The second episode of ‘Inside the Auditorium’, discovers the business-critical role of the internal audit profession. 

I’m joined by Sandro Boeri, a leader and audit specialist with an impressive career trajectory from head of audit, to audit recruiter and trainer and now head of culture assessment for Deutsche Bank and his new role as president of Chartered Institute of Internal Auditors. In this episode, Sandro shares invaluable perspectives on auditing culture and retention, his advocacy for the industry and moving the dial on diversifying talent outside the mainstream system.  

This episode explores:  

• Diversifying internal audit entry points: Sandro challenges the conventional notion that an accounting background is the sole gateway to a successful career in internal audit. He advocates for a diverse range of entry points, encouraging professionals to embrace the expansive nature of the field. 
• Nurturing Talent and Culture: Internal audit has a critical role in shaping organisational culture. Sandro shares his experiences in fostering career progression, investing in people, and creating a culture that retains and develops young talents. 
• Crafting a dynamic career path: Retention is paramount. Discover how internal audit can be a stepping stone to a varied and dynamic career path. Sandro advocates for mobility within a business to gain an understanding of day-to-day business pressures and laying the foundations for returning to internal audit at a more senior level.  

This episode shares deep insights that will reshape your perspective on internal audit careers and the spectrum of opportunities available.  

Enjoy! 

Note: The views expressed by Sandro are her own and do not necessarily reflect those of her employer. 

Hello, Sandro. I'm very glad that you're here with me today. Obviously we've known each other for quite some time around the industry, but I'd love you to sort of share your background with our audience.

Merchant Bank, now called an investment bank, called Kleinwald Benson, where I spent six years. I had the chance to travel the world, 42 countries and see an organisation from top to bottom. Then had a short stint with something called Manufacturers' Hanover Trust, which is now part of JP Morgan, if I'm not mistaken. Then moved on.

and spent three years with something called Amsterdam Rotterdam Bank, which is now part of today's ABN AMRO, where I led the London audit function. Then I moved on and spent seven years with Credit Agricole in London, where I did two things. For five years I led the audit function and then for two years I decided to jump on the other side and actually manage their futures business. That's the first chance to be audited by somebody.

Then I spent a short period of time with Lazards in internal audit and then joined Sumitomo Bank where I was their head of audit in London for about three years. Then I joined the Gerard Group, by the way I've been around a long time as you can see I don't just jump from job to job. Then I moved on to something called the Gerard Group which was essentially an asset management business where I led the audit function and had my first midlife crisis and decided I never wanted to work for anyone again.

So I set up my own business called Risk Audit, which as you know very well Hazel, was not only a training business but also a recruitment business. And that's survived for 17 years, long period of my life. Then I had my second midlife crisis and I decided to go back into the world of employment and I joined Deutsche Bank, where I still am after almost 7 years, where I've got two roles. I'm responsible for people enablement.

In other words, organising and managing career paths on behalf of our very large audit function. And I'm also responsible for cultural assessment, in other words, assessing the culture of the organisation of Deutsche Bank. And if that isn't enough, in addition to my day job, I'm now the President of the Chartered Institute of Internal Auditors in the UK. How's that?

Wow, very good. And tell me, can we just go back, I always sort of found it quite entertaining that, you know, going from a internal all-debt, and then you became the trainer for quite a lot of the banks when you was at Reschool Debt, and was doing that part. Can you tell me a little bit more about that role?

Yeah, I mean, it started off. Why first of all training? Well, if I'm honest, Hazel, we wanted to demonstrate the credentials of our recruitment company. We were in a very competitive marketplace, so we wanted to differentiate ourselves and show that we really knew what we were talking about. So why not run a training course? I ran a training course for compliance auditors. One training course became two, became a portfolio of courses.

And then my natural inclinations were more towards the training rather than the recruitment. So it developed into a portfolio of courses around product, in other words, how to audit corporate lending, around regulation, in other words, what are the latest key regulatory themes, around people. In other words, how can you best get the best out of people in an internal audit environment with

A lot of emphasis on financial services, obviously. That was my main arena. So dealt with internal auditors, but also dealt with risk managers and compliance officers.

