The third episode of ‘Inside the Auditorium’, Andy Blight, Chief Auditor for Risk at Citibank, pushes us beyond the traditional boundaries of internal audit and offers a fresh perspective that will resonate with internal audit professionals.  

This episode explores:  

• Longevity in Internal Audit: Andy emphasises the appeal of navigating challenges within the control environment, and what’s kept him in the industry. He also sheds light on the significance of the people side of audit, highlighting relationships, reputation, and the ever-important human element in this profession. 
• Navigating emerging challenges and trends in 2024: As a thought leader in the industry, Andy discusses the macroeconomic and geopolitical challenges that internal auditors need to navigate. From the evolving landscape of ESG, climate risk and artificial intelligence, the conversation explores the need for ongoing understanding and knowledge.  
• Internal Audit as a people business: Andy encourages a mindset of problem-solving, improvement, and active engagement with stakeholders, echoing the roots of the term "audit" derived from the Greek word "audio" – to listen. This episode explores how the profession has transformed over the years, shifting from a desk-centric approach to a people-centric ethos.  

This episode is a must-listen for internal audit professionals seeking inspiration, valuable insights, and a deeper understanding of the multifaceted world of auditing. 

Enjoy! 

Note: The views expressed by Andy are his own and do not necessarily reflect those of his employer. 

Hello, Andy. Welcome to Inside the Auditorium. Very pleased that you're here. I want to start off by just telling us a little bit about who you are and why you got into internal audit.

Thank you for having me.

To be honest, I wasn't looking for an internal audit job. I qualified as a chartered accountant with KPMG outside of London. I was looking for a job in the financial services industry. By the time I was looking at product control roles, because that was sort of the new thing then, sort of working with traders and spreadsheets and pricing and so on. And I was persuaded to go for an interview for this internal audit role. And the people I met...

were very exciting about what they were looking to do. And I think part of what internal audit was looking to be at ING bearings kind of tempted me into it. So I took the job, spent a few years in internal audit and then moved into market risk management. I did a math degree and focused on a lot more of the quantitative stuff and so on. And ended up spending a little while in risk, both in risk management, at market risk, and then

throughout your career has been sort of more on the risk side of all, I know that you got into a consumer a little bit when you was at SCB but what's made you sort of stay with risk and concentrate on risk just because you know that you like the subject?

Yeah, so I originally got into that, I think probably because of my more sort of, I'd never describe myself as a con, but I've always been interested in the maths and so on. I think it's developed over time because really risk moved into, especially with Basel 2, moved a lot into sort of the capital side of things, risk weighted assets and so on that then morphed more into, excuse me, morphed more into general governance.

So I've moved around a little bit and then come into more of a risk focused role again now. I think risk is so central to so much of what the organisation does that I think to me having a good understanding of how risk is measured and managed helps in all sorts of ways looking across the organisation front to back. So it's always something that's interesting.

And also as well, you're doing risk over all products. So from consumer right the way through to markets and everything at the moment. Do you find one is more interesting than the other?

Yeah, that's right.

So I used to think that back in back earlier in my career, I used to think that the trading floor or these complicated derivative products and so on had to be the more interesting side of things. And you mentioned just now that when I was at Standard Chartered, I did spend a few years leading the consumer bank audit team there. And that's a role that my boss asked me to take on at the time. I thought it was something different.

It was what gave me the opportunity to move to Asia, which was good. I thought at the time, well, you know, credit cards, mortgages, how hard can it be? But actually, the challenges around risk management and running and managing a consumer business are very different, but just as interesting in terms of the type of data, the frequency of the data, the different techniques that are used to analyse that, the different risk management techniques. So I...

I think I learned from that actually there are equal challenges really in all sorts of things. I mean, some of the complex structured derivatives, some of the math gets quite tricky with that. But when you actually look at the risks and the controls and how the bank is looking to manage those and earn a return and deliver to customers and clients, I think both have their own challenges.

So would you say that consumers got more interested now because of the digital piece and everything going online and just in terms of what's happening in the world as well with the interest rates and everything?

