Explore climate change, data analytics and AI in internal audit in the eighth episode of Inside the Auditorium with our guest Imtiaz Hussain, Managing Director and Deputy Chief Auditor for BNY Mellon. 

This episode explores: 

• Navigating environmental and climate risks: Financial services has a responsibility to the environment, and internal audit plays a big part in this. Imtiaz shares the three critical dimensions organisations focus on today: People, planet, profit. Internal audit plays a vital role in evaluating organisational commitments, preventing greenwashing as well as rolling out environmental, social or D&I strategies.  
• The power of emotional intelligence in stakeholder engagement: Imtiaz shares his learnings on the importance of emotional intelligence as a leadership style and in stakeholder management. Whether addressing or selling an issue, understanding viewpoints and being able to effectively listen and communicate is paramount.  
• Internal audit and beyond: Imtiaz discusses the expansive role and the opportunities to play a role in educating the entire organisation, providing value-add services such as training, awareness, education and thought leadership. 

Don’t miss this episode as Imtiaz delves into the pivotal role of an internal auditor and the breadth of opportunities and responsibilities available as he provides actionable insights and key takeaways, particularly across the ESG space.  

Enjoy! 

Note: The views expressed by Imtiaz are his own and do not necessarily reflect those of his employer. 

Hello, Imtiaz, welcome to the podcast today.

Great, thank you very much, Hazel. Thank you for inviting me.

Maybe we can just start in terms of you can just tell us who you are and what you do.

Thank you. My name is Imtiaz Hussain. I'm the Deputy Chief Auditor at Bank of New York Mellon. I cover several areas as Deputy Chief Auditor, predominantly investment management and wealth management globally, the Global Financial Crime and Compliance Audit Organization, audit innovation and analytics, and also I look after the ESG strategy.

from internal audit perspective globally. There are some other small areas such as people audit and chief admin officer audit areas that I cover as well. So quite a versatile and big portfolio.

So do you ever get any time to sleep?

I try my best. Probably I catch up on sleep over the weekends.

And tell me, you've been working for Bank of New York for a very long time and had a very successful career there. What sort of made you stay there?

Yes.

I think it's culture. So I have been in many organizations and also as a consultant, I have had the opportunity to sort of interact with various organizations, both in financial services and non-financial services. And what stood out for me when it comes to BNY Mellon is the culture, the openness and the willingness to experiment, fail cheap, fail fast.

but learn a continuous learning organization and ever-changing organization. I think that is why I am with BNY Mellon for so long.

Sure. And what made you sort of become an internal auditor?

Initially it was by accident. So my first role at a firm called Circuit City, I joined the Fast Track Management Training Program. They had a financial services arm, but predominantly they were retail organization. And I did a couple of rotations. And then my third rotation was internal audit.

And I enjoyed it so much because of the versatility the role offers. In internal audit, you are a specialist, but you can also branch out. You have many areas that you can look at. You get a bird's eye view of the entire organization and the opportunity to collaborate as well as interact with all parts of the organization. That sort of excited me about internal audit. And I stayed at internal audit.

Sure. And you're educated in Pennsylvania. And so you, I'm assuming, did you start working within the US and what made you come to London?

That's correct.

So yes, I studied originally from Bangladesh. I moved to the US for undergrad After that I worked I earned my MBA as well from George Washington University in Washington, DC continued to work there And it's my better half. She's from the United Kingdom. So She dragged me to United Kingdom for quite some time. So That's the story

Okay, excellent. And so with such a long career, you know, there must have been some instrumental sort of people that have helped you or good mentors throughout your career.

Yes, absolutely. I mean, it's very important to fuel your career with mentors and sponsors and surround yourself with really strong individuals that you can look up to. So I've had many mentors and sponsors along my journey, but you know, few I can mention is Paulette Mullings-Bradnock, the chief auditor for BMI Mellon who passed away.

