Add Digital Signature Menu Compliance Audit Report with airSlate SignNow

Add digital signature Menu Compliance Audit Report

so let's meet our presenter for the webinar today we have sergio sernaton cpa and cisa sergio is the vice president of product strategy at galvanize sergio has over 20 years of eternal audit external audit risk and regulatory compliance consulting experience with deloitte kpmg straight talk consulting and galvanize at galvanize sergio is responsible for shaping product content and enablement strategy managing influencer and analyst relations and performing proof-of-concept projects on emerging project product capabilities sergio thanks for so much for being with us today i'm just going to go over the agenda for our web webinar today next slide why the current approach to internal audit reporting isn't working anymore another point is what management's expectations of agile audit reporting are and how to effectively present audit findings and recommendations so that they are acted upon we're going to start with a polling question how impactful would you say your internal audit reports are select from the following extremely moderately not enough negligible or zero or i don't know so go ahead and answer that and sergio i'm going to welcome you uh to our webinar today hello everyone and thanks joe and and welcome uh to our session today very excited to be here and looking forward to an engaging time together and your questions and as we're awaiting the results i thought we'd start with this question because it's important to know at the end of the day the assessment of our impact on our organizations because we all strive to add value and and promote uh sound financial practices and promote our organizations forward so it'll be interesting to see joe uh where the today's audience uh ranks themselves uh what have you experienced in the past in in this in this area yeah so i mean i really do think that this is a trouble point for people um you know i i think that uh you know we're gonna find that let's see if we can close this uh and share the results yeah so kind of what i expected to see you know there's some you know moderately impactful a lot of folks saying uh not not nearly enough uh probably what we sort of would expected how about you sergio yeah uh it's it's probably where i expected the bell curve to end up distributing itself uh means super happy to see uh the 14 and extremely impactful uh i'd be glad to to hear from those folks uh um you know if we can but um what troubles me as well is is the last six percent they're negligible or i don't know so that's a good thing that we're here and we're hoping to move this uh closer to the upper end of the poll responses all right well um again as joe mentioned introduction the topic of today's webinar is uh covering a topic near and dear to all of our hearts as internal auditors is audit reports audit findings management's taking action on them so a good thing that we're here and hopefully you'll get some takeaways from today's session that you can implement right away in your organization and improve your reporting and management actions all right well before we get into uh the specific topic of audit reports let's let's take a step back and review our relationship uh to information in the digital age as people as professionals as human beings you know not so long ago the the only mediums of of learning and exchanging information were limited to newspaper uh radio tv books maybe some videos but all kind of consumed in a in a programmatic way today we have a flood of information screaming at us from every device and every digital interface whether it's our smart watches or smartphones or smart fridges or internet of things or our computers or various apps that we run throughout the devices and more and more things come embedded with controlled uh by apps and so forth so in the digital age uh some marketing research was conducted and i'll have the link to this in the slides when we distribute but talking about what happens to our attention span in this flood of information and so it's been established that in the last 15 years our attention span has actually dropped from 12 seconds to 8 seconds or thereabouts and in in a funny way what that means is scientists tell us that our average attention as as a human being has uh become equivalent to that of a goldfish sadly uh and and this was done by a marketing companies to try and understand the way that they are able to reach people and so um you know this this was a very telling to them because uh in in a flood of information that we're all experiencing is very difficult to get attention and some telling statistics there about not just the flood of information but how much our brain is able to retain and the percentages there show various examples of how many things we forget anywhere from uh major details of our close friends or even our own birthdays uh or uh one basic piece of information uh lost every day uh from our memories and so um this is in parallel is kind of this bombardment of of data that we're experiencing you know these are just a few statistics here but whether whether it's the email that we're checking 30 times a day or our phone that we're picking up 1500 times a week you know taking up about three and a half hours each day you know results in a flood of information screaming in our direction and uh what is very telling is you know when we interact with this written information uh people on an average read about 28 or more likely 20 percent of words on a web page and their time spent on each web page is no more than 10 to 20 seconds so in this type of environment when we're dealing with a flood of information content and delivery are more critical than ever when when we as audit professionals deliver our reports and uh you know organizational uh changing you know findings we need to pay close attention to our content and delivery and and need to ask ourselves the question are we delivering information a consumable way so that people can make their way to that information through the myriad of various data points they're looking at each day each week is our content critically relevant and engaging so that folks spend more than 20 seconds on our pages of reports and more importantly do the findings and recommendations