Governance Unplugged - Internal Audit, Risk & Controls

What happens when doing the right thing comes with real personal risk, to your job, your safety, or your reputation? In this compelling episode of Governance Unplugged – Internal Audit, Risk & Controls, we sit down with a highly experienced (and anonymised) Chief Audit Executive, whom we call “Michael.” Together, we explore what it truly means to lead with courage when the pressure is high, the stakes are real, and the risks are personal.
Key Discussion Points
· Uncovering tax fraud and bribery at the highest levels – and the personal consequences that followed.
· Facing direct death threats and even shots fired during intense fraud investigations.
· Managing pressure from the board and management to overlook or suppress critical findings.
· Dealing with missing evidence and leadership’s preference for silence when stakes are high.
· Personal safety strategies when audit work becomes dangerous.
· Staying fact-based, ethical, and humane in crisis situations.
· Balancing the assurance role with genuine support – without becoming an “alibi function.”
· The importance of emotional intelligence and communication, alongside technical skills.
· Building and rebuilding trust with management, the board, and audit teams after tough times.
· Future skills for Heads of Internal Audit: AI, analytics, and adaptive leadership.
· Practical advice for auditors who see wrongdoing but fear the repercussions of speaking up.

Michael’s Message
Despite the dramatic stories, Michael’s message is not about heroics. It’s about calm, clarity, professionalism, and integrity, and how to maintain these values when everything around you accelerates. He emphasises:
· Remain calm, even in the darkest moments.
· Stay positive, seek clarity, and focus on facts.
· Stick to your values; integrity is your anchor.
· Recognise that dark times are often where you grow the most, professionally and personally.

In the second part of their conversation, Thomas Michel and Martin Studer (Linkedin: https://www.linkedin.com/in/martinstuder/ ) explore the future of internal audit and assurance. This episode focuses on how artificial intelligence (AI) and “alternative intelligence” are reshaping the profession, the impact on the Three Lines model, and the enduring value of human expertise. Martin Studer shares insights from his extensive experience leading global assurance and risk functions, challenging listeners to rethink the role and relevance of internal audit in a rapidly evolving landscape. Key Topics Discussed • AI and Alternative Intelligence • Digital Maturity in Audit • Governance Driving Transformation • The Sherpa Metaphor • Slow Pace of Change • Board Expectations & KPIs • Effective Audit Reporting • Team Board vs. Team Management • Next-Generation Auditors • The Human Edge • Assurance vs. Advisory Guest Profile – Martin Studer Martin Studer has nearly 30 years of experience in assurance, risk, and governance. He has led global internal audit and risk advisory functions at EY and Zurich Insurance Group, and now serves as Founder and General Partner of Bluerain Partners Group https://bluerainpartners.com . Martin is passionate about connecting governance, impact investing, and regeneration, driven by the question: “What if business became our most trusted platform for regeneration?” What You’ll Learn • How AI and digital transformation are changing internal audit • The importance of governance in driving innovation and accountability • Practical metaphors and strategies for effective audit leadership • How to write audit reports that truly influence decision-makers • Building resilient, courageous audit teams for the future • The critical distinction between assurance and advisory roles Looking Ahead This episode concludes Part 2 of “The Future of Assurance – Rethinking the Three Lines” with Martin Studer. Stay tuned for a next episode 15, where Thomas and Martin will discuss “Beyond Audit: Intelligence, Trust and the Next Frontier of Governance”, exploring how AI, trust, and intelligent risk management are redefining assurance. Subscribe to Governance Unplugged – Internal Audit, Risk & Controls to catch all future episodes.

Episode Overview In this first part of a two-part conversation, Thomas Michel sits down with Martin Studer, a distinguished leader in internal audit and risk advisory, to discuss the very foundations of assurance. Together, they explore the true purpose of internal audit, what makes the role genuinely impactful, and why the future of assurance will belong to those who demonstrate intellectual, emotional, and ethical resilience at the executive level. Martin also shares personal anecdotes—from family moments to reflections on rock icons and performance art—offering a glimpse into the human side of a career at the top of the profession. About Our Guest – Martin Studer With almost thirty years in assurance, risk, and governance, Martin has built and led internal audit and risk advisory functions worldwide. His career highlights include serving as Head of Global Internal Audit at EY and Head of Group Audit at Zurich Insurance Group. Currently, as Founder and General Partner of Bluerain Partners Group, Martin is dedicated to connecting governance, impact investing, and regeneration, driven by the powerful question: What if business became our most trusted platform for regeneration? Linkedin: https://www.linkedin.com/in/martinstuder/ Key Topics Discussed • Why Internal Audit and Internal AUDITORS Exist really: Delving into behavioral science (Daniel Kahneman’s “lazy brain”) and the principal–agent problem, Martin explains why internal audit is a structural necessity rather than a luxury. • The Auditor’s Right to Exist: Auditors must continuously learn and evolve alongside management to truly earn their place. • Internal Audit as a “Medal of Honour”: • Martin advocates for wearing the title with pride, rather than hiding behind more fashionable labels. • Designing Meaningful Careers: Insights on career rotations between internal audit and business functions, and why short-term “tourist” assignments can be counterproductive. • From Controls to Storytelling: The importance of senior judgment at board level and framing facts into coherent stories for decision-makers. • The Three Lines Model – Tool, Not Gospel: The model’s effectiveness depends on genuine leadership support and partnership across the lines. • Champions League Referee Analogy: Why a Head of Internal Audit must know the rules inside out and maintain respect from top executives. • Backbone of a Modern CAE: Martin’s three pillars: intellectual, emotional, and ethical resilience; and the importance of true independence. • Advice for Younger Auditors: Daily reading, seeking pressure, learning from strong leaders, and developing ethical sensitivity across cultures. Teaser: What’s Next in Part 2 This episode concludes Part 1 of the conversation. In Part 2, Thomas and Martin will delve deeper into the future of internal audit and assurance, discussing technology, data, and how the profession must reinvent its relevance. Subscribe to Governance Unplugged – Internal Audit, Risk & Controls so you don’t miss Part 2 of this compelling conversation.

