We’re focused on empowering diversity inside the world of internal audit in the second episode of ‘Inside the Auditorium’.  

I’m joined by Sandy Balasubramanian, Audit Director within technology for Bank of New York Mellon. She discusses her move from India to the UK and cultural challenges, as well as her biggest achievements being a woman in technology audit in a senior position. 

This episode explores:  

• Operational resiliency: Sandy sheds a light on key technology risks and the critical importance of operational resiliency in today's landscape and emphasises the significance of having robust controls in place to ensure business continuity post-attack. 
• Diversity in Audit: Addressing the issue of diversity in audit, Sandy talks about the underrepresentation of women in technology audit roles. She shares insights into efforts made by her team to break stereotypes and encourage more women to pursue careers in audit, especially in technology. 
• Career advancement in internal audit: Sandy passionately advocates for internal audit as an ideal career path, highlighting its unique position to provide a comprehensive understanding of the entire organisation and the invaluable learning and growth opportunities available.  

Don't miss out on this enriching conversation that offers valuable insights and inspiration for all internal audit professionals, especially those wanting to advance their careers.  

Enjoy! 

Note: The views expressed by Sandy are her own and do not necessarily reflect those of her employer. 

Hello Sandy, welcome to our second episode of Women in Audit. Maybe you could just introduce yourself and let us know who you are.

Thank you for having me on this. It's a pleasure. So I am Sandhya Bala Subramanian. I go by Sandy. And I work as a audit director with the Bank of New York Mellon, covering portfolios with the technology audit department that includes tech risk management, tech change and integration, and tech governance. I also am part of the management team of a niche group.

that covers strategic initiatives that we call them enterprise initiatives that are of key priority to the board. And we provide audit points of view on how these enterprise initiatives are progressing and what do they have or what do they do not have lacking them to achieve success to make sure that, you know, we provide that feedback on guardrails pretty early in the process rather than after having them go live.

So that's another portfolio that I handle as part of my role within the environment.

Sure, wow, okay. And you've been with, you first started your career in India, correct? And did you move here for your role at Bank of New York?

Yes, I did. So a brief of my career, I am a Chartered Accountant by qualification. So I started off my career in India, like traditional Chartered Accountants doing financial audits, looking at the balance sheets, P &L cash flow statements. But after that, what I realized is I would like to do more than the looking at the numbers. I wanted to get into the process of how those numbers are being generated.

So that's when I got into technology, or luckily I was having really good mentors who helped me with that. And so my consulting career was with India, with Grant Haunton, and then I also had a stint in Deloitte, and after which I moved to Bank of New York, Mellon. There was a move that I planned out because I always wanted to be in financial services, and perhaps we can speak about it later. So as part of my role, the team that we have in B &M Mellon,

has presence in different geographies, given the coverage that we're providing that's enterprise wide. So we have presence in the Americas, EMEA, as well as APAC. And as part of my role, I moved into UK from an EMEA presence perspective, yes.

And how did you find the transition coming from India and then working in the UK?

So that's a good question and...

Let me mute my comp so that you don't hear the noise. So that's a good question, right? So in terms of transition, I'd like to put it in two different buckets. One is the personal transition that you go through, then the professional transition. The processes within BNW Mellon are pretty much the same wherever you work out of, be it APAC or US or EMEA, right? So there was not a huge amount of change for me, accustoming professionally here because I was with the same team and.

the team out in the UK welcomed me really warmly. So the biggest change I went through culturally was, you know, accustoming professionally to, not professionally, but personally within UK, right? The climate, obviously, if you are aware of India, it's the tropical animals and coming into UK where it rains every day, I call Manchester rainchester. So it rains almost every day. So yeah, those were the changes that I went through. And, you know, how,

evading through that and the real estate market here is really hard. So you can't get a house that easily and all of those, those were the personal things I went through culturally and then making new friends, that's making friends in adulthood and developing your network of professionals because back in India, because I had the background of charred accountancy, I was coaching charred account in students and then I used to be presenting in different professional bodies.

including the Comptroller General Office or Unis and all of those people to provide guidance. And then setting that network back up here took me a bit of time, I must say, yes.

Sure. And have you helped yourself do that? Are you part of any networks now?