I guess I think the whole world has got worried and got well I say that it's a challenge at the moment but when I think back to when I first started out I mean we had we have people running around trading floors picking up paper tickets to go and input into machines it's a very different world so although there is change going on all the time there have always been these challenges of doing things differently I think the consumer has

So.

particularly embrace the idea of mobile internet, so that's a digital way of doing things, which potentially brings an additional challenge there. How you move from those interfaces down into the core banking systems of the bank and how you manage all that, I think, remains the same across all of the businesses. You mentioned interest rates. I think we're in an interesting environment at the moment where a lot of management in...

financial services have grown up in an era of low interest rates. And we're still historically at a relatively low level of interest rates. But we've got a lot of people out there who are learning how to manage through this and learning how to run their business, let alone manage the risk or control the risk through the control environment. Just learning how to manage and build a strategy for their business in a higher interest rate and higher inflation environment. So that brings interest and challenge to everyone.

Sure, and then so because one thing I've noticed though is that I don't see, I see credit risk as being a really hot topic, especially on the counterparty side over the next year. But I haven't really seen so much in terms of more on the lending side in the fact of people's mortgages that have gone up and the risk there. But consumer risk seemed to be quite more of a hot topic a few years ago.

Why is that?

That's a good question. I think counterparty credit risk, you're right, is one of those hot areas at the moment. There's a lot of development there. It's quite a technical area. There are those convergence risks with market risk and so on. I think to me with retail, the challenges from a credit risk...

point of view come at either end. It's about making the right decisions in the first place, so making the right lending decisions. So scorecards and different scoring models use for that. And then mortgage may be slightly different, but when you think about credit cards, P loans and so on, generally those are managed more on a delinquency basis rather than a cash flow basis. And so you look at your collections activity and how.

Yeah.

you'll respond to an increase in delinquencies and sort of forward planning for that. And so it changes the scale of that in terms of the, I guess the inherent risk of future defaults and so on. But the controls and the way that the bank needs to think about that, I think are fundamentally the same.

Okay, and you're pretty much then you are a career auditor, although that you have stepped out into other roles a couple of times over the years. I suppose what sort of kept you in internal audit?

I think it's two things. One is the challenge and the interest. I've always enjoyed working at organizations where there's work to do around the control environment, if you like. And so being involved in discussions with senior management around how to make the bank a better place, safer, stronger, but in a commercial way, because obviously

There's a cost to control and you can't pay to control all the risk out of the business. That would be the wrong thing to do. So it brings that to the commercial side into it. It's also the people. Audit is a people business, right? The teams we work with, the stakeholders we work with, it's about relationships, it's about reputation. And I enjoy meeting new people. I've just recently taken on an additional team.

here at Citi and are very much enjoying meeting a whole new bunch of stakeholders, getting to know a whole new team. So the people side of things is important.

So do you feel that then, you know, years ago when we all started to get into all day, it was very much tick boxing and that has very much changed even when I'm picking up vacancies now, the more, you know, being consultative, making sure you know that people understand their topic and that they can communicate properly.

This I didn't find was such a wasn't as necessary years ago and do you think that people that get into audit don't understand now how much of a consultative role it is than just being a dictator? If I could say that. Yeah they did didn't they?

I hope we were never dictators. I think the industry, the profession, if you like, as a separate discipline has moved on a lot in the time I've been working in internal audit. I think it's the overall we've moved things forward. I think even when I go back to the mid 90s when I started out, there were individuals then who were...

Yeah.

trying to work in that way. And it kind of depended on the organization. So again, at ING Bearings, management wanted help. They wanted that advice. They wanted all the views that they could to make the bank a better place at that point in time. So yeah, I think we've, post-crisis, we've seen a lot more emphasis placed on internal audit. Boards, executive management, regulators, all place a lot of

Yeah.

importance on internal audit's opinion. Fundamentally, the job hasn't changed. The independent internal audit function, whose job is to provide positive assurance that controls are working to manage the risks of the bank, is fundamentally what we do. And then we raise issues where that's not happening. What we've seen, I think, as I say, post the crisis is a change in

Yeah.

Mm.

in the industry and in organisations towards putting more of moral emphasis and focus on that control side of things, on the balance between risk and reward and the professionalisation, if you like, in some ways of internal audit so that the standards that the Institute of Internal Audit has brought out and so on. I think that's all helped. I think what we tend to see now is the culture in organisations has moved on.

Eh.

to be more inclusive of all those different views of all the lines of defense.

Sure, okay. Okay, because there was a state, you know, I think as well, do you think then the reputation of audit has changed in terms that people actually didn't want to get into internal audit because they would have to speak to stakeholders and the stakeholders wouldn't give the information that they wanted, whether that was because the stakeholder hadn't done it and, you know, people saw all that, I want to choose the right word, but.

you know, wasn't as, wasn't as glamorous. You think that that's all changed now then.

