In episode seven we discuss innovation and technology in internal audit with our next guest Alex Gibbons, Head of Internal Audit at HSBC Innovation Banking. We discuss being at the forefront of regulation and innovation and the role of internal audit in facilitating change and improvement within organisations. 

This episode explores: 

• Market outlook for innovation: Alex shares valuable insights into the rapidly evolving landscape of AI, cyber, and information security. With a focus on governance and regulation, she sheds light on the importance of staying ahead in these critical areas. 
• The role of an audit professional: Discover why being in internal audit is akin to being a VIP with access to all areas of an organisation. Alex emphasises the role of audit professionals as catalysts for change, facilitators for solutions, and key stakeholders in driving organisational success. 
• Building impactful teams and strategies: Learn from Alex's experience in founding and leading teams, navigating challenges, and driving impactful strategies. She highlights the dynamic nature of internal audit and the creative opportunities it presents for making a real difference in the business landscape. 

Enjoy!  

Note: The views expressed by Alex are her own and do not necessarily reflect those of her employer. 

Hello, Alex, welcome to the podcast. If you could please just introduce yourself and let us know who you are.

Sure. Good to meet you, Hazel. I'm head of internal audit at HSBC, innovation Banking.

And can you tell us a little bit about your background? Because I know that you first started in insurance and how you've navigated your career.

Great. Yeah. Yeah, so it's a long time ago you're talking, but I did actually start as an insurance broker and I really enjoyed it actually. It's a market facing role and I love, I'm very much a people person. So yeah, how I got from insurance broking to internal law and innovation banking is quite a few big strides. So one of those big strides was basically I got involved in risk management in terms of insurance broking. That took me to a new function at Ernst called Business Risk Consulting. And from there I was involved in internal audit work. So that was really my grounding in internal audit and where I've got the strongest kind of background of methodology and how to conduct audits. And I went pan industry in that role because we were quite an innovative little team at Ston Young. At the time, risk was quite a new idea. Risk management was quite a new idea in terms of audit skills, so, so from there I just really, I pushed around into insurance, reinsurance, banking, and I've stayed in banking because it's so fast moving, I guess. And that's where the innovation part comes. So I've really enjoyed things that are fast moving. I stayed in audit company for quite a long time, partly because I wanted to be at the spearhead of regulation where everything happens. And that's where I've liked my career to be is really where things are current.

And so therefore, when you are talking about innovation, the banks that you went on to work with are more sort of FinTech startups, is that correct? And yeah, sorry, go on.

No, yeah. Yes and no. I mean, I did some work with hbos and I then went on to work on treating customers fairly in hbos, which was really interesting because it was sort of looking from a customer angle at everything. And so from there I was really interested in how customers are treated by banks. And I guess it's why I've come down on FinTech because fintech's and that sort of leading edge are always looking at how can the customer experience be better. So that's really why I went to Clear Bank, which was the fifth clearing bank outside the big 4 0 1 banks and they were a startup. So that was about six years ago. I went there and really only 30 people, and it was kind of just the right time for me to have a sort of role that was really stretching and really a little bit frightening, if I'm honest, in terms of the barriers it was going against. It was going against those big four banks in terms of providing an alternative and was just getting its license as a bank. So that was really exciting time

Then. So do you think then really that most of these FinTech companies is all around about consumer duty now looking after your customers? So would you say the most ideal candidate for fintechs are probably more from the retail banking sector?

No, not necessarily at all actually, because peer bank is actually mostly doing work with bank to bank. So it's commercial, but obviously the end point is the customer. So lots of those commercial banks are dealing with individual customers, so there is an end point. But yeah, I think generally FinTech and innovation broadly, it starts with a small idea and that small idea can be very simple. So for me, it is not a question of retail per se, it's broader than that, but it is someone probably thinking I can think of doing that better. And that's what I like is not accepting the status quo, thinking you can do something better, and being brave enough to have that idea and put it into the market and test it. That's really exciting.

And why do you think it's more probably the Gen Z candidates that are probably more interested now in going forward to more of a FinTech smaller environment? There may be some of the bigger banks.