Jack Cosa, earlier in my career, he gave me a lot of good advice. It's all about sense of urgency in your career. He talked about one of the quote that he mentioned to me that sticks with me even today is, if it's to be, it's up to me. Just do it. You know, and I live to that, live up to that as much as I can. You know, the sense of urgency, making sure that we don't leave any tasks for tomorrow. If I can do it today.

I'll get it done today. And it's important for internal auditors to get things done in a timely manner because at the end of the day, you are providing assurance to the organization.

And you mentioned emotional intelligence that you've learned. Is that sort of more in terms of your own development in terms of your management style or is that more in how you deal with your stakeholders?

Yes, absolutely. So empathizing with stakeholders. So one thing Paulette taught me, you know, I was aware of it. I've been through many management training program, but I've seen that in real life where she was able to empathize and she was able to understand someone else's point of view. And I learned that, you know, a lot sharpened my skills on emotional intelligence. So.

when you speak to a stakeholder, especially when you're selling an issue as an auditor, it's very important to understand your stakeholders' viewpoint, empathize with your stakeholders because we don't know what they are going through and we cannot just, you know, provide an issue and say it is what it is. We have to understand their point of view as well. So that emotional intelligence is important, but also dealing with your staff, you know, they go through

you know, a lot of picks and troughs and understanding your staff and listening to them, having that listening ability is so important for a leader.

Sure. And in terms of that then, what sort of keeps you doing the role and staying within internal audit?

I think it's how I got introduced to internal audit. It's the versatility, the diversity of work that I do. You know, at BNY Mellon, I've been in internal audit for 12, 13 years, and I've had so many different roles. I was asked to grow India audit, which I did, sitting in London. I was looking after operations audit. I was the chief admin officer for

the International Head of Audit at one time. And then I was responsible for investment services, the front office audits covering multiple lines of businesses, as well as being senior management function for some of the legal entities, the UK and the Irish legal entities that I was responsible for. And then when I got the global role as Deputy Chief Auditor,

there are additional items that were added to my portfolio or different, my portfolio got changed with investment management and wealth management. And that versatility is so important and that keeps me motivated as well. And it keeps me excited because, you know, I wanna make sure that we continue to learn and grow. And the only way you learn and grow is through versatility, through change.

Sure. And so therefore, is there a particular portfolio throughout your career that you've enjoyed auditing more than others?

I would say it's actually more recently when I became the deputy chief auditor for investment and wealth management as well as financial crime compliance. Both very topical areas, both areas are being shaped by the industry, the wider ecosystem, financial crime and compliance because of the geopolitical risks.

such as Russia-Ukraine war sanctions, anti-money laundering, a lot of regulatory focus. And I had the opportunity to sort of modernize the financial crime and compliance audit, completely transform that. So I enjoyed that sort of work, building out the strategy. Same thing with investment management and wealth management. I built up the strategy from when I took on and created some new leaders.

for that area and hired some subject matter experts in line with the strategy, as well as build out the talent pipeline as well. It's not just about subject matter experts, but building that talent pipeline from ground up. So that sort of keeps me energized, interacting with people I learn every day, not just from my boss, my peers, but also people who are...

the most junior level because they bring different perspective and I enjoy the interaction.

Sure. And I'm particularly keen to talk to you when we met the other day. We were very much talking around data analytics, ESG and could you maybe explain to, you know, everybody's talking about ESG and climate, but if you could maybe explain to some of the audience that perhaps doesn't really know how that's audited and why that's audited.

Yeah, absolutely. So first and foremost, it's imperative to look at ESG as an audit function. As an organization, we have a responsibility to the environment. We have a responsibility, even financial services. There is a concept called financed emissions, where we make investments, where we make lending. They all contribute to finance flows.

