Well, thank you everybody for joining us in this session today. We're excited to have three fantastic guests as we talk a little bit about forecasting the future of audit in 2020 and in this coming decade that we have. And then joining me today is Laura Ganann senior director from Walmart's internal audit group. We have Angie Negron from Party City and Doug Sasso from EPAM Systems. Thanks to all the panelist members for joining us today.
We're just going to kind of dive right into the discussion today. And I think all three of you really hit on something that we're all dealing with right now is just all the different changes, hitting all industries, all geographies. Obviously, Covid is a big part of that. But I think really the theme of the last decade has been change as we looked at 2020 and 2021 in the next coming decade, we could just expect more change and more uncertainties ahead as well.
I'm curious, just in terms of how you stay across the changing business conditions. Doug, maybe I'll start with you, because you also see it from that ERM perspective as well, just in terms of being able to remain a trusted advisor when it comes to risk and engaging the business in that sense. You know, it's obviously a challenge in the current environment to do that, one of the ways that we look at our function at EPAM is to continually deliver quality audit services. And what we see is that kind of leads to the next opportunity, the next initiative that we're informed of and asked for help on. So the way we coach our team members, both our internal team and the folks from our partner, is to focus on today's delivery of quality services, give good audit insights through the work that we do, and then you'll naturally be in a position to offer insights into the next initiative or deliver the next audit.
So we're very focused on thinking about that as we deliver our services. Yeah, fantastic. And Angie, just in terms of Party City as well, I imagine the whole organization has gone through quite a bit of impact within the last six to nine months here, just in dealing with everything from being able to source manufacturing all the way through to delivery in that brick and mortar sense there... Just curious in your perspective, with that amount of change, how have you been able to keep pace and be still relevant within the business and shift the activities that your team has been doing so far? Absolutely that's a great question. It's really important to build that confidence, those relationships with those key stakeholders. You're not going to have a seat at the table if you haven't proven yourself to be add-value, create value.
So that's really important for us. And it's either keeping abreast of all of the issues that could arise, having the ability to look at issues from a risk lens that sometimes management may not necessarily have that skill set And being able to leverage what you know, because you have that historical knowledge and applying it forward for other creative solutions. We also make sure that we keep up to date and use all the resources available to us, whether it's joining webcasts, networking with older colleagues, keeping those great relationships with external audit because you do have an ability to leverage them as they have a good wide net.
And we've done that, given Covid and all the changes in the retail space, for example, store closings, that was huge on us. We had over 700 stores closed for several months. Customers, the impacts on customers, insolvencies. And if you're able and have already established those relationships, you can lean on others just to see how they're handling it. And for us, that's been huge and bringing various points of view to the table. Laura, we've had a discussion before in the past just about your business.
I know you've shared some things with AuditBoard before and to our user base as well. Just about the complexity of the how your business has grown tremendously prior to this year, understanding the end to end processes also in a vertically integrated business model as well. Just curious in terms of how you modified that approach to now fit within the last six months as you're kind of dealing with the same, similar activity that the rest of the audit community is dealing with today. Yeah, I mean, I think there's probably some differences because I think Walmart, as one of the necessary businesses, definitely remained open and we were kind of dealing with the throes of Covid and running out of product and trying to serve customers and keep everybody safe -- our associates and the people shopping. So I think for us you know, there was a lot of what we were kind of calling pop-up processes as the business tried to adjust really quickly to an increased demand in online grocery shopping and some things that we already had in play, fortunately, but just really accelerated quickly, I think, to Doug and Angie's point, having really good relationships with the business and having established value before this time really helped us because we didn't really slow down at all.
We were being asked to come in because people are saying, 'Hey, we have to do this really fast. Can you come and make sure that we put the right controls in place?' And so we kind of got a lot of new business as an audit team for that. And then on the other side of the coin, everybody was really worried that because we were having to shift. So quickly to focus on new things, that we were going to let some of the fundamentals that we need to maintain to be compliant fall by the wayside. And so we have people saying, can you come look at old processes and make sure those are still going well, because we don't lose sight of those.
