In my first Python post, I described the first steps of my python journey.
In my second Python post, I shared my thoughts about whether auditors could learn programming and Python (yes).
In this third post of the series, I want to describe how my audit management has supported my Python journey (spoiler: poorly).
Leading from Behind
I found a special program that allows me to take Python Programming, Data Mining, and Machine Learning courses at night at no cost to me or the company. I approached my manager and director and asked them how much work time I could dedicate each week learn and practice these skills.
They said none.
They liked that I was broadening my skills, but I couldn’t spend any work time on the classes other than charging some of the time to our training category (we track all the hours we work–that’s another post altogether). Once I reached the maximum hours of training allotted (30), the rest of the training and all of my classwork, studying, etc., was on my own time (all the classes together are a year’s investment of my time).
Knowing I would be spending a minimum of 10 hours/week attending class and doing homework, this was disappointing, as 30 hours is the amount auditors are given each year for training. So in other words, they provided nothing extra.
I reminded them that no one else in the department was pursuing these skills, and they recently told the audit committee we were already doing an ‘AI/machine learning’ project (we aren’t; that was rules-based analytics, not AI/ML), so why not grant me extra time, since now the audit committee would be expecting more of the same?
They said no again.
Begging for Support
About 5 months later, after finishing the second class, I approached my manager and asked if I would be able to practice my own skills on a real audit project. He said no, we are too busy doing Power BI dashboards and automating data for them.
I then approached my director and asked him the same. He said if I could find a real project, he’d let me charge 2 hours a week to the project (by this time, I had already changed my max of 30 training hours).
I found a project, but I need to spend at least 6 hours a week minimum on it, so now I was looking at 16 hours/week doing work-related stuff that I wasn’t paid for (more on that later).
So I asked my director, “So I’m breaking new ground for the department, trying to catch up to the other departments that we audit that are ahead of us, and that’s as much as you’ll support it?”
“We simply can’t afford the time right now with all the audits and other analytic projects in process,” he said.
I didn’t give up. “In the department meeting last week, you said that ‘machine learning and AI are the future of audit and analytics’, but you can’t invest in the future by giving me more time, while all the learning is fresh in my mind?”
Lip service, the same service they gave to the audit committee.
This was the same thing that happened with ACL years ago, only I charged my ACL learning time to audits anyway (and no one complained). All of a sudden I was finding more problems faster. I started automating my ACL projects and then asked management to put me in the analytics champion role where I could focus on obtaining, validating, analyzing, and automating data fulltime.
That was a different management team, and they took me off the technology audit team and put me in the new role.
A few years later, some of my* automated projects got senior management attention (it helped that regulators and my legal department liked what I was doing), and my management was praised As a result, I’ve had a lot of support and other auditors have been able to dedicate part of their time solely to data and analytics.
*I keep saying my, me, and I, but other team members were involved; I was the lead and did a lot of the coding and most of the automation.
Here We Go Again
Like the ACL journey, we are again staring into the unknown, and management is (I think) afraid. They don’t understand the technology and the process required, so they are not sure how to manage it or how to milk the glory out of it.
As usual, my foresight, ideas, and action (taking the courses and learning) are way ahead of management, and I think that irks them.
I dunno…if you were management, and you had someone who always thought ahead AND took action whether he got support or not, wouldn’t you at least cautiously support that person? Especially with my track record, which spans more than a few years?
I would. In fact, that’s the kind of person I always looked for when I was hiring.
When the Audit gets Tough
Since I am the key technical person in the department, when a tough technical audit comes along, it is assigned to me; due to a lack of others with data savvy skills, I end up doing most of the work even though in my role, I am not supposed to lead audits, nor do audit testing.
My role is champion; I consult with other auditors to help them generate ideas, identify and obtain datasets, finalize audit and analytic test steps.
But since management only ‘looks’ to the future instead of creating it, they don’t identify areas of need and ensure the department is growing its skills (I am always growing mine).
So if the decision is to pay E&Y 90K+ to do an audit or have me do it, guess what? They pick me!.
And all the other work I’m doing is put on hold while I complete the audit.
So why can’t we put some of that work on hold NOW so I can help them create the future?
Eventually, 1 of the following will occur, maybe both:
- Our CAE will turnover (this happens on a regular cadence for reasons I can’t share). We cannot get a CAE that has been less data savvy that the last couple of CAEs. So that should help.
- The department will get pressured to look into all the AI/ML that is permeating the company, and since only 1 person has any knowledge in that area, you know who will get the call.
I predict one or both will occur by the end of 2023.
In the next post (Part 4), I’ll discuss WHY I keep moving forward in spite of my management. What keeps me sane?
3 responses to “My Python Journey, Part 3”
It’s amusing how internal and external auditors can babble on and on about fancy buzzwords like artificial intelligence, machine learning, advanced analytics, and resilience, yet fail to apply any of them in their work.
They’re nothing but a bunch of smoke-and-mirror salespeople who can’t keep up with the latest trends. It’s no wonder they’re always lagging behind when it comes to real progress. It’s time for these so-called “experts” to put their money where their mouth is and start implementing what they preach.
It will happen again and again forever.
Sorry if my comment sounds salty, but your post about managers not approving time to actually implement something just reminds me of one of the key reasons why I left external audit.
Not all of them, but too many.
Salt is always welcome around here. Thanks for the comment and come back for my next post regarding why I put up with it.
Pingback: My Python Journey, Part 4 | ITauditSecurity