that we come up with compel our colleagues and organizations to action so with that in mind we'll turn our attention to some of the key hacks so to speak on how to crack this dilemma in our day and age as internal auditors and we'll talk about why the current approach to audit reporting isn't working how to fix it and how to compel our organizations to take action over to you joe great so we have another polling question here and the question is how easy to consume would you say your internal audit reports are and i'm going to push that pulling question out here so we've launched that so you know this is a little bit different than saying how impactful they are uh it's kind of ease of use uh is what we're looking for here how easy how digestible would you say your internal reports are extremely moderately not enough negligible or zero or i don't know uh and sergio i think it'd be interesting here to see uh if we get about the same curve as we did for how impactful they are i i have to imagine that there's a pretty good relationship between how easy they are to read and consume and digest and how much uh how much effect they're having yeah definitely imagine there's a correlation there and you know as a white color professionals one of the most tangible invisible parts of our internal audit work are these internal audit reports so i know folks put a lot of time and pride and and effort into them to digest all of what they uh discovered during the audit and converted practical recommendations so very very curious to see the correlation to the first question and then kind of as a springboard for our continued conversation so we have just about uh most of our answers in here i'm just waiting for uh we're gonna close that uh and share the results oops sorry can you share their results again joe great so yeah i don't know if you're seeing it on your screen sergio but i'm seeing that uh very similar um you know moderately at 60 just about um but again you know um 24 saying that that they're that they're not that easy to consume to 30 either saying they don't know uh or or you know they're not that easy to consume and i i think that is probably fairly typical for uh audit reports as they've been being written uh over the past uh 10 or 15 years and i think there's a bit of a push um to reinvent them to rethink them most certainly most certainly go back to you yeah most certainly yeah and it does look very very uh closely correlated to answers to the first question and the answers are not surprising we're on a journey as the world around us has digitally evolved so are all the audit shops trying to keep up pace and innovate and get ahead so maybe we'll start with a question here about consumability i'll flash up a gif representation of the apple website you know as consumers we we go to commercial websites and we we look at these pretty layouts and it's easy for us to interact with them we're very used to demanding even digestible and nicely laid out websites so on the left hand side you know is is something that we are experiencing our consumer lives here's another website uh on our right and the question is kind of a rhetorical question about which is easier to consume as we look at the two of these of these websites and and i i for personally for myself i i find that um you know the the professional writing style and professional websites that that i go to are a lot harder to find information on and to consume in a manner that's meaningful to me as the end user so you know with with that in mind maybe let's take a a look at um our audit reports and see at what stage or how the techniques and reporting can relate to this and sergio i just want to interrupt you with a question here uh and again you know so we're showing the ii a website we're not taking issue with them we love the iia they do wonderful wonderful stuff uh i think all of our websites could be better of course but you mentioned the apple website example um and one of the things i'm wondering is should we be looking more outside of the traditional internal audit you know spaces and universe for examples for like unique and effective ways to convey information you know i know that that a lot of our attendees and ourselves we go to uh internal audit reporting um you know seminars and uh and training sessions uh and they're very much kind of in that internal audit universe uh when we're really at the end of the day we're trying to convey information we're trying to get people to act uh are there great examples we should be kind of taking in from the outside world outside of internal audit well i like how you uh put it in frame that joe and of course uh as as auditors we look to our peers and um you know leading audit practices to exchange uh experiences and and get better at our jobs and that's fantastic but i think unequivocally the answer to your question is yes you know even uh as professional auditors we um have the discipline of consulting outside specialists whenever we conduct uh risk management reviews or or complex audits we we have procedures for looking at engaging audit specialists or certain subject area specialists subject matter specialists and so this is no different i mean our marketing colleagues are the professionals at attempting to get people's information and to get them to take action that's that's pretty much where they gear their effort all day long get people's attention and compel them to take some action so i think this is very much in line with our sort of audit mindset of consulting outside specialists as necessary to improve our uh efficiency and effectiveness in our in our in our profession got it so uh so to look over to the marketing folks uh and we can learn a thing or two from them i really like that that idea uh go ahead sorry that's right so so with that in mind let's maybe take a walk through some of the traditional uh pain points in our uh ways of delivery of the report so this this first part of the session will focus on ways in which we can improve the delivery or the consumability of our reports so one question to ask ourselves when we do release audit reports are they outdated at the time of publication i know frequently we have to look to past events and past transactions and that's that's really really good but one of the key principles one of