And can you also take a look at the new things that we're doing? So I think that the last six months has actually been a little bit about getting in quickly and doing those quick audits to give everybody comfort. I think outside of that, in a more normal environment. Yes, we were being asked to come in and do more intense processes. And we still kept some of these things going because we do have such a large company. And often times processes are sort of broken across different functions.
And we're very uniquely positioned to be able to see a process from end to end and have a bird's eye view that sometimes the business doesn't have. And so being able to look at the process as it moves across functions, what's not working seamlessly? Where is it breaking? Where do -- Where are people doing duplicate work? Where does no one have the ball on something? That happens where it's like, 'Oh, no one actually owns this.' That's that's something that we've been asked to do more in this complex environment, which wasn't necessarily something we anticipated, because when we started moving towards trying to be more agile, like, 'Oh, we're going to do faster, shorter audits.' But we've actually, and we've done some of that.
But we've also been asked to really, as the business has gotten more complicated, do deep audits and more end to end audits as well. The theme that I hear from all three of you, very similar, just in terms of being able to adapt to not just Covid, but to how your business is adapting and being a leader and a steward within your team. So that you can be in front of that.
And not playing catch up the whole time, being able to remain relevant with the key stakeholders there and see an internal audit at the forefront rather than kind of from that back piece, you know, kind of coming back to yourself Doug, you've got a unique lens across a couple of lines of defense there with not only risk, but audit as well. Just curious from your perspective, how have you had to adjust priorities? Are there things that are less important that you might have dropped? Are there things you've had to pick up and actually do more in this type of environment? And how do you see that kind of shaping the future within your group going forward? So we've always had what I call kind of a dynamic approach to our audit plan, so we'll set an annual audit plan. But we've had a relationship with the audit committee, where they support our ability to recognize a shift in priorities from the business, or shift in initiatives or shift in risk that we're seeing across the business and the need to adjust our audit plan as needed. Usually that comes in the form of adding to our audit plan. But we saw this year was there was a few things that no longer made sense because the risk changed. So what we did in the Q2 timeframe, when everything kind of shifted to a work from home environment, is we put a slight pause to our operational audit plan.
What we did with that kind of pause was then accelerated some initiatives that were focused on our digital enablement for our internal audit team. So we had a three year strategy that we were developing at the time. For us, the timing worked extremely well to be able to accelerate some of those initiatives.
And get ready for jumping back in. In that short four to six week period where we kind of slowed our interaction with other stakeholders, I think it was important to allow the business to shift and make those dedicate their time, rather not to audit as much as to making the shift in the risk environment that we were in. We soon picked back up and it was more through the initiatives that were changing and requests that came from the business where they're asking us to have a view into what they're doing.
So it gave them a time to kind of think about what those initiatives should be. And how that shifted or changed. And then looking at it from that audit lens, how can audit be a consultative partner or kick the tires on something that got recently put into place? So we had a typical year in that we adjusted our audit plan, but atypical in the sense that the reasons for it were totally unforeseen.
Laura kind of turned the focus a little bit to yourself now, some of the things you mentioned and you kind of echoed Doug and Angie was about maintaining those relationships and being able to be a good Steward with the business and having people to the point where you're trusted where they're seeking you out without having to chase them down. Just curious in terms of how you've established that, the work prior, how you've been able to leverage it and how you've had to approach it differently now that you can't just see those guys, those folks in the hallways or by the water cooler and have those kind of interactions that we would have had maybe 10 months ago. Yeah, Yeah.
So I think, you know, for us, you know, first of all, just working as a global company, I think we had a little bit of an edge because a lot of us were already having to do a lot of Zoom things before this. But but we do kind of work in an office as well. I think one thing that we did, you know, Doug mentioned that four to six week period, that they kind of had to pause and we definitely had that where we were like, well, everybody's kind of in crisis mode.
Let's kind of talk with our customers and figure out where we need to back off. One of the first things that we did was just offer ourselves up and we said, look, internal audit can come and help you. Now we evaluated conflicts of interest.
And we didn't want to create any of those, of course. But, but we knew that they needed help. And we wanted to offer that no matter what.
