Audit, Financial Scandals, and Emerging Technology with Jerry Ravi

AR:
Wow. That's a long time.
JR:
Yeah.
AR:
So, the topic of today's audit, and as far as I understand, there's internal and external audit. And I know a lot of people are like, "Wow, this is a riveting topic." But when I started doing research into it, I found that it was very interesting. There's a lot of really crazy stories in the past. I mean, Enron is one of the big ones. Can you help break down...? And you have some great analogies that can maybe help paint a picture of what audit is or why it's so important and how it plays into the stuff that you guys do.
JR:
Yeah, so, in essence, and I think you had asked how do you explain it to a five-year-old, right?
AR:
Yeah. Explain like I'm five.
JR:
It's difficult, so I'll go back to my kids are 13 and 15, and I have tried to explain it to them over time, so I've actually used them as the Guinea pigs. An analogy for me is, think about your home, and you have objectives, whether you have a family or not, but the objectives of that home is to keep it safe, keep you safe, keep it looking good, curb appeal. And that's an objective that you have. So as a company, you can think about it that way. We have objectives. We want to grow, et cetera. But in your home, you want to make sure the water's lawned. You want to make sure the Ring camera is charged, so that way, you can see what's going on, see when packages arrive. You want to make sure the doors are locked in the evening in the right way.

So think about audit as someone coming in and checking on that for you. It's also called, in our world, lines of defense, where the first line would essence be those that are actually operating the home. And the second line can give you advice on risk, and a third line is really internal audit. Beyond that, you have regulators and auditors, but I just look at audit as more of somebody and a group trying to help you actually do better to meet those objectives.

So, many companies... And think about the other side of that. Think about if something were to go wrong. That's usually a question we ask when we do particular audits, "What can go wrong? What's the risk?" But again, I say risk can actually turn into opportunities. I even go back to thinking about how you would audit something like cybersecurity.

When my kids were five years old, one story is, I remember giving my son my iPad, and he had a friend over, the next-door neighbor, and the friend actually asked, "What's the code?" Because I had the passcode on it. And he gave the code out to his friend. And I pulled him aside and actually had to talk to him about good governance, at five years old.

"This is what you need to understand. You don't give out your passcode, and here's why." It's hard for a five-year-old to understand that, but in essence, you are protecting what you have inside that home. So I always use that as an analogy.
AR:
So, I think one way we can frame the importance of audit is based off of the consequences of poor audit or no audit, correct?
JR:
Yeah.
AR:
Because, for me, if I'm running a company, the last thing I want to think about is defense. Because businessmen are usually aggressive. They're thinking about the offense. But really, sometimes, the best offense is a good defense, or vice versa, right?
JR:
Yeah.
AR:
So, it's funny, like your kid, when he was giving out his password, not realizing because of his innocence that that could have major consequences, I guess it's human nature, to some degree. But what are the consequences? And obviously, we could talk about Enron, but what is the human impact of the lack of audit, or good audit?
JR:
Look, I think that's a great question. The human impact, I mean, I see clients, friends who have started companies and the consequence that they deal with. And there's the psychology of it too, behind the scenes, is when they don't have something in place. They lost money, funds. Someone committed fraud. Those, I think, are the easier ones.

There's some other things that I would even call blind spots that are just sitting out there, yeah. You're there to grow the company. That's the objective. How do you grow it without...? You don't want to put handcuffs on anybody, especially if you're an entrepreneur. We see that a lot. But at the end of the day, that's our view. We put the risk lens on, without trying to stop a company from the process of actually growing.

So ultimately, the consequence is a number of things, again, not meeting your strategy, not having your financials in order and potentially losing money, and, ultimately, operationally, you're just unable to operate the company. So, worst case scenario is the company goes under, company goes bankrupt.
AR:
And obviously, people get laid off. They lose their retirement.
JR:
They get laid off. Right. Think about the mental state of what happens there. And I know we'll get there, but ultimately the consequences can be very drastic and dramatic. So, in essence, the owner of that company is certainly going to be... Think about the peace of mind concept.

