Governance Unplugged - Internal Audit, Risk & Controls

Full version of the Manifesto can be shared upon request by email: thomas.michel@keystone-governance.ch
Personal Manifesto of Internal Audit
by Martin Studer
Internal audit is not a technical function.
It is an institution of trust.
It exists because organisations are human systems: vulnerable, incentive-driven,
pressured, political, ambitious – and imperfect. Where incentives distort judgement,
where bad news evaporates on its way up, and where complexity overwhelms individual
oversight, structural risk emerges. That is where internal audit begins.
Not to control.
Not to please.
But to speak the truth early enough for it to still matter.
Independence is our only real asset.
Not as a principle on paper, but as an operating condition: organisationally protected,
intellectually grounded, emotionally resilient, and ethically non-negotiable. Without
independence, internal audit becomes scenery. With it, it becomes an institution.
Independence means accepting the price of solitude. It means not needing approval to
be right. It means enduring criticism without becoming quiet – and exerting influence
without becoming arrogant.
Assurance is not produced. It is granted.
.
.
.
Internal audit is not a career of comfort.
It is a career of responsibility.
Those who take it seriously gain something rare: the ability to see how organisations
truly function – behind presentations, beyond narratives, beneath formal structures.
That understanding is not a career step. It is long-term capital.
It survives crises. It transcends industries. It protects value, trust, and strategic freedom.
And sometimes – not often, but decisively – it allows us to change the course of
decisions with clear words.
Not loudly.
But in time.

The Internal Auditor of Tomorrow: Why Artificial Intelligence Raises the Bar (Part 2) 💥

In the second part of my conversation with Hervé Gloaguen https://www.linkedin.com/in/hervé-gloaguen-5348ab9/, former Group Chief Audit Executive and Group Chief Compliance Officer of Allianz, we move from the what to the how. And Hervé does not hold back.

His big idea: internal audit should not protect its own people. It should be a talent incubator for the whole organization. 🌱

That means attracting the best, developing them intensively, and then, the truly hard part, having the courage to let them fly. In his own words: “I need to cut my right arm regularly.” 💪

A few provocations that stayed with me:
🔹 Around 70% of an audit team should be non career auditors, talented people passing through, not staying for life.
🔹 A Chief Audit Executive should serve a maximum of about eight years. Fresh eyes matter.
🔹 Real growth comes from movement, across functions, geographies and roles. You are the manager of your own career.

And on the eternal budget debate, his insurance cover metaphor is brilliant: it is not about praying for more headcount, it is about advising the board on how much safety they truly want. 🛡️

His closing advice to every head of audit? Do not hire the next you. And keep a good sense of humour. 😊

If you missed Part 1, start there, then come back for this one.

#InternalAudit #Governance #RiskManagement #Leadership #TalentManagement #AuditAndAssurance #GovernanceUnplugged

The Internal Auditor of Tomorrow: Why Artificial Intelligence Raises the Bar (Part 1) 🤖

I had the real privilege of sitting down with Hervé Gloaguen @https://www.linkedin.com/in/hervé-gloaguen-5348ab9/, former Group Chief Audit Executive and Group Chief Compliance Officer of Allianz, where he led up to 900 auditors and 800 compliance officers across more than 40 countries. He has also sat firmly on the business side, as a board member, bank co chief executive and audit committee member.

Few people have seen our profession from so many angles. And his message is refreshingly optimistic. 🚀

The headline? AI will not replace the auditor. It raises the bar.

As the manual testing, the sampling and the first level analysis get automated, the human qualities become more decisive than ever:
✅ Professional skepticism and critical thinking
✅ The ability to communicate and to persuade
✅ Integrity and ethical behaviour

Hervé also unpacks the idea of the T shaped auditor, the importance of a genuine risk mindset, and why the great auditor is part diplomat, part curious investigator and, perhaps surprisingly, deeply humble. Think Inspector Colombo, but turbocharged. 🕵️

And he challenges one of our most comfortable habits: the belief that an audit team should be built mainly from accountants. The dream team of tomorrow is younger, leaner and far more diverse. 🧩

This is Part 1 of a rich two part conversation. Part 2 follows next week, and that is where it gets even bolder. 📅

👉 What do you believe raises the bar most for the auditor of tomorrow? I would love to read your thoughts.

#InternalAudit #Governance #RiskManagement #AuditAndAssurance #ArtificialIntelligence #Leadership #GovernanceUnplugged

In this episode, Thomas Michel interviews Tony W. DeKker, a former global head of business risk services at Ernst & Young, who now serves on various boards and teaches at Erasmus University. They discuss the gap between GRC science and the reality of the boardroom, the human factor in governance, and the art of risk discipline. They also explore the challenges of risk oversight, the strategic mistakes in cutting GRC functions, and the shortcomings of boardroom risk discussions. The conversation with Tonny Dekker covers the topics of risk management, governance, and the impact of AI on GRC. It emphasises the importance of human judgment, behavior, and emotional intelligence in board-level risk understanding and decision-making. Additionally, it explores the future of GRC and the challenges and opportunities presented by AI and technology.

Takeaways
Human behavior and the human factor play a significant role in the effectiveness of governance and risk oversight.
The gap between GRC science and the reality of the boardroom presents challenges that require a balance between formalities and the art of risk discipline. Risk management is more of an art than a science
The future of GRC belongs to leaders with the courage to integrate, simplify, and embrace technology

Chapters
00:00 Effective Risk Oversight in Boardrooms
31:00 The Art of Risk Management
38:19 The Future of Technology and GRC
51:08 The Evolution of GRC Platforms

The conversation delves into the purpose and challenges of modern risk management, the importance of risk management in decision-making, the limitations of traditional risk reporting, the role of quantification, and the integration of risk management with internal audit and compliance. It emphasizes the need for risk management to shape decisions under uncertainty and be integrated into the decision-making process, with a focus on better judgment, resilience, and closer integration with other governance functions.

Takeaways
Risk management must shape decisions under uncertainty
Integrated risk management is a part of the decision-making process
The future of risk management involves better judgment, stronger resilience, and closer integration with internal audit, compliance, and leadership decisions

Chapters
00:00 The Purpose of Modern Risk Management
07:42 The Importance of Risk Management
13:21 Practical Changes in Risk Management
18:39 Decision-Relevant Risk Reporting
24:15 Quantification in Risk Management
31:29 Integration with Internal Audit and Compliance