Bruce is an active company director and audit committee chair. He is a well-respected transformational leader with deep and broad professional governance, risk, compliance and audit experience. He was appointed a Member of the Order of Australia (AM) in the Queen’s Birthday Honours of 2015 in recognition of his significant service to public administration through governance and risk management practices, and to the profession of internal auditing.

He was a contributing author for Sawyer’s Internal Auditing seventh edition published in 2019, and his book New Auditor’s Guide to Internal Auditing was published the same year. He had two books published in 2020, Team Leader’s Guide to Internal Audit Leadership and Powering Audit Committee Outcomes. His latest book – coming out in 2021 – is Rising from the Mailroom to the Boardroom – 101 Building Blocks for Professional Career Development.   (You can see Bruce’s complete bio here.)

We provided him with our Drivers of Change 2020 list and then asked him to respond to the following questions.

1. What’s your reaction to this list? Is anything missing that is relevant to your profession?

The list of major forces driving change right now certainly provides food for thought. We are seeing a re-baselining of organizational values across many sectors as a result of corporate leadership failures over the last twenty years where poor industry-wide cultures, behaviors, and practices were allowed to fester unabated. Public inquiries have highlighted disgraceful neglect within areas such as aged care and across significant elements of the finance industry (banking, insurance, retirement planning, and superannuation).

The ways of working need to change. An important step to driving these changes is the Statement on the Purpose of a Corporation signed by 181 CEOs of the largest companies in the U.S in 2019 reflects on the vital role businesses play in the economy by creating jobs, fostering innovation, and providing essential goods and services. There is now a clear commitment by business leaders to deliver value to customers, invest in employees, deal fairly and ethically with suppliers, support their communities, and generate long-term value for shareholders. This aspiration is likely to shift the boardroom mindset from one of earning money for shareholders to serving stakeholders.

We have seen the emergence of environmental, social and governance (ESG) as the three central factors in measuring sustainability and impact on society of an investment in a company to help determine future financial performance. Recent reports suggest that more than 80% of mainstream investors now consider ESG information when making investment decisions. There are currently $22.89 trillion of assets being professionally managed under responsible investment strategies, an increase of 25% since 2014 (which exceeds the gross domestic product of the entire U.S. economy).

Several other forces that need special focus are broached in other answers (i.e. supply chains; modern slavery; wage theft; loosening of red tape; sovereignty; globalization; and, quantum computers).

2 What drives the business model of your profession?

The internal auditing profession – coupled with associated governance, risk management, and assurance activities – has continued to evolve to fulfil its mission, which (according to the Institute of Internal Auditors international professional practices framework) is to enhance and protect organizational value by providing risk-based and objective assurance, advice, and insight. To fulfill their mission, auditors need to be attuned to the business environment, balanced in their approach and what they report, and credible in the eyes of their key stakeholders, including the board, audit committee and members of the c-suite.

Governance, risk management, compliance, assurance and audit professionals need to champion more efficient service delivery and help their organizations navigate a more complex business landscape. They need to continue to be innovative in remodeling what they do and how they do it, so they evolve from a hindsight perspective where they traditionally reported on the past, to delivering insights that help business managers now, and ultimately, they need to share foresight that helps business managers run the business in the future.

Examples are included later on how auditors are currently using technology, including drones, natural language processing, machine learning and artificial intelligence (AI), to conduct better audits.

3. What major changes have you seen over the past few years and do you see coming in the next few?

The technological advances experienced in a single generation are unfathomable. When I bought my first cell phone twenty years ago, I could not have imagined the potential power of the device or the innovations to be unleashed in the form of even more advanced smartphones (in the decade from 2007 global sales of smartphones accelerated from 122.3 million to 1,536.5 million).

The technological convergence that is now occurring with computers, television sets and set-top boxes through smart TVs was beyond my wildest imagination. The traditional TV evolved to provide integrated internet and interactive web features, so users have at their fingertips the opportunity to stream music and videos, browse the internet, view photos, watch online interactive media, and access on-demand streaming media (the global smart TV market is expected to grow by more than 293 million units during 2020-2024 at a 21 percent compound annual growth rate).

There are many new technological developments that will reshape the way businesses operate in the future through innovative methods, systems and devices. It is hard to comprehend the future of technology by 2050. But if the predictions in media reports are correct, we will expect by 2050:

• The internet to be free for everybody
• Intercontinental rail travel will be a reality
• There will be personal aircraft for short trips
• AI-powered devices will used for routine tasks
• Self-driving cars will be more common
• Robots will have taken on half of human’s work
• Cancer mortality will be reduced substantially
• And perhaps humans will live on mars!

It is predicted that over the next thirty years there will be a huge increase in the number of cyber-crimes and hackers, commensurate with the increase of internet usage. Data privacy and security will be a primary concern for most people.

4. Which of them do you think will be the most impactful? In the near-term? In the longer term? Which will be most difficult to navigate and why?

Sovereignty is an important concept for any nation; it relates to a state’s full right to exercise its power without interference from outside sources or bodies. The risks of globalization will need to be rethought and mitigated in the near-term. This will be difficult to navigate because of geopolitical interests. Whereas the advent of quantum computers will shake up our traditional technology security arrangements in the longer-term at a time when more and more people and businesses are relying on technological convergence in their daily lives … with the expectation that privacy and security will be protected. So there is a natural tension between people’s needs and expectations and this will, at times, be difficult to navigate.

