outside the core of the IT
[2:32] infrastructure.
[2:32] Exactly. You could, one can consider it, and actually I, I think you bring a point
[2:36] up, there's an implied there, like the, the, not that your point was implied,
[2:39] but a lot of people think shadow IT is negative.
[2:42] I like the term for what it is. It's outside of the formal constraints,
[2:46] 'cause where does a lot of innovation happen?
[2:48] Less inside of the formal constraints and outside.
[2:50] So to your point, these analytics teams who are doing some of the stuff, now they
[2:54] may have some level of blessing, but yeah, th- they're, they're working on
[2:58] technology for the business sake outside of cer- possibly the
[3:02] normal channels. And like, it's not negative, and it's not that it's positive or
[3:05] negative. I like to think of it as a neutral term, but it describes the, the,
[3:09] it's almost like there, there was a guy named Kevin Henley, he's out of, I think
[3:12] he's out of Norway. If you ever heard the, the whole thing of functional versus
[3:15] non-functional requirements, it's almost like going into a zoo and you see
[3:19] elephants and then everything is a non-elephant, right?
[3:21] So like this false dichotomy. So it's almost like I wanna like sort of break down
[3:24] that, but yeah, you're, you're right that those are exactly the sha- the shadow
[3:27] IT.
[3:29] That's a really interesting perspective too on organizational culture, because you
[3:33] mentioned an organization like Red Hat where the concept of
[3:36] shadow IT doesn't make sense because everybody in Red Hat has to be
[3:40] data-forward and technology-forward as a part of their culture.
[3:44] Many businesses don't operate that way.
[3:46] We've specialized certain people into being the data people or the tech
[3:50] people, and that creates the possibility of shadow
[3:53] IT.
[3:54] Exactly. You're right, and you, you hit it, the specialization, right?
[3:57] And I think when you look at those organizations, what do they deliver?
[4:01] They deliver whether it's a, a specific good or something, like it, because it's
[4:04] not ingrained in the, what they deliver, that's why they specialize and that's why
[4:07] they separate. Which by the way, that's not negative and bad.
[4:10] There's a lot of people in those organizations that find it bad, but if you think
[4:14] about what those organizations do versus like what a startup does, Steve
[4:18] Blank, Four Steps to the Epiphany.
[4:20] There's basically two types of organizations, one that executes
[4:24] a known business model, and one that discovers business models.
[4:27] Startups discover business models.
[4:29] There's a lot of people in the shadow IT realms, they wanna discover things,
[4:33] right? But they're inside of this cultural constraint of an operational model
[4:37] that's about executing unknown constraints.
[4:40] I put a dollar in, I get $1.10 out, right?
[4:42] That's what a lot of businesses are, and that's where you get a lot of the, the
[4:45] rub, right? It's where you get the ...
[4:47] And not just 'cause they're specialized, but you think these organizations are
[4:50] optimized to deliver a physical good or a
[4:54] service, and to have low variability and
[4:58] high expectation and low, and even low variation, but high expectation of
[5:02] I put a dollar in, I get $1.10 out. And that's where a lot of the rub
[5:06] around shadow IT will come in these organizations, and as you pointed out, like
[5:09] somebody like Red Hat, very different.
[5:11] Everybody's delivering software, these types of services, so everybody's ingrained
[5:15] in bringing those features, bringing those ideas back into the portfolio,
[5:18] whereas that's not necessarily a value of somebody who's, you know, collecting
[5:22] trash or, or like, you know, could be, you know, c- collecting trash, could be
[5:26] delivering physical goods. That tends not to be types of value
[5:29] propositions they've traditionally relied upon.
[5:33] I think many people in the IT audit world when they hear shadow
[5:37] IT, they're not necessarily thinking of the people in the teams
[5:41] at first, they're thinking of the technologies.
[5:43] So I could imagine an organization that licenses a
[5:46] tool. Maybe we licensed Claude, and
[5:50] then we've got people in our business who instead of using Claude, they go ahead
[5:54] and get ChatGPT and use it on the side, which is not
[5:57] licensed and did not go through all the right channels.
[6:00] That's a different concept of what shadow IT is, right?
[6:02] That's focused on the technology and not the people.What's the
[6:06] advantage in thinking of it the way you do, by thinking about the people in teams?
[6:10] So when you think about the people in teams, and I'm gonna go back to my experience
[6:13] inside something like Boeing versus the technology Boeing
[6:17] IT, like, unless it costs at least 10 million or more, you think about
[6:21] with internal rates of returns, hurdle rates so I'm in the audit world.
[6:25] I got finance geeks out there that know those terms.
[6:27] Like, IT inside of something like that organization has a hurdle rate and
[6:31] internal rate of return. So if that thing's not and this is an arbitrary
[6:35] value $10 million in spend, they don't wanna touch it,
[6:38] right? And they're optimized to not touch that stuff.
[6:41] So that means everything that's 10 million and below, which could be a lot of
[6:44] stuff. Like, for me, a lot of my things are basic PHP apps and to...
[6:48] like, basically collecting some data from a data warehouse, doing a bunch of stuff
[6:51] people would do on a spreadsheet, but doing it live in interaction with some of
[6:55] these, these systems. So people have like a, a I call it a, a procurement
[6:58] relationship system. So they, they have a, they so they know things that are going
[7:02] on with their supply base in real time. That's not a $10 million thing.
[7:05] That's something like a Bill Bensing, who has limited competencies, and, like,
[7:09] back then, if I had Claude, holy cow, would I be dangerous.
[7:12] Um, yes, a lot more dangerous than I was back then.
[7:15] And when I say dangerous, I dangerous in a good way.
[7:17] But, like, as you go through, because, you know, I can go, I can go into actually
[7:20] some of the outcomes that that kind of stuff generated, which by the way, I built
[7:23] this small thing. They're still using it today, and within the first six months, it
[7:26] saved a large program on the West Coast a million dollars
[7:30] in direct procurement costs. A million dollars, right?
[7:33] As I'm going through, take the tools and technology way.
[7:37] What was somebody like a Bill doing?
[7:39] Somebody like a Bill is driven to solve these problems 'cause they experience them
[7:43] themselves. They have an idea of how they can solve it, and just by giving them
[7:47] whatever the tools or competency, they can demonstrate what these
[7:51] solutions are, and some of them hit.
[7:53] A lot of them don't, but some of them do hit.
[7:55] And then to that perspective, separating the tools from the people, the ones that
[7:58] hit, they get rolled into a portfolio that IT can now do.
[8:02] Like, the value of it, let's talk about control from a perspective.
[8:05] Like, the biggest thing around startups, like, most of them fail 'cause they're
[8:08] experimenting, and maybe the idea hits a market, but the market's not big enough
[8:11] to take it to, you know, to, to, to, to grow over time.
[8:14] That happens, like, if you think entrepreneurship outside and then
[8:18] intrapreneurship inside of an organization.
[8:20] That's what the value of shadow IT is.