the core principles of the internal audit is being forward looking so if we're just going into the past without having uh you know extrapolated lessons for the current and for the future and the reports only are hindsight type looking then then we should ask ourselves if that is going to you know engage with our audience the norm for agile internal audit is beginning to be more and more having reports that are closer to real time that are closer to monitoring events as they occur and responding so it rr reports the bulk of our reports the majority of our reports historical or are they close to current near real time transactions and do they have an element of forward looking in and predicting and trying to advise into the future another question to ask ourselves is tldr as i mentioned earlier you know the average person spends 10 to 20 seconds on a web page if our report is too long to read and it's difficult to get to the point it's likely that the intended audience will abandon the report after the first few glances at it you know why not adopt some of the modern practices about getting to the point quickly efficiently maybe having a simple visual representation of the status or the end result of an audit uh like for example here showing that you know the fcpa compliance process in this case uh was 88 percent effective and that gets the attention of the audience gets them to the conclusion right away and hopefully encourages them to click through and get to the more detailed findings and recommendations the other question to ask ourselves is do we deliver our reports uh in in a single delivery endpoint are they trapped in uh excel you know dog you know word documents powerpoints pdfs shared drives or email you know all places where it's a one-way trip uh it's a cul-de-sac it ends up in there and there's no way to interact or are are our reports more socially shareable more um you know interactive have social commentary features places where people can dialogue and exchange questions that's another common expectation of the social grc generation of today and a lot of us as consumers and even in the b2b world are used to interacting with our business counterparts in a more digitally you know friendly environment where a two-way dialogue can happen so that's another question to ask are they socially shareable the other thing to ask is do our reports have user-friendly interface yes this is not a question for software only software professionals again it's another example of looking at specialists of how do they attempt to navigate us through the the technology so that we can quickly uh on board ourselves so do our reports have uh user interface and user experience consideration in mind i mean i put this funny example here with the parking signs because i'm forever trying to decipher the parking uh restrictions and and it's no joke uh the the sign on the left is pretty representative of how uh we we engage with the parking and as consumers get frustrated whereas this cleaner ui uh experience on the right it exactly tells us when and we can and cannot park in this location so similar mindset can be applied to when we deliver our audio reports is how easy are they to navigate and get to the point and get users oriented in the uh you know path that we want them to take the other thing to say is and ask questions if we do indeed want our users to take action do our reports make it difficult for for for users to take action and because uh i mentioned earlier the typical delivery of our reports is through uh single delivery endpoints without a two-way communication so if we have a beautiful finding like this has all the recommendations and actions and you know impact documented how is the user going to be able to take action on this do we envision a place like most of us are used to going on a website logging an incident having a dialogue tracking our use case or complaint or what have you so in a modern day and age management expects to be able to interact with a list of findings click through maybe double click into the underlying detail look at the supporting evidence and be able to create an action item or or kick off a workflow that instructs their teams to take action so do our reports give static recommendations or do we have a way for bringing users into a social online community to exchange comments and take action on our report so that's another thing to ask ourselves about the mode of delivery and then the other thing to keep in mind too as we have proliferated the mobile experience in our b2b and personal consumer experience again as auditors do we deliver reports in a way that are friendly for mobile users for executives that are always on the go and and half the time working from their tablets or smartphones or surf you know smart surfaces or whatnot and can we deliver uh information a mobile-friendly way that's summarized for easy consumption so that's another question to ask so these are a few there are probably many more but these are the ones that kind of more acutely stand out to us as software designers and trying to ensure that we can get engagement with with our users so the near real time has been sergio i'm sorry i just wanted to interrupt you with another question here uh and i really like you know you have the phone there um should we be thinking about putting out audit reports in multiple formats um you know so it's not just having an executive summary but actually having a version that could be consumed on a phone or using video that runs down the highlights of the report uh i know you know we've talked about how people have different learning styles and it's the ideas to kind of um communicate to them in lots of different ways so that they they perceive the message so should we be thinking about different formats as we're thinking through our internal audit reports yeah that's a that's a great uh question george actually echoes back to the one of the opening slides i had about the flood of digital information and the attention span relationship and the many places that we go to uh email smartphone uh and other devices uh web pages to consume information so uh to your question uh in today's day and world there's dozens of ways um beyond the traditional that we experienced in the past for people to engage and consume information