How auditors can demystify transformative technology

Digital disruption is everywhere, including in the practice of internal audit. An audit leader joined the JofA podcast recently to discuss how technology can be harnessed instead of feared or resisted.

Anthony Pugliese, CPA/CITP, CGMA, president and CEO of The Institute of Internal Auditors (IIA), said it is understandable for fast-moving technology to be daunting. But such technology presents opportunities as well as risks. One tie-in is the new tools’ ability to attract the next generation of talent for auditing.

In this episode, Pugliese reviews recent IIA research, reminds auditors about the importance of curiosity, and discusses some of the misconceptions facing the profession.

What you’ll learn from this episode:

• Highlights of recent research by The IIA about top risks.
• Some of the “misconceptions” about internal auditing, according to Pugliese.
• How the “slow trek” of blockchain integration into processes differs from today’s tech implementations.
• The “most golden thing” auditors can do.
• A reminder of the timeline for adoption of international auditing standards.

Play the episode below or read the edited transcript:

— To comment on this episode or to suggest an idea for another episode, contact Neil Amato at Neil.Amato@aicpa-cima.com.

Transcript

Neil Amato: Hello, listeners. This is the Journal of Accountancy podcast. I’m Neil Amato with the JofA. Glad to have you back for another episode. Today’s conversation is with Anthony Pugliese, the CEO of The Institute of Internal Auditors, or the IIA. Anthony and I are going to discuss some recent IIA reports on trends. We will also talk about the pipeline for talent and other things on the minds of both internal auditors and accountants in general. Anthony, hope you’re doing well. Thanks for being on the JofA podcast.

Anthony Pugliese: Thank you, Neil. Thanks for having me.

Amato: First, let’s talk about some recent IIA research on this topic. I’m based in the Southeast U.S. So are you. We know from so many around us that hurricane damage is top of mind, and it’s part of broader climate change. How can the risks on the climate change front and also the tech front, which we’ll get to in a minute, be deemed so important, but then at the same time, in your research, not truly be prioritized by audit plans?

Pugliese: First of all, everywhere but the United States, it seems to become a really burning hot issue for internal auditors and external auditors as well. I was once told by a U.S. senator, “There’s more than enough work to go around for almost every profession here.” Unfortunately, in this country, it’s become more of a political issue than it really is in almost every other country around the world, where people are really scrambling to try to come into compliance with ISSB standards.

But if you look at our general trends on where ESG reporting or just sustainability reporting lies, it’s moving up quite rapidly. Last year it was like No. 14 globally for risk for us. By 2025, we expect it to be No. 5 — fifth-most-prevalent risk for internal auditors around the world. U.S. is a little lower, but as soon as the SEC or whatever agency ends up enacting legislation and it becomes effective, it’s going to quickly move into No. 1 or 2 probably because of how extensive the reporting requirements can be. So it is moving up.

Amato: Then the other top risk in that recent release related to technology or digital disruption. First, what does that phrase “digital disruption” mean to you?

Pugliese: Yeah, we’ve actually toyed around with that expression and thought, maybe as we move ahead, there should be a more positive connotation. Disruption is kind of only perceived as negative. I think it’s because of the speed at which so much technology change is occurring. It literally means it’s disrupting the way we do business and, by default, the way organizations do business, and then how internal auditors assess risk around that, hence, the term disruption.

There are so many unique technologies, AI being the most prevalent now. But we put them all in that category or probably the entire list would be IT-related or ESG- and IT-related, but it’s any technology that has the potential to disrupt the way an organization does business and then, hence, the risk and opportunities that come with that technology.

Amato: How in your mind can internal auditors best work with disruptive technology instead of working against it?

Pugliese: There’s probably two main ways, if you want to put it in two broad buckets. Our profession needs to understand how to audit disruptive technology and understand what about it creates risks and opportunity, then approach it in their audit plans accordingly. The other way is internal auditors and, for your audience, external auditors as well need to understand how to use it as a tool in the conduct of internal audit work.