And whether it's brown finance or green finance, it's important for financial services to be responsible. We have a responsibility to ensure that we continue to improve the earth, the people, planet, and at the same time make profits as well. So we are not a nonprofit organization. So there's this three dimensions that organizations talk about these days, people, planet.

profit. And this is where internal audit come into play and making sure that what organizations are doing, what organizations are reporting, because when you report on environmental risks or climate risks, these can be perceived as non financial risks. Some of it can contribute to other risks, existing risks, like credit risk, market risk.

Internal audit has a role to play in climate risk, making sure that if there are any commitments made by the organization such as net zero, internal audit needs to evaluate because there is a potential for greenwashing. Organizations may be over committing to the stakeholders, to the investors, to the activists, to the wider population. And it is important that

We as third line of defense, as internal audit, we continue to review, monitor, act as checks and balances when organizations do reporting. But also we can actually play a very important role when organizations are rolling out their ESG strategy, whether it's environment, whether it's social strategy, whether it's diversity and equity strategies or overarching governance. How is the governance being...

uh structured internal audit can play a very important role um and no it's not just the organization you know there is a concept called scope one two three emissions when it comes to environment or climate uh greenhouse gas emissions what scope three means is you have to go beyond your uh boundaries of organization and look at

the sustainable value chain that has been created. So review of your third parties, review of your partners, your joint ventures. I think those are very, very important. And these can only be achieved in a reporting of ESG and accurate reporting of ESG and completeness of ESG data is through data management. So data plays a very important role.

the data source, given that climate is a long lead time. So climate, what we are experiencing today, it will probably materialize in 10, 15, 20 years. We are already seeing impacts, but the true impact will come in 20, 30 years. And it's important that we have the historical data, but also future oriented data.

and current data and how we use that data to report to wider public, to stakeholders in our enterprise ESG report is very, very important.

And so therefore then if I could just dial it down a little bit in terms of if you were going to do a ESG climate audit, what type of things are you auditing? Would it be maybe just is it just travel? What sort of other factors do you have to take into consideration?

Yeah, I mean, first thing is a great question. So first thing I would look at is there is a model called TCFD, Task Force for Climate-Literated Financial Disclosure. There are four specific pillars that's been outlined and the regulators sort of aligned to that TCFD model as well. And the TCFD model highlights these four pillars governance. So if I'm auditing, the first thing I would look at is

how it's governed, what is the tone at the top, who is responsible and accountable for rollout, not just at the board committee level, but also at a management level. Are there any goals set around climate? Then I would look at strategy. So we may have an existing strategy. How are we aligning our strategy to our climate commitment?

Are we stress testing our strategies? So say for example, I'm reliant on a third party in a flood prone area. And if that third party goes down, how is it gonna impact my strategy? So stress testing that strategy using scenarios is very, very important. So aligning your strategy to your climate commitment is very important. Then the wider risk management. So some organizations view climate as a standalone risk.

others view climate as a crosscutting risk. So it's something that could impact credit risk, market risk, liquidity risk, operational risk. And how is that risk management framework accommodating climate risk? It's very important for internal audience to evaluate that sort of alignment in risk management framework. And then finally, metrics and targets. Using data, how is management

collecting metrics and how are they assessing those metrics and how are they escalating those metrics to the governance forum. So those are the four key pillars that I would look at, but then there's this overarching thing, which is culture. The culture of climate and environment, embracing that, how is that permeating across the organization? And that requires training.

I would be looking at the culture and the training aspects as well, which is overarching.

And so therefore you're looking at that. I know that you mentioned your third parties that you work with, but are you also looking at that from the bank as well as sort of customers, maybe where customers are based?

Yes.

Yes, absolutely. So that's a great question. So we evaluate our third parties, make sure that they are, they have sustainability goals and they're practicing sustainability. But also at the same time, when we are offering service to our customers, more and more, we see customers asking financial institutions, hey, what is your ESG strategy? What is your sustainability strategy?