[8:23] And I, and this is also to the people who are, you know, against shadow IT and
[8:26] maybe folks that are listening that are the shadow IT people, really
[8:29] understanding those fundamental differences because what you talk about, it's a bit
[8:33] of a, it's a symbiosis behavior, a, a yin and a yang.
[8:36] If you're doing shadow IT to create more effective and
[8:40] efficient operations in different ways, that's great.
[8:42] When you're doing it to try to explore all these tons of business models, now
[8:45] you're fighting against the grain of the organization.
[8:49] So yeah, so that's, a- as you think through it, it is about the people, less the
[8:52] tools. The tools are the easier things, even though those annoy people 'cause
[8:56] those give tools give people like me the ability to do things they don't like to
[8:59] do, so they go straight to the tools.
[9:02] Whether the tools are there or not, people like me are gonna find ways to do this,
[9:05] and so why not make it a form of control?
[9:09] Absolutely. So you got into there a little bit of what are the benefits of
[9:13] shadow IT, and let's come back to that more explicitly for a moment
[9:16] because many of the people listening here, they may be
[9:20] auditors, and they may think shadow IT sounds like a dangerous thing,
[9:24] or you might be the audit analytics person like I am, or you may have an
[9:28] audit analytics team, and you may be mentally now reconfiguring that to
[9:32] think of them as shadow IT because they are outside of core
[9:35] IT doing those development tasks.
[9:38] Intrapreneurs trying to bring value to their organization in much smaller scale
[9:42] than central IT does. But what's the value that these
[9:46] shadow IT teams are bringing to their organizations?
[9:49] Why do we want them?
[9:50] Validated assumptions. How many people in
[9:54] the organization have an idea of what thinking goes better, and how many times has
[9:58] it actually caused friction? So shadow IT is a mechanism to
[10:02] validate and/or invalidate, to falsify assumptions about how to
[10:06] do things differently or do things better.
[10:09] That's what I've always looked at it as.
[10:10] Now, because information technology's very malleable, it's an easy and quick
[10:14] way to do it as opposed to having to physically build stuff, but that's
[10:18] the core value right there is validated falsifiability.
[10:21] We'll put some big words around it, right?
[10:23] Validated falsifiability, i.e., being able to prove to people that what
[10:27] they think should happen, you have evidence that it should not happen that
[10:31] way or it cannot happen that way. And that's why, and not everybody, by the way,
[10:34] should be part of shadow IT or, or part of it.
[10:36] I, I, I find, like, this is the, the driven people that want this stuff, you
[10:40] empower them. Like, the best things people that I worked for ever did
[10:44] was just get out of my way. They didn't have to support me.
[10:47] They didn't have to be friction. They just got out of my way, and
[10:51] that's like as you start to think through some of that, then you, you people,
[10:55] then that's what the value is. So yeah, getting out of some of these folks' ways,
[10:59] letting them go through and prove to the organization
[11:02] that what they think they know, 'cause a lot of people think they know
[11:06] things, but it is not valid. It's invalid, or it's not
[11:10] supported.
[11:10] So if I were to summarize a little bit what is the value of shadow
[11:14] IT, at the lowest level, there's a functional
[11:17] value, it sounds like, in that they produce tools that you want at a
[11:21] smaller scale than your purchasing department wants to procure
[11:25] or a smaller scale than your IT department wants to support, right?
[11:29] The economics there for them, they need to focus on big projects, but your shadow
[11:33] IT teams can economize to smaller projects tailored to
[11:37] that domain explicitly. And then from there, there's maybe a
[11:41] organizational value in helping you
[11:45] validate your business model the way that you currently do business and then
[11:49] innovating that structure. Is that what I'm hearing?
[11:51] Exactly. A lot of people like to think the latter, those are the big dreams and,
[11:55] you know, going through some of the h- new, new things for the business, but
[11:58] more the former is the reality of shadow IT.
[12:00] It's just doing stuff to better, to make operations less frustrating,
[12:04] whatever it may be, whatever, whatever those feelings are that, you know, makes you
[12:08] not wanna, makes you wanna go home at noon instead of like, you know, kick it
[12:11] around until 5:00. That's really the, the, the efficacy of shadow
[12:15] IT. And, and frankly, you know, as a, as an organizational leader, that's where I
[12:18] wanna focus on as well. Like yeah, we've got the business we wanna focus on.
[12:22] There's things, there, there's possibilities there, but, you know, there's formal
[12:25] mechanisms like R&D that exists inside of businesses to
[12:28] find parallel and/or new lines of business.
[12:31] But the shadow IT in the organization, like efficacy and
[12:34] efficiency of how we w- h-how we operate.
[12:38] So there was a lot of really juicy stuff in there.
[12:41] I wanna start off though with why doesn't shadow IT happen
[12:45] sometimes? It sounds like such a good thing everybody would have it.
[12:48] But I'll tell you, in my career in audit analytics, I've heard from lots
[12:52] of CEOs, CFOs, chief auditors who say, "I
[12:56] want this kind of innovation. I want people to blow up my processes and make them
[13:00] more effective and more efficient and change the way I do my work." And then it
[13:04] doesn't happen. So what holds them back from doing something like
[13:08] that?
[13:08] I'm gonna say these two things out front, and I'm gonna have, I'm gonna, I'm gonna
[13:11] ask you to help me keep me on track with this.
[13:13] One is the formalities of letting people do this then bringing it back in, but
[13:17] two is also the support. So everybody says, a lot of leaders say, "I
[13:21] wanna do this." But the one thing a lot of leaders don't understand is how to lead
[13:25] these people and how to guide these people.
[13:27] This is not just let them go throw stuff at a wall and see what sticks.
[13:31] You can do that, but you'll end up with just a bunch of stuff stuck into the wall
[13:35] and not making it back in. Uh, there is a, I think it's called Corporate
[13:37] Innovation. It's a book. If you're familiar with like the business model, business
[13:40] candidate books. I have to think of the, I can't think of the name off the top of
[13:43] it. It's called Corporate Innovation or whatever.
[13:45] Anyways, it talks about building that flywheel of bringing it back in.
[13:48] So while most organizations express the intent of wanting people to do
[13:52] this, they have not set up the structure to allow
[13:56] people to experiment, but then also provide small
[13:59] investments. So, at the end of the day, like a lot of organizations have
[14:03] entitlement investments. Every year they get their X millions of dollars.
[14:06] But instead of entitlement, having these smaller like V-- when I say VC type, I
[14:10] loosely say that, letting people prove certain thesises,
[14:14] like Marc Andreessen's Onion Model of Risk. Go look it up.
[14:17] It's amazing. A startup is all about peeling layers of risk back
[14:21] at a time, and he's got 15 he talks about, and I think there's a video from him in
[14:24] the early 2000s at Y Combinator talking about this.
[14:28] But like why do you get additional funding?
[14:30] Is you've peeled back risk, you've mitigated it, now there's additional funding to
[14:33] peel back other risks to mitigate, right?