Yeah, so look, I think everybody has their idea about where they want to work. I think with the newer generation, obviously my generation weren't brought up on mobile phones or any kind of real advanced technology like we've got now this generation and others before have been brought up with mobile phones, have been brought up with the internet, email, everything. And there's so much scalability and potential with all of that. And indeed access to coding, access to computer skills that's really now has to be in your tool set if you are growing up getting an education. So I think we've advanced with technology so much that those skills mean that you can work from anywhere. They mean you can work anytime any place and that really means you can be a lot more flexible. And then we've had Covid of course, which has changed the landscape a lot. So I think it is horses for courses. Some people love working in big institutions. I think it takes a different mindset to want to work in a maybe riskier environment where your ideas are kind of at the forefront. But I think it's nice to be master of your own destiny. I think the people who innovate have a strong sense of purpose behind their ideas quite often, and that makes them really compelling to listen to.

Sure. And then I noticed that your C are qualified. I'm not too sure when you've got that exam in your career or that qualification should I say, but do you think more people within the FinTech and innovation space should really have some interest or a technical bias now?

Yeah, I think it's fundamental to think about the security of the organization you work in. As an auditor, you have to be, to some extent technology focused because that focus, those risks are really out there. I don't know what caused the recent outages that were in the news about Sainsbury, but quite a lot of outages now are related to cyber ransomware, all that sort of stuff. So really ensuring about your information security and you are able to deal is a fundamental for internal audit. I agree. Sure.

And I've been to, lately I've been to, the big word on the street is about women in audit for innovation and technology. And from hearing from a number of people, and I may be wrong on this, but it does seem that you've got to be quite literate, be able to read, be able to read code and spend hours and hours looking through books, which especially nowadays with the younger generation and some of the learning skills, et cetera, some people just don't have the aptitude to be able to do that. Do you find that you could probably teach maybe a good investment banking product auditor whose skills may be becoming a little bit out of date now that you could actually teach them how to do more of the technology application side and to get involved in this?

Yeah, absolutely. I mean, Isaka where I did the certification in information systems, that course is highly relevant, highly accessible, and it has a self-paced online learning. And really if you combine that with the ability to step into information security risks and issues in your organization, it's actually there's a lot of learning on the job that gets fallen and adapted. So I really think it is accessible. I wouldn't say it's inaccessible at all. In fact, they go out of their way to make it very, very, very, very accessible. And also I would say a lot of the subject areas are fundamental to risk anyway, so you would be looking at risk and control in those areas anyway.

Sure. And do you think companies are taking as much interest in that and trying to, I know we're all talking about, oh, skilling up internal employees, but really is anybody thinking about somebody as perhaps they may feel as farfetched that's been working in investment banking or I don't know, commercial banking to move them into technology audit? Or do you think fundamentally it's going to be too much to do that?

So I think the way I'm positioning my team is that everybody has coding knowledge and experience at the sort of ideal level. So that's on a trajectory of development, but actually the awareness around information security is there from the get go. So there's a baseline amount of information on information security. And then I think within five years, most people coming into audit will probably, I would say within five years would need some coding knowledge and some knowledge of how programming is put together and what controls are around that sort of environment for sure to be at the right edge of managing the risks.

Sure. And you mentioned earlier that obviously coming from insurance into risk and then into banking. Can you elaborate on maybe which was quite hard for you to navigate coming through that process or something that helped you coming from that background to maybe entire Southern Insurance auditors to getting to the FinTech space?

Yeah, so Hazel careers are often sometimes a combination of chance happenstance and taking opportunity and luck. So it'd be interesting to think that my career was all nicely planned out. That's just often how things happen. So I think one thing sometimes leads to another and sometimes timescale. I've been working for a long time, so it's no surprise that I've come around a bit. So yeah, hasn't all been one day after the next something else happened. But I think to your question, I think you go where things interest you, but to me the key point about what I've done is just to stay, try and stay current because the first thing that traditionally you could be as an internal auditor is in the third line away from the action commenting on things that have already happened and kind of, yeah, that's very interesting. But so for me, internal audit is actually about being on the front foot, seeing things before they happen, being proactive with your board, being proactive with your management team, enabling really being a facilitator and an enabler and a ambassador for risk that's managed well and facilitating that in the business. And that means that you are very current. So it's probably slightly forcing the edge of the role that when I first came into internal audit, I thought, God, you were kind of after the fact and I wanted to always be very highly relevant. So it's a combination of those two things probably.

And when you say you want to be relevant, I know obviously is that you've managed to do that by, I don't mean keep changing startups because you've got a nice solid career, but in terms of changing to the banks that you've worked for, is that how you've kept current?

