Back to Basics: Why AI Won't Save an Audit Without a Solid Foundation

Happy 2026 Everyone!

As we kick off 2026, the buzz in the hallways of every organization is the same: Artificial Intelligence. We are talking about predictive analytics, automated reporting, and real-time monitoring. But as auditors, we need to have a moment of intellectual honesty.

There is no point in talking about Artificial Intelligence if we are still failing at the basics.

Disruptive innovation has indeed changed the way we work, but the pillars of a high-impact internal audit remain unchanged. Whether you are in the public or private sector, the value we provide isn’t just in the tools we use, but in the rigor of our methodology.

The "Shiny Object" Trap

It is easy to get distracted by the latest software, but a sophisticated algorithm applied to a flawed audit plan will only produce "high-tech" errors. High-impact auditing is born long before the first line of code is written; it is born from:

• Respect for Standards: Adhering to professional norms is what gives our work legal and institutional weight.

• Rigorous Planning: Understanding the object of evaluation, defining clear scopes, and setting realistic timelines.

• Quality of Evidence: Collecting evidence that is not just abundant, but sufficient, reliable, relevant, and useful.

Returning to the Foundations

For a truly effective audit, it is essential to "work the basics." This means mastering the core cycle of our profession:

1. Planning with Purpose: Truly knowing the entity and its risks before defining objectives.

2. Execution with Precision: Applying the right techniques—be it physical inspection, circularization, or analytical review—and documenting them in flawless working papers.

3. Communication with Impact: Reporting not just "what happened," but providing a professional opinion that helps management improve through actionable recommendations and consistent follow-up.

Looking Ahead to 2026

My invitation to you this year is to review your foundations. Masterfully executing the basics is, ironically, the greatest competitive advantage an auditor can have in a world obsessed with automation.

AI can process data, but it cannot replace the professional judgment of an auditor who knows how to apply a materiality lens or evaluate the "design and discipline" of an internal control system.

Let’s embrace the future, but let’s keep our feet firmly planted on the bedrock of our profession.

Be happy! 

Professional Diligence and Integrity: Lessons from the Wells Fargo Case for Risk Managers and Internal Auditors

 

The recent decision by the Office of the Comptroller of the Currency (OCC) against former Wells Fargo executives underscores the importance of professional diligence and integrity in risk management and internal auditing. This case highlights how failures in monitoring improper practices can lead to severe penalties, impacting both the company and its executives.

The OCC investigation revealed that Claudia Anderson, who served as the Community Bank Group Risk Officer, failed to adequately challenge the bank’s incentive program, neglected to implement effective controls to mitigate the risks of improper sales practices, and did not escalate known risks. Additionally, she was found to have provided false or misleading information to regulators during 2015 examinations. Former internal auditors David Julian, Chief Auditor, and Paul McLinko, Executive Audit Director, also failed to design effective audits to detect and document irregularities and did not properly escalate issues. In McLinko’s case, there was an additional concern regarding his compromised professional independence due to his close relationship with the bank’s retail division.

To prevent such scenarios, risk managers and internal auditors must operate with technical rigor, independence, and integrity, ensuring that internal controls are effective, and that risk oversight and escalation mechanisms function appropriately. Professionals in these areas need the courage to challenge policies and practices that could compromise governance and expose the organization to financial, regulatory, and reputational risks. Furthermore, it is crucial that they are embedded in a corporate culture that prioritizes transparency and compliance, thereby reducing their own exposure to potential penalties.

The Wells Fargo case serves as a critical warning: governance failures and oversight negligence can lead to severe legal and reputational consequences. For professionals in risk management and internal auditing, the lesson is clear— 
complacency and negligence are not options. A proactive and vigilant stance, grounded in best governance practices, is essential to ensuring that business decisions are made with ethics and responsibility.

Questions for Reflection:

1. How can corporate governance strengthen the independence and effectiveness of risk managers and internal auditors?
2. In what ways can companies foster a culture of transparency and compliance to mitigate fraud and irregularities?
3. What challenges do audit and risk professionals face when attempting to escalate critical issues within an organization?
4. How can companies ensure that incentive programs do not pose risks to organizational integrity?
5. What steps can professionals take to develop a more critical and proactive approach to risk identification and mitigation?