I think we've seen a significant change in how people look at internal audit. Back when I joined it was seen as a good way into an organization, but a lot of people would see it as you know, learn your way around the organization for two or three years in internal audit and then go and get a different role. We still see that happen because what we're doing is we're giving people a good grounding in risk and control.

Yeah.

And if we're exporting that talent out to the organization, and they have a good control mindset, then everybody's happy. And it makes the organization a stronger place. We're also seeing more people who look to build their careers within internal audit. And I'm fortunate to work at a large organization where we have a lot of opportunities for people to look at different products, different businesses, to have an international career here as well.

Yeah.

But in all sorts of organisations you see people who see the value in building that longer term career in the Turner Lord.

Sure. You started as an external auditor. What would you say, one issue that we do get come across is that I think some of the external auditors don't want to get into an internal audit role because they think it's the same thing. What would you say to that person?

Yeah, so I think there's always been that choice for someone from a, if someone was coming from a professional services firm to look at a finance related role or an internal audit related role. To be honest, when I worked as an external auditor, the work that I did was more akin to financial reporting and financial accounting than it was to internal auditing. So I think there's an equally valid argument.

for someone with an external audit and a chance of accountancy or equivalent qualification to look at either. Equally, there are skills that you learn through your training that are equally relevant to internal audit. So I think there's a choice. It's a great professional qualification to get and it's a good grounding in all sorts of things, but I must admit, I don't.

Because of the worlds that I look at, we have auditors who obviously cover the financial side of things. They're very knowledgeable and skilled in that sort of financial accounting, financial reporting and so on. I don't use a lot of the accounting side of things that I learnt in my jobs to cancelling qualification, but I've picked up all sorts of other skills and a lot of the experience I got from that set me in good stead to start off my career.

Mm.

Yeah.

I think as well that sometimes people don't understand how much product knowledge that you actually learn as well, and yet again, how you can move internally into other organizations. So you mentioned earlier on that you've been to Singapore and you worked there for a while. What do you think that's been your biggest achievement then so far or what has all that allowed you to do?

that you don't think would have happened if you hadn't have been in the role.

Yeah, so I think there's a couple of sides to that. In terms of biggest achievement, I sort of align what I feel to be big achievements with where the organizations I work for have made achievements. So where I've worked on things that, again, make the bank a better place in terms of how it's thinking about managing risk and controls. I think you can't separate audit from that. In terms of my own...

personal career. I do think the international side of things does stand out. So I've been fortunate to spend some time based in Singapore and spend some time based in New York. But outside of that, I've traveled to so many different places, met so many people in so many different cultures, corporate cultures and different environments as well. But to see a lot of the world, admittedly a lot of it airports, hotels and offices, but you always find a way to see a little bit of the local culture.

while you're there. And to me that's an international, that international opportunity that Audit offers, maybe these days with their different ways of working and probably more conscious, being more conscious of our carbon footprints and so on. We're not flying about quite so much but we still get the opportunity through Zoom and through in all sorts of different ways to work in a very international environment. It's a very international business. So even though

the ways of working may be slightly different. To me, that's one great thing about internal audit, especially in financial services.

Yeah, so I think you mentioned earlier around the interest rates, inflation and so on. I mean, there's always going to be the macroeconomic geopolitical side of things that we need to think about. We're seeing all sorts of challenges in the world around that. We've also got ESG climate risk, and we see across all three lines of defence, a lot of demand for either people with that experience or...

how to give people the understanding and knowledge. We're all working that out as we go along. I think when you look at, and again, our industry is the same as the rest of the world as we're working out how we're gonna deal with artificial intelligence and machine learning. And we see a lot of demand again for knowledge around that. And similarly digital assets, although it sort of ebbs and flows a little bit in terms of the...

in terms of the levels of different organizations, digital assets are clearly here to stay. And so making sure that we have the right specific knowledge around that, again, either building it up, building it out for existing team members or hiring those skills in. Fundamentally though, what I would say is at the end of the day, it all comes back down to control. And so the qualities and the skills that we look for in internal auditors remain the same.

around curiosity, around tenacity, around skepticism, but not cynicism, pragmatism, and so that commercial awareness. You're right around product knowledge. It's something that we all build up, but fundamentally, you know, controls are the same for any business. The form may change a little bit, but in substance, they remain the same. So there's some specific subject matter expertise that I think will be in demand, but the same

type of person, I think we'll still be in demand for internal audit function.