But it also helped us stay connected with them. It also helped us look at what everybody was doing. And apply that risk lens. We even ended up writing a couple of memos where we saw that things were headed down a path that wasn't great.
So just being boots on the ground was really helpful because we had a valuable perspective to offer. But we got some goodwill at the same time because people really appreciated that we kind of came in. And in a crisis. And worked with them.
Right so that was really good for business relationships. And they really appreciated that. I think staying connected outside of that, you know, we've really just sort of adopted the mentality, like if you would have done it in the office, you need to figure out a way to do it virtually. And it might look different. You might have gone to lunch with somebody before, and now it's a 15 minute Zoom chat, or you might have gotten everybody in the room to do a big brainstorming session. And now you're having to do digital brainstorming and whiteboards and make things kind of visual and interactive through Zoom and try to use some tech features.
But we just sort of shifted and not allowed ourselves to say, 'Well, if we can't meet in person, we're just not going to do it,' right? So the culture around that has been really good. It's every, our audit team has definitely felt like, you know, surprisingly, it doesn't feel like we've skipped too many beats this year. We've heard from all over the company that we've adjusted and shifted better than they ever would have thought.
Like if they could have predicted how this would go, they would never have thought it would have gone this well. But I think at Walmart, the core of our business is relationships. And we just found a way to do it, even virtually. But that it's all about intentionality, it really is.
Kind of thinking ahead to what is 2020 going to look like, I think one of the things that we're all wrestling with this year is what travel will look like. We've been impacted with a halt in pretty much on all business travel. And this year, unless somehow you've been able to get on a trip.
But I think the majority of us have probably been working from our homes on teams, Zoom and other activities here. But just curious, as we look ahead in the next decade, travel is not going to look the same as it wasm being able to observe certain audit evidence, being able to sit with key stakeholders and do that kind of traditional audit method is probably not going to be as relevant or as easy to do as it has been in the past. Laura, Walmart -- very global organization and lots of key stakeholders across the globe. And I'm sure travel is a big part of what your team might have done in the past. Curious as you look for the next step ahead to the next 10 years, how do you think that lack of travel and how will you put things in place to deal with that lack of travel? And I think, you know, wal-mart's kind of an everyday low cost company, so I think we were always pretty travel, travel conscious.
Obviously, this year has upped the ante on that and has forced us to prove that there are a lot of things that we can do remotely. I don't think we're going to take travel off the menu. I don't think that you can replace sometimes the value of an in-person interaction. But I definitely think it's forced us into evaluating what we can do without that extra time and expense. So I think operationally, we've explored, you know, normally a big part of our audit plan is getting out to the stores, getting out of the D.C's We've really evaluated those audit programs and thought, 'OK, what can we audit the camera?' We have security cameras everywhere.
Is there just footage that we can look at from the home office and evaluate how a process is working, how things are really happening out in the stores, in the D.C.'s without actually traveling there? And so we've come up with some efficiencies. And that way we're pulling a lot more data and saying, 'OK, what insights can we get from data,' rather than having to go and put our eyes on it? And we've gained some efficiencies there It's also forced us, I think, to think about how can we partner with the different lines of defense. You know, is, is there a way if we're doing less travel, can one person go out and come back and provide insights to the other lines of defense? So can we rely on our compliance continuous monitoring team as they're out in the stores or in the D.C.'s
looking at things to take pictures and gather evidence for us and just partner a little bit differently? Can they rely on us? So it's sometimes about less travel, but someone's going to be going. And just how can you leverage that a little bit differently? Doug, I know that I think a big thing from an internal audit perspective is when we do go out in person being able to have that, well, we don't know if internal audit is going to show up or not or we know internal audit is going to show up. So we're going to do some preventative stuff and just make sure things are good, kind of without having that watchful eye. I'm curious how you approach that with kind of reductions in travel and in making sure that the different sites, the different locations are still going about business appropriately and how you would expect them to. It's a part of our operational audit plan includes some site visits that typically work. Were done in person.