There's really no peace of mind promise at that point if somebody didn't necessarily take care of their home, right, because now, like we were talking earlier, imagine that you didn't take care of your home, or I didn't. My family's on the street.
AR:
I think when it comes to protecting your house, I mean, Enron is one huge example. You have Theranos. You have SVB. You have FTX. I mean, I think there's a common thread, even though the regulation behind why these things failed maybe may look different, right?
JR:
Yeah.
AR:
And how we can mitigate them from happening, there are different solutions. I would love to get into that as well. But I guess, let's start with Enron. So, Enron was an energy company, right?
JR:
Mm-hmm.
AR:
I think they were founded in the '90s, and then, they went bankrupt in, what, 2000?
JR:
It was 2001.
AR:
2001.
JR:
It was 2001, yeah.
AR:
And so, the auditor was Arthur Andersen. They were one of the Big Five.
JR:
They were the largest-
AR:
Oh, really?
JR:
... five, yes.
AR:
So, next to Deloitte-
JR:
Correct.
AR:
... PricewaterhouseCoopers, KPMG, Ernst & Young. And then, they were showing $1 billion in profit, when they were actually in major loss. I mean, it's crazy, and the only way that could've happened is the CEO was in on it, and obviously, he was.
JR:
Right. There was an environment where even the audit firms weren't really looking at the, call it the controls over how things were done, the operational practices, versus just there's financials. Yes, the auditors clearly did something wrong. Arthur Andersen would still be here if there was no issue there, right?
AR:
Right.
JR:
That's a fact. But ultimately, I think if you let it loose a little bit, and FTX is very similar. It took an event. SVB's similar. At some point, things will come together and crash together. It's like a perfect storm. When I look at this, it always comes down to good governance. Somebody did not think about governance in this process. And, unfortunately, and fortunately for companies that actually have a good governance structure, that starts at the board level, too. So, ultimately, we got to figure out how we balance that. And I think that was completely misaligned with Enron, and controls were overlooked.