Globalization achieved integration across the world in areas such as transportation, communication, education, trade and other practices. It was embraced by different societies, cultures, and regional economies and resulted in the increased interdependence of various nations. And it shaped world affairs by driving economic, political, cultural, security, consumption, environmental, and social impacts. While it boosted the exchange of ideas across different nations, global integration amplified a range of risks, including:

• trade integration resulted in greater exposure to the economies and policies of other countries;
• financial integration resulted in more severe financial crises; and
• people-to-people links meant the disease in one nation quickly became a global pandemic.

Quantum computers will shake up the encryption and authentication protections that organizations rely on today, so business leaders need to be proactive in strengthening the security arrangements that protect their data and systems. Because quantum computers harness the wonders of quantum mechanics to deliver greater processing power, there are reports suggesting they have the capability to break the cryptography underlying public key infrastructure (PKI) by 2030; consequently, replacement algorithms capable of securing against quantum computer-based technologies are needed. This is crucial for business segments that need to secure devices or maintain confidentiality of information beyond 2030, especially those with high-level security requirements such as critical infrastructure (e.g. water, energy and satellites), the military, law enforcement, fire-fighters, automotive industry, airline industry, financial services, and health services.[1]

5. How do you think your profession will have to change to adapt?

There are three fundamentals to internal auditors adapting to the changes confronting them – demonstrate impact; embrace technology; and apply a balanced approach.

The anticipated coronavirus-triggered economic slump will force to organizations across all sectors to reduce their spending, as limited funds are redirected to strategic and recovery priorities. Auditors will need to continuously demonstrate the value of their work if they are to receive sufficient and sustained funding. They will need to work more efficiently while operating in unpredictable conditions, and it will be imperative to leverage technology to compensate for the likely loss of people within their audit teams. Auditors need a balanced approach, whereby audit technology is used wisely and strategically, and blended with physical interactions with clients to witness organizational culture and operational practices firsthand.

Governance, risk, compliance and assurance professionals will increasingly need to look outside their organizations when considering the emerging risks that have the greatest likelihood to impact their business. By way of example:

• Gaps were exposed throughout 2020 in manufacturing supply chains across the world, and have demonstrated the vulnerability of commodity-based economies to external shocks and the need to address the hollowing out of manufacturing capability. There has been a consequent shift in attitudes and opportunities with regard to supply chains and local manufacturing (especially medical supplies), that are likely to play out over the next decade.
• Modern slavery is another heightened area of risk. It refers to the condition of being forced, deceived, or coerced by threats or violence to work for little or no pay, and of having no power to control what work you do or where you do it. Trafficking and slavery are common denominators undermining the United Nations’ 17 Sustainable Development Goals. Regardless of whether modern slavery legislation is in place (it is being introduced in many developed nations) the community is becoming more attuned to responsible consumption, with their purchasing decisions influenced by supply chain safeguards established to address human trafficking, child labor, forced labor, slavery, and human rights crimes.
• Wage theft is emerging as a critical issue in some nations especially where there are extensive and complex employment conditions in place (i.e., total remuneration packages, including salary, wages, allowances, and other benefits). It involves the inadvertent and/or deliberate underpayment or non-payment of wages, allowances, entitlements, or retirement benefits (including superannuation) to many workers by an employer who denies workers their legal entitlements. Some organizations have identified underpayments of tens of millions of dollars across their workforce.
• The most profound changes from the COVID-19 response have been the swift loosening of red tape requirements by governments, which would normally take many years to implement. Governments adopted a mantra of ‘don’t let perfection be the enemy of the good’ in forcing changes to the way we work.  These changes were inspired by the need to support economic activity. This will hopefully translate into a continued focus on eliminating or softening unnecessary red tape that is holding business back while generating little tangible benefits for society.

6. What advice would you give to anyone contemplating entering or remaining in the profession?

It is difficult to imagine how technologies will evolve over the foreseeable future. But it will be an exciting time if we embrace the changes and quickly become experts in these technologies and the new ways of working. Lifelong learning will continue to be a prominent factor in how we develop, and how we constantly reinvent ourselves and the profession.

Innovation will be vital. We are already seeing auditors at organizations like the Asian Development Bank embracing opportunities for innovation and improvement through enhanced digital skills. They are currently using technology to conduct better audits. Examples include:[2]

• Using drones to track on-the-ground progress of building projects, such as new roads and transmission towers under construction in Kalimantan Indonesia, which saves auditors from having to travel to remote sites in person. It also helps to monitor the progress of larger areas, with drones providing a bird’s eye view.
• Using natural language processing (a way of teaching computers to make sense of and analyze a written document) to check that key covenants in a contract are reflected in their system. The tool reads a document, compares it against what is in the system and points out any differences. The time for completing this process for a single loan has been slashed from around two hours to seconds. The technology equips the auditors with the precise terms when they audit projects without the need to refer back to the agreements.
• Using an AI technique to check that all payments are processed according to established rules. For example, the software checks that the person initiating a payment cannot then give approval for it, and that the transaction has proper confirmation before it goes through.
• Using machine learning to identify risk areas more accurately by setting parameters based on rules; exceptions are raised for items not meeting the rule which narrows down the areas for which auditors need to conduct more in-depth checks.

[1] Paul Lucier, ‘Six Steps to Start Readying for Quantum’, 10 August 2020, https://www.isaca.org/resources/news-and-trends/industry-news/2020/six-steps-to-start-readying-for-quantum (sourced 14 September 2020)

[2] Yun Xuan Poon, “How ADB is using AI to refine audits – Interview with Hock-Chye Ong, Auditor General at the Asian Development Bank,” GovInsider (20 May 2020).