Pre, pre Covid. What we like to do is go out to our sites, especially the ones that are not in scope for SOX, maybe smaller entities, entities that are our newer geographically or acquired entities. So we performed the acquisition at some point in the recent past We might go take a look there with the goal of ensuring that controls are still in place there. So obviously, we took that off for this year at least... We'll revisit next year,
but we replaced it with trying to do as much as possible remotely. So we didn't want to lose that effect in that kind of watchful eye. And the deterrent effect that an internal audit function can have on controls operating appropriately throughout.
So we found that we were able to execute about 90% to 95% of what we otherwise could have done on-site, remotely, not the same level of value that we would get if we were physically out there. But that was kind of the way we thought about it. It's similar to what Laura said. I don't think it's permanent for us not traveling.
So I don't think this is a permanent shift that we're going to always do this remotely. I do see us getting back on the road at some point when it's safe for everybody to be out there. You know, we're not going to run to jump on a plane and fly across the globe.
Early next year. But when we do feel like things are back to a steady state, I do see travel picking back up for our operational audit plan for the same reasons that it was there previously. But I do think we've been very, very conscious of the ability now to do things remotely and that might change the way that we do some of our work in the future. And Angie, I know in your environment, obviously, a lot of different systems, a lot of different international locations, as you mentioned, just in terms of that whole end to end process, really curious kind of how you see about bridging that gap where you guys are able to do things a certain way because of that planning this year. Do you foresee that continuing on in the years to come? Have you had those discussions with management of this is a short term fix versus a long term way of doing things, and especially when it comes to, you know, those multinational global locations, kind of how are you able to assess those? You can I think just to echo what Laura and Doug have said, it's that in-person connection. You can never lose sight of that.
There's so much value to be on the ground. We actually went through a whole IT risk assessment. And we got an opportunity to travel and travel internationally and sitting down with some of the key stakeholders that you've only spoken to over the phone or have really had those touch points. It's invaluable because as you come back home, they have the ability to pick up the phone and ask you questions and make sure that they're partnering with you and leverage other parts of the business and make sure that you're that bridge, that value, you're creating that value.
I think having that travel aspect, it can't be replaced. I think Doug and Laura said it perfectly. But there's also other ways that you can identify change in the organization and keep abreast of it. For example, for us, we have steering committees. And in terms of technology, if there's any significant changes, we make sure that we're attending the steering post.
So that we understand if, because of the pace and the rapid pace, for example, we implemented curbside pickup, is there going to be an impact in the OMS and how we need to consider for scoping purposes, or is it going to change our scope for the current year? So all of those things, making sure that you have a seat at a steer co., or at a management discussion, whether it's an acquisition that's coming on board, it's really critical that you already have those established relationships because they'll be able to pull you in and you'll become a trusted advisor. Laura, I'm curious, just in terms of your perspective as seeing the next decade in that kind of digital transformation that continues to rapidly change the business. How are you kind of viewing that from internal audit where you're making decisions to digitally adopt new technologies and where to invest in the future to keep pace? Yeah, so I don't think, you know, the ideas are necessarily new.
We all want to use analytics. We all want to automate things. I think that some of the barriers that we've had sometimes are prioritizing. I think sometimes it's hard to hire those skill sets into your audit shop. And if you're having to use a centralized skill set to help you automate or use analytics, does internal audit ever rise to the top of the pile as they're prioritizing? So I think that internal audit kind of faces challenges when it comes to really diving into technology, the way that we would want to.
But we are lucky enough to have some of those skill sets within our team. And I think it just kind of depends on where you're focused as an internal audit group. We do a lot of operational audits. And so one of the things that we've done, they're very time consuming. They're very expensive.
So this has been a great year to pilot some things that would keep us from having to travel. So much. But even when we're out in the stores, you know, something that we've been implementing over the last couple of years is more mobile auditing capabilities and having the technology and the auditors hands as they're out there instead of having to come back to their hotel room and enter things into Excel and work papers to your point.