In future articles, I will explore these questions in greater depth. For now, I leave you with this thought:

Are you comfortable with how you are currently managing risks or conducting audits? Do you feel supported in questioning company practices that could pose governance, integrity, or reputational risks?

Be Happy!

Let's make enterprise risk management simple!

 

Today I want to bring to our reflection a fundamental theme for the consolidation of corporate governance.

Let's talk about enterprise risk management.

I was preparing the course, and I came across a slide that I use to explain, the structure applied to risk management, and I felt motivated to bring this topic to our discussion.

Anyone who follows me on social media knows that I always try to bring a simple view to important topics related to management and governance, facilitating understanding and their application in corporate activities.

Simplicity is currently a competitive advantage for the organization, but understand that being simple does not mean being superficial.

Well, let's get back to our topic, which is risk management.

In a simple way, I can say that:

“Managing risks is a proactive activity, looking to the future, understanding the events, external and/or internal, that may materialize and adversely impact the company's or process's ability to achieve its objectives; evaluates them for their magnitude, and treats them based on the acceptable levels of risk defined by the corporation.”

The primary objective of risk management is to allow the corporation, in the pursuit of fulfilling its mission, to conduct, direct and maintain its activities, actions and decisions, within its acceptable level of risk, defined by risk appetite.

The starting point for risk management is the correct understanding of objectives, whether strategic, corporate and/or operational. If we do not know the objectives clearly, it is difficult to know the risks in a comprehensive way.

Not using objectives as a basis for identifying risks is the most common mistake I find in corporations, causing time and resources to be spent in a wrong and ineffective way.

Remember that the risk event directly impacts the ability to achieve the objectives.

Regarding the operational objectives, those that relate to the various existing processes for the operationalization of the organization's activities, I recommend the definition of the objectives inherent to each of the processes, as well as the objectives related to legal compliance, objectives related to moral values of the organization, and objectives related to the consistency, integrity, confidentiality and recoverability of the processed data.

The better the definition of objectives, the more effective the identification of risks tends to be.

Well, since we have already determined the objectives, we now begin the process of identifying the events, external and/or internal, that may impact the corporation.

Then, in a simple way, we begin to identify the risks that, if materialized, will adversely impact the organization's ability to achieve its objectives. We can see risk as the negative view of the objective, for example: If one of the inherent objectives of a purchase process is to buy only products and/or services necessary for the operation of the corporation, the risk may be the purchase of products and/or or services not necessary for the operation.

Based on the understanding of the objectives, try to identify all risk events that relate to it. This is a brainstorming activity. There is no Cartesian way of doing this.

Once all the perceived risks are related, the next step is to know their causes, that is, the events that could materialize the risk.

It is the risk factors (causes) that we assess the magnitude of and that we treat, so it is important to be judicious in identifying them.

To illustrate, let's go back to the example of the purchasing process, why can the corporation buy products and/or services not necessary for the operation? The answers to this question will allow us to identify the risk factors. Example: a. A wrong purchase requisition, b. Lack of inventory planning, c. A fraud.

This procedure must be performed for all identified risks, without exception.

Very well, at this point, our risk matrix already has three basic columns: Column of objectives, column of risks related to each of the objectives and column of risk factors related to each of the identified risks.

The next step is the analysis and assessment of risk factors through the matrix reading of probability (frequency) and impact (in several dimensions, such as financial, image, market-share and others).

At this point, it is important that the corporation has metrics, approved by senior management, to assess the magnitude (probability and impact) of risk factors.

It is also important that the company already has a risk appetite defined by top management. As a suggestion, to facilitate the risk management process, guide senior management to define the risk appetite based on the heat map resulting from the metrics, indicating the quadrant that should be considered as the accepted level risk.

I like to use metrics with five levels of probability and five levels of impact, so that the heat map has quadrants from 01 to 25. In this case, risk appetite can be defined as being one of the existing quadrants, for example the high management can direct your risk appetite to quadrant six, so anything above will need to be addressed.