[14:35] And so as a leader listening to this, if you're just
[14:39] like, "Let them throw stuff at the wall and see what stick," that's gonna be the
[14:42] number one cause. You can't, 'cause you're not bringing it back into your main
[14:45] portfolio. There's no way to say yes, and there's no way to say no.
[14:48] Not saying either yes or no to something is the worst thing you can do for
[14:52] anybody, 'cause now that's just devoid of information.
[14:54] Now, from a leadership perspective, let's go into the actual physical how to make
[14:58] it happen. This is also where some of the tools come back in.
[15:01] So I'll go to organization. I stood up the enterprise architecture organization at
[15:05] Pods, portable on-demand storage.
[15:07] Didn't have one before then I stood it up, and one of my things was to enable
[15:10] shadow IT. So the first thing I did, the basic thing, was get everybody their
[15:14] own SharePoint on their own domain.
[15:16] And back then, this is when SharePoint 2016 came out, so it was new.
[15:19] It was like, it was basically like the cloud stuff was starting to happen in an
[15:22] organization. I gave them their formal one, but I gave them an
[15:26] on-demand way to build what I called the FUBAR
[15:29] environments. Go experiment. Go do it, mess it
[15:33] up, and then if you blow it up, let me know, we're gonna issue you a new one.
[15:37] And so for like example, the Pod sales and service organization, they actually
[15:41] built their own like issue tracking system.
[15:43] They were using spreadsheets and stuff like that.
[15:44] They built it in SharePoint, and then when it came time to do an
[15:47] ERP, they basically said, "Hey, look at what we're doing.
[15:51] You want our requirements? Here's exactly how we're doing it." They had their
[15:55] own technically competent... Now, they weren't software developers or anything, but
[15:58] there were people who were interested in learning it.
[16:00] Like that right there is the epitome, and then ultimately, that became the basis
[16:03] for requirements that fed back into an ERP system.
[16:06] Uh, similar on the financial side.
[16:08] Like they, they were doing a bunch of stuff with Excel.
[16:09] Excel, or not Excel, Access databases.
[16:13] Give them the ability to learn. So there's the two formal ways.
[16:17] Formally in your organization, how do you build the cycle of when you identify the
[16:21] stuff, being able to incrementally fund it, and then also be able to cut it off so
[16:24] you say yes or no. But the second is the physical infrastructure.
[16:28] Back then, one thing we were working on is cloud was starting to come into
[16:31] organizations, was actually giving, like folks in the marketing organization,
[16:35] they are the ones that had software developers.
[16:37] So by giving them sort of ways to work, and people know
[16:41] about Kubernetes and containers, I don't wanna get geeky in this area, but like
[16:44] giving them environments, giving them access to a Git repo back in the day, I mean,
[16:47] this is 10 years ago. But like, and letting them just write software and deploy it
[16:51] and play with it. Like those are the basic things that you can do, and that's how
[16:55] you bring a form of control. 'Cause everybody wants to build this stuff.
[16:58] They want to experiment, and they're happy to do it within a set of boundaries of
[17:02] controls, but giving that is how you can actually prove it.
[17:04] So there's the two ways. There's the organizational leadership management strategy,
[17:09] and then there is the physical ways to allow people to experiment within a
[17:13] bounds that is frankly sufficient for 90 to 95% of
[17:17] anything they could build anyways.
[17:19] Yeah, so I, if I'm imagining myself talking to this leader, this chief auditor,
[17:23] this CFO, whoever it is, and they say, "I would love to innovate.
[17:26] I would love to find a better way of doing our work," then the two
[17:30] things to put to them is, on one hand, you enable it with tools,
[17:34] so you need to give people tools and environments
[17:38] and opportunities to innovate in a safe and constructive way,
[17:42] and maybe not worry so much about if the experiments don't work.
[17:45] Just enable them to do the experimenting.
[17:48] And then on the business case, take their
[17:51] successes, celebrate them, integrate them into your organization,
[17:55] because that's how you recognize and encourage further innovation
[17:59] I want to add a third that I didn't talk about, and you actually hit on the other
[18:02] one in the second. Uh, Red Hat, big in community. Build the community.
[18:06] One thing we did was we found ways as we saw people work is could we get them to
[18:10] build presentations on what they did and how they solved it, and could we get them
[18:13] to share with other people? So outside of the IT organization of Pods, there was a
[18:17] small amount of people between some of these organizations that had their FUBAR
[18:20] SharePoint environments that they started creating like little weekly, biweekly
[18:23] things of here's what we're doing in SharePoint and here's how we're doing it.
[18:27] Like that right there, building those, those, those are flywheel mechanisms inside
[18:31] of an organization. So I'd say the third one is like, how do you know this is
[18:34] successful? You see flywheel mechanisms happening.
[18:38] Because you may see a lot of failure and people may be like, "Hey, nine of the 10
[18:41] things we do fail, so this is failure overall." No.
[18:44] If that was failure, then the VC world would never exist, right?
[18:48] It's gonna be that one out of 10 that really makes a large difference, but you
[18:51] can't get out to that one out of 10 unless you're going through those, you know,
[18:54] those other nine ones that fail. So to your point, yeah, it's building those,
[18:57] having those flywheel mechanisms and seeing those visible in
[19:01] work in your organization, that, that, that's the manifestation of shadow IT
[19:05] doing great things for the organization.
[19:08] How do you see people typically doing this?
[19:11] Is it your existing staff, you enable them and empower
[19:15] them and they start innovating? Or do you need to bring someone with some new
[19:18] technology skills into the mix and that's how you start this kind of
[19:21] innovation?
[19:22] A little bit of both, but I'll just call it the, the, the, the John Kotter
[19:25] approach, right? So for, and if people, for the John Kotter change manage
[19:29] type stuff, build a, build, build a gliding coalition.
[19:32] So the first thing I do is I go out to anybody regarding a competency and be like,
[19:36] "Are you willing to do... What do you wanna do?" "I wanna do this, I wanna do
[19:39] this." "Are you willing to learn? Like possibly off, off hours type learning?"
[19:42] "Yes." Then what I do is I fund their learning.
[19:45] There's a company called Pluralsight, but what I've done at every organization is I
[19:48] go through and I generate, I g- I get, I, I get Pluralsight
[19:52] subscriptions for these folks, and what I do as a, as a manager and leader
[19:56] is I actually build guided courses with the different things in there to get them
[20:00] where they need to go. So to your point, yes, you have to support this.
[20:03] You just can't let this sort of bubble out there.
[20:05] But what I wanna do is I wanna build a guiding coalition.
[20:07] I wanna go find the people who have the problems and who have these solutions in
[20:11] their mind, but also have the want and the drive to try to
[20:15] build these outcomes. And then what I'm gonna do is I'm gonna give them the
[20:17] support. I'm gonna give them the okay to make
[20:21] mistakes. A lot of these people, half the time, they just need to hear,
[20:25] "Yes, you're approved to mess stuff up, and guess what?
[20:28] You can spend hours of your day messing stuff up," right?
[20:31] So that's all they really need to, to... This is the getting out of the way.
[20:35] So from that organ- from there, to answer a bit of both, there's a bit of both.