so in order to even reach our audiences and they're so diverse and they have so many preferences of how to receive information it's important to be able to deliver audit reports in multiple formats that are accessible to our audiences but that's not the only reason because you know we talked about how uh you know people only spend 10 20 seconds on a page and you know only read you know on average 20 to 28 of the words we by delivering in a manner that's consumable we also want to go after their mind share we don't want them to skip past our uh information past our the substance of what we're trying to deliver so in order to gain that mindshare we also need to be flexible in the ways that we deliver and then the many mediums that we reach our audiences in i think with so many people you know so many people's email inboxes are flooded and they're going through those messages whether it's early in the morning uh you know and trying to address the ones that they know they need to address i usually think that uh your message has about four to five seconds uh to hit or not or it gets deleted um you know so that's another thing to be thinking about that's right and like you know knowing ourselves like let's say we're even on this webinar i mean we've switched to work from home and there's no shortage of disruptions as we're uh you know forced to sit behind a screen for for eight hours a day from various uh applications that we're running and it's even hard to concentrate on one thing at a time so definitely having those mediums of delivery and and considerations of uh the the way in which is delivered to to be consumable and and so that they can park attention for for the time that we need them to and so these are just some of the things we ran through in our in our previous slides to summarize uh that it's very critical in today's day and age to keep these attributes in mind as we design the delivery of the auto reports got it and so with that in mind kind of move and pivot a little bit because delivery and the way in which we communicate is not everything we also want to have users engage with our reports we want them to soak in the information and take action and so you know having a beautiful ui and having a very user-friendly delivery medium and being in real time and only take you so far unless we have a reason for users to keep coming back so that's a little bit of the second part of this presentation i want to spend on the aspect of relevancy and engaging with the audit reports uh great so sergio we have another polling question here uh and uh let me push that out first and then i'll read through it and the question is how relevant and engaging would you say your internal audit reports are so they may be impactful they may be easily consumable and in multiple formats and getting attention but if they're not about the right things uh then what does it matter this might be uh my guess is it's it's maybe the most crucial thing sergio yeah and and that's kind of where i'm looking forward to seeing these results i expect them to parallel our previous responses but curious to see if there is a divergence here in some way because indeed um you know a shiny thing will only attract us uh so much uh unless unless we have relevancy and and compel people to being engaged and have substance in our findings that are important to the intended audience so let's see how how this resonates with with our audience great well we have a lot of folks in attendance today so we're just waiting for the results to come in and this really gets at your idea of agile uh audit reports uh making sure that you're um you're flexible and you're moving quickly and that so that you're addressing especially uh in today's day and age uh that you're addressing the right things uh so we have let's see 84 are in i'm just going to close this in just a minute please get your answers in if you haven't already so let's take a look at those results yeah and and you know even even more so i think than the first two questions uh there's a larger portion who are saying that that they're not engaging or not relevant enough uh at 31 so over more than a third uh either either not enough or or not at all yeah and this this shows a little bit of decline from the previous uh distribution a little bit more skewed towards um you know the the the center of the responses so definitely um we are on a journey to improve and i'm happy to engage around this conversation in the next few slides so let's talk a little bit about uh key attributes for relevant and engaging audit reporting things that were reported back in 2017 by pwc doing a state of internal audit profession study i'll have the link to it at the bottom of the slide when we send them out but essentially management expects from internal audit that they will help their companies anticipate business disruptions and at the same time create and and generate forward-looking consultative suggestions of how the management can take action to manage disruption uh survive during disruption and and actually thrive as well so uh if you summarize all of these points it it if you will see here how it's they relate to anticipating business issues being prepared and adaptive and ready to lead through disruptive times which we find ourselves in even as we speak today through the pandemic situation assessing the risk of future possible disruptions and then taking that proactive involvement to intervene and help the business to navigate through that and and and i like how it says here ready to change course and evaluate risk at the speed required by the business because our audit plans in the beginning of the year may not uh you know how many of us had audit plans uh before march that suddenly changed uh you know in the middle of march as as new uh pandemic policies were being rolled out and then the other important element is cohesively partnering with other risk functions and compliance functions to address the disruption and having a coordinated risk management approach and this very same survey mentions that these you know when when inquired about the effectiveness of internal audit and delivering on these and and adding that value that they're looking for uh only 44 of of management respondents felt that uh audit provided that sufficient insight and value so