I think I've always been excited by starting a team, founding a team, getting it on its feet, establishing a good momentum, establishing good working relationships with the business, being pragmatic about the size, scale and capability, and also the demand on the business. And all of those things are very much forming strategies. And I've always really, really enjoyed that because I quite honestly haven't had one year of business as usual for the last seven years. And actually that's where I enjoy the pace. And I would like to say also that I think impact with the business, and I think internal audit isn't somewhere that you always feel could be creative, but ironically, it has been very creative for me.

And in terms of being very creative, I think nowadays as well, I'm struggling with the, I get into quite a lot of senior roles with the FinTech companies now, whether that was crypto or payments, whatever. And I've had some companies that really want to employ just really somebody from the big 4 50, 60 grand a year that doesn't really know what they're doing, just so that they can show that they've got an audit presence, which obviously never works and the person gets overwhelmed and can't do a framework. But also as well, I find that there's been becoming quite a big divide is that people that have grown up our age that have been working for big banks because that's what you've been brought up to learn on grow big longevity, grow your career through the same bank and their heads of audits. And unfortunately their skill sets are not being looked favorably to the startup companies Now, why do you think that is?

That's a tough question. I think the landscape's changing a lot, right? I think the employment landscape's changing for everyone. We've got hybrid working. I think that still has to prove itself, but I think the demands of employees are changing. And equally there's been an impact on skills and demands through Brexit. So this landscape is changing a lot. And I know that just in the announcements around the big four consulting, the amount of consulting is diminishing a little bit. I read news about one of the big four just the other day that they're not as busy as they were. So I think there's a lot going on. There's a lot to unpack. It's not simple to comment on the whole of the audit landscape and say there's one reason for things changing. But I do think that financial services is changing with digital so rapidly that that's having a very big impact. And with the impact of AI as we'll see that happen, that will also have a massive already starting to have a massive impact. So I think many technological changes, many people changes at the same time, and also different demands of employees, not just employers. Those things are all having an effect. I don't think it's been worked out what that effect will be. I think that's just a trajectory that's playing out.

Sure. And I think one thing I've learned coming back from the UK, from Singapore and having to probably re-identify yourself, if I can say, and I think people just need to sort of carry on staying current and whether that's non-exec roles in some of these FinTech startups and what have you is something that's quite important to do as well. And just going back to the, I know that it's already gone minimum from two days to three days in the office for a lot of organizations, I know global banks, some of the local banks in Singapore and obviously Goldman's here, we're all back to five days working. When is it that we put pause on it and realize that we still need to do a job and it's all very well to be flexible, but how flexible do we get until we create a different society, if that makes sense?

Yeah, it does. And I think there's a debate still ongoing, but what I would say is I do think there's going to be skills gaps where people are at home a hundred percent of the time. For example, how do you train someone junior if they are at home? They're not just part of the tactical day to day. Equally, I think it is important that people have some flexibility. I think the commute for a lot of people is horrendous. We haven't exactly got a fantastic transport infrastructure in this country. So I mean that gets into wider societal stuff, but I think that there is probably a medium there somewhere where there's enough in-house training and in-house on the job working and developing and learning. I do worry about if people are at home all the time that they're not going to get that.

Well, I think especially in audit, because you've really got to learn who your stakeholders are within any job that you're doing,

Relationship business.

Just going back to your career then, obviously you've got your degree in languages and literature, which is nothing to do with internal audit debt, and then you went on to do A MSC and management. Where do you think if you knew what you knew now, would you have studied those degrees and do you think having a degree nowadays helps within internal debt because it's now not just about being a chartered accountant?

Yeah, I think the thing for me was fundamentally, I really enjoyed those years and I learned a lot. And I think skills are transferable, so communication skills obviously fundamental communic way, and I think thinking in different ways is also really important. So yeah, I would do it again. I wouldn't make any changes to my life actually, per se, except I do know there's a lot of pressure on students now with student loans and to end up with a higher student loan because of interest than you had before you went to university or even when you came out of university, I think that is a problem. And ending up with a large debt at the end of your university time is really onerous and also might make you think going in, well, how do I really know this degree is going to give me a commercial accelerator?