And they had whistleblowers too. I mean, people were actually blowing the whistle and saying, "I know something's wrong. I didn't check this information, but I'm being told to sign off on it," those types of things. And now you have ethical issues at that point. So, it's almost like a domino effect. And there's no way you can continue doing that over however many years. I mean, yes, some can get away with it for a long period of time, but eventually, it comes to roost, and it always has.
AR:
There's always a cost.
JR:
There's always a cost. And at some point, something happens. And in that particular case, obviously, once it was realized, they had to go through and really unwind everything with Enron, and then they created regulation and compliance over it. And that's what typically happens. And it's going to happen with the banking regulatory reform that will... It happened back in '08 and '09 as well. I've seen a couple iterations of this. And sometimes, there's a balance there too. We have to be careful with that. I've always thought that, although regulation sometimes is not a bad thing, you also don't want too much, and you want to balance it with what a company can do, because you don't want to handcuffing the... Let's just say you're going to start up a technology company, and you want to be handcuffed and have the raise double the amount of money that you had to raise to be able to handle compliance. That's not ideal in this world if we want entrepreneurship...
AR:
Because that introduces inefficiency, and it slows down progress.
JR:
It can slow down progress, yes.
AR:
Right. So we have to find that balance.
JR:
Exactly. And one of the things that we talk to clients, even when SOX coming out back in 2002, one of the things that we always say is, "How can you get the most out of it?" More touchpoints on operational efficiencies versus, again, risk, opportunity. We have a risk. I have to do this. I get it, and maybe even a necessary evil, because I don't want to do it. But how do you get the most out of it? How can you actually be more efficient? And we'll talk a little bit more about technology as well, because with what's happening on the technology front today, it's much different than it was in 2003, in 2004, when I came to the firm, where it was always at the top of mind for me, but ultimately, I was always trying to come to the table and help a client do more with less, and be able to comply.
AR:
This is a great segue to a more philosophical conversation, I guess, like the need to find balance, because with SVB going down, it's like, "Okay, do we make it necessary for every single depositor to have to do their own due diligence on every bank that they ever put money in?" That's not really feasible, right? And that's the thing with... You can't have unfettered capitalism, and you can't have unfettered socialism. You have to have a balance, and that's really hard to do.
JR:
Yeah.
AR:
And I was digging into the Enron story, and one thing that I found really interesting was that his favorite book, apparently, was called The Selfish Gene by Richard Dawkins. And he believed, this is his own words, that money and fear were the only things that motivated people. So, it got me thinking like, human nature has both of those things. It has greed, selfishness, and the desire to kind of transcend, especially like status, getting status and everything like that. So, on the one hand, people would look at the story and say, "See, this is why capitalism is terrible, and we need to move to socialism." But at the same time, socialism doesn't necessarily incentivize ambition. If you're ambitious, some people more than others, there's no incentive in a socialist structure. So we need both, right? Because human beings are... They're greedy on the one hand, but they're also compassionate, and they like to cooperate within a community. So, it's tough, but I think we need a little bit of each of those things to really build a strong society.
JR:
I agree. Yeah, I'm with you there. I think ultimately, when you think about, like you mentioned greed, I think, ultimately, yeah, you could have some of that, but what about the human element? What's going to happen if people actually think about that and companies think about that? And I literally just had a meeting with a potential client prior to coming here, where the audit committee chair was doing all the right things, making sure things are covered, and for all the right reasons. Even though they only have eight employees, I'm worried about those eight employees. I'm worried about where this is headed. I want to make sure I can touch all of these things and not just say, "Oh, the only thing I'm worried about is making money." So, it's not just about that. But, ultimately, I think this all comes together nicely if we have a good balance.
AR:
So, I wanted to talk briefly about SVB, FTX. I think this is a great segue. I know audit is a broad topic, and we can get into the different technology that's used. But I think one thing that's misunderstood is blockchain. And blockchain basically creates a decentralized system where everything's a little bit more transparent, because it's immutable, which means that once something is written to the blockchain, you can't undo it, right?
JR:
Right.
AR:
So, have you noticed it in the audit world that blockchain is becoming more relevant?
JR:
And a lot of the discussion is around how this is going to be used in the world of audit as well, not just how we're going to operate, but how do we actually get back to auditing and checking on how the controls are working within the blockchain?
AR:
Have you heard of Chainlink Proof of Reserves?
JR:
I have, yeah. Yeah. Yeah, it's an interesting concept of making sure that... And again, even going back with FTX and having some of this in the mix, I think, going out. And even the word proof, if you think about it, is sort of an audit concept and term, where proving things out, where validation is always key.
AR:
Or bringing transparency.
JR:
Exactly. So what actually occurred in this world, and can we actually see evidence of that? Is it traceable? And you have transparency over transactions.
AR:
Yeah, so, for the audience, the way Proof of Reserves work is, basically, there's a smart contract, and it updates automatically whenever the reserve increases or decreases. So, one of the issues in the crypto space, and this is a really interesting experiment, because you know have conservatives, and you have liberals, and then you have libertarians who want more free market and less regulation. Crypto's kind of the Wild West. And the consequences of that are that people lose money all the time, FTX being a great example of that.

But what's cool is, humans will come up with solutions. They're not going to just be like, "Aw, man," and then they're going to just move on and then invest in the next Ponzi scheme. They're going to say, "Okay, well, prove to me that you're trustworthy." And because of technology, now we can do this in an automated fashion, which is really cool. So, it seems like the primary advantage to Proof of Reserves is preventing hyperinflation through minting of tokens, because there are all these cryptocurrencies where there's a fixed number of tokens, and then they're like, "Oh, you know what? Here's a million more." And if you do that, basically, you're manipulating the reserves. And it's kind of a interesting segue to the way the Fed works, in a way. But the Fed is obviously a lot more regulated than some guy in his basement who's created a coin and wants to get rich. If the AI is doing some of your audit, how do you trust AI? So there's all these different components to it.

But can you talk to us a little bit about what the newest or emerging technology within audit specifically that you've seen and are most excited about?
JR:
Yeah, right now, so I could tell you two things. So, I'll talk about what I'm seeing today, from where we've been, and then ultimately, where I think we're going that's exciting me. And it's actually what drives me to get up in the morning and do what I do, to be honest with you. I mean, the passion I have for technology has been with me since the beginning days of even before I interned and even came into the world of accounting.