there's some work to do based on the results of this of this survey and so looking ahead uh how do we how do we overcome that well cb did a helpful study not too long ago about the type of risks that management care about and if we look at the uh top portion of this graphic we see that most of the issues for businesses arise from strategic and operating risks and that's where management focuses you know about 86 to 95 of the time but by contrast the proportion that we as internal auditors spend on each of those activities is massively skewed to areas that do not bring such significant strategic and operating risks so naturally as that converts into our audit reporting and recommendations there is this misalignment and i had a chance of running a survey when i was in i i was speaking in in sydney at the ia international conference in july of 2017 and we ran a poll uh with the audience that i was speaking at and i asked them to rate themselves against those areas and as you can see the bottom part of this graph shows where the iia audience in sydney assess themselves as spending time and you can see it's very close to the top and representative of the top bar and the middle one of course shows where management is spending their time and focus on strategic and operational risks of significance but it was encouraging to see at least a beginning of a shift to rebalancing the audit time and i asked the question a different way saying okay when when you look at your top 10 enterprise risks and then you look at the time you spend uh auditing those risks uh where where is the difference and so the same audience kind of represented the above graphic in a different way and the red bar graph shows a little bit of the variance that uh basically the audit effort didn't exactly overlap with the significance of the of the risk profile of the organization of the top 10 risks and so there's some work to be done here and so naturally where we spend our time is where we find our issues and that's where we issue our recommendations but if they're not quite aligned to management risk areas we may have a little bit of trouble being relevant and engaging to our audience and so part of that mindset and part of that agile audit involves the ability as we read earlier one of the feedback points of changing audit plans as business circumstances change it's having continuous uh pulse on business risks reassessing that the top 10 20 enterprise risk themes that management is working on in aligning our audit effort to accommodate or even to preempt those risks from materializing and so it's very important to be able to stop auditing when circumstances change and i don't think that was an issue back in in march when we encountered such a drastic uh you know wholesale risk as the pandemic and the ensuing uh challenges that that uh posed for all of our professions the other the other thing is knowing when to stop auditing by the fact of you know how much assurance do we need to know uh that an area is broken a lot of times we go in and we have a set audit procedure and plan and you know it's clear perhaps 10 20 even sometimes 30 percent into the audit we we totally know the wholesale issues uh that exist in that business area so it may be that we need to pause create some findings that are pervasively overarching and handed back to management for remediation before we go and re-audit the nuances and the details of the processes so that's another you know big area that i see and you know today more than ever uh this is critical i i love this quote from richard chambers back in march where he talks about how economic downturns affect internal audit professions and and needless to say that they offer both threats and opportunities um unfortunately organizations that face severe economic pressures you know especially bottom line oriented organizations often disproportionately penalize internal audits when making these business cutting decisions the the cost cutting decisions so more than ever we now must turn our attention to demonstrating that our internal audit profession can help organizations navigate uh not just economic downturns but thrive through this and there's many examples mckinsey published a study of how organizations are becoming more agile and more innovative in this pandemic world of delivering services i recently heard of a famous bar here and in canada that um you know obviously because of social restrictions wasn't able to accommodate people so they they had uh probably brilliant risk people working for them because they started a curb side sales of of cocktail kits but what's more interesting is if you paid a premium let's say an extra hundred dollars or whatever then you would have a tailored private zoom lesson from like the top bartenders to help you kind of learn about mixology and and sort of create some uh you know tasty drinks for your family so again businesses are pivoting and and we as internal audit must pivot with the speed of risk in the changing landscape to deliver that value that we are so um good at and that we see uh across the organizational processes sometimes across the silos better than anybody else in position more strategically than anybody else and there is absolutely nothing you know go ahead i just wanted to um you know kind of reinforce that point and ask you about you know so so obviously the the pandemic is is front and center for all of us um and i'm going to guess that that it's changed in a lot of ways what matters to organizations a lot of them are dealing with in some cases existential risks and this gets really gets to the relevancy question um so if you're not auditing what matters then you're not going to be able to report what matters you know has this uh increased the importance of agile oh you know infinitely so infinitely so it's become more front and center to a lot of conversations and more than i can count through various articles and research and even our customer experience but obviously there's no shortage of risks right now to address we're talking workforce health workforce continuity and effectiveness working in a remote and distributed and digital world customer continuity being able to tap into the customer without that physical interaction our third parties that we're relying on as organizations to continue