Episode 12 From Trustless Code to Trusted Governance: Why Crypto Needs Boards and (Internal) Audit Guest: Marieke Flament: https://www.linkedin.com/in/mariekeflament/ Episode Summary Crypto was built on “don’t trust people, trust the code.” But code is written, maintained, and exploited by people. In this episode, Thomas sits down with Marieke — a crypto-governance expert and industry leader — to explore the paradox at the heart of Web3: trustless architectures still require trusted structures. We unpack how Bitcoin and Ethereum took different paths, what DAOs have actually taught us about decision-making, why “trustless ≠ riskless,” and how boards, risk management, and internal audit can bring credibility, resilience, and scale to this fast-maturing space. You’ll hear concrete examples (FTX, Terra/Luna), practical boardroom questions for M&A and partnership decisions, and a clear playbook for founders who want governance to be a growth multiplier, not a brake pedal. What We Cover • Bitcoin vs. Ethereum: two governance philosophies, one shared lesson • DAOs: transparency, participation—and the human layer that never disappears • “Trustless ≠ Riskless”: why accountability and oversight still matter • What TradFi can learn from Web3 (traceability, on-chain analytics) • What Web3 can learn from TradFi (boards, controls, audit discipline) • The role of Internal Audit in crypto: from “after-the-fact” to “at-the-table” • Crisis readiness: scenarios, controls, and board behaviour when things break • Founder–Board dynamics: co-creation over compliance theatre • A day-one governance checklist for crypto founders Key Takeaways • Governance is a capability, not a constraint. In crypto, it’s the difference between hype and scale. • DAOs increase transparency, not infallibility. Human incentives and bias remain—just more visible. • Internal Audit belongs at the table. Anticipate risks early, shape controls, and strengthen credibility. • Convergence is here. TradFi gains traceability; Web3 gains board discipline and structured assurance. • Trust is built before the storm. Scenario planning and control design are non-negotiable. Memorable Lines • “Trustless doesn’t mean riskless.” • “Founders who treat boards as partners unlock real, sustainable growth.” • “Governance isn’t the enemy of innovation—it’s a multiplier.”

Small but Mighty: Running a High-Impact Audit Function with Limited Resources with Ingo Hartmann Welcome back to Governance Unplugged! In Episode 11, Thomas sits down with Ingo Hartmann, Head of Group Audit & Consulting at Maxon, to unpack how lean internal audit teams can punch well above their weight. With 20+ years across internal audit, risk, and compliance (including Big-4 and industry roles), Ingo shares practical strategies for credibility, focus, and influence when you don’t have a big headcount. 🎯 Episode Highlights ✅ Closer to the business = earlier risk sensing. Small teams build trust faster, hear the “real story,” and spot issues before they escalate. ✅ Credibility through consistency. Deliver what you promise, meet deadlines, and show up prepared — reliability beats volume of reports. ✅ Focus where it matters (the 20% driving 80% of risk). Use risk-based planning across process, IT, and board/shareholder lenses; keep reporting sharp and succinct. ✅ Narrative over noise. Position audit as a connector and enabler — tell impact stories (risk reduction, safer operations, better decisions), not just lists of findings. ✅ Say “no” to protect “yes.” Avoid overcommitting; defend independence and quality by being transparent about priorities and capacity. ✅ Scale with partnerships. Use guest auditors (finance, procurement, etc.) with light training and clear guidance; co-/outsourcing for specialist topics (e.g., IT, ESG). ✅ Board engagement that counts. Regularly gather insights from directors; align on top risks and trade-offs (e.g., supply-chain stock decisions and their real costs). ✅ Pragmatic yet principled. Be approachable and solution-oriented while staying independent and compliant — clarity about the audit mission keeps the balance. ✅ Looking ahead. Smart use of AI in audit — and a cultural shift so leaders see audit as a driver of improvement, not a “pain.” 💡 Key Takeaway Lean audit teams win by focus, reliability, and storytelling. When you consistently deliver on the few things that matter most — and communicate the value — size stops being the headline. 🔗 Connect with Ingo Hartmann LinkedIn: Ingo Hartmann https://www.linkedin.com/in/ingo-hartmann-44a53a8/ Disclaimer The views expressed by the guest are personal and do not represent any current or former employer. 🎧 Listen & Join the Conversation Catch the full episode now on Spotify, Apple Podcasts, or your favorite platform. If it resonates, please subscribe, rate, and share — and let’s keep building smarter, more resilient organizations, one conversation at a time!