And do you think that helped you from being a head of audit and then going into training, that helped you in terms of just not what the banking knowledge or how to sort of get into these companies as well from a recruitment perspective.

See you then.

It helped me keep up to date as to what's going on, because if I'm going to teach people I've got to stay up to date. So for some weird reason I'm quite good at reading large documents and making some sense out of them. So it enabled me to deploy skill I didn't even know that I had and helped me stay up to date. A habit I haven't lost. I still...

Sure sure.

I'm an avid reader of every regulatory publication and still produce a daily newsletter called Stop Press but this time it's produced in a Deutsche context rather than a marketplace context.

And so if we can just briefly touch on culture because I'd like to go into that more later, but obviously you've been working within culture and then you've gone to be the president for the Chartered Institute of Internal Auditors. Can you tell me what that sort of involves now and how being in culture has helped you get into that role?

I think being somebody that was passionate about auditors auditing culture, auditors auditing behavioral risk, it enabled me to make a lot of noise, to stand out from the crowd to a degree because auditing culture is still unfortunately not a mainstream activity. That got me into meeting more and more people in our profession and then got me curious about

doing a bit more for our profession, which got me to submitting my name for election to the council of the institute. Failed the first time, missed by about five votes, got on the second time about two years ago, and then one thing led to another and I found myself putting my name forward as president. Why? Because I wanted to influence the profession that has kept me gainfully amused.

for many, many years. When I say I wanted to influence the profession, number one, I certainly wanted to do my bit and continue on to do my bit to push the profession to really embrace behavioral risk. But at the same time, I would hate to think that our profession becomes irrelevant. So I want our profession to feel confident, to move the dial in terms of the organizations that employ us and actually make a difference. So the best way I can make a difference.

is by getting myself a microphone and a podium and making a bit of noise.

And do you still think that, you know, I was having a chat with somebody the other day about the CESA qualification and, you know, the IIA qualification. Do you think that they are still relevant now in terms of how internal it's changing?

I'll give you two answers. Outside the financial services sector, I certainly believe that the CIA and CISA qualifications are totally relevant and more importantly respected and embraced. Why? Because they teach people the foundational dimensions of our profession. What does our profession exist to do? What is a risk-based audit? How do you perform a risk-based audit? How do you manage stakeholders and so on?

within the financial services sector, I think we're on a journey. I hate that expression, but that's really what I think. I think we can do better. So I think as a profession, we've got to work hard to demonstrate the relevance of the CIA in the financial services sector. But I also think that our institute can do better in terms of adding value in a financial services context.

something that as president I really do want to promote.

it sort of do better in which way in what way

A number of ways. Number one, advocate for the financial services sector. So what I mean by that is the financial services sector is a heavily regulated sector. In the UK, we've got the Prudential Regulation Authority and the Financial Conduct Authority. I believe we can do better in explaining exactly what the third line of defense is about and how the third line of defense can help.

two regulators and other international regulators really understand more about what's going on in their organization. So I think there's still a little bit of getting to understand each other and the institute has a role to play there, number one. Number two, I think, I hope what I'm about to say doesn't sound terribly arrogant, but it may do, but I'm going to say it anyway. When Riskall it disappeared, I believe it left a bit of a hole.

in the marketplace in terms of the provision of relevant training, mass market training for financial services auditors. So I'd love to think that the Institute can step into that hole and therefore improve the education of our financial services sector internal auditors. So being relevant as far as regulators, improving the training offering I think is quite important.

I think the Institute can probably push the bar a little bit. We've got a financial services sector code in the UK. That code, in my opinion, reflects the lowest common denominator. I actually think the code can go beyond that. So I'm quite keen to play my role in pushing the Institute in encouraging for the financial services sector related codes to develop.

and really encourage internal auditors to push the bar. Does that make sense?

Yeah, it does. And when you when you was the trainer, it was true, we schooled it, I don't feel that there was enough internal audit graduate schemes, it was more candidates came from the big four. It's really known as one of the best training grounds if you come from a big four. Now these now I've noticed there's a lot more banks that are getting involved in these graduate schemes, very much an internal audit, people are going around

How do you think that the IIA can help with that?

