INTERNAL AUDIT THAT CREATES VALUE — NOT JUST FINDINGS

Risk-Based Internal Audit | IT & Cybersecurity Audit | SOX & ITGC | Regulatory Assurance | Issue Management | Audit Analytics

Internal Audit should do more than identify control weaknesses. At its best, it gives executives and the Audit Committee an independent view of where risk is changing, whether controls are working, whether remediation is sustainable, and where management attention is needed most.

I have spent more than two decades building, leading, and transforming audit, risk, and compliance functions across complex financial-services organizations. My experience spans enterprise Internal Audit, technology and cybersecurity assurance, regulatory compliance, SOX, operational risk, third-party risk, data governance, financial crimes, and remediation.

At Bank OZK, I rebuilt Internal Audit and led a 25-person organization conducting more than 60 risk-based audits annually across technology, cybersecurity, lending, compliance, BSA/AML, operations, trust, and wealth management. Earlier in my career, I helped strengthen risk-based audit coverage at Countrywide/Bank of America, and more recently I have applied FMEA, analytics, automation, and technology-risk methods across more than 100 critical systems.

WHAT I BELIEVE A STRONG INTERNAL AUDIT FUNCTION SHOULD DO

An effective Internal Audit function should be able to answer a few deceptively simple questions for the Board and management:

  • Are we auditing the risks that matter most now — not the risks that mattered two years ago?

  • Are controls merely documented, or are they actually operating effectively?

  • Are repeat findings telling us something systemic about governance, ownership, data, or culture?

  • Are technology, cybersecurity, AI, third-party, and data risks adequately reflected in the audit universe?

  • Are remediation plans solving root causes or simply closing issues?

  • Can the Audit Committee clearly see where risk is increasing, where assurance is weak, and where management action is overdue?

That is the standard I use when designing audit plans, evaluating methodology, reviewing findings, challenging remediation, and developing executive reporting.

BUILDING A HIGH-PERFORMANCE AUDIT FUNCTION

Strong audit departments are built around more than methodology. They require the right people, a disciplined risk assessment, clear quality standards, strong business relationships, credible challenge, and an environment in which auditors are expected to understand the business — not simply execute test steps.

My approach combines risk-based planning, clear accountability, coaching, subject-matter specialization, quality review, analytics, and continuous improvement. Audit teams should know why an engagement matters, what risk they are addressing, what evidence supports their conclusion, and what management should do differently as a result.

The best audit leaders also develop people. I have led teams ranging from specialized engagement groups to large multidisciplinary audit and risk organizations, and I believe strong auditors are taught to think critically, communicate clearly, challenge constructively, and follow evidence wherever it leads.

CORE IT AUDIT & RISK FOUNDATIONS

Technology audit has changed dramatically. Traditional ITGC coverage remains essential, but modern audit functions also need to understand cloud environments, cyber resilience, identity governance, data lineage, third-party technology dependencies, automation, and increasingly AI.

My approach starts with the business service and works backward through the technology supporting it: systems, data, access, dependencies, controls, recovery capabilities, vendors, and failure modes.

That perspective became particularly important during enterprise cyber-resilience work covering more than 100 critical systems. Looking at systems individually is not enough. The greater risk may be the dependency between systems, a shared vendor, common access architecture, concentration risk, or a recovery capability everyone assumes will work.

HOW I RUN A RISK-BASED AUDIT

A strong audit should have a clear line of sight from risk → control → evidence → testing → conclusion → remediation.

I begin by understanding the business objective and the risks that could prevent it from being achieved. From there, I identify the controls management relies upon, determine what evidence should exist if those controls are operating properly, and design testing that answers the real risk question.

Findings should not simply describe what went wrong. They should explain why it happened, what risk it creates, whether the problem is isolated or systemic, what compensating controls exist, and what sustainable remediation looks like.

That is especially important when findings involve technology or data. A failed control may actually reflect a broader problem involving ownership, system configuration, incomplete populations, weak governance, or poor-quality underlying data.

ISSUE MANAGEMENT: CLOSURE IS NOT THE SAME AS RESOLUTION

One of the most important lessons from regulatory remediation work is that an issue is not resolved because a milestone was completed.

I evaluate remediation through several lenses: Was the root cause correctly identified? Was the control redesigned appropriately? Is the control operating? Is the evidence reliable? Has management considered the affected population? Does the solution address recurrence? Is residual risk acceptable?

That discipline is essential whether the issue originated with Internal Audit, a regulator, compliance testing, risk management, or management itself.

At Citi, I applied this approach to technology regulatory remediation, challenging root causes, control design, evidence, corrective actions, and closure readiness across Technology, Risk, Compliance, and Internal Audit.

USING DATA, ANALYTICS & AUTOMATION IN AUDIT

Internal Audit should be moving steadily away from small samples wherever reliable data allows something better.

I use SQL, Python, analytics, dashboards, automated control testing, continuous monitoring, FMEA, and structured risk analysis to help auditors identify patterns that traditional sampling may miss.

Analytics can improve audit in several ways: defining complete populations, identifying outliers, finding control exceptions, testing entire datasets, understanding issue trends, monitoring remediation, and focusing human judgment where it matters most.

AI adds another opportunity — and another risk. Audit functions should be exploring how AI can improve research, documentation, analytics, and testing while simultaneously auditing AI governance, data use, model risk, privacy, access, explainability, change management, and human oversight.

WHAT THE AUDIT COMMITTEE SHOULD SEE

An Audit Committee should not have to decode fifty pages of audit activity to understand the risk picture.

I prefer concise reporting that answers:

What changed? Where is risk increasing? What did Internal Audit conclude? What remains unresolved? Which issues are aging? Where are repeat findings occurring? What should the Committee pay attention to now?

Audit reporting should create transparency, not volume.

The dashboard is not the product. Insight is the product.

SELECTED INTERNAL AUDIT RESULTS

Bank OZK — Internal Audit Director
Rebuilt Internal Audit for a $25B+ financial institution, led 25 professionals, and directed 60+ annual risk-based audits spanning technology, cybersecurity, compliance, lending, operations, BSA/AML, trust, and wealth management.

Bank of America / Countrywide — Vice President, Internal Audit
Helped strengthen risk-based audit coverage while materially increasing coverage and reducing audit cycle time; supported SOX and technology-enabled assurance.

PwC — Senior Manager
Led large, technology-enabled audit and regulatory engagements and served as interim Internal Audit Director for a financial institution.

Mastercard / Protiviti Engagement
Applied FMEA, scenario analysis, and structured technology-risk assessment across 100+ critical systems following a major industry technology disruption.

Citi — Technology Regulatory Remediation
Evaluated issue remediation, control design, evidence quality, root causes, residual risk, and sustainable closure across high-priority technology matters.

WHAT I BRING TO AN INTERNAL AUDIT LEADERSHIP ROLE

I bring a combination that is increasingly important in Internal Audit:

Traditional audit discipline + regulatory experience + technology fluency + enterprise risk perspective + data analytics + executive communication.

I have worked across all three lines of defense. That experience helps me understand the difference between management ownership, independent risk challenge, and Internal Audit's assurance responsibility — while also understanding how those groups need to work together when significant issues arise.

My certifications include CPA, CIA, CISA, CRCM, and CAMS, complemented by graduate-level study in finance, cybersecurity, data science, and Python.