[20:38] Do I need to bring formal technology people in? No.
[20:41] The person, though, that is designing and helping to upskill, they should be
[20:45] very dominant in technical competencies, so they should be
[20:49] technically a software leader interested in building these other c- these other
[20:52] folks. So if I were to bring somebody in, that's where I'd bring somebody in
[20:56] at, because you need to build that, that guide there.
[20:59] I did it at Red Hat. I did it at Pods. Then at l- almost every single
[21:02] company I've been... But as you go through, but yeah, so to answer your question,
[21:05] it's, it's a bit of both, but that's also from the leader.
[21:07] This is where focused investment comes in.
[21:09] It's not a lot of money, and you're not asking a lot of people to spend weeks at a
[21:13] time just doing stuff, but what you're doing is you're enabled th- these inherent
[21:16] drives in these folks by giving them the space to explore, letting the
[21:20] people who have the problems and ideas go explore those, and then
[21:25] basically building these formal mechanisms to bring those ideas and everything back
[21:28] in to review them. 'Cause you gotta remember, like startups, the best
[21:32] form of revenue for a startup is actually customers, not, is not, is not
[21:36] investment, flow, it's a customer. And why?
[21:38] Like, yeah, it's money, but getting customer feedback, and that's the whole thesis
[21:42] of Steve Blank and the, his four steps to epiphany is getting out of the office and
[21:45] getting feedback. By you as a leadership organization
[21:48] structuring those mechanisms, you're now building in formal
[21:52] feedback to ensure that this type, that they're not going, that the
[21:56] course they're going on is, is the value-added course, that they are
[22:00] discovering where value is. And when I say feedback mechanisms, it's not if
[22:04] you're a leader that thinks you're omniscient and you're just telling them, "No, it
[22:06] doesn't work that way," that's not the feedback. You're now being more Socratic.
[22:10] You're looking at and asking the questions, how do you know that that's
[22:13] valuable? Falsify, give me falsifiability or give, prove
[22:17] me, you know, what is, prove to me that that is the value, that
[22:21] type of stuff to keep them guided in those, in, in their
[22:25] directions.
[22:26] I think there's a lot of really interesting cultural stuff in there because
[22:30] as auditors, we spend all day, every day criticizing the
[22:34] things that we see, and we do that constructively to provide value to those
[22:37] processes, but there is sometimes a tendency to
[22:40] internalize that message and then feel like everything you do
[22:44] has to be perfect the first time or it could never possibly
[22:48] work. But there's a little bit of a lesson here in it's okay to innovate.
[22:51] It's okay if your tools work 80% of the time because that's still
[22:55] bringing a lot of value, and we can enable people to bring that new value.
[22:59] Wanna transition just a little bit here.
[23:02] Let's speak directly to those auditors. They're out there auditing.
[23:05] They hear shadow IT, and they see risks.
[23:08] And because I'm in the insurance industry, I'm gonna be more specific and say we're
[23:10] talking about hazards. These are risks that can only ever be a
[23:14] bad thing. What would you tell those auditors to
[23:17] maybe enable them to look at shadow IT slightly
[23:20] differently?
[23:22] So, so dear auditors, I'm gonna help you help yourselves by helping the
[23:25] first line, first off, know they're the first line at the end of the day, and I'm
[23:28] gonna give you a way to do it in what I'm gonna call, call this Bensing's three
[23:32] systems model. So being a, a, a little, a little more humble, let's call it
[23:36] the EV- EVO phases, exploration, validation, and
[23:40] operation. As an auditor, you are trained, which an auditor is
[23:44] very... When I say auditor, I'm gonna separate auditor for somebody who just
[23:46] executes, right? Somebody who just executes to a large degree, and I'm
[23:50] gonna take formal engineers off the plate at this point in time, 'cause formal
[23:54] engineers understand the yin and yang of execution and risk
[23:57] management.
[23:59] Execution folks-A lot of the time it's they're told to jump how
[24:03] high, go fast, and they just keep going with irregard
[24:07] to whatever the uncertainties are, right?
[24:09] Now, I'm gonna say complete reckless regard, but that's why you see on the,
[24:12] on, on the, on the audit side the, the risk side there's
[24:16] fear. And so actually there-- what I love about the three lines model and you start
[24:20] thinking of indifference is like teach people what...
[24:23] The thing about auditability is verifiability.
[24:25] A lot of these execution folks have never learned, they could be in industry for
[24:29] thirty years, what it means to prove beyond their own mind
[24:33] that this thing is what it's supposed to be, right? Or it's good.
[24:36] Like what does it mean to actually prove to verify and
[24:40] validate what this is? The best thing the third line can
[24:44] do is to help the first line understand that.
[24:46] And when it comes to the shadow IT, this is where I bring in sort of these three
[24:49] phases, exploration, validation, and operation.
[24:53] So as an auditor looking at shadow IT as, as a
[24:56] mechanism for exploration, you can mitigate the risk by putting,
[25:00] some, some constraints around it, which basically is like let that exploration
[25:04] phase happen, because to a large degree the output of that which will go into the
[25:07] validation, there's a boundary between it.
[25:09] At that boundary, start to help the folks on the, on the front line
[25:13] understand what they need to do to sort of identify what risks and uncertainties
[25:17] should be mitigated before it goes into validation.
[25:19] Exploration is literally somebody like Bill's got an idea in their
[25:22] head, can they make that work? It's just mechanistically can you make it
[25:26] work? Don't get in their way. Stay out of their way.
[25:28] Let them mechanistically make it work within some level of sandboxed
[25:32] environment so there is no second order effect.
[25:35] But really in exploration there is no second order effect beyond what that
[25:38] person who's creating this thing is.
[25:41] Now once you get into the stage of validation, that's when you start to bring other
[25:44] people, like say Bill's created this thing, he's proved he can make it work.
[25:47] Now he's got Daniel, now he's got somebody else who's like, "I'm interested in
[25:51] trying that." Where you can come in, and this is sort of in, in line with Vision
[25:54] Twenty Thirty-Five, right? So I know there is the like I'm the independent
[25:58] auditor, but there is also the other side of that that I have the
[26:02] auditing expertise that I can coach the organization in how to
[26:06] verify and validate when it comes to risk.
[26:08] So taking that version of it and coming in and working, helping them to
[26:12] identify between exploration and validation what it means to
[26:16] identify where the uncertainties are, 'cause most of the time they've never truly
[26:19] been asked to do that. Or I take it back.
[26:21] If they've been asked, they've never been given any clear
[26:24] mechanism on how to do that. It's like giving a child some pieces of
[26:28] wood, a hammer and nails and saying, "Go build a birdhouse." I mean they've
[26:32] seen birdhouses so they know what they look like, but to get from that raw
[26:35] material to that finished product, they've never seen it happen
[26:39] before. So that's... I mean I don't wanna call f- I don't wanna call first liners
[26:42] children because I mean even though my, my wife would call me a big kid, I am a
[26:45] first liner. It's just sort of like i-i-in that same
[26:48] vein. But if you go to that validation, this validation step is now I'm bringing
[26:52] other people in, right? I have second order effects that, you know, Daniel's data I
[26:56] could do something wrong with it. So but it's still, it's not an unrisked
[26:59] environment. The people that are coming in and interacting with this
[27:02] thing in the validation phase, there is an admission on their part
[27:06] that they know that there are risks inherent and there are uncertainties inherent
[27:09] to th-their interaction with, with whatever's being done.