I'm slowly building in that. So we have multiple employee support groups within our firm itself. Like we have the Women's Initiative Network within the bank. And then there's Impact Network within the bank, which I'm part of, and then taking active roles there. And then apart, what I try to do is attend some of these good conferences that are hosted by, let's say, IAA or ISAC.

or yourself, right? I do see that I hear the podcast that you have put in and there are some good places where you can and then being active on LinkedIn. And then when you are in the recruiting market, when you're trying to recruit staff, you speak to people and then you kind of build your network on. So I would not say I've made like huge progress there. If I'm going to compare it against what I had in India, but definitely slow and steady progress and that.

kind of gives you that confidence, you know, when you have the professionals and where you can bounce ideas of each other.

Sure. And, you know, going back to technology, the technology area now, how do you see, do you feel that there are quite a lot of women within the technology space, or do you still think when you're recruiting that you find that quite hard to find sort of diversity within recruiting for your roles?

That's really an excellent question. So at VMware Mellon, that's been one of the priority, women in technology, fostering women in technology. So for me, for me being in audit and specifically in technology audit, one thing that we have discussed within our groups, recruitment partners, et cetera, is how to bring that diversity specifically in the end graduates, right? So one interesting research paper that was discussed with us was that,

when people are young, like when they qualify in uni, a lot of them do not pick up audit, particularly women, because of how generally the job description is written up. They do believe that it's not potentially for them. They believe it's a guy's job rather than a woman's job. And we've tried a lot to break those myths. We've tried, we've bent into the universities, we've bent into campuses where we speak about it and represent.

the women community that's out in order, that's out in technology. And obviously in women, generally I have seen that they're quite shy when it comes to math or technology, right? Like they believe or they don't think that they might be good at it, but I have their word, right? So it's just that building that early challenge on, and I'm very proud like within BNY Mellon to say that we have a very, very good graduate program.

that provides a rotation across different teams with an audit. And a lot of our graduates who started off with traditional audits came into technology audit experience what technology audit is and then they rotate on. And then I'm hoping that that gives them that exposure and then tells them what is their technology audit, what it entails and then can they progress there or not.

Sure. And do you think that that is changing now, sort of in, since in the last sort of eight years you've been at Bank of New York, with the different graduates that are coming in on a year -on -year basis for technology audit, have you seen sort of more females joining or?

Yes, I can. I mean, if I analyze it, yes, I do see that, you know, right now we have a lot of graduates or entry level candidates who are women with an audit and specifically as well as with the technology audit. So what we and what would help better is that as they progress along their career and they're going to have a career break to them at Trinity or everything, right, supporting them.

fostering them back to work and then providing the support that they need so that they can progress through their career. And then when they hit perhaps a glass ceiling, provide them that support and provide them the confidence to navigate through things. That's going to be a huge help. And it's just not for the young graduates, even professionals who are experienced, they would need that support as they progress along. And that's where mentorship, sponsorship.

plays a huge role.

But I, you know, do you think that it's just younger people don't understand that technology does need to be audited and they just look at internal audit as chartered accountants because even yourself you started your, you know, you've done your degree in chartered accounting, finance, right? So do you think that...

Bye now.

The communication is that people just don't understand that technology also does need to be audited.

Absolutely, that's spot on. So because when I started off my career, audit was a niche profession then when I started off. And then all I knew when I came in was financial audits, looking at balance sheets, looking at equity statements, cash flow statements. I did not have an idea that there's more to it. And I didn't know that audit on controls existed, leave alone audit on technology, looking at the process controls and then the technology, the people process systems that.

I was not aware when I entered into the professional world. Luckily for me, I started my career with Grant Haunton and they had different services that they offered. And as an intern who started my career, I had the opportunity to wait through different services that they provided, including diligence, technology audits, and process audits, controls audit, and I found a real good mentor.

who helped me, who taught me the ABC of technology audit, because back then I was a chartered accountant with only financial, because my degree was also in finance, I had a really less idea of what entails in a technology audit. So my mentor taught me the ABC of technology audit. And after that, and when I started doing at least years of technology audit, I decided it's time for me to upskill myself.

and completed a certification on information systems audit. That's CESA certification, which is very renowned and upskilled myself to be able to sell myself better, right? Like have the credibility for me now that you, because the questions that I used to get is like, now that you're in finance and how would you understand technology well? So I needed to have that upskillment and then I continued to do that. So, you know, understanding AI data sciences, et cetera, I continued to upskill myself, but yes, as you said.