What is your net zero commitments? How can you demonstrate that? So our customers or financial institutions customers more and more are asking these questions because they want to partner with organizations that demonstrate good sustainability practices. Just like we want to work with third parties.

that have sustainability front and center in their strategy.

Sure. And just out of interest, how highly regulated is this now from, how important is this from the regulators to ensure that companies, banks are auditing this and in a certain way?

Yeah, I mean, I would say there is no hard and fast requirements for internal audit, but it's just like any other regulations. Regulations are, you know, any kind of commitment organizations make. They bring additional risks. There is a regulatory headwinds and therefore internal audit has a responsibility to make sure that we protect the organization. We help.

first and second line to manage any kind of regulatory risks. So to your point, when it comes to ESG, you see more regulations outside of the US, in the UK, in European Union, in APAC, such as Hong Kong, Singapore. More and more jurisdictions are implementing these regulations, even Latin America. In the US, there are certain regulations, such as California.

Climate Act, so that's very much specific to California. There are pending regulations, pending approval, such as SEC climate disclosures. Federal Reserve Bank has actually recently undertaken a scenario analysis across the financial institutions, the large, what we call GC fee financial institutions. So there are activities going on, climate risk.

is a risk, everybody recognizes that, and how is that impacting the portfolios that the bank holds, whether it's a lending portfolio or investment portfolio, but at the same time, what are we doing as financial institutions, as a good corporate citizen, to help build a better planet and better future for our next generation?

Sure. And I know I have noticed in terms of when I'm recruiting candidates, you know, and they're telling me the types of companies that they want to work for, especially sort of people that are starting out or sort of under 10 years in their career, if I can say, you know, climate is very important to them. In terms of if we were going to get an internal

Yes.

are now working within the ESG area, ECG, sorry. But in terms of how big do you think these internal audit departments will get to actually dedicate time to auditing this? Because I've noticed that there aren't, you know, there's two or three in a company, you know, will these become departments as big maybe as the private banking team or whatever?

I don't think so. I think it will be you need few specialists and they can be coming from different industries. So for example, in my organization, I hired an ESG carbon accounting specialist who has ESG background, but no internal audit background. And that diversity of thoughts, the versatility is very important. So these days.

We bring subject matter experts who don't have internal audit expertise, but we train them on internal audit So I have a couple of folks You know that fits that profile and then it's everybody's responsibility, right so it's not a One group that does it and it doesn't get cascaded across the organization ESG is a topic that everybody has to be responsible for just like culture is

Just like diversity and inclusion, there is no one group. So when it comes to internal audit resourcing for coverage of this area, yes, there are a couple of specialists that the organization needs, so we can create those toolkits that can be used for auditing purpose, but everybody needs to learn about ESG auditing, how to audit ESG, how to audit topics such as...

SFDR, Sustainable Finance Disclosure Regulations, or SDR, Sustainable Disclosure Regulations, which is a UK equivalent, or any kind of prudential regulatory matters. So given the broad versatility of the topic as well, you've got lots of areas to cover in environment. On top of that, you got social as well as good governance. So I think it's important to make sure that

all auditors have some level of awareness, but what is important is to create those toolkits, the tools and the tools of the trade basically using subject matter experts.

And in terms then, you know, talking about subject matter experts in ESG, I've noticed that some of the auditors that now audit ESG have actually come more from a financial markets, market risk, quantitative type of background. Is that probably the better?

Yes.

skillset that an auditor would need to audit this area.

Yes, I mean, when it comes to climate and climate risk, absolutely. I think they, you know, someone with credit risk expertise or market risk or liquidity risk expertise, they have the know how to evaluate those risks and the models associated with it, the stress testing that goes with it. And climate risk is nothing but an add on.

It's something that is crosscutting, as I mentioned, to credit risk, market risk. It's sort of like an additional dimension that can impact those risks, credit risk, market risk, liquidity risk, operational risk. So it's a natural fit for when it comes to climate risk to bring in or inject your inject people from those sort of expertise and experiences. But you can also bring in people as I did.

from someone who has carbon accounting expertise because that goes to the disclosure. How are we disclosing net zero commitments, scope one, two, three emissions to the street?