Yeah, I think the IAEA can help in two ways. Number one, acting as a bit of a facilitator between the UK's educational system and the internal audit profession. In other words, explaining in universities what internal audit is, but also how exciting internal audit can be, how internal audit as a first career is a really good thing for somebody to be doing. But you and I come from diverse backgrounds,

I don't have a college degree as my American friends tell me. We need to be diverse in terms of our profession. I actually think we need to go looking for future internal auditors outside the mainstream university system. Perhaps there is room to improve our apprenticeship offerings and really take advantage of people that have grown up with a diverse background.

And I think the Institute has a role to play in making what I describe a living, breathing reality.

So would you be right to say then as progressive, in some ways, the internal audit is, with data analytics and so forth, the role of somebody going to university to take their accountancy qualifications, do you feel that internal audit may not necessarily just need those accountants?

I think an accountancy background for an internal auditor is one, one way of entering the profession. But remember, accounting has a heavy focus on financial accounting, on numbers. Internal auditing is about having a widespread understanding of many, many themes, understanding the risks attached to those themes and then being able to comment on whether the controls are appropriate.

not just financial risk, cyber risk, credit risk, market risk, actuarial risk and so on and so forth and therefore I think an accounting background is just one way. I'd rather we had a diverse range of entry points for internal audit so somebody can embrace the wide breadth of our profession and the opportunities that it offers up. I'm seeing change.

When I first entered into the profession, I was an outlier. I'm a qualified banker, not a qualified accountant. But I was competing very heavily against the qualified accounting profession. I am seeing radical change in that, both outside the financial services sector, but also within that. There is a wider range of entry points into internal.

And so who do you think needs educating more on that? The chief auditor or the person looking for their university degree?

both. I do think we need to start with audit committees. An audit committee is still very heavily focused on financial risk and therefore has a penchant for the accounting profession. I think we need to start there. I think it's a mass complex explanatory exercise that we need to engage in, but a critical one.

Thank you.

Sure, sure. Okay, interesting. And in terms then of, maybe you can explain exactly what the IIA can do for companies in terms of helping them with training or what have you.

So first of all, the IAA has a number of corporate membership schemes. So corporate membership schemes gives you access to discounted arrangements in terms of access to qualifications, access to training, access to conferences. The IAA has a leadership forum. So there's the opportunity for the senior leaders in a corporation to meet other leaders and to compare notes and to try and... There's always safety in numbers.

The IAEA is an organiser of training courses on a variety of subjects but also conferences that embrace a variety of subjects. I mean I've just come back from the IAEA Scottish conference in Edinburgh where you had artificial intelligence, ESG, people, the future of intern law.

could go on forever Hazel. So the IAA has got education in its very DNA, it promotes a learning culture across the markets and it tries to spot the next big trend. I mean obviously we're talking an awful lot about artificial intelligence at the moment because not only does it represent a threat, it also represents an amazing opportunity for our profession.

Sure, sure. And just in terms of how do you think that the IIA can help in terms of culture and helping people in getting into sort of, you know, understanding where they should be placed as an internal auditor.

I, from a cultural perspective, the IAA is certainly sharing all sorts of tips on how to audit culture. At the same time, we also, because we create these congregations and networking events, the IAA is certainly providing an opportunity for people to compare the culture in the environment they sit in versus the culture of other businesses.

So I would say we are to a degree a clearing house to use old financial services terminology for different cultures and different tribes within our sector. Quite unique.

And what sort of into going back to is there any particular companies as well Not just being in the role that you do now But as the president is there any companies that are doing well to attract talent through culture or doing anything differently? And if so, what are they?

I'm not going to mention specific names but I'm going to mention specific characteristics if that's okay. At the moment the companies that are doing well to attract and more importantly retain talent are the companies that have a very clear sense of purpose and walk the talk. So if you look at companies that for example are mutually owned.

Ciao.

I can think of one large building society amongst others. I can think of a number of insurance businesses. These companies have got a very clear sense of purpose. They exist, they live and breathe to service the customer and to provide a social benefit. These companies are very good at attracting gen Z, gen Z and the younger generations. Why? Because they are what they say on the tin. They, they,

They give people a sense of value. Companies that are driven by only the profit motive and nothing else have to work harder to walk the talk, to actually mean what they say. I've got to work harder on having career progression, investment in people. Some of these companies are really good at what they do.