The knowledge around these type of things exist and these types of things needs to be audited is very less when you start your career young, right?

Yeah, and tell me when you was at Grant Thornton then your clients were they financial services clients or did you have to when you went to Bank of New York what was it sort of a whole learning around sort of banking applications and the banks infrastructure?

That is again a very good question. So in Grand Taunton as well as Deloitte, I had a multitude of clients. So health and healthcare, I had clients in broadcasting media, you know, the fancy part of it is they're like looking at their processes, looking at the satellite of streaming, et cetera. I had clients in financial services, I had clients in multitude, right? And then that's when I said like my mentor. So my mentor was my reporting manager. So, and he is,

Right now he's the CEO and founder of a consulting firm that has branches across the world, at least in three places called Feinstein. And we used to have like really good conversations about what is audit, what entails, what's consulting, what's industry. Because at the point in time, a lot of people did not move from consulting to industry because there was a myth that the work that is done in industry could be monotonous.

So when we spoke about it, I used to have these transparent conversations with my manager and then understand from what's his perspective on it. And then we spoke about how in consulting, we are profit centers, we bring in revenue. Whereas when we go to industry, we be looked at as a cost center. So we kind of, so I always had this idea that when I move into industry, I need to move to a place, I'm going to be a cost center. So I need to move to a place where audit is critical for the growth of the firm.

critical for systematically for that particular company to progress well. So my easiest option was BFSI, right? So Banking Financial Services and Insurance, because that's highly regulated and audit is going to be the biggest factor for them to attest things to prove that the bank or the firm systematically sounds. So I always knew that when I was going to move to industry, I'm going to move to financial services.

So I kind of picked and choose my clients when I was a grantaunt in July to include financial services, a lot more of financial services so that I would have that background when I move into industry.

So do you think then, doing your career, do you think anybody that's working within a technology audit role now, whether that would be in, I don't know, telecommunications, other non -financial services industries, is it really quite easy to make that transition into banking, do you feel?

I think the way I would answer that question is that yes and no. To make a transition is easy because you will have the basics in the background. But to sustain here is going to be difficult unless and until you are going to be upskilling yourself continuously because the market's changing, your risks are changing, and you need to be on the lookout to understand what's the risk to the process because to technology audit, when you look at it, the risks are

evolving every day. What was risk five years back is no longer a risk now and then we have newer risks like including you have people exploiting the bank's vulnerabilities, you have insider threat risk. So your risks are continuously evolving and changing. And particularly when you're going to be in banking, you need to be having that risk focus and understand.

the regulatory, the regulatory focus. So what are the regulators looking for? You need to know what's the industry, where the industry is going, what are, and you need to upscale yourself continuously to be able to sustain the transactions, what I would think.

Sure, okay, thank you. And so what attracted you to internal audit then? Because was you actually, was you planning to actually get into technology audit? I know we sort of spoke about that briefly. Or would you have liked to have been a finance product auditor, let's say?

So my idea when I took out my or when I started on the pursuit of chartered accountancy was to be in finance. Eventually. So again, as I said, my mentors have always taught me to have like a bigger picture, a vision of what you want to be 10 years from now. So that's something I always I used to always have in my mind, even when I started my career off young. And my idea at that point in time was to, you know, be in finance.

be an expert in finance, in your IFRS, your accounting standards, making sure you know how to get your numbers running and then finally be a CFO, right? Or something like that. That was my idea when I started off. But later I realized that more than numbers, the process of running the company excite me. So that is why I went into technology, right? So how I got into audit was because,

When I was graduating, I graduated in finance, mainly because I did not take the biggest liking to chemistry or physics. So I was like, okay, I'm not going to do chemistry, physics. I'm going to do something that's interesting for me. And then I took up finance. And then from finance to technology audit, I think it was what drove me was...

you know, my passion towards understanding the systems better and understanding the process better. That's just what I'd say. It was, was a gradual progress because I did a lot of finance, it was statutory audits, like looking at the company's financials for, for at least one, one and a half years of my internship. And perhaps the, yeah, go ahead.

Jeff.

And sort of why is internal audit a great career for women then to build careers?