So, we're maturing now, coming back from... I mean, if you think about where technology has been, I mean, unfortunately, I'll date myself here, I mean, you have the element... When I came into the workforce, I mean, you still had mainframes, and then you went to your PC, your client-server environment, to SaaS. That in and of itself is a pretty big jump in evolution. And in our world of audit, we have evolved. I actually think it's slow to move, but now there's an accelerator. I think you even said it's almost like you put that drop in the water, and all of a sudden, boom, it's fizzling. And I think we're fizzling right now for the future. And I'll talk a little bit about that too.

But right now, it's really, we're focused on the data elements. And an example of that would be, we use a platform called Workiva to do SOX compliance. Instead of asking you for documentation, we want to be able to get it from the different systems that you have and pulling that in and providing some insights along the way, and that's where the automation can come from.
AR:
I want to know, 10 years from now, or, I mean, things are moving fast, so it could be even as soon as five years, but what does controls monitoring look like five, 10 years... or what does audit look like five, 10 years from now?
JR:
Yeah, I think we're going to have a platform where we're going to be able to grab all the information that we need to see the operation of a particular control or a transaction and allow some AI components to actually look at certain criteria that make up that control or that transaction and give us some element of, "I think, based on what you did before, I actually have these three things that I found," let's say, almost like pre-populate a potential observation.
AR:
So like Minority Report type of thing.
JR:
Yeah, just give me some information about where we... And then, I would have to spend some time on the human side trying to figure out what are the other value ads that are in here. And a good example of that is, for instance, technology and accounting and regulation changing all the time, and maybe not at the speed of light, for sure. And each one has a different velocity in terms of speed. Ultimately, imagine that you plug that in, and you're not doing that as a point in time, that it's happening continuously that there's an element of, "Okay, this needs to be checked, because, you know what, I know over here, the regulation changed or the accounting guidance changed, and I need to make sure that I look at this."

Very often, when things are found in the audit world, and I'm even talking about the external audit world, it's after the fact, not during. So the picture that I want to paint for you is, imagine that it's now during, like you know it's happening. Again, it may not be exactly real-time, but you're not going to have to wait four or five months, six months, or maybe even longer, to find out that I had a problem back in January of last year.
AR:
So it sounds like, if you've seen the Space Odyssey, it's a classic movie.
JR:
Yeah.
AR:
And HAL is the AI, and it's like, "I'm afraid I can't let you do that, Dave." It's kind of like an employee trying to do something, and the controls monitoring just kicks in. It's like, "No."
JR:
Yeah. No, you can't.
AR:
"Can't do that."
JR:
"Unlock..."
AR:
It's kind of dystopian, but-
JR:
I like that. I have to actually watch that again.
AR:
Yeah. Yeah. So I'm imagining, because I'm not really knee-deep in the world of audit, but tell me how far off I am, I guess. And, in the future, you'll have a persona using... It'll generate a human figure. It'll call you. Let's say Brad Pitt calls you, and it's like, "Hey, Jerry, tell me about this weird report that I saw," and it's fully powered by AI, speech to text, all that stuff, and then it just asks you questions, and then you're talking to it. It goes, and then it jots it all down, stores into the database, compares it, generates reports, and all that's being done on the fly. You're focusing on your own thing while Brad Pitt just makes his rounds, I guess, or whoever it is.
JR:
Well, even better, I love that, because it's a great way to think about it. The future is, maybe you do have... So right now, we have what we call... We perform process walkthroughs, and we do that in front of a client, for the most part, even now that we're kind of beyond COVID and still hybrid. But we like to do that in person with you. So I'm sitting here with you now, and I want to go through your process. "Okay, Aimann, tell me how you go through and grant new access to users to this application. Maybe it's SAP. How does it get approved, et cetera? Take me through that process." In your scenario, the so-called avatar could be talking to you, but could also be doing a walkthrough with someone else at the same time, asking those questions and gathering that information and providing suggestions.
Right now, we do that manually, right?
AR:
Mm-hmm.
JR:
Yeah. And I could see that happening, where we could be doing process walkthroughs in an automated fashion, in an AI fashion, with that so-called avatar. I'm sure Brad Pitt would be a good avatar for lots of people.
AR:
I think that human beings are... They're going to gravitate towards... They find that when they deal with more attractive people, they're more likely to divulge information. It's weird, but if it works, it works, right?
JR:
Yeah.
AR:
And it's not going to be... It's going to be generated on the fly, right? It's going to look like some human being, but, at the end of the day, we have to work with what works for people.
JR:
The key there that I think about too, so I always put my risk hat on, or I just think about some elements of, not even what could go wrong, just an element of what could slow it down. I think the other side of it, you lose the human element, so you lose the fact of... Because even with ChatGPT, there's risks. You lose the ability to be able to interact with that individual.
So I'm sitting here talking to the avatar in a process walkthrough. I'm not going to get the laughter and the communal feel.
AR:
I mean, that could be programmed.
JR:
In some ways, in some ways. But I will say, then there's some societal elements to that. People have to want to do that, right?
AR:
Right.
JR:
And one of the things that we pride ourselves in consulting quite a bit is being in front of the client.
AR:
So, I guess as we wrap this up, I'm curious to hear your thoughts on how all of these innovations will affect the profession itself, because it seems like the common thread across all industries and all professions is AI will basically make the orchestration side more important. So, it's not so much the tedious stuff, but now, we need a leader to lead the effort or orchestrate like a maestro. So, what do you think is going to happen? And, obviously, I won't hold you to it, no bets here, but what do you think will happen to the audit profession?
JR:
Well, look, so it's something that's near and dear to me, because I've been talking about this for quite a while. I even go back to the firm that I was with prior to coming to Eisner, EisnerAmper, and I helped them, really, perform their audits. And this is, I'm going back to the days when there were floppy disks. But what we haven't realized is there's still more that we can do with auditing through the technology. And I think that, unfortunately, hasn't made its way into the full audit process, which at some point, it will. And it is happening today.