[27:13] And so that's where you have that level of risk mitigation, but the biggest one is
[27:16] going from validation to operation, and that's where a lot of auditors can get
[27:20] involved because that's what people always like tend to think, whether it's an
[27:23] auditor or even a tech person. I've been in many org- IT organizations have these
[27:27] people work for him, for me and they're just like, "No, they can't touch it unless
[27:30] they do one hundred percent right." And I look at them like, "You can't do one
[27:33] hundred percent right. Why would we expect everybody else to do that?" So it's
[27:37] like, so like these unreasonable expectations, but what's the reality?
[27:39] It creates this burden. But by having this exploration,
[27:43] validation, and operation phase, what you're doing is you're weeding out
[27:47] mechanistically can I even get it to work?
[27:49] If you can't get it to work, it doesn't go to validation.
[27:51] Now that it's in validation, is it actually something just more than Daniel and
[27:55] Bill can find useful? Are there people in it?
[27:57] Is there a justified reason to put resources into scaling
[28:01] this beyond two, three people, maybe a team?
[28:04] If there is, cool, we'll get an operation.
[28:05] And each of those boundaries represents a time for auditors to come into
[28:09] play from a consultatative and coaching perspective even to help build
[28:13] this out of the organization. Think about combined assurance from the combined
[28:17] assurance approach. Building and helping to blueprint and grow towards sort of a
[28:20] level of combined assurance in a graduated way that you can allow exploration
[28:24] to happen, but as it goes into an operational reality you are
[28:27] building control. Not saying controls, but you are building
[28:32] control along this path to
[28:35] operations, and then you have your operational control standards.
[28:38] So let me see if I can translate in my own words those three steps and what
[28:42] internal audit is doing here. In the exploration phase, this is
[28:46] where you're generating the use cases, generating ideas, and just looking at your
[28:50] work and saying, "Can I do it better?" I think audit does have
[28:54] a really interesting role there in that as the auditor you see all of
[28:58] the business process in your organization.
[29:01] You've seen the portfolio of technologies that this one
[29:04] team who are not engineers, who are not IT experts, they have no
[29:08] notion of these things. So you're in a really great place to help them
[29:12] explore how they could solve their problems.
[29:16] That's not an audit finding, it's not an audit opinion, but it could be some darn
[29:19] good consulting. And then in the second phase when we're
[29:23] validating, that sounds like more of a traditional auditing perspective
[29:27] of, you know, you're up there taking swings, you're trying to
[29:30] improve your business world. Are you effective?
[29:34] Are you managing risk? Are you doing all of these things to make sure that this
[29:38] is safe for our organization? And then in the third phase it
[29:41] sounds like that's more of a broader rollout.
[29:44] How do we maximize the value and get this out to all of the
[29:48] people who could get value from it?
[29:50] Yeah, I think that's pretty accurate.
[29:52] And just to read back to you, like in that operational phase, I think that's where
[29:54] the trad- the, where the auditor puts on the traditional, independent hat,
[29:57] right? It's now to get across that boundary from validation to
[30:00] operation, you need to bring that independent perspective in.
[30:03] But as you pointed out, like in the second one, the validation, you take the
[30:06] independent hat off, and you're basically, you're consulting, saying, "Hey, we need
[30:09] to get to a higher level of fidelity to get over this." That's where you're really
[30:13] cooperating. So when you think about what you talked about, the first two levels of
[30:15] cooperation, in an operational, you're cooperating around the true
[30:19] tenets of managing risk and uncertainty that audit was founded to
[30:23] verify. And then to your point on the exploration phase, they see
[30:27] a whole swath of things. They have ideas.
[30:29] Maybe they have the competencies to bring it, maybe not, who knows?
[30:33] But I can tell you right now, it's never one independent genius that does this
[30:36] stuff. It may be one person that pushes that boulder up the hill till it rolls back
[30:40] over them, but there's always people with them working
[30:44] together. And exactly, the, the auditor could be the seed that grows that,
[30:48] finds a build type who just can't sit on his hands and says, "Hey, I got this
[30:51] idea. I see you like to write some of that software stuff.
[30:54] Um, how about you bring your Claude code over here and we look at this thing and
[30:57] see if you can prototype me something?" Right?
[30:59] That right there, and what is the point of audit?
[31:02] To reduce uncertainty and mitigate risk.
[31:04] And if you think about risk, risk is not just threats, it's opportunities.
[31:08] And so now this is where audit expands and brings these additional
[31:12] ... Like, 'cause everybody says they wanna have business value.
[31:14] I hate that term business value because business value basically means I just wanna
[31:17] figure out how to do something. So people are not gonna like my, my term on that.
[31:19] But that's actually, like, what does it mean to have business value?
[31:22] Right there, and I think you've nailed all three of them.
[31:23] That's exactly where the value from audit can be driven at each of those phases.
[31:27] I guess to use a little bit of the auditing vocabulary, the terms of art,
[31:31] maybe in that validation stage, we're looking at the design
[31:35] of the process and the design of the controls to ensure that they
[31:39] can be verified, and then in the operation phase, we're looking at in
[31:43] their performance, were they actually performed correctly
[31:46] according to design.
[31:48] Amen. And I'd even go one further. Standardizing design across all of
[31:52] it, 'cause this is one of my things, and I write about this.
[31:55] I'm writing about some of this thing is, like, when you have very differing
[31:57] standards, you increase your probability of at least one failure, more source of
[32:01] risks you put in there. And a, a, a, a control is also a source of
[32:04] risk at the end of the day, and so more standardization across that.
[32:07] So I, I wanna sort of pull a little further on what you're saying.
[32:10] If you can use the EVO phases to actually more standardize some of this, help
[32:14] to standardize the technology, standardize the process, standardize the control
[32:18] designs, you reduce variability.
[32:20] Variability reduction is risk reduction. You're doing your job.
[32:24] Yeah, you know, that's a good thing to bring up too because although there's a lot
[32:28] of positives to shadow IT, they do operate outside of the
[32:32] ordinary SDLC, software development life cycle.
[32:35] They do operate outside ordinary change management and ordinary
[32:39] IT general controls. So there are hazards
[32:43] there. What would you see as the key hazards, and maybe what are the
[32:46] most beneficial ways to address those?
[32:49] You're right. They have hazards, but the hazard isn't the shadow IT
[32:52] itself. The hazard is the lack of the integration of bringing them from
[32:56] evaluate, from exploration to validation to operation.
[32:59] If you just want to sort of stiff-arm them and keep them out there, expect them to
[33:03] keep doing what they're doing and expect to keep seeing the hazards.