There are a number of investment banks that are really good at what they do. There are also some quite smaller organizations where internal audit is a niche activity, but because the head of audit is really plugged in and respected, they get the investment they need. So to me, a key metric is always looking at the degree of turnover, staff attrition that you see amongst the younger population.

in an audit function. That always tells you something about the culture of an organization. So one of the reasons that one of the key parts of my job at Deutsche Bank is working on careers and career progression in a way that we really do retain young staff and develop young staff into the leaders of the future. That's an absolutely critical thing that certainly gets me out of bed.

And can you just give me a look, you know, when you're talking about retaining, are you talking about retaining them particularly within the audit function or are you talking about just retaining them in the company altogether?

I know I've had a career in internal auditing, as an only been in internal auditing, but I'm actually a great believer that a great career is a career where people are dipping in and out of internal auditing. So for me, when we talk about retention, we're talking about retention within an organization. So ideally, we're talking about internal audit being an entry point where somebody gets a really good understanding of risk and control. We're then talking about moving into the business and getting a really good understanding about the business and the day-to-day pressures. And then armed with that good risk and control understanding and armed with that exposure to the business coming back into internal audit and more senior level. And then maybe rotating out the business again into a very senior level in the organization and maybe one day.

coming back to run the audit function and who knows one day being the chief executive officer or the head of the business or organization that employs that is a wide and varied career if you can retain that person and help them transition in and out I think you're doing a great thing. I'm not naive I know the world doesn't always operate that way but that for me is the aspiration

and how

And what do you think the internal audit can do to keep getting these people to come back because pretty much people don't.

I know. I think an internal audit function needs to be seen as a place of aspiration, a place that walks the talk, a place that has a sense of purpose and a moral conscience, but a place that really does understand the commercial realities of the organization. In financial services, there are certain jobs where quite frankly, if somebody leaves audit and goes into that job, the chances of seeing them back in audit are probably zero. I am

positions where variable compensation is extraordinarily enormous. But they're actually quite rare in terms of the proportion of the whole. I think there are a lot of other jobs which are ops facing, client facing, perhaps building products where moving back and forth from intern Lord is a viable career path. As auditors we need to do more to sell this type of career path.

And how do you think moving forward then we can sell it better?

I think we've got to try and get across that the internal auditing function is something for everybody. Let me try and explain what I mean. If you're a doctor, you like to prod patients and understand what makes them tick. Well, you certainly get a lot of chance to prod the patient, metaphorically speaking, and understand what makes the organization tick. If you're a forensic detective, you like following trails, following the money.

Well, internally, it gives you plenty of opportunities to follow the trails of destruction, sometimes in our organizations, to try and understand where did the money go, what went wrong, why did the control fail. If you're a lawyer, you love reading documentation, you love arguing about words, you love playing with words. Well, as auditors, we need to express ourselves verbally and in writing.

we have to be able to play with words to get our message across. We are in the battle of ideas. So if you want to be a litigator, well, there's plenty of litigation within an internal audit function. And finally, if you want to be a psychologist, well, come and join an audit function that's into behavioral risk because you certainly get a chance for looking at the human condition. I've tried to illustrate, Hazel, that there is something for everybody in internal auditing. And that's quite rare.

in the professional world.

Yeah, yeah sure. No, I totally agree with that. And going back to culture, why do you think it has become such a big area for the people wanting to get involved with an audit?

Ehh

implications of austerity on the society we live in today. I remember writing the most wonderful audit recommendations. I remember many colleagues who wrote the most wonderful audit recommendations and if those audit recommendations had been implemented I believe there's a number of banks that went bust that would still be around today. So why wasn't common sense and logic, why didn't it prevail? And the reason it didn't prevail is you and I, Hazel, are human beings.

We're emotional, we're flawed creatures, we don't always do the sensible thing that people would expect us to do. And I'm just describing the type of person that implements and manages controls, frail, emotional, illogical human beings. So therefore, option A, as a profession, we can ignore that it's human beings operating controls, or option B, we can embrace.

the controls will always be designed and operated by human beings in one shape or form, so therefore we need to embrace and understand the human condition. That's why we need to get into culture.