I suppose I was pretty naive when I did my language degree. I just enjoyed doing languages. I was interested a little bit in teaching, and actually it was just, I did some work for an economics lecturer when I finished my degree, and that sort of led to the master's in management, which sort of put me on a path to insurance broking. So one thing will lead to another. It's sometimes just a bit iterative. I've lived my life a bit more like that. I haven't been someone who woke up and said they wanted to be a doctor when they were 16. And I've always been very jealous of those people actually, because they're so certain about what they want to do. But actually I think if I look back on my life now, there are themes that make sense of why I did certain things and I can kind of piece it together. So it is a logical thing to me, even if it doesn't look it on face value.

And is there anyone that's sort of helped you in your career? It is quite diverse and I think this is what makes it really interesting, but just in terms, have there been anybody or a mentor that's helped you in your career? And if so, why?

Yes and no. I mean, don't think I've actually quite struggled with that. I think largely it's been people who've encouraged me that aren't necessarily around me for my career, but have just supported me. So within my career, I don't think, I've obviously had colleagues at work who've been supportive, but I haven't had a strong kind of mentor that's kind of led me through particular things. And that's probably, I haven't really wanted one, I suppose. Yeah, it's an interesting question. I haven't thought much about that, but I know it is something that is encouraged. But actually, I suppose I've been quite self-reliant, but relied on the advice of good friends and people I trust and respect.

Assuming that, and I'm just assuming this and I hope I can say this, but you're obviously working for quite new innovative banks and startups, et cetera. I'm assuming that maybe the teams that you've managed have actually been sort of quite younger teams. Have you learned anything of them in terms of moving forward?

So I work with quite a young energetic team, and really I think what I like about that is just the amount of energy they bring and the momentum that brings with it as well, just the sheer enthusiasm. So I think what I learned most from them is just I can see when the energy's in a good place, you can get an awful lot done. And so I guess I'm just corralling energy as far as that goes, but also with a very clear direction and very clear objectives. I don't think there's any particular, I think one thing I've learned with teens is there isn't any particular real science except that if you can show gratitude that goes, I was always surprised how much if I said thank you, that would really run a mile. And people will really do the distance if you ask nicely. And also you thank them and also probably reward them as well. But I think just saying thank you goes an incredibly long way. I've learned also, I suppose I respect and listen and respect to everyone's opinion because even though someone might be hugely new in the role, they may have noticed something. So it's always good to even listen to people who you may think, well, what do they know? They're only a year into this, but actually they may have seen things from a different perspective, and that's always useful.

Sure. And with regards to internal audit now, and I was going to say, why do you think this is a good career for a woman to build her career, but I'm particularly keen now in terms of not just for women, but also for the younger generation. In your view, what does entice them to internal audit that makes it a good environment or a good career?

Yeah, that's a really good question, Hazel. I think I would've asked myself that probably 10 years ago I was desperate to get out of internal audit and I worked in the second line and I worked in first line actually heading up a personal banking, a small bank. So I was kind of desperate to get out, and actually I couldn't think of a better place to be now because you get such wide coverage, you get access all areas. It's kind of like being a VIP. You really are allowed anywhere in an organization you can get to the heart of problems really, really quickly. You can be such a fantastic facilitator for solutions for an organization. And one of the things I've really, really enjoyed, innovation banking is relatively small in terms of number of people. And it's been great to really cut across the organization and engage stakeholders and have discussions about how to solve problems. And you can do that really, really quickly and it's just hugely effective. So you are actually a highly prized catalyst for change, and it's a role with an enormous amount of autonomy within, obviously within a firm methodology and really appropriate quality assurance processes that give assurance to everyone, the board stakeholders and the regulator that you're doing the job within the remit of a proper audit function. But it has a lot of freedom within those constraints. Fantastic role. I couldn't think of a better role.

I can't think of a better area to recruit for, to be quite honest with you, rich. But so just getting back to stake, working for a smaller bank and dealing with stakeholders, the key is to have within internal audit is great stakeholder and communication skills and every role that it's something that you have to learn in, engage with. And I remember years ago that if in turn it wasn't speaking to the stakeholders properly and being able to guide and direct them, quite frankly, the auditors would either have been walked all over or never have been able to get a report done. I know that there's a lot of things done digitally, digitally now where you can just be called out on the paperwork, but just in terms how much car blanche should we be giving these junior auditors to be taken seriously to get the skills to go out and run their own audits. But also as well, the audit division still keeps the respect that needs to get the job done.