[33:06] But pull the stiff-arm out, bring them on in, and teach them how to be part of the
[33:10] delivery team, and you'll see that things change quickly.
[33:13] 'Cause these individuals, they, they all have professional pride.
[33:16] They all have this drive to wanna solve and create.
[33:19] And you say, "Hey, to get to this next phase, I need to do X, Y, and
[33:22] Z," a lot of the time maybe it's a bellyache for some of them to start with, but a
[33:26] lot of the time it's like you gotta get to phase two.
[33:27] Here's how you get to phase two. Give them a clear path, then the hazards start to
[33:31] disappear.
[33:32] Yeah. You know, I'm impressed kind of in my daily life too where when you
[33:36] reach out to IT and you start telling them what you want
[33:40] to do, they will be more than happy to help you.
[33:43] So if you're in shadow IT, if you're in audit analytics or any other similar
[33:47] kind of role, if you call up your IT function and you
[33:51] say, "I'd really like a GitHub repository.
[33:53] Can you teach me to use GitHub?" They will be over the moon
[33:57] happy to tell you because they recognize the tremendous
[34:01] value of those kinds of controls. They want you to also
[34:05] get that value. So it doesn't have to be a scary thing.
[34:09] My experience is, yeah, IT would be more than happy to bring you into that world of
[34:13] a better controlled, better engineered solution.
[34:16] You, you're absolutely right. And I wanna speak to earlier we were talking about
[34:18] the flywheel. Like, this is the mechanism.
[34:20] Dear CIO, dear CFO, dear CEO, you don't need to put on
[34:24] formal things. What you need to do is have inf- well, you can have a formal path,
[34:27] but have informal pathways. Like, you don't need to stand up these lunch and learns
[34:30] once a quarter to talk about some of this stuff.
[34:31] You could if you want to, but what I tend to find is having that open door policy
[34:35] that says, "Here is our shadow IT open door policy.
[34:38] You're experimenting with this stuff. We want to enable you.
[34:41] We'll tell you about some of the stuff we do in the capabilities, but at some point
[34:43] in time you need to come forward and ask us as well, like, how do we get there?"
[34:46] And then to your point, like, geeks love to geek.
[34:49] A lot of the informa- a lot of the IT people, they learn stuff too because here's
[34:52] the thing is, like, a lot of folks in IT, they like their tools, and they really
[34:55] jump around to jobs to play with their tools.
[34:57] Provide that as a mechanism, and as we can talk about control or risk
[35:01] mitigation, to your point, it's, it i- that is a form of a, of a, of a
[35:04] control. Think about change processes and change management.
[35:07] I could, like I could make this a broa- broader argument for that as well, making
[35:10] that part of your change process as well.
[35:12] Like, you're not just changing the software, but you're also changing the people
[35:14] too. And so you are de-risking and, you know, reducing uncertainty by
[35:18] bringing everybody up to a minimum level of understanding to
[35:21] deliver less hazard-full solutions.
[35:25] You don't have zero hazard solutions, but you less d- within the bounds of
[35:28] tolerances you as an organization are willing to accept.
[35:32] So reflecting a little bit on what you just said and maybe some other themes
[35:35] throughout this whole conversation, what I'm absorbing, and
[35:39] you haven't exactly said this, but the source of our risk is
[35:43] people and the things that we do and the choices that we make, so
[35:47] the best way to manage that risk is to, to engage people as
[35:51] people, not through formal processes and procedures, not just by changing
[35:55] the technologies, but just byHelping us all to do our best.
[35:59] Is that part of the message here?
[36:01] It's part of the message, and I think that's like, that's my call to action for
[36:03] internal audit right now, engaging the people to do the people. There's, there's...
[36:06] I'm gonna, I'm gonna be a little selfish.
[36:08] I'm working on something right now I call the combined assurance model.
[36:10] Like, if you look at the, the, the King III, like he has the big overlap and things
[36:13] for combined assurance. But one thing I've realized is missing is I'll use the word
[36:17] standard specifications. Like you said, engaging the people for the people.
[36:21] There's a lot of lack of specificity when you go from a control objective down to
[36:24] like some level of control procedure.
[36:26] What does it mean to actually meet that control?
[36:28] What's measurable about that, right?
[36:30] And so working with and across those to bring this idea of a control standard,
[36:34] and then to your point of like the resources, the people resources, these are
[36:37] mitigations. Having clear standards is the source of mitigation.
[36:41] So absolutely. I, I look at this as a call from the combined assurance approach
[36:44] for internal audit because this is...
[36:47] I mean, I get a little meta with some of this, but it wouldn't...
[36:49] I mean, at the end of the day, what is assurance?
[36:50] It's just verifying and validating you're doing what you say you're doing.
[36:53] How do you delineate what you're doing?
[36:56] And that comes down to helping, when you talk about the people helping the people,
[36:58] help them delineate what it is they're doing,
[37:02] and that way you can provide assurance and you can be an independent...
[37:05] You, you can have an independent objective opinion of whether they are doing what
[37:08] they say they're doing and if it is valid.
[37:11] So if I start doing shadow IT things and I start developing
[37:15] tools to make my world better, whether I'm an auditor or a
[37:19] salesperson or, you know, mechanic, whatever it is that I do,
[37:23] right? I think one pervasive fear that I hear from
[37:26] people is, "I'm gonna build these tools and they're gonna take my job, and then
[37:30] I'll be unemployed." How reasonable is that
[37:33] fear?
[37:34] Unreasonable, because it's quite the opposite.
[37:36] I'm gonna build these tools, and now you become accountable and responsible for
[37:39] managing them. Here's the number one drawback to anybody who wants to do the shadow
[37:42] IT thing. You build it, you own
[37:44] it. If you want it to go forward, this is like anything in most organizations, you
[37:48] have the idea, you build it, you own it, you need to drive forward.
[37:50] Actually, the one thing that optimized me for doing some of the startup stuff I'm
[37:53] doing and building go-to markets and things like that is having to push my own
[37:57] stuff forward in an organization.
[37:58] So no, it's not gonna take your job back.
[38:01] Actually be, be ready for it. You're most likely gonna have to own it for a long
[38:05] time until it becomes something that is truly pass off-able,
[38:09] if that's a word, and you can truly pass it off, right?
[38:11] And so in, what's his name? When you think, the beyond,
[38:15] crossing the chasm, I, I can't... Geoffrey, Geoffrey, forgot his name, but crossing
[38:19] the chasm, the high, the high technology adoption curve, you get, you've basically
[38:22] get to what's called a full product offering.
[38:25] And so to it, no, these things aren't going to.
[38:27] Right now with things like Claude and whatnot, you have the ability
[38:31] to create at speeds that nobody's ever created for.
[38:34] Now, just 'cause you can create doesn't mean it's valuable or, and it's gonna
[38:37] create an outcome. But no, you're not gonna lose your job.
[38:40] Frankly, you may be put in a different position.