And so therefore with the skills that are going to be required, do you think a lot of these skills can be taken from current internal audit teams? Or do you think that new training is going to be provided? Because I remember years and years ago when we was all recruiting for financial markets auditors and there was nobody. And so we was all trying to get people that were big four trained that may have been traders, but really, you know, it just didn't work.

Do you think that there's gonna, you know, we're gonna have to get people more from the business to try and entice them into internal wall debt?

I think we've been doing that anyway. Again, I think referring back to what we were talking about a few minutes ago, I think that people are being attracted to internal audit more now for the opportunities it gives to get involved in different things. So when I look, for example, within my team at our model risk auditors, we have people in that team, all of them could go.

work in the second line or the first line. They have the skills, they have the detailed knowledge and so on, but they choose to work for us in internal audit. Similarly, we have people with backgrounds from the first line and the second line in all sorts of disciplines. So I think that's been happening already. And the important thing, of course, is to balance those business product knowledge, subject matter expertise side of things with the

audit skills and the understanding of risk and controls. And you can teach people to either of those things. So everyone comes with something to bring to the team. And then we bring those different skills together to work together. People learn off each other and we bring everyone up to the right standard that we need.

Yeah.

Well, I think it helps anybody in whatever they do, you know, whatever role that you do within banking, it's always good to have a little stint in internal audit anyway. You know, that's something that I've always, you know, seen and feel that, you know, is always good for people's career. It's something, you know, that, yeah, that people like. Okay. And then do you think, you know, when you're sort of 16, 18 years old and you're at university

Yes.

school thinking, oh yeah, I want to be a doctor or a nurse and I don't think internal audits on anybody's lips. What do you think, how do you think that we can get people to come into internal audit more? I see there's a lot more graduate programs, apprenticeships, but is there anything that you think people don't realise about audit?

Yeah, I think, again, I think it's been changing over the years. So as you say, you see graduate programs at a lot of places that bring people in straight from college and university into internal and specific schemes. Other places have internal audit as a rotation on other graduate programs. I think a lot of organizations find that people who come through those programs will very often stay on and take a permanent role within internal audit.

So again, I think that image has changed over the years. I think the, again, that point around the breadth and the breadth of relationships, the breadth of the people that you meet, that you interact with and so on, to me is important. It's, because those are the kind of people that we want to attract, are the people that wanna go out and meet with stakeholders. Again, 30 years ago, you'd have some...

some auditors who would just want to sit at their desk and go through documents and pieces of paper. And the idea of meeting a stakeholder was not particularly attractive to them. That's not who we want. We want people who want to get out there. The word audit comes from the Greek word audio to listen. It's about listening to people. It's about talking and listening and learning and understanding and joining things together. So.

I think the more that we can, that people understand that it's a, it's very much a kind of people business. It's about problem solving. It's about looking at ways to make things better and not just about taking a box. But again, I think we have made good strides in the industry towards that.

Yeah.

And do you think then, you know, in terms of internal audit, what do you think sort of companies are doing that works well to attract and retain candidates?

So I think again it's to do with the teams that people work with and the people that they meet. So I think obviously we've just been through a few years where we've all learned how to work differently but one of the things I think across the financial services industry now you're seeing in different ways but and to different extents but bringing people together, bringing people

back to the office. Here in my office, here it's a busy, thriving place again, which is great. And helping people to see the benefit of working together, of having those people to bounce ideas off of, of having that environment of meeting stakeholders in person face to face rather than over Zoom, of being back in those rooms with a whole group of people where you're...

You're coming up with ideas and talking and solving things in the room, rather than scheduling specific 15 or 30 minute Zoom meetings just to catch up, just to catch up on something. I think the more that we can get that environment together and get that collaborative way of working back into things, that to me is what again, what helps enormously. Whenever I interview someone as far as possible, I like to do it in person.

over Zoom. That's getting more and more difficult. The expectation now is that these things are going to be done over video but the more you can get that personal connection up front and then that's really important.

Yeah.

I think as well, it's trying to get that balance because not everybody wants to come back to the office and you know, so it is trying to find the balance to try and keep everybody happy, right? So, okay, great.