Sure. And so therefore, if you had, for anybody, let's say, that was becoming an ESG auditor, because it's, you know, something that's very popular at the moment, do you think that you could grow a career or do you think that it would be somebody that would come and do it maybe for two, three years, get back into markets and, you know, maybe progress their career elsewhere?

I think you can certainly make a career with ESG, even in internal audit, especially for large organization. Large organizations have culture unit, right? Culture audit unit. So, and all they do is culture audit. They bring that expertise. So say for example, ethnography, observation skills, other types of techniques, behavioral science techniques,

assess culture of an organization and you see more of those expertise in internal audit in large audit organization Same thing goes for ESG or climate With large organizations there are multiple commitments. There are multiple You know organizations are signatory of different Commitments such as TCFD or principles of responsible investments

or other types of UN commitments. So UN, United Nations, SDG. Those commitments mean that organization needs to demonstrate that they're not just paying lip service, they're actually doing it. They're delivering on what they committed to. And otherwise the big reputational risk, right? So it's not just financial risks, there are other risks involved.

And this is where internal audit can play a very important role. And then on top of that, you could review third parties. You could review how we onboard clients, because as I said, clients also expect more from us financial services in terms of sustainability. Internal audit could also play a role in educating the entire organization. For example,

one of my subject matter expert in carbon accounting actually delivered a detailed greenhouse gas accounting training to a lot of our stakeholders. So that's very, very important. Undertaking governance and effectiveness review is very, very important. Educating board internal audit can play a role. So it's not just delivering audits, but also delivering

other value added service for the organization, such as training, awareness, education, thought leadership.

Sure. And do you think this is now so important because the companies as a whole are willing to invest because, you know, throughout my career recruiting internal audit, as soon as there's sort of a ever been a banking freeze or what have you, it tends that internal audit always have their budgets cut first because it's a non-profit, you know, third line non-profit.

think internal audit is taken more seriously in the long term that you know if the reviews are taken seriously that you know in the end a profit will be turned because of putting these regulations.

Absolutely, I mean, you know, we are regularly invited to speak to clients, you know, my equivalent at my client organization, we will interact, we will share our thoughts, our thought leadership, and we'll learn from them as well. It's very important. Audit branding is so important. You know, it's extremely important to...

how audit is portrayed because perception is reality. So if you are an audit organization and is not evolving, not willing to change, then there will be probably less budget. But if you are a brand, audit brand, that is forward looking, that is delivering on cutting edge work, that is creating solutions and thought leadership that first and second

And also, you know, portraying some of those thought leadership outside of the organization as well in forums as part of giving to the community. I think then it's a different value proposition. Use of data analytics, use of AI, machine learning, early adopters of experimenting with machine learning AI. Those are really, really important traits for a good audit brand.

And in that way, you can also retain your talent as well, because no one wants to work for an organization that does the same thing day in, day out, right? We want an evolving, changing, dynamic audit organization where people can thrive, they can learn new things, especially this is important for Gen Z. They wanna come in and work for an organization they feel proud of, they want to be empowered.

And that is why audit branding and how we portray ourselves and what we do day in day out is very, very important.

Excellent. And when we did meet, just going back to culture, which I was really interested in, you know, we're all speaking a lot again about data analytics and how that's working. And it seems to be going very well, but also as well now where it's the next step with regards to AI. And you were telling me some very interesting facts the other day,

So perhaps if you could sort of let the audience know why AI is good within an audit organization and what types of audits the AI does to help, how that helps the internal audit teams.