There are many tools that are out there on the market. Commercial tools that are embedded in various internal-audit-oriented software. But both of those buckets have to be addressed. Right now we’re really focusing on how do you audit disruptive technology, with really right now a focus on cyber and artificial intelligence for our members because those are hitting at a little bit of a disproportionate heavy rate. That’s how we tend to look at it. Those two broad buckets and with a little bit of a more focus on two of them.

Amato: Probably the most popular or most commonly discussed disruptive technology these days is artificial intelligence, AI, generative AI. What’s the difference to you between being resistant to using AI and simply having a healthy skepticism of it?

Pugliese: I think for any profession, it’s really human nature to resist change, especially if it’s change you’re not the one causing. We have a lot of members that have been doing things the same way for many years. A lot of external auditors the same, doing things the same way, a lot of management accountants, and to some it works fine. It’s very difficult to take a technology and completely think about how it changes what you do from stem to stern.

I think there’s just a human natural resistance to that kind of change because it’s not simple. It’s not like all of a sudden we’re using spreadsheets and then spreadsheets are an isolated technology. It’s everything. I think it’s so big to bite off that a lot of people shy away from it, a lot of professionals. Our profession, meaning accounting and auditing, but also other professions like engineers, doctors, lawyers are shying away until they really feel like they have to use it. That’s a shame because it does bring a lot of opportunity along with the risk it presents.

But for me, we talk a lot about mindset and having a mindset that’s more oriented to technology and trying to lean into the fact that auditors are curious people or we wouldn’t have chosen the profession we did. Curiosity lends itself quite well to very difficult-to-understand, at first, technologies. It’s leaning into the mindset and the skill that I think we actually already have. We remind everyone, let’s start there. Be curious. Ask questions. Then I think some of it is a little bit demystified in terms of its complexity. Because we don’t have to know everything about AI as an example, because it can be daunting and I’m not sure there really are many people that understand everything about AI.

Amato: Yeah, it’s changing every day, too. What’s the link between technology and then also the talent issues facing internal audit and also accounting, the wider accounting profession?

Pugliese: I think in the past we had a bit of a luxury in, I wouldn’t call it a luxury. It’s always been disruptive, but we had more time to think through a lot of disruptive technologies. Think of blockchain. It’s still not 100% implemented everywhere, and we’ve been talking about that for what, seven, eight years or more that it’s been around. Slowly we started to notice it being embedded in accounting platforms. You name the platform, it’s embedded.

It became a little bit of a slow trek to get there. I think everyone had the time to ramp up. You find out, my company’s implementing Salesforce and it’s got blockchain in it, and I need to learn that, and you have a cycle of time to get comfortable with it. New technology, like AI, has hit so fast. Less than two years, I guess, next month is the two-year mark for when Open AI introduced ChatGPT, and it’s literally changed everything around the world and moving at a rapid pace.

We estimate 77% of businesses are already using it or contemplating the use of it, meaning they’ve dedicated resources and budget dollars to understanding how to use it more. It’s difficult to keep up, which leaves it to us. We can’t ignore the risk; it’s still there.

As we wait for talent to catch up to that, we ask our members, we remind our members the most golden thing to do: Ask questions and understand that, if anything, you start with governance around topics like that and understand if boards, audit committees, management, and other functions in the organization understand what they’re doing.

That in and of itself can be a huge bit of advice to a board of directors. You know, our organization doesn’t understand how to use AI, and they’re using it. It’s getting more difficult for sure, but I think it’ll catch up, but then there’ll be the next thing. We have to be incumbent to learn these things on our own as we move ahead. The market will catch up, but probably not as fast as it used to.

Amato: All this new technology, do you think that — maybe I’m generalizing some — but that the new generation, the next generation of internal auditors is really excited by new technology?

Pugliese: I do. I think the same applies for the broader audience your podcast will hit — accounting majors, internal audit majors, or people that move into internal audit from other professions. I know that young people are excited by the prospect of it. We’ve actually learned that over the years, even AICPA had research dating back years that led to the CPA Exam evolution project that really spoke to the fact that young people are excited about technology. They see it as a sexy part of the work that they want to do, and they want to learn it. You add that to — I don’t want to say less interesting subject matter — but I think technology can be a little bit more attractive than just accounting or just auditing.