One of the problems that I come across, in this evaluation stage, is in relation to the use of complex metrics, with the inclusion of weights, weighted average and other calculations that only bring complexity and delay to the process.

Note that, more important than the accuracy of the risk factor measurement, is the action that management takes to address it. It doesn't matter if the risk is 15,234 or 15, what really matters is the action that management takes to mitigate the risk factor.

The calculation is simple: probability x impact = gross risk

Another important point at this stage of the evaluation is the definition of impact, that is, if the event materializes, what impact will it bring to the organization. Some corporations seek to assess impact through a weighted average across the various dimensions. The suggestion is to work with the dimension that receives the primary impact, and not with a weighted average of the impact in the different dimensions, because, note that this is not how it happens in reality. Example: if the event materializes and impacts the image, it will not necessarily impact, simultaneously, the other dimensions measured, so it is best to focus on treating the effect on the image, ensuring that it does not affect secondarily the other dimensions.

Okay, now that we know the magnitude (gross risk) for all risk factors, whether inherent, compliance, fraud, or IT, the next step is to compare the magnitude obtained with the risk appetite, and based on in this, determine the best treatment to align the raw risk with the risk appetite determined by the organization.

Keep in mind that the primary objective of risk management is to enable the corporation to act within its acceptable level of risk, formalized through the definition of risk appetite.

Risk factor treatment can be: Accept, Share, Avoid and Mitigate.

We can accept the risk, when the gross risk is already aligned or below the risk appetite, however accepting the risk does not mean doing nothing, but monitoring the risk factors, because today it is low, tomorrow it may change and with this change our treatment.

Another important point is in relation to who can accept the risk, and my suggestion is that it need to be accepted by the statutory managers, since legally they are the ones who take the risk for the company, including their private assets.

Sharing risk is a process where another corporation, be it a financial institution or an insurance company, accepts to take part of the risk for the company. Example: Insurance policies, or foreign exchange hedge. Note that this is an answer on impact and not probability.

Another form of treatment for risk factors is risk avoidance. It is one of the most difficult answers to work with, because in order to avoid risks, the organization can no longer be exposed to risk, which means, in most cases, strategic decision-making, such as the company's exit from a market, or closing a unit, or not carrying out an operation, etc.

Finally, we have the possibility of mitigating the risk factor, which operationally speaking, requires the implementation of an internal control to mitigate the probability of the risk event materializing.

Just remembering that internal controls are:

“Actions, formalized in policies and procedures, aimed at mitigating the probability of materialization of the risk event. These are actions of review, checking, certification, validation, authorization, approval, etc.”

Depending on the materiality and nature of the risk, in addition to the probability response, it will be necessary to prepare a contingency plan, which aims to minimize the effect of the impact, when the risk event materializes.

Once the responses have been determined and implemented, the next step is to calculate the residual risk, which is the effect remaining after the treatment action, and make sure it aligns with the risk appetite defined by the corporation.

Remember that simplicity is currently a competitive advantage! Bring simplicity to operation, not superficiality!

Be happy!

Por que os programas de compliance falham?

 

Como acontece com outras práticas de governança, o programa de compliance, para ser efetivo, requer que os pilares que irão sustentá-lo, no tempo e espaço, estejam presentes.

Vejamos alguns pontos com os quais normalmente me deparo nas corporações:

• Encontro programas de compliance que se restringem apenas na existência de políticas de integridade, que é importante, mas não o suficiente.
• Também, me confronto com programas muito bem elaborados e formalizados em políticas e procedimentos, entretanto, infelizmente, este programa fica somente no papel.
• Me deparo com áreas de compliance que sua atividade se resume na execução de controle, por meio do preenchimento de checklist, passando a ser, neste caso, parte da primeira linha de gestão, perdendo sua identidade de área especialista de segunda linha de gestão.

Não quero dizer com isto, que contar com um bom programa de integridade, ou ter um processo adequadamente formalizado, ou realizar um monitoramento independente não seja importante. Sim é importante, mas é preciso é que tudo isto faça parte de um processo mais amplo, estruturado e integrado.