Absolutely, I think it makes internal audit so powerful as a proposition, a value proposition and again, forward thinking, right? So the example I was giving you was we created a machine learning tool that looked at customer complaints because customer complaints, the definition of customer complaints is very broad, expression of dissatisfaction. So when a relationship manager is speaking to a client,

Yeah.

they may be collecting information and not really thinking that is a complaint. Um, uh, whilst they're, you know, trained extensively, but when what we do is we use the machine learning tool to glean or extract information or ingest information from the relationship management software or application. And then we analyzed using machine learning and determine whether that

documentation made by the relationship manager, the interaction between the relationship manager and the client. If that should be perceived as, or if that should be treated as a complaint as opposed to a normal dialogue. And the machine learning tool enable us to analyze that, do that, and the machine becomes more accurate as we continue to use that tool.

So it pays a lot of dividends. So that's a great example where we could apply a machine learning tool. It shows how modernized the internal audit organization is to our stakeholders. And we are adding value to the relationship management community. Another example of use of AI is we ingest all sanctions data and see if there are any anomalies related to sanctions and identify any...

gaps. And that makes our audit observation very, very powerful as well, because it's all data-led. And we can give real-time feedback to our stakeholders as well. So using data analytics or AI machine learning, if you can have continuous processing or continuous auditing, you could provide real-time feedback to our stakeholders or very

quick agile feedback to our stakeholders. So it's very, very important to embrace first data analytics then mature to AI machine learning. You know, one of the things that I tell my team is we must have a data first mindset. Data first mindset is don't think about auditing a process using samples, even...

before we go to a planning of an audit area, we need to think about data first. How can we accomplish this audit using data? So that's what's important. And stakeholders find it very, very valuable. Oftentimes, they don't even have those data analytics capabilities. So sometimes I have actually, we were able to wow our stakeholders by identifying issues and then give them that

know how to them. We don't obviously want to share our tools with them, but we give them the know how in case if they want to develop something and build it into their own control environment. Because, you know, what we want is a very clean control environment for our businesses. So if we can contribute to that, that's great. Not just audit.

Okay. Yeah, that's it. It's so interesting. And if you were so do you think the natural step for somebody that's doing data analytics or more a data scientist, how would you then would you think that they are the people that the companies will start to that are currently working with in internal audit, that the companies will train up into AI, or do you think that you'll go to more of a

I suppose a younger generation that are already adapting AI within their learning at university and things like that.

Yeah, it's a great question. I think two things. One, upskilling your own team. So you need to have a, my view is we need to have a dedicated analytics team that can provide training. So my team, for example, in my organization, they provide bootcamp to all audit staff.

on a prioritized basis. So whoever is interested, it's not mandatory, it's voluntary. But there are lots of people that want to learn these skills. So business auditors will volunteer and say, you know, I want to be registering to this bootcamp. Great. So come along, we'll give you a six-week crash course on analytics. So that core team does that. You know, part of auditing, undertaking analytics is to create those pipes.

where we can pull data, whether it's people-related data or risk-related, other risk-related data, such as credit risk, et cetera, or even census data from outside or third-party data from outside. We need to create those pipes. So we have to have data engineers, not just folks who can do analytics, but engineers, data scientists, who can create those avenues,

pipes to pull data from other parts of the organization. More organizations are embracing data lakes, for example. So we need to have access or we can tap into that data lakes. And then I have another group called risk intelligence. So they follow the life cycle of a risk. So take people as an example. When people come on to the organization, there's onboarding, orientation.

then they are an employee, they're multiple.

Wow, it sounds very, very exciting and very interesting. So thank you very much for your time today. I would just like to ask you a sort of couple of quick questions to round off our conversation. I would, you know, I'd be very keen. You've traveled all around the world personally, and obviously with your job. What's the best country you've visited and why?

Yeah.

And I've been asking everybody this question and everybody's been giving me the same answer but what piece of technology could you not do without?

And if it's, is there any sort of companies in whatever industry that you admire the most?

Well look, thank you very much for your time today. It's been absolutely great to speak to you and I hope you've enjoyed it as much as I have.