the supply chain and business relations financial uh you know ramifications of movement of capital and a slowdown of some industries and and speeding up of others that the effectiveness of our communications that the uh reputation the the security of the company now that everybody is moving into the digital realm we all know about the fiasco that uh a famous company zoom experienced early in the pandemic with people hacking the calls and then dropping the ball on security all of these kind of things have become more front and center and so risk is screaming at us from every direction but so is opportunity and so in fact the word risk comes from latin verisky there to venture forward to achieve your objectives and so it's not just about suppressing these threats but also is helping our navigation to smartly take risks and then improve the overall risk performance and so yes it's it's more disruptive than ever now and and organizations are looking for more forward-looking advice more than ever right now so it sounds like you're suggesting to move past some of the uh mundane things that internal audit does that might have less relevance now so for example uh if you're putting out audit reports on travel and expense reporting uh those aren't going to rise to the top of the pile yeah perhaps those who take uh perhaps those can take a a a backseat through automation and analytics and and some monitoring they're high volume uh typically low risk they can they it's not that we have it's not that we have to drop our defense but we we have to uh be able to pivot strategically to areas where greater risk is like you know in any hockey game you know you don't leave the goalie alone unless you're desperate so we do need some defense but if we see an opportunity to take to tackle a bigger risk and score a bigger uh return then we need to be able to pivot to those and so automation offers that capability for us and we can monitor those quietly in the background while pit pitching pivoting sorry to these higher level risks strategic operational got it all right and so um to summarize basically on this uh part of our presentation and kind of the takeaways from here is if i was to recommend any two things is uh in in order to have relevant and engaging content in our reports we need to be more and more aligned with the top headaches of management which at the current hour is the disruptive risks that matter to stakeholders and also to uh this will also help us deliver on the core principles of internal audit like being forward-looking and reporting on these risks before they disrupt the business ideally or advising companies how to navigate and survive through them that would be one aspect of considering our balance of content in the audit reports so with that in mind i just kind of want to turn our presentation now to the presentation of audit findings with the end goal in mind that management will act upon them and and it kind of actually might be simpler than you think but before we go there maybe we'll turn it over to you joe for another polling question great so yeah this is the uh the last of our pulling questions here um let me pull that up push that out so what percentage of your audit recommendations are implemented by management uh you know so this really gets at the heart of the matter here um you know if you're seeing a response by the stakeholders that you're sending it out to uh then they're reading it and they're digesting it it's getting their attention it's it's having an impact uh but if those recommendations aren't being implemented uh there's a disconnect along the way somewhere sergio right i would hope so at least that i would hope that's one of the root causes uh you know there could be many sometimes the tone at the top is not right management is not investing correctly in the internal audit function maybe the uh the ethical position of the organization it doesn't quite line up many many circumstances but one of the most common reasons i see as an audit professional and as discussing with my peers and colleagues is that there is a misalignment frequently in our recommendations to where management focus areas are so maybe we'll we'll take a look at how our current audience has experienced this and and maybe offer some helpful suggestions in that area so the the um the answers are coming through here but but it you know it also gets it what we've been discussing for the last 45 minutes that if you are not communicating the problems out effectively then those problems aren't going to be addressed um you know we can't we can't kind of put the blame on the um the business units for for not taking action uh when when those recommendations aren't really getting through yeah and and you're you're correct like it's not one answer solves at all like we are progressively building to key hacks of of uh of delivering better reports so you know we talked in the first part of this presentation we talked about the delivery mediums and how it's impacted people's relationship to information in the digital age then we talked a little bit about the content and the relevancy and uh whether that overlaps with management uh top risk areas and now we're pivoting to uh you know uh getting them in in a mindset of taking action and how to do that and so there's probably many areas and this is not surprising i actually um i actually am quite you know not surprised basically to see this result because one of the most uh conversations com you know that i have with my audit colleagues and peers and customers is how difficult it is to get organizations to take action on their findings and and this is very very telling and very representative of you know my real life experience and and i see like it's troubling me that um you know there's basically 60 60 one percent uh of of the audience that where where they're experiencing between moderate to you know no uh actions or very low actions taking but very super happy to see that there are some uh participants here who are getting greater than 80 response which is fantastic uh okay so i'm going to push that down all right so uh moving on to kind of the the practical aspects of um maybe going back to the beginning of the presentation the beginning of our time together in the marketing study is yeah what what the marketing