Gosto sempre de lembrar que compliance é na realidade “atitude”.

É a atitude que todos, que façam parte ou se relacionam com a corporação, executem suas atividades, ações e decisões dentro dos valores morais e éticos da organização, amparado pelos requisitos legais, sejam eles oriundos de legislação externa, do país, estado, munícipio ou do órgão regulador, sem exceção.

Outro ponto importante que devemos considerar é que se o objetivo é ter uma corporação onde suas atividades sejam amparadas pelos seus valores morais e éticos, dentro dos requisitos legais, temos o “risco” de isto não acontecer.  

Se compreendemos que não estar em compliance é um risco, precisamos gerenciá-lo por meio de um processo estruturado para a identificação dos riscos e seus fatores, avaliando sua magnitude e no final, tratando-o de forma a manter o fator de risco alinhado ao apetite a risco da organização, que neste caso deve ser zero, por motivos óbvios.

Agora, considerando que se não todos, uma boa parte dos fatores de riscos tem sua origem em fatores internos, podemos dizer que o seu tratamento será por meio da implementação de um sistema de controle interno, o qual é formado por ações, formalizadas em políticas e procedimentos, para a mitigação da probabilidade do evento de riscos se materializar.

Então, até aqui, podemos compreender que um programa de compliance para ser efetivo necessita estar amparado por um processo integrado para o gerenciamento dos fatores de riscos, o qual por sua vez, necessita de um eficaz sistema de controles internos.

Mas tudo isto, ainda não é suficiente para que o programa de compliance realmente funcione apropriadamente. É importante que os três pilares basilares estejam presentes. Os pilares são:

1.   Cultura – A organização precisa ter um conjunto de valores e crenças apropriados para influenciar e alinhar a atitude e o comportamento de todos colaboradores, prestadores, terceiros aos requisitos de compliance.

2.   Consciência – A cultura prepara o caminho, mas é importante contar com gestores, colaboradores, prestadores e terceiros que conscientemente acreditem, se comprometam, e que, apoiado pelos valores morais da organização e pelas melhores práticas de gestão, exemplifiquem e exerçam suas atividades dentro dos requisitos de compliance,

3.   Formalização – Para a manutenção da qualidade e entendimento das atividades, estrutura, processos e monitoramento é necessário a existência de um conjunto de documentos como: políticas, procedimentos, código de conduta, instruções de trabalho e outros. Esta documentação, uma vez atualizada e amplamente divulgadas, permite a equalização e alinhamento das atividades e operações, independentemente de qual ciclo de negócio ela pertencer.

Posso, sem medo de errar, dizer que o grande desafio para a implementação de um efetivo programa de compliance é com certeza trabalhar os dois primeiros pilares: cultura e consciência.

Os órgãos de governança, a alta e a média gestão têm papel importante nestes quesitos. Eles têm a responsabilidade de definir os valores, promover um ambiente propicio para a aplicação das melhores práticas de gestão, exemplificando estes valores em seu discurso, posicionamento, ações e em suas decisões.

Logicamente, tudo isto exige uma mudança mental e comportamental de todos os envolvidos, principalmente dos níveis de gestão e tomadores de decisão. Um programa estruturado de capacitação gerencial em governança, compliance e nas práticas de gestão tende a reduzir a resistência à mudança, mas o comprometimento incondicional aos requisitos de compliance, pelos membros dos órgãos de governança, será essencial para o amadurecimento da gestão em relação ao compliance e melhores práticas de gestão.

Cada linha de gestão deve conhecer claramente suas responsabilidades, de forma transparente, não podendo haver dúvidas, de forma que possam prestar conta, para quem os elegeu, sobre toda e qualquer materialização do risco de compliance e/ou violação aos valores morais da organização.

Temas estes que devem fazer parte da agenda do presidente, do conselho de administração e do comitê estatutário de auditoria.

Para finalizar, os programas de compliance que falham são aqueles, que por algum motivo, não contam, de forma equilibrada, com os três pilares: Cultura, Consciência e Formalização

Então: Reflita, inove, mude e no final

Seja feliz!