I think internal audit is one of the best places just for women, for anybody who wants to have a understanding and who wants to have the bigger picture, who wants to have the understanding of this entire company because being in line three gives you the bird's eye view of that entire company, right? What is happening in line one, what's happening in line two and what can you do to add value, right? So that kind of exposure.

It's not something you're going to get in any, and then I can, I can bet that you will not be getting in any other line of defense, right? So being in internal audit gives you that bigger picture. And if you're ambitious, I would obviously say that you should start a career in internal audit, just because the kind of instructions you have, you start your instructions with senior managers who are veterans in the process. And then, you know, when you do that, when the kind of people, when you surround yourselves with people like them, you're going to upskill yourself really fast.

to be able to match them, right? And then you're going to grow, you're going to learn super fast. And that's what I feel, in turn, what it's going to do for you.

sure. And, you know, working, I know that you work out of Manchester, but do you travel quite a lot with your position, whether that's sort of to London or?

Yes, we have offers in London. So there are and we do have given this is a banking and a financial, we are in financial services. So we have a lot of regulatory commitments and regulatory, regulatory focus scrutiny as we go through. And then that entails travel. So to meet the regulators or to meet your team in London, obviously, because it's a global company, also travel to America, New York, Pittsburgh, where we have offices.

and to meet the team, to meet senior stakeholders. So that's happened as well. So, but I mean, when you ask that question, if I have to put a comparative lens to consulting, I would think that travels a lot lesser with an internal audit than you compare it to consulting because in consulting, you need to travel all day, every day. You need to go be it with your client, go to their place and then do the audit. So.

your client might be in a different city or a different country and then you still need to travel there. So in that way, it's fairly manageable here.

And tell me how has the pandemic affected you then in terms of, you know, how does that look like now with regards to travel and getting out and meeting people?

Okay.

and we can see that travel has really picked up. And then the collaboration, the spirit of collaboration has picked up as well, because everybody has written to office now. Everybody are spending good time in the office where you collaborate with different teams, you collaborate with different people. So that's happening. So yes, the pandemic did affect. At a point in time, we were fully remote. But now slowly, everybody's back on the streets, everybody's back into the office. Then...

collaboration starting the travel sources starting is what I would think.

What keeps you within internal audit? Is that something that you feel that you will stay in or how do you think that will enhance your career maybe moving out of audit?

So to answer this question, I want to quote something that Ed Corian, who's a deputy chief auditor, who always keeps saying this, saying, the role of internal audit is to develop tools, people, processes that are transferable. The business needs to come and ask you, hey, this is an excellent analytical tool that you've developed, so can we have it? Your person has really good understanding of our business, can we hire him? So that's...

kind of people we aspire to develop, right? So that's what should happen. And then that needs to be really organic, right? That transition needs to be organic. Having said that.

I see myself being in audit because I really love what I'm doing. And what motivates me to be in audit is the value I see I'm adding, right? Particularly when looking at, as I said, like when we are looking at enterprise initiatives, we providing that support to them and then letting them know what is going wrong or having that foresight telling them this is going to go wrong if you don't fix it right now. Providing that support now, I do see that adds a lot of...

value to the business. And I can really see as third line, we are evolving and then doing adding more value to the business. And that kind of keeps me motivated, right? Like, because every day you come into the office, and then you feel accomplished, you see, you feel that you've done something, you either save some money, like by identifying a few things, or you've saved a regulatory fine or things like that, right? So that keeps you motivated, you believe, as long as you feel that you're adding value.

and then you feel that whatever the job that you're doing is really, you can see the value that you're adding that that would keep you motivated, that's what I feel.

Sure, okay. And I'm assuming all your stakeholders are obviously from technology departments, right? Do you find that even the other departments are still quite male dominated or do you see a lot more women just in the technology space in general?

So to answer that question, when I was in consulting, I used to see that most of my CIOs, like the chief information officer, CTOs, chief technology officers, were always men. And you need to handle the three difficult stakeholders of men all the time. But being me and Melon, it's all different. Our CTO is a woman, like she's Bridget Engel and she's...

one of the most toughest women I've ever met, right? So she's very strong and to sell a point of view to her, you need to really have all your duck syndrome and then say what you see is why you see that important that they have to make the change, right? So, and I think I do feel in being my melon, there's a culture of fostering women in technology and then helping them back to work.

when they have had a break, I do see that those are things that we at my balance doing really well.