professionals found and again they spend a lot of time trying to figure out how to reach people and how to get them to take action is that you know some of the tips of of how to deliver and this pretty much combines a lot of the takeaways we've had earlier in our time here but being clear in the messaging focusing on that user experience the navigation uh stick-to-itiveness you know uh keeping the messaging short sweetened to the point uh uh appealing to consumer desires you know telling stories and and we do when we you know in a sense when we uh write an audio report we are telling a story we are telling a story about our business and how it's performing and what it's doing and then and then having different modes of delivery and presentation video for example the research shows that average length of a watched video is 2.7 minutes so there's a lot that can be delivered in in a short video and then it shows that executives are actually more biased to watching a video than reading text and so in our organizations we started experimenting with video reporting as well and it's been quite well received or sometimes through training uh uh you know uh online training you can deliver key key messages and people engage with it more so uh these are some of the findings um that we we look to for uh you know effectiveness and stickiness in our audit reports but with all this in mind and recapping back all of the points and kind of thinking back i'm kind of trying to empathize with people sitting in the audience going but this looks onerous and complicated and and a lot of work well it doesn't necessarily have to be my my boss here at galvanize ran into the director of internal audit at google at a recent conference when we were still allowed to travel and she kind of uh told them an interesting approach that they took to delivering audit findings and and increasing their response rate in organization so in google there's a there was a huge there's a huge culture technology culture and that's used to uh demanding things in real time and using you know modern social uh collaboration tools uh and ability to to kick off workflows and and having a friendly user interface so as they were delivering audit reports in a conventional way you know through pdfs through those powerpoints the response rate to taking action on audit findings was super low and so she was telling us how by studying the organizational culture discovered that a lot of actions being taken in organization revolve around already established workflows in the business but most uh most common one was the system where they would report bugs and uh login issues and and summarize them in in a certain way so that all the teams could take action and they were baked into their workflow daily routines daily systems that they use so she had this clever idea of saying why don't we deliver audit findings as bug reports and so they kind of pivoted a little bit of the audit reporting structure and in the ways of summarizing things through through the lens of a bug report and the um engagement level in the organization went through the roof and the the level of response rates that they received to audit findings was was massive because they were dealing with a constituency that was used to this newer digital uh world the digital experience and by being able to reach through those communication channels and present information in ways that was uh meaningful to them they really hit the ball out of the park with that so as you can see it doesn't have to be very onerous or complicated by reading the organizational ties and seeing how executives and peer teams take action we can tap into those workflows we can tap into those frameworks and and deliver something inside the dashboard as people are driving their cars that shows that hey you're low on gas you might want to pull over the next 10 miles to fuel up and taking that concept to this audit reporting and audit finding logging would help us in a great deal to internalize this in our organization so that's that's just one practical example i'm sure the audience has other avenues of doing this that are interesting as well but that's pretty much where i want us to to end our our thinking and and kind of be inspired in taking action um and practically implementing this in our organizations well sergio thank you so much for a wonderful presentation here we have just about a few minutes here to take some questions from the audience and uh you know i'm just looking for the questions here and looking for some of the common themes that are arising and what i'm seeing is um how much do we need to tailor the audit reports uh to to the audience uh so you know these are going from to everyone from members on the board who want the very high level summary uh and the main issues down to the you know the line manager who wants who's responsible for the risks and controls and once one specifics how should we be thinking about it i'm gonna guess that know your audience is a big part of this well that is a big part of this and and also like the many layers of reporting like it what i mentioned today doesn't mean that we eliminate the volume in our reporting that's required to reach different organizational hierarchies but distributing it in such a cascading way as it makes sense to the audience is important like for example when reporting to the senior leadership team and the board of directors the audit committees and whatnot they relate everything to the top 10 20 risks uh that they are managing and you know we need to be able to summarize our audit results and impact of our audit results into those risks like when i speak with audit teams from our customers i ask them all the time is do they have a list of the top 10 20 risks that their organization has identified whether it's in the 10k or whether more precise list is available internally and the reason i do that is that i like to challenge them to summarize the themes of all their audit findings the cumulative results of all their audits into their own enterprise risk heat map and say how impactful the work that they've done is to those areas so that'll reach maybe the senior echelons in the organization but then of course um the process level the geographical level the the departmental level of response we can save for those