So, that's where we were. And then, where we're going to go with all of this, I think is, for you to actually be an auditor, I think you're going to have a technology background. And, look, I've spent a lot of time talking to accountants about this. I was actually coached into it. When I was in college, I had an internship, fantastic mentor, CFO of the company, coached me into the fact that I had passion for technology. He saw the light and said, "Try double majoring in IS and accounting and see where that takes you." That was one of only a few at the time that was doing that. It was actually hard for me, when we talked about Arthur Andersen, they were still around. I was unable to get a job with the Big Five at the time. Actually, it was still Big Eight. It turned to Big Five very quickly after I graduated.
AR:
And then, Big Four.
JR:
And then Big Four. I couldn't get a job with the Big Eight, Big Five, Big Four without having at least two to three years of this experience, because I wanted to go straight into consulting on the technology side. They wanted me to do audit first, like regular audit for two years. And I said, "Well, I don't really want to do that," so I ended up working for the government, actually, for a little over a year, and then started an IT consulting practice with this firm in New York that I'm talking about, prior to coming here. But ultimately-
AR:
I think everyone... That's the trend. It seems like everyone now needs to be a technologist. It doesn't matter what profession it is. If you're an artist now, you need to know technology.
JR:
Yeah, yeah. My niece had her birthday yesterday, and I was joking with her. She's 15. And I was telling the family last night, "I'm going to be doing a podcast tomorrow." And they were like, "Oh, what about?" I said, "Well, we're going to talk a little bit about ChatGPT." And they're like, "Really? What are you going to talk about?" My nephew who's going to be 17 this summer, he was more intrigued by it, because he's doing some stuff in high school on just emerging tech and some on ChatGPT. And I just said, "Look, at the end of the day, we have to embrace the fact that we have these tools in front of us and this technology in front of us." And I think in the accounting world, we did see it. It's there. It just never made its way into our world until later.
Accounting has always, and auditing has always been a lagger with adopting new technology.
AR:
Which makes sense, because they're more conservative. They're risk averse, so they wait and see, and then they pick up...
JR:
I think there needs to be more of a sandbox type play with this, where-
AR:
There's more room for experimentation.
JR:
Exactly. So that's really what it's all about. Let's try to find a way to use AI in what we do. Let's experiment. Let's be agile. So the reason why I'm saying all this is the mindset is going to change-
AR:
It has to.
JR:
... which then changes the culture. So then, maybe five years from now, the way you just described it, because, "Oh, yeah, I get it," because you just said they're conservative, they're risk averse, maybe that's going to turn the other way, or, "No, actually, auditing, that's like emerging... They're using all the"-
AR:
They're trailblazers.
JR:
"They're trailblazers," right. "They're innovators. They're creative." And, look, I don't want to say that they're not today. I feel like I am in this world. We're just going to see more of it. We're going to see more people doing it. We're going to see... You even understand it, and it's not the world that you live in. And I'm not just saying understand it, but you're able to make it better.
AR:
Right. And it can be applied across all the scales. Small businesses now can afford to do it, because the innovation has made it within reach. It's not just for Fortune 500s anymore.
JR:
Exactly, exactly. Another example is, I remember when blockchain was just starting to kind of gain some momentum, not really in mainstream at all, definitely not into the internal audit world, and I invited a friend of mine who really was a trailblazer on the... And he's the one that invited me to the Accounting Blockchain Alliance, et cetera. He wrote a book on being a blockchain accountant, the first, and I'm going back almost 10 years now. So, when I brought it probably eight years ago, seven, eight years ago to the internal audit world, it was met with resistance, like, "Wait a second. I'm not even sure what this is. I don't know." I convinced them to do it, and it was more that we had an event on the topic. People don't understand it. It's going to be over their head. And they're going to think crypto. And that's really when, actually, Bitcoin was just starting, which is interesting. Probably should've bought some at the time.
AR:
And we all should've bought some-
JR:
Yeah, exactly. That's always the case, right?
AR:
It's not too late. That's what I always tell people.
JR:
So, it was actually very low at the time. I'm saying maybe it was dollars at the time. But ultimately, we did it. And it was interesting, because I was quite surprised that there were probably about 100 people in the audience for that couple-of-hour session on this. And I kind of moderated it with my friend. He and I went to college together, and he was always a trailblazer in this space. And I was quite surprised there were... Probably 25% of the audience understood it for sure. And they came with a lot of questions. But then it was, "What are we going to do with this...? What do we do now?"
AR:
Yeah.
JR:
"How do we now build this into the model?" So we had to figure that out. Now, look, we're seven, eight years later, and I can't necessarily tell you now that we're that much further along. I mean, we are.
AR:
We are, in theory, but-
JR:
Theory, we are.
AR:
... maybe not in practice just yet.
JR:
Exactly. And I think that's where we're going to see... That's that eyedrop that you're going to put... the dropper you're going to put in the water that makes it fizz. I think now we're going to have that moment, and we're going to see more of it come out. So I always try to coach our people and others as best I can to kind of pay it forward in some way, where it's... Please make sure you're focused on this. It's imperative. I just had a conversation with someone that's been in the business even longer than I have. And, unfortunately, he was part of a layoff, and he was asking me like, "What do you think I need to do?" "Other than just culturally mindset-focused, et cetera, being mindful and meditate, as well, get yourself back to a state where you can be creative. Go into this, do more on the technology side, get those certifications, do more of the learning and understand..." Because he was in a space where he unfortunately didn't have enough of that in his background.
AR:
I think that advice is for everybody, just keep developing yourself-
JR:
Yeah. Yeah. Absolutely.
AR:
... and you'll always be in demand. I mean, I always tell people, though, there's always a place in the world for people that work hard, and AI won't change that. I think that it's just going to maybe modify where people find value, and hopefully for the better.
JR:
I love that. I love that. Work ethic always starts... That's where the culture begins, right-
AR:
Yeah. Yeah.
JR:
... in you and with others.
AR:
And hard work, yeah.
JR:
Absolutely.
AR:
Well, I appreciate you coming on here and talking about all this. It's obvious that there's a lot of really exciting stuff, and hopefully, that means that we generate more efficiency for society and that means consumers have more choices and better lives. So, thanks again for your time.
JR:
Oh, thank you.
AR:
Hopefully, we-
JR:
My pleasure. This is awesome.
AR:
... get to see if Brad Pitt becomes the future of audit. There you go. Brad Pitt, the future of audit, okay, you heard it here. Thanks, Jerry.

^{Transcribed by Rev.com}