[38:42] So as I did this through my career, like I talked to my wife about this, every time
[38:46] I did this career, I grew up in the ability to go higher in the
[38:50] organization 'cause now I had to take on more accountability and more, more
[38:53] responsibility. So quite the opposite.
[38:55] You build it, you own it. Don't expect anybody else to own it.
[38:58] But also at the same point in time, once it becomes valuable, as I say, valuable
[39:01] people do valuable things. That's why they became valuable people.
[39:04] And so that right there is no, you're not gonna lose job and it's going
[39:08] to... It's gonna create more work, not less work, just a different type of
[39:12] work.
[39:13] And maybe part of the lesson there is that the tool builder is much
[39:17] more employable and has much better prospects than the tool user.
[39:21] If you have domain competency and you have building
[39:24] capabilities, you're dangerous at the end of the day, regardless of whether
[39:28] you have Claude or whatnot. This is one thing I've seen throughout my career.
[39:31] The ability for somebody to understand a domain deeply, and I'm not saying
[39:35] PhD level deep, I'm just saying probably master's degree deep, right?
[39:39] And then the ability to actually build a solution that solves it, you will
[39:43] do valuable things as an outcome, which will make you a valuable person, which will
[39:47] continue like in, in, in your career.
[39:49] And so, and I look at that from a lot of, from a lot of competencies as well.
[39:52] Like if you're a domain expert and you have auditing competencies, like talk about
[39:56] going in and having those deep domain understanding so you can go help people
[39:59] actually root out some very specific causes of uncertainty and risk in some of
[40:03] these areas. And it's not just doing the traditional audit opinion.
[40:06] It's like, hey, when you're building, you are changing, you are modifying, you are
[40:09] mutating, you are taking sand and putting it into glass
[40:13] at the end of the day, and taking that glass and making it into a pretty sculpture
[40:16] or a window. Like that's the essence of building.
[40:19] So to operationalize that a little bit, I hear from people all the time who
[40:24] see the data analytics is great. They wanna become analytics
[40:27] people. They wanna get into what you were calling shadow IT, but what
[40:31] we might call audit analytics. And they say, "Should I start by learning
[40:35] Tableau? Should I learn SQL? Should
[40:39] I learn any of these various technologies?"
[40:42] And I think the advice I'm hearing from you would be something more like, well,
[40:45] instead of learning to use the tool, learn something
[40:49] like data modeling, data engineering, inference, like learn
[40:52] these broader disciplines, and then using the tool comes with
[40:56] it.
[40:57] You hit it. So I'll get back to the first principle.
[40:59] So I think there's a bit of a yin and yang.
[41:01] Don't learn the tool or think you can learn the tool and you understand the, the
[41:05] first principles. A lot of tools are abstractions of the principles.
[41:08] So use the tool to learn the principles behind what you're
[41:12] doing, but don't think that just by using or adopting this tool, you are
[41:16] now this, this thing. Because to your point, if I take the tool away from
[41:19] you, can you still operate? If I give you pen and paper, it
[41:23] may take you 20 times as long to do it, but can you do it?
[41:27] And that's how you know you know it.
[41:28] If you understand the first principles, by the way, there's a book called, I think
[41:31] it's Model Thinking, highly recommend reading that.
[41:34] If you understand the first principles around what you're doing,
[41:37] then you are dangerous. When you...
[41:39] When tools come, when you have tools, you're now one at,
[41:43] one, you know, you're 2X dangerous, one plus one equals three.
[41:46] So to that point, as you're going through and learning, absolutely agree.
[41:49] Don't hinge on the tool, but you can use the tool as a way
[41:53] to learn the first principles, and I think that's key with some people because as
[41:56] you're going through, and you just sometimes as a human, we need a f- way to
[42:00] get our hands onto it. Tools gives us the ability to be our hands-on, but don't
[42:03] stop at the, "Oh, I did it, so now I know it." No. Like now take the tool away.
[42:07] Can you do it without the tool? And if you can, now you know
[42:11] y- y- you're a builder
[42:13] Absolutely. I think that's a pretty empowering message too
[42:17] I'm biased 'cause I'm talking about it, but you're absolutely right.
[42:19] Like, I think that's the most empowering thing. And this is the ...
[42:21] Maybe let's get a little meta here, a little thing, is like a lot of people think
[42:24] other people are standing in their way. The reality is they're not.
[42:26] Most people don't even know you exist, right?
[42:29] And so it's one of those things, when it comes to some of the, the builder things,
[42:32] like when you can do that, that is truly how you build value.
[42:35] You understand a domain competency.
[42:37] You can use a tool because you understand the first principles to build something
[42:40] or deliver something that doesn't exist in the way that it could generate
[42:44] some type of good return for somebody. And I'm not just talking about money.
[42:48] It's always like I could give more time back to Daniel if I could get him and a lot
[42:51] of people like him like this using this, right?
[42:53] And so it's like, yeah, to do important things, to be an important person, do an
[42:57] important thing.
[42:58] Yeah. You know, I've spent a little bit of time directing your ideas to the audit
[43:02] analytics person because I think it's really interesting for them to
[43:05] reconceive of what they do as shadow IT, and it's a really productive way
[43:09] to rethink that role. But now to get back to the core auditors who are
[43:13] out there auditing IT activities or business activities
[43:17] that they have developed their own systems, right?
[43:21] The auditor is gonna be concerned, like you've already described, about are risks
[43:24] being controlled, are the controls being implemented and
[43:28] operated the way they're supposed to.
[43:31] How do you strike a balance between wanting to
[43:34] deliver those observations where maybe those controls aren't
[43:38] designed well and aren't being operated effectively, while also
[43:41] recognizing that actually what you're doing is really valuable and I don't want you
[43:45] to stop?
[43:46] So by saying that, it's as a ... If I were to read, make sure I understand the
[43:50] question, let's say I'm the, I'm, I'm the auditor, and I'm providing an independent
[43:54] a- analysis that this is not designed well, but I want you to keep going.
[43:57] Like, I'm telling you it's not designed well, but I don't want you to stop.
[44:00] I want you to keep going. Is that sort of-
[44:02] I want you to improve. Uh, I think sometimes when people
[44:06] hear, you know, my controls aren't designed well or I'm not
[44:10] operating them successfully, it's like discouraging.
[44:12] So how do you deliver that message without discouraging
[44:16] people from innovating more?
[44:18] So this is where the partnership aspect comes in, and so this is where because I'm
[44:22] on the fir- on the front line and not third line, I think this is where some of the
[44:24] rub comes. There's a time to be independent objective and there's a time not to be.
[44:28] When you're assessing and doing the opinion, be truly independent and objective
[44:31] about it, but when you're like, "Hey, I don't want you to stop," that's when you
[44:34] have to cross a line. And so as we go through this, there's a balance to walk,
[44:38] but also when you talk about design of controls, I can tell you the first and the
[44:41] second line, which really doesn't exist that should know how to do this stuff, they
[44:45] have no clue. And so this is where like to help the third
[44:49] line help themselves, they need the help of the first line.