So I'll just speak for my own circumstances where I am. I'm very lucky. The culture within which I work is really one of doing the right thing and also of huge respect for audit and for its findings and for continuous improvement. And not only that, the senior manager's regime props up our objectives in terms of we make sure that all our actions are tied to senior manager function leaders, and that then percolates the tone from the top is very important, but that percolates throughout the organization. So the other thing is, that's one side of things is the accountability regime and the tone from the top and the risk culture within my organization. The other thing is that actually the onus on the employee base is that they want to do the right thing and they view internal audit as a facilitative function that allows them to raise issues, self-identified issues as well as when we find things, there isn't a defensive stance towards that. And this is what you want for your audit function. You want it to be welcomed in and for the recommendations to be kind of seized upon as well. It's good opportunity for us to improve. And I would say if you've got that equation right, that's where it really accelerates to becoming a very, very effective function.

Sure. We touched on earlier, I just want to go back to the innovation piece. It is just such an interesting topic and you mentioned earlier on, especially in terms of digital cyber ransomware. Where do you think the risks for innovation banking are going to be for 20 24, 25, or going forward?

I mean, that's an interesting question. I mean, I think the broader market outlook for innovation itself is clearly there's a lot of work in the UK to do on AI to get around the governance and regulation of that. There's also continuing work that's needed in every organization on cyber and ransom information security end user controls, ramping down on making sure that information going in and out of the organization is bonafide E correct and authorized. I think my biggest crystal ball gazing view is that ai, if it takes off as it's muted, it will, the governance and regulation of that is really key. And I think we're only in the early days of that at the moment. I know things are accelerating very fast with chat GPT and organizations are even doing their own internal versions of it. So I think that's going to be where I'd place my bets as to where to focus. I'm actually attending a governance conference around AI in May, and I think it's going to be really interesting because the European Union has put some legislation out there, so it's going to be important to know about that area, frankly.

Sure, okay. And do you think that companies now though everybody talks about AI and lots of things have been spoke about in my career in internal audit recruitment. How seriously are these companies taking it? Because always the third line function, do they get budget, don't bring in any revenue per se, really? Do you feel that people, so there's not a skill shortage next year when this, I wonder how seriously the banks are taking it to actually skilling up people with improper AI techniques and sending them on courses now and do you think that they should be?

Yeah. Yeah, they definitely are. I think the full capability has not yet been, we haven't got to the final frontier of what we can do with AI and we don't know what the implications are for the employee base. So it's sort of still working itself through. I do know that there's a lot of experimentation and I think that's absolutely right and appropriate before anything's let loose, because as I say, the consequences aren't fully known. So I think that we're in an experimental phase. It is going to be interesting. I don't think I can conclude on what the results will be yet. I think everyone's still working that out.

Alright, great stuff. Well look, thank you very much for your time today. I've got a few quick fire questions if you don't mind asking, where's the best place you visited and why?

Oh wow. I think that would have to be Greece, and it's simply because the color of the sea is so beautiful and I'm a very keen swimmer and I also like Greek food very much. And Greek people are extremely friendly. So yeah, Greece is very soulful place.

Sure. And what podcasts are you listening to at the moment?

So I really like several podcasts. I like Rory Stewart and Alistair Campbell's politics podcast. There's also one I do like Desert Island Discs, very much so. I like listening to them. So I don't like too much politics, but I like a bit and I find them very engaging. And the desert island discs, I just really like listening to how people have lived their lives and what music they like.

Yeah. Okay, great. And if you're going to spend the day off in which, what's your favorite way?

Oh gosh. I was probably going for a walk or a cycle ride Hazel, so I'm lucky. I live quite near Wales at the weekends at least. And I really like going to the Brecken beacons and walking or cycling. I'm a very keen outdoors person. I like to see greenery. So that's probably the key thing for me.

And tell me, if you was going to have your own biography, what would you call it?

Oh, I think I got asked this last week. I was on a training course. I'm just trying to remember what I said. What would I call my biography? I don't know. It finding purpose, I think. I mean that's not very inspiring, but I can think of a better one.

Sure.

I'll write first.

Well look, thank you very much for your time today. It's been great getting to know you and look forward to speaking with you soon.

And you, Hazel, it's been a pleasure. Thank you.