And using those extra tools to then create real time dashboards for the business where they can immediately see what the results are, our operators, and can immediately start actioning and we can have those discussions. And so I think, you know, if you've got kind of an operational audit focus or that's something that the type of business that you're in allows for things like that, I think those are things to think about. If you're doing more transactional testing, which most of us are definitely focusing in on, on analytics, I think that there's enough resources out there from an educational perspective that we're I think we've been on a journey, but we're pushing it super hard now. It can't just be one or two people that know how to do analytics within your group. Everybody needs to know the basics of your Power BI's, you're Alteryx, your Tableaus, something so that you don't have to rely on kind of one or two people to do that.
And it creates a bottleneck or a limited capability within your team. So we've got a lot of work that we've been doing on bringing everybody's kind of skill level up, where we're playing around with some technologies. We have a quick license that does some natural language processing. So we just put all of our findings into to quid to see, 'Hey, can this generate some themes over the last 12 months that we can bring back to the business or start focusing in on in our audit plan?' And, you know, it actually generated some pretty interesting things. We tried to mirror that in Power BI just by doing some word frequency and played around with some things and got pretty close there. So even if you don't have a Quid license or something like that, you know, you could use something like Power BI by which I think a lot of people have access to.
And then we actually just took that to a pretty important committee that we have at Walmart today to say, 'Hey, here's the things recorded in the last 12 months. And that are really preventing you guys from being able to achieve your objectives. And just so you know, some of this maybe even didn't explicitly come out in our audit reports, but we're going to make sure that as we go audit next year that we're focusing in on these things.' So I think it can take a lot of different forms. You just have to have a little bit of creativity and the right skill sets.
Doug, you've been on a journey for digital transformation and effort as well within your internal audit team. You spoke earlier about how you've been able to accelerate that a little bit during the last few months. Curious as you kind of come to that inflection point now, how do you look at setting yourself up for the next decade? Are there further things that you still have on the roadmap, or are you at a point now, where it's... you kind of take a look back and say, 'We need to continue processing what we have just put in place?' So, yeah, we're definitely not there.
Right, so so we will, I would say, probably perpetually have a road map. Right it's going to continue to evolve as time goes on. But but what we've done to date is definitely not the end. We want to continue on that. What I thought Laura said very well was sometimes it's not practical to hire in the skill sets that you need as far as what you see strategically, what compliments you need on the team.
So being creative on achieving that strategy, that's one way that we see the future evolving. And what I mean by that, how can that take shape for us as an organization? It might be somewhat different because most of our production resources have this technology capability. And I could tap into that if I could tear them away from client work for a brief period of time to do that.
But if we can come up with a concept, we find the way to go, then implement that. So the strategy that we're about approaching this with is that we're likely not going to hire that one key skill set of data analytics person to add to the internal audit team. But will both of you have said, how do we build that capability on all of the team members? So fostering the creativity on the team members to be able to think of the concept and then be creative in how do we go accomplish that? So for us, it might be making a phone call to somebody who has that skill set.
It could be sourcing that with another firm if we wouldn't have that skill set internally. So how to apply that to other companies that might not be technology companies, but also using resources. And we do this in other areas as well, using resources that aren't internal audit resources, but maybe have a skill set with the independence concept in mind where appropriate, and tap into that. Right for a period of time, almost how you would leverage a co-source partner, but leveraging resources that exist and that skill set that exists at your company, just not within the internal audit function.
So that's kind of the thought that we have on how this evolves into the future. We're definitely, definitely not there, not where we envision we'll end and probably there will be no end to it... Probably will be a continued evolution of our technology roadmap. Angie, at Party City, obviously, you mentioned a lot of different stakeholders, there, the co-source model and others.
Similar question just in terms of obviously a lot of disparate technologies that you're dealing with. So from that aspect. But then also just a lot of different cultural, as you mentioned, traveling globally and nationally. So curious as you look to the next decade, increasing data analytics for your activities and really kind of embracing technology to a certain extent as well. How do you look at skill sets as you kind of staff up and look towards the future? For me, what's critically important is being skeptical and curious and digging a little bit deeper, just because we've done something in the past, the way we've done it, doesn't mean that that's the right approach going forward. So I think that for me, it's fundamentally important for a resource also to kid ourselves.