Yeah, great. I just to me that internal audit is a role that it's very difficult to do unless you spend a reasonable proportion of your time with other people in the office. Again, it's a people business. And so we really do need to need to keep working on that and help people to understand and, and want to come back in to spend time with people because that's the way that we do we

Absolutely.

Yeah.

we do better work. And I think that's the same across all sorts of teams within an organization.

Yeah.

Well, also as well, I know most of the organisations that you've worked in really do promote internal mobility. And, you know, I don't I wonder whether anybody realises that being an internal auditor, when you're going to audit these departments, you can actually see what the manager's like and, you know, how they're doing as a department, whether you actually want to go and transfer in there or not.

Sure.

Okay great, I've got some quick fire questions just to finish off with. So if you could just let me know one piece of technology you can't live without.

Ooh, I'll be boring and say my phone. I must admit I'm a little bit of a Luddite. I'm not great with technology, but I am very reliant on my phone. I don't know how we did with...

And what are you reading right now?

Right now I am reading two things. One is I'm reading the Thursday Murder Club novels by Richard Osman which my wife read and really enjoyed and told me I must read. I'm also reading a book about black coals. I just randomly went to a lecture a couple of weeks a couple of weeks ago actually at the RAC club

This doctor of astrophysics from Oxford University was presenting a round book Black Holes. It was it was very interesting I bought her book. So I'm educating myself a little bit about that. So

Is that an easy read though?

It's a lot easier than that, a brief history of time and all those Stephen Hawking books and so on. There's not a lot of actual methods.

And tell me who's a company that you admire quite a lot?

Ooh, um...

So when I was living in Singapore, I, whether for good or bad, again, as we say, we all think differently about travel now. I spent a lot of time with Singapore Airlines. My job took me all around a lot of different countries. And the combination of the logistics side of things and being able to run something as well as they do along with the customer service side of things, I've always had a soft spot for Singapore.

I'm not going to contrast them specifically with British Airways.

and the air miles.

And tell me what's the best thing about working in internal audit?

the people that may have come across in some of my previous answers, it's all about the people and the opportunity to meet so many different, different people in different teams and learn every day.

Yeah, I agree.

Yeah.

I think, you know, that's when people ask me about my career. I mean, you know, the one thing about internal audit is, is all the teams are all different, different personalities in whatever, what product they audit. And that is actually one thing I do find really interesting about the role, definitely. And if you wasn't to do internal audit, what job would you do?

Oh, no, that's a difficult one. So what I wanted to do when I was growing up, I played a clarinet and I wanted to go to music college and be a professional musician. Now, I was persuaded by my dad not to do that and to kind of go and get a proper job, as he put it. But I think if I wasn't doing this, then I might, I might.

give it a go and see if I could get my playing up to speed.

Do you still play now?

I do, yes, not so much with others now. I used to play in various different groups and so on, but time and work have made that a little bit impractical, but I still try to keep things up.

Okay, is there anything else you'd like to add to our listeners?

I think the only other thing that maybe we could touch on is around diversity and inclusion. We talked a lot about teams and people. I just think that it's such an important topic for everyone these days. I just think it's worth mentioning to everyone that it's as important, maybe I might even argue more so, we're a function who are

Yeah.

who are there to think differently about things from the business to be that critical friend, to think of things the business doesn't. And so the more diverse we can make the team and more inclusive the environment, because they are two separate teams, you can have the most diverse team in the world. If you're not inclusive about making sure everybody has a voice, then you don't get the benefit of that. But I just think along with some of those other areas we talked about just

So.

for me a really important one to make sure we keep in mind and keep pushing forward.

And also as well though, there is now internal audit teams that are dedicated to audit culture as well, right? How does that work?

Absolutely. So these are, again, we have a team here that does that. These are people often with, again, with different skills, different education, training, different knowledge. There are different ways of looking at and monitoring, auditing and assessing these things. Often quite difficult conversations then to have with stakeholders. And again, we're

We're all, I think, across the industry working on that and learning how to think about culture. A strong culture is the ultimate preventive control. If everyone's aligned to do the right thing in the first place, then it goes a long way towards making sure that the right outcomes are achieved. So yes, very important area.

sits has been thought of a little bit separately in the past because of the because of the nature of the techniques that are used but very much something that we and others around the industry are bringing in.

Yeah, that's great. That is great. Okay, well, look, thank you very much for your time today. And I look forward to speaking with you soon.

Thank you for having me. Thanks, Hazel.