Okay. And do you think culture is here to, you know, I think a lot of people are talking about it, but how much investment goes into it is another, you know, how much time and what would you think is the most important thing about culture to audit if there was a particular area?

I would say, can I cheat and give you two answers? There's two things. The first one is, really the obvious one, what incentives and what disincentives are in place to try and influence behavior. So in financial services, for example, the variable comp is a massive incentive, vast amounts of money. So the way those incentives are applied,

Yeah, sure.

has a big impact on the way people behave. But we're not only talking about financial incentives, we're also talking about promotions, demotions, as far as one can demote anyone under UK law. But anything which incentivizes behavior, for me, should attract the attention of the internal auditor. What mechanisms are attached to determining pay and promotion? Are those mechanisms linked to good conduct?

to good behaviour. Are those mechanisms being consistently applied in a way that people understand that if they do the right thing they will be rewarded? So that's one big area. The second one is training. When you train employees, do you make a heart-mind connection between what you want people to do and why you want people to do it? Great training makes that heart-mind connection. So as an internal auditor, we should be looking at...

How is the training material structured? Is it explaining to people why something that they should do is important? Does it describe it in a language which is likely to resonate with people? So these are two, for me, immediate pressure points that internal auditors should be looking at when dealing with culture. There are obviously many, many more, but if I had limited time, that's where I would start.

Well, of course. And in terms of that, do you think it will continually become, you know, where culture will be more designated in some of the smaller companies in terms of internal audit? Because it's really only the large big banks, right, or two or three I know that I've recruited for that actually really have taken this quite seriously.

I've seen a bit of a sea change at conferences in the last 18 months. So when speaking at conferences, say two years ago, a typical question I would get from smaller audit function is number one, what do you mean by culture? And number two, it's too subjective, it's too woolly, we can't get involved. Now I'm not getting that question anymore from smaller functions. What do you mean by culture? What I'm getting is practically.

What steps should I take to start getting involved? So I'm seeing more and more smaller functions putting their little toe in the water and starting to comment on culture, starting to audit controls that are closer to influencing people, starting to audit controls on training, on recruitment and so on. So I'm starting to notice a sea change. You are right.

The larger organizations are more into it. Not all of them, by the way, but they're more into it. Why? Because it's easier for them to employ occupational psychologists, and it's easier for them. They've got bigger budgets to actually employ occupational psychologists on a contract basis, for example. But I'm noticing a sea change. I'm as optimistic on this subject as I've been in years, Hazel.

And in terms of people going out and auditing culture,

So how much do you think it's been taken on board to change? You know, I don't know, they noticed that some people haven't had training. How much action is being taken on that?

I would say you've got the big four and a number of consultancies that are very active in this space now and are starting to train and show auditors what to do and how to do it. I think there's a lot more room for improvement from a training and educational perspective, something that I really hope the Institute of Internal Auditors will embrace.

Yeah, sure. Because it's all very well auditing it. But if you're just going to audit it and put it in a cupboard, so to speak, then there's no point in doing it right. So, you know, it's, it's a bit like some of them.

No. It's like any, yeah, it's like any other activity, you know, you issue a report and it's important to follow up to see what have people done with the report. No difference to reports really regarding culture.

Sure, sure. And so therefore, you're very much, your mindset then in terms of like, for example, data analytics is gonna take over internal audit and we're never ever gonna need people to do internal audit. It's all about the culture and we still need, well, we still need internal auditors then.

I think so it's more art if well let's start with data analytics first. We still need to organize ourselves to be able to collect and analyze data. There's still a long way to go in our profession but over the last 18 months we've seen the exponential growth of the use of our artificial intelligence tools. In fact I noticed today that Elon Musk has just introduced his own.

tool called what's it called GROK or Gronk something of that nature. What artificial intelligence allows an internal audited to do is to it gives an internal to a suggestion as to what are the risks, what should the controls look like and how should you audit the controls and based on what you find what should be in an internal audit report. So what you've got is a relatively

a relatively cheap source of advice. Why would you ignore that advice? But I don't think AI is advanced enough yet to replace human judgment. So I see AI as an additional really cheap member of staff that you can use to basically challenge your thinking at the different stages of the audit process.