When you combine the two, it really brings to life a whole other way of looking at everything we’ve ever learned. Yes, they are very much excited by it. But at the same time, I think there are students in colleges and universities, they only have so much bandwidth to learn all of the volumes of accounting and auditing data out there and IT issues, and then also learn the new technologies. Campuses and instructors are very hard-pressed to keep up with it themselves. All that said, yes, they’re very excited, and I think it’s another selling point for the profession at large.

Amato: I think it leads us nicely to this next question, which is about the talent pipeline. In addition to getting them excited about that new technology, what else needs to happen to get more quality candidates into internal audit?

Pugliese: With internal audit, I think the biggest issue that we have — and I call it an issue because we’re going to work on solving it — is there’s a lot of misconceptions around what internal audit is and what it is not. People don’t have a strong sense of the collective profession.

For example, our research and what we call Vision 2035, our best attempt to see what the profession will look like in about 10 years, we found that students thought it was a very compliance-only job, compliance with laws and regulations or just Sarbanes-Oxley, or they found it as not as glamorous as other professions. Then some even think of it as like a policing function, and probably no one in an organization wants to be seen as the police because that’s typically not the group you want to go to if you want to figure out if you’ve done something right or wrong. But I think it’s perceptions, and the perceptions need to be changed, because the profession really presents a huge avenue of opportunity, certainly to accounting majors, but quite a few more as well.

Amato: You mentioned that Vision 2035 report. You also mentioned the CPA Evolution project at the AICPA. Going forward, is there in your mind, or in that report’s details, a sort of here-to-there plan for opening up the talent pipeline?

Pugliese: There is, and we have a whole new project that we’re launching in 2025, which is our pipeline initiative, is IIA, has a bit more of a challenge I think at times, and I don’t want to say than the AICPA, because I know the AICPA has got a really big talent pipeline issue as well based on current trends — every organization hiring accountants is experiencing it. But for us, we have 117 countries that we operate in. Our membership base is at 250,000 and growing. We have to design programs that can almost work in a variety of cultures and languages and regions. That can be daunting, but we’re undertaking that now.

Fortunately, internal audit is not as regulated as a profession is like external audit, which means there is a lot more commonality as you go from country to country than there might be with the external audit profession. We’re launching a project to actually bring greater awareness to young people about the opportunities that they can experience in internal audit.

That includes the development of curriculum, which we already have. We just need to be better at making it well known and embedding it in programs. And some places around the world, I’ll give South Africa as an example, they have universities that are devoted to turning out internal audit majors at the bachelor’s level, master’s and Ph.D. programs. And there are schools in China that do nothing but teach audit, internal and external.

It’s bringing the profession and all the benefits of being in it to those universities and to those young people and also influencing the professors at universities because that’s whose students will listen to you. That’ll be the first pass at showing the opportunity that’s in the profession. Very similar to what’s going on in the U.S., I think, for the accounting profession. But it’s a time-tested approach. We’re working on that right now.

Amato: Anthony, I’ve enjoyed the conversation today. I want to give you an opportunity to sum up or touch on anything that maybe we haven’t. Anything you’d like to add in closing?

Pugliese: Well, for those out there that are practicing internal audit or for others, I just wanted to bring awareness to the fact that, as we think about shifting current perceptions of our profession, internal audit, we have developed a new set of global internal audit standards that become applicable Jan. 9, 2025, a couple of months away. But those new standards are deep. They actually provide a very different format than our prior standards on how to approach internal audit engagements. I would just ask everyone if you’re in the profession or your peripheral to the profession, you might want to become aware of those.

Our Vision 2035 report, as well as our Risk in Focus report, are free to download on our website for anyone that would like to see them. We even segregate it by regions like North America, Asia, Europe. All those are free on our website if people want to take a look at it. I do think a lot of the risks are the same in the accounting profession overall, as well as internal audit, where it was based.

Amato: Agree. We’re having a lot of the same conversations numerous times on this podcast. Thank you very much for the time today, Anthony. We appreciate you being on the JofA podcast.

Pugliese: Thanks for the invite, Neil. Thank you very much.