I don't think it's going to be putting people in a box where you do business processes, you deal with I.T., IT -- it's going to be a discipline that you're going to need across the board, because now when we question and we look at business processes, there's always an I.T. angle to it, and you'll be surprised how integrated it is. And that's how we get better.
We challenge ourselves. And for me, that's critically important in making sure that the folks that are coming in the door have the ability to understand systems, technologies and how there's dependencies in them, because that's really fundamental on the business side as well. And really, kind of the last question that I have for the group is just in terms of as you kind of look to the next decade here and Doug I'll start with you, just in terms of what are some of your main goals that you have for your internal audit function, some of the things that when you're discussing with the audit committee, with your CFO and executive management, some of the things from a strategic business impact that is top of mind. And how are you trying to align internal audit towards that? What steps do you take. And how do you communicate those to the team as well? So I think for us, and this is in our strategic vision, is to continue to provide the kind of value that we would expect that out of ourselves in the future, that it's going to involve all the things that we talked about today. So building those relationships and being seen as a trusted advisor, getting a seat at the table where you need it to be able to deliver on those initiatives.
So that's part of our goal is to find our strategic plan and getting that buy-in both from our executive leadership team and the folks under them by delivering good quality services. And what we do today will focus on today. I think those are all going to be critical to us achieving that goal into the future. And curious also from your spot, Angie, you kind of mentioned being able to have that critical component in terms of how do you shape that message to your team when you think about the alignment of strategic objectives for your organization, how do you kind of shape that to the team? How do you create their buy-in? And what are some of, again, some of the goals that you've aligned for the team that aligned back to those strategic objectives? I think it's always important to communicate what your vision is. And the importance of creating value. We, for us, Our core values is creating value to our customers.
Right but we also have external customers and internal customers, and that's key for our group. And making sure that we're giving value to our internal customers, whether that's management or any other key stakeholder. Also getting that seat at the table and adding values in other areas we're a very SOX heavy shop. So looking to exploring some operational audits and adding value through that and going through that lens, also potentially integrating and launching an enterprise risk assessment, and a program as well. So just sharing that vision, how we can add value, how we can create value, I think it's really important.
And Laura, same question on your side, when you look ahead to the next decade, some of the organizational goals that are in place at Walmart and some of the goals that you have for your team, how do you make those connections and how and what are some of these goals that you have for the team going into the next decade? So we've tried to boil our job down in a really simple way to our audit team, which is what we identify risks. And there's many ways to get better at that. Having that seat at the table, being involved in the steering committees, knowing your business really well, then we test it. And we make sure that the risk is mitigated.
And then if it's not, then we help the business figure out how to mitigate or manage that risk. And that's kind of our job. And so two of the things, well, one thing that we've really kind of focused on heavily and that we'll continue to focus on, because we can see where we're making really big strides, is around this concept of helping the business more with remediation, because I think it's easy for auditors to kind of get into the habit of, 'OK, we found something.
Here it is. Please submit your management action plan and we'll record that.' And we don't get in there in the room with them. And really battle out and help figure out how they can solve this problem. And we're solving really hard problems today, and it helps when audits part of the process to make sure that they solve it really well in a way that addresses root cause and is sustainable. And because of our role that we play, that's one of the best ways that we can help the business achieve their objectives.
And it wins us a lot of points when they can say audit really partnered with us on this, they didn't just come in and point out all of our problems and leave. I think the second thing that we're really doing, and it's sort of our fourth pillar, if you will, we want to be a talent pipeline to the business. We've got a couple million associates at Walmart and we're about 300 people. So we can't pull things together from a risk management perspective. We need the business to do that.
But what we can do, we can educate, but we can also provide really good talent out to the business that understands risk management, that are really good leaders. And I think that with the way that audit has to operate today to be successful just in our own function, we are a great development group for the rest of the company. And we want to provide that talent pipeline. So that's something else that we're really focused on so that we can kind of amplify our value by having people move out of the group and into the rest of the company. Well, I would like to thank the panel here.
Doug, Laura and Angie, thank you so much for joining us on today's session. And forecasting the future of audit as we look ahead to the next decade.
2021-01-16