Are we going to get to a position where you can replace the human internal auditor with AI? Yeah, I think that risk exists, which means we're going to have to work hard to differentiate ourselves. At the moment from what I'm seeing with AI, it's still very vulnerable and very fragile and you can't just take everything that this box tells you at face value. But...

that's like people as well right? No but what they're meaning as well though you still need to understand your stakeholder right? I'm a little bit biased knowing if AI can do that in terms of

Uh, yeah. Yes.

I think we're a long way away from AI telling you and me how to interact with Joe or Fred.

Oh.

the

So how important do you think then is it in sort of company culture to start now attracting talent into internal audit?

I think it's absolutely critical. I actually, I'm a great believer that every company needs trusted advisors. Trusted advisors who are independent, trusted advisors who are objective, trusted advisors who know the business and trusted advisors who can talk truth to power. That's what an internal audit function is. So therefore it's critical that we attract talent, diverse talent into our profession.

We develop that talent, we refresh that talent, and we challenge that talent to progress. So if you believe, and I obviously do, that an internal audit function is a critical must-have in any business, in any occupation, then let's do it properly. Let's make it a place that people wanna join and people wanna develop. So I absolutely believe it's critical, which is why.

a recruitment business has an essential role to play, Hazel, in acting as an intermediary in the market. You'd expect me to say that because of my past, but also it's what I truly believe.

Hahaha.

I totally agree with that.

LinkedIn won't do the job automatically for you. At the end of the day, LinkedIn, for example, can only take us so far in finding the right type of resources.

Sure. Well, you don't need to tell me that. Okay, great. Well, look, is there anything else that you'd like to speak about, the IIA, or how people can get involved, or any good thing that's happening at the moment?

It's also a chance for you to come and join a big party and celebrate the best in our profession. So if there's one thing I'd like you to take away, let's celebrate what we're great at as a profession and the CIA will have a glittering evening of booze, champagne, fun, but celebration in June next year.

Great, well perhaps you can send me the link and I can put that up on my LinkedIn, along with the podcast so people know where to go. And with regards to culture or anything else that's going on in the internal audit space that you'd like to talk about.

Absolutely.

I would say keep a lookout for the regulator. Keep a lookout for the regulator as it starts to encourage auditors to do more and more work. I expect to see the US regulatory system talking more about it in the not too distant future and I certainly expect the UK regulators to talk more about it. So I don't believe we're going to get a choice.

I believe that if we work in financial services and we're regulated, we're really going to have to get our head around it. So I would certainly keep an eye out. Thank you very much, Hazel.

Okay, great. Well, I'll just finish off some quick five questions if you have time. I would just like to ask one piece of technology that you can't live without.

Go for it. Yes.

my iPhone. So it's like an appendage.

I'm sorry.

I think I'm going to stop asking that question, everybody says it. And what are you reading right now?

What am I reading right now? At the moment I'm reading a book on agility in internal auditing written by a lady called Clarissa Lucas. It's one of the most radical books on the subject of agile auditing that I've read in a long time and I would certainly recommend it. I'll send you a link to that one as well.

Okay, great. And tell me what... Yes, please, why not? And tell me, who is a company that you admire quite a lot?

Who do I admire? I admire Apple. I admire the sheer creativity of Apple. Apple at the moment has a very mature product range. But what I admire is the way that they've invested in and continue to operate their service proposition on a scale which is unfathomable.

I admire the way that they encourage people to serve you with a smile, to listen to you, to want to react to you. And they've done it in spite of the demise of their founder. Incredible business.

And what's the best thing about working in internal audit?

It's the sheer variety. Every day is different. Variety of people you interact with, variety of subjects you interact with. It's the sheer variety of the job. It's certainly not mundane, put it that way.

Great. And if you wasn't doing internal wall debt, what would you be doing?

I'd love to think that I would be working in the world of sports, either some job associated with following the world of Formula One around the planet or some form of role supporting my favourite football team, Chelsea Football Club.

All right, fantastic. Well, look, Sandro, thank you so much for your time today. It's been great to speak with you. All the best.

Pleasure, Hazel. Thank you very much. Cheers.