Okay, that's great. Okay, and just in terms of your career today, what's been your biggest achievement?

difference to me that my value was being recognized. So I was selected for this award by my reporting managers, their managers, and then the chief auditors. So that made me really proud of what I have done so far. It's something that really helped me realize that whatever I've been doing, I must have done right to have got that. So that was my highest high point in my career so far.

In the technology space, I think the biggest risks are going to be around these emerging technologies, right? So, generative AI. So, what are we doing as a company or as an industry around generative AI, as lucrative as generative AI seems, there are risks associated with it. So, what are the guardrails we have in place to address those risks? That's something that's really key.

Obviously, the next key risk is resiliency, right? So how resilient are we? How are we going to be back in business after an attack? What kind of controls we have in place to be back in business immediately after an attack or immediately after something untoward happens, right? So that is the next biggest risk I see, the operational resiliency. There are several regulatory acts, including Digital Operational Resiliency Act that speaks about

resiliency and then what the firms needs to be to do to be compliant towards it. That's another biggest risk. And then, and me speaking about these emerging things also, I do not want to lose focus on the basic law, right? Like managing your access, managing changes appropriately. Those things are going to be technologies this forever. Like if that's not managed efficiently, whatever the company builds on, it's not going to be.

sustainable because when your foundation is not strong, you're not going to get that building to be strong.

Great, so you just froze a little bit then, I do apologize. Okay, so if you had any advice for your younger self then what would that be?

for my younger self.

That is the question I didn't think about too much. I think maybe I would have said, I used to be a very, very studious kid when I used to be studying. And I would have said to myself that it's okay to have maybe chill a bit and then you do not have to be that studious. That's what I would have told myself because when you're too studious, you kind of miss the fun around you. So you need to be in the moment to get better. That's what I would tell my younger self.

And just in terms of technology, how do we, or technology all day, how do we try to entice more people or more women into the industry?

I think we do that by having a robust graduate program and a robust interning program, right? And fostering diversity and inclusion is something that needs to start at a grassroot level. You need to be more on the campus and then there you really let people know, provide them guidance on what are all the career opportunities that are available and what are all the things that they can do to upskill themselves.

as they graduate or differentiate themselves as they graduate. So being on the campus, having a good internship program, having a good graduate program, supporting diversity across and then helping people as they join along, providing them a really good experience because I honestly believe people do not leave companies, people leave people. So when you provide, when you.

provide the change or when you provide them a good atmosphere that they want to stay at, that's a way where you can entice. And then I do think there's them in initiative networks like we have been and making sure that we have support groups that, you know, let people know that, hey, you do not have to have had a huge engineering background for you to be able to do this technology audit. So this is what is all technology audit is about logic. Technology audit is about understanding.

Okay, well look, thank you very much for your time today. I think we're finished on a quick fire round. So tell me, what's the best place you've visited and why?

Bye.

Is it personal or professional? So personally, I like Switzerland. Switzerland has everything that, you know, it's like the come out of a book from a fairy tale. Professionally, I do think New York is the place like, you know, Wall Street, New York, where you have several financial services there, and you can see things happening on the ground. So that's really has been enticing to me.

Are you reading a current book or listening to a particular podcast at the moment?

The book I'm reading currently is the book by Stephen Hawking, Brief Answers to Big Questions. I've been trying to understand a little bit more about how the universe works. That's good. And then the podcast, I've listened to all of your podcasts in your first season. That was really good. I liked MTS's, Sharia's and all of them. It was really, really good. And the repart, not much, just that. I've listened to those and I'm just getting into the podcast to understand where these were.

Okay.

That's good. Look, you're listening to me. That's fantastic. And if you're going to spend, what's the best way that, or how do you spend your day off?

Yeah.

That's it.

My day off, depends. I I'm ambivalent. Sometimes I'm like too extroverted. I want to be in the city or go up to the mountains, do everything external. Sometimes I'm just going to be home reading a book or being a couch potato watching a series.

And lastly, what would the title of your biography be?

I love my biography.

taking calculate how to take calculated risk.

Well look, thank you very much for your time today. I've really enjoyed it.

Thank you.