intended audiences and so the multiple ways of delivering reports and the multiple means of doing them but you know it helps us to reach at every level but obviously each one of those segments can take these principles and and uh apply them so that they have a maximum impact on the intended audience and just a follow-up question on that you know so we've talked earlier about you know delivering audit reports in multiple formats uh we're talking just now about delivering variations of this report depending on the audience we're talking about uh for for me it sounds like a lot of work um you know instead of putting out one traditional audit report now we're being expected to uh tailor them in all these different ways it does it add a lot of work or or is it really you know technology solutions that we need to look for things like data visualization uh that can make a lot of this easier well technology solutions definitely help but i would say it's not that we need to change the volume of audit reporting because audit reports typically contain that hierarchy from the lowest level of detail to the highest level of detail it is just applying the delivery and content summarization principles to each level so that you know middle management or or department management or or lower level transactional uh business process owners uh also have a flood of information to deal with so uh you know it if there's anything there's there's an opportunity to simplify and and raise the level of uh our visualizations perhaps use storyboarding as a way of saying here's some dashboarding and here's accompanying commentary and prepare drill down levels of detail and so technology does help with that there's many tools out there that help to start at the top and then you drill down through the various levels and so you can provision access to those intermediate steps because you still need them as an audit professional to build the report to the overall level and so what we're saying here is that we're we might be distributing different parts of the report to different audiences and if anyone wants to read the whole thing obviously make it available but i see that instead of delivering one big report in one file we we now have seen the trend of being partitioned into relevant sections with drill downs to lower levels of detail or you know summary levels if desired i see it and there's another great question here i'd like to get to uh and it's asking for your view on um including the recommendation or not uh do you suggest maybe moving away from from the recommendation i know this can be a real pain point for lots of folks there's a lot of back and forth on these whether it's a grading from a letter grade or you know sufficient not sufficient you know what what's your view on this and can we get bogged down on the recommendations can they bog down the audit report i think personally i think um if if you if you um learn a great deal about a business area and we're in a unique position as internal artists to see across areas and deeper and wider than most people in their respective roles it would probably do a disservice to the organization if we don't share our conclusions in fact i i know people like when you take a position and are able to articulate it and justify it uh in a business uh sense so in my experience i've welcomed and i've seen great success from uh you know highly skilled audit professionals that know a great deal about their companies and are able to articulate their findings in such a way and take a position in such a way that is actually welcome and impactful so i would say my bias is towards issuing a recommendation but if we do we need to make sure we have listened enough documented enough and socialized our findings enough so that uh by the time that we do give the recommendation it's a welcome uh a change in in in some respects it uh driven by the very auditees that we're auditing to make it part of their owning the solution so when we can reach that kind of consensus i think it's the best of both worlds obviously in some areas recommendations may not be applicable or relevant or appropriate in which case uh presenting the facts and allowing the audience to take conclusions and actions is also appropriate now and we're running out of time here but i want to go to one last question but sergio i'm going to ask you to keep your answers on the brief side the question is what about the challenges of maintaining confidentiality and privacy especially when reports are on multiple electronic options we're going to offer it through these different outlets does privacy and confidentiality become a problem that's always been a business need and so the way we solve it may change but the substance was there before even all this technology arose and so just thinking through the fact that sensitivity confidentiality and privacy is always going to be there we need to think about ways whether digital or physical documentation of safeguarding that and properly delivering that so in fact some of us are specialists in those areas of technology and subject matter so definitely something to keep in mind and build into the design of your report delivery got it well unfortunately i think we're just about out of time but i want to thank our partner in today's webinar galvanize galvanize is the leading provider of grc software for security risk management compliance and audit professionals the integrated high bond platform provides visibility into risk and helps grow audit programs without incurring extra costs i also want to thank our presenter here sergio sernaton of galvanize did a wonderful job and gave us a ton to think about here in terms of putting out an internal audit reports that are more relevant more impactful more digestible i think it's it's something we can all work on um and finally i'd like to thank all of you for being here with us today for this presentation the demise of traditional audit reports how to get stakeholders to finally act on audit findings please look for an email with a link to the recorded version of this webinar a pdf file of the slides that we presented today and if you've qualified a certificate for one cpe that should be coming in your email in the next day or two and i want to thank everyone for being with us please enjoy the rest of your day