[44:51] And so having the ability to snap that line somehow and have it
[44:55] organizationally acceptable, I think having what I would call, I would c- just call
[44:59] audit engineering teams, right? I'll just broad, like 'cause everybody likes a new,
[45:02] everybody likes a new term and to belong to something called audit engineer team.
[45:05] What that audit engineer team does, or let's call it governance engineering, right?
[45:08] They step out of the independent, and so may- eight- maybe every nine months
[45:12] they're doing independent audits.
[45:13] Then they snap a line so the next nine months they're not doing audits, they're
[45:16] actually listening to what their peers audited, and they're teaching the people,
[45:20] and they're saying, "Okay, we're not gonna have you stop, but I'm gonna teach you
[45:23] and I'm gonna help you what it looks like to design controls.
[45:26] And I'm gonna show you what it la- what it means to be verifiable and validatable,
[45:30] and I'm gonna help you. I'm going to ... It's not holding your hand.
[45:32] I'm gonna be part of the team. You're great at software.
[45:35] You great, you, you're, you know, you personally are great at software.
[45:38] You personally know the domain. Like, you have a team, and I'm gonna be part of the
[45:41] team that helps to balance the risk perspective
[45:45] along with the operational perspective." And if you think about that from like a
[45:49] governance engineering team perspective, that right there is a sociotechnical
[45:53] model that an organization could use, and it's not outside the
[45:57] bounds of anything. Actually, I think things like Vision 2035, I've seen stuff from
[46:00] PCOAB, like this idea of getting closer and
[46:04] collaborating, that is a physical implementation of collaboration.
[46:07] Snap a line, you've gone from issuing opinions to now listening to your, what are
[46:11] your peers' opinions and helping these people understand what it means to design.
[46:15] So you're in the design perspective. You're helping them.
[46:17] It's not just issuing another independent's opinion.
[46:20] You are designing. You may be codifying.
[46:22] So from the audit analytics perspective, you may be writing a little Python to do
[46:25] something. Like, you're getting your hands dirty in ways you've never got your
[46:29] hands dirty.
[46:30] Yeah, I, I think part of what I'm hearing there is
[46:33] historically that kind of collaboration, and when I say historically, I don't know
[46:37] what I mean, prior decades, these kinds of conversations have happened
[46:41] at a high level. The chief audit executive or the audit vice
[46:45] presidents meet with the chief technology officer and
[46:49] tell them what it means for a control to be designed well.
[46:53] But there's another dimension here where the
[46:56] operational IT people, but maybe the operational
[46:59] shadow IT people need to have contact with
[47:03] auditors so that they can be coached and learn what effective controls
[47:07] look like, not just to test them, but to tell them what it even means
[47:11] for a control to be successful.
[47:13] Well, first, just to define what the heck a control is, I can tell you right now
[47:16] your shadow IT persons that come through, when they hear the word control, they're
[47:19] not thinking what you're thinking.
[47:20] Same thing with the word control between third line and first
[47:24] line. Like yeah, you use the word control with the shadow IT and the
[47:28] first line, they're gonna look at you and be like, they're gonna giggle and be
[47:30] like, "What are you talking about?" So absolutely, I think that is even
[47:34] more key.
[47:35] Well, is there anything we haven't talked about here that we probably
[47:38] should?
[47:39] Wow, no, I think we've covered everything.
[47:41] I mean, at the end of the day, if I were to try to sum a couple things up,
[47:45] it's, you know, as, as things are moving faster,
[47:49] coordination, I won't say collaboration, collaboration's expensive, but
[47:51] coordination is key. A- a- as an internal auditor in the, in the
[47:55] auditing industry, understanding how to increase coordination across
[47:59] all three lines. First off, letting the first and second line actually know there's
[48:02] three lines at the end of the day. Like, it's a great model. Like, that is key.
[48:06] So driving coordination, understanding that there is the risk,
[48:10] there's operational execution and risk mitigation as a yin and a
[48:13] yang, and then crossing those lines to go help people
[48:16] understand. But also like from a co- a John Kotter perspective, just start building
[48:20] a guiding coalition to drive that change.
[48:23] Um, this change does not happen from ...
[48:25] Unless there is highly incentivized top-down
[48:28] changeWhich rarely it happens. It's not going to
[48:32] happen unless it happens generally from a middle up or a, a middle out or a bottoms
[48:35] up perspective. Uh, that's a reality everybody's gotta, gotta come to grips with,
[48:39] and everybody complains that they want this institutionalized, but the best things
[48:42] I've ever done have never been directed towards me.
[48:45] They've been me seeing problems and reaching across the aisle and being like, "Hey,
[48:49] I have this idea and this solution," and then being humble enough to listen to
[48:52] everybody complain about their stuff.
[48:54] So at the end of the day, that's a bit of the message there.
[48:57] So as the first line, to help the third line help themselves, they have to help the
[49:01] first line and the second lines understand what their roles and accountabilities
[49:04] are. Because as we get to moving, like you talk about cloud as, especially in the
[49:08] software that's run as execution just becomes so high
[49:12] in variation, high in variability, and high in volume, shadow
[49:16] IT is your first control at the end of the day.
[49:19] If you can't enable those types of people and
[49:22] organizations to help you help themselves so they understand what validation and
[49:26] verification looks like, what it means to be
[49:29] auditable, then you're never... You're always gonna face the same
[49:33] problems that you have, and the thing is they're gonna 10, 20X worse.
[49:37] Your queues are gonna back up, and it's just gonna be, I mean, I could s- just
[49:41] like, that's just like that, that, that downward spiral.
[49:43] So at the end of the day, you've talked about it, Daniel, like you have a
[49:46] perspective. You have a burden of knowledge.
[49:48] O- o- overcome that burden by going and helping these folks.
[49:52] Drive these formal organizations. Build these flywheels.
[49:55] You don't have to be granted okay by your CAE.
[49:59] Just dear CA-CAEs, if you see it, get out of their way.
[50:02] At best, give them a little money to help them, right? Give them some guidance.
[50:05] Give them some, you know, whatever it may be.
[50:07] But I think that's the, that's my key takeaway, my key message to the,
[50:11] everybody across the industry.
[50:14] Well, thanks for joining us here.
[50:16] Thanks for having me on.
[50:18] Ready to strengthen your audit work with analytics, automation, and
[50:21] AI? Well, join the IIA's
[50:24] AAAI virtual conference on April
[50:27] 7th. You'll hear practical strategies, real-world
[50:31] insights, and earn up to nine CPE credits, plus a bonus
[50:34] AI nano course included with registration.
[50:37] Learn more at theiia.org.
[50:41] If you like this podcast, please subscribe and rate us.
[50:44] You can subscribe wherever you get your podcasts.
[50:46] You can also catch other episodes on YouTube or at
[50:49] theiia.org. That's
[50:51] T-H-E-I-I-A dot
[50:54] O-R-G.

Shows are listed from Apple Podcasts' charts and directory, and Podcast Index where it is used. Every show and episode belongs to its publisher and plays from the publisher's own feed; this site hosts none of them.