A career in public-sector internal audit

Hello, I'm Richard Chambers, the Senior Advisor for Risk and Audit at Audit Board, and welcome to another episode in my podcast series, Speaking of Risk and Audit. I'm joined today by Mike Peppers, who is known to many of you, and he's been a good friend of mine for a long time. Mike is the Chief Audit Executive for the University of Texas System in Austin. Mike, we've known each other for more than 20 years, and you have had an amazing career working in and for the internal audit profession.

Among your IA volunteer roles, you served as the chairman of the North American Board, the chairman of the International Standards Board, and the chairman of the board of IA Global. You have 35 years of internal audit experience in higher education. Maybe you could take the audience through a bit of a chronology of your career, and much of your career has been in academia. Is that right?

Yes, that's true. Thank you very much for having me, Richard. Excited to be here. Actually, 35 years is more like 40 if you go back to the beginning, because interestingly, I started at my internal audit journey as a graduate student at the University of South Florida and Tampa and worked while I was in school, actually auditing work papers, going to exit conferences.

It was really an exciting opportunity. And after I graduated and. Then obligatory stint in public accounting that we needed to do, I was recruited back to the university to lead the internal audit function. So at the ripe old age of 28, I became chief audit executive and haven't looked back since.

It's just been a tremendous journey. After working at the University of South Florida for a number of years, I went to the University of Texas system and worked at two of our different institutions there. And in the higher education space, it's just been a very interesting journey. And I think today we're going to talk a bit about that in the public sector and what that means.

And so that's been very special to me. But during that time in the University of Texas system and before, I was also very involved with the Institute of auditors, as you well know. That's been the side journey that has been part of my trajectory and have very much enjoyed it. And it's given me some amazing opportunities to learn from and think about my colleagues around the world, and in particular, those in the public sector.

So look forward to chatting about that today. We worked together for a number of years in the I community, even from your time in the Houston chapter when you were heavily involved with the International Conference there, I think back in 2005, and then later on the North American board. And then when I became the CEO, you obviously continued your progress in the volunteer structure, and then you had a chance to be my boss for a year when I was the CEO and you were the chairman.

So very fond memories on my part of all those years we spent together. Yes. Well, thank you. I do as well.

It was a blessed career and opportunities and you and several others were instrumental in terms of making some of those opportunities possible. You know, we talked about your extensive career in the public sector like me, although I think you've now got more years in public sector than I did. But what do you think if you're, and again, knowing that it's still a work in progress for you, but what do you think is the most rewarding aspect of public service? Yeah.

It isn't often rewarding monetarily. So what is it that should inspire and motivate internal auditors to undertake a career in public service? Well, it's interesting. As I have looked, why have I remained in this or why did I pursue it in the first place?

I can kind of link it a little bit to whenever I was global chairman of the board. And as you well know, we had to have a theme that we were, you know, that we kind of carried throughout that year that we spoke. And my theme in 2017-18, in a time when social media was just, you know, kind of started to come through, was hashtag purpose, service, impact. And a big part of my message at that time was how important it was to find your purpose.

And that is true for all of us in life, but in our professional careers as internal auditors, that purpose that you're at an organization, you're at a place where you're committed, you're interested. I often say that's kind of sometimes the difference between external auditors and internal auditors because external auditors have their various reasons that they come in and work in organizations and they check that box and they move on. Internal auditors are there because we want to be, we want to help our organization succeed.

And so I think very often in the public sector and public service, internal auditors just have that strong commitment. And for me, that has always been higher education. For those who may not have thought about it recently, higher education is fairly broad, has a broad compass. I mean, we have not only education and the advancement of learning for the public good, but also health care and research.

For about 13 of my years in the UT system, I was chief ad executive at healthcare organizations. And so, you know, those specialties are something that are unique. And again, you know, curing cancer at MD Anderson Cancer Center. You know, that was always an important mission.

And I would say that when we talk about the public sector, there's a variety of elements of that. Very often people jump to thinking of government auditors. And that certainly is a significant element of it. But I have always been, higher education is kind of in a unique sliver of that.

We are not generally considered government auditors. We are state institutions in our case, certainly not for profit. But we have to be successful in our mission as well as financially. Operationally.

You very often, I recall over the years, talked about as you led not-for-profit IA, it's like no margin, no mission. And so you have to help your organization succeed. And it's been an interesting last 26 years for me in the UT system because it's just such a massive enterprise. We are a $33 billion-a-year organization, and I've got 120 internal auditors across our 13 institutions.

So it's significant. But then also, and I think we'll chat about it, there are government auditors as well that I had a chance to see and learn from. Particularly one that's come to mind a bit, was one of my trips as the global chairman to Eastern Europe and visited with the state auditors there and the folks that were working in that structure. So, again, quite a diverse background.

You know, I agree with you. The higher education, public sector of higher education maybe has some differences. But I think the one common ground maybe that government auditors have with auditors in higher education is that there tends to be more public scrutiny maybe of the mission of the organization. And if there's ever an issue or a problem or the public perceives something inefficient or not effective, there tends to be more scrutiny and maybe more noise about it.

So how have you helped the leadership in the organizations that you've led to kind of help them manage that risk, that public perception risk, if you will, of the institutions? Right. You're exactly right in terms of if we think about our stakeholders, you know, and go back to the core of the stakeholder group for the public sector, it is the public. And whereas in.

Somewhat different from the corporate world where, you know, the shareholders, that board is the, you know, the key stakeholder there. And in the public sector and public sector auditors, so much is in the sunshine, public everything. You know, it used to still does shock some of my colleagues when they find out, oh, that your annual work plan is a public document. Your audit reports are posted on the web.

Yes, they are. My audit committee is broadcast live on the web. So very much government in the sunshine type of thing, which differs. And so that goes into your comment about the accountability and the transparency.

And so I think that chief audit executives that operate in that setting do have to have an awareness of that or respect for that and skills at navigating that. Recognizing who our stakeholders are and really working with our organizations. Because I've been fortunate at the University of South Florida and at my UT institutions that, you know, I have just had the ability to work with management of such high integrity and openness, you know, that that hasn't been so much an issue.

But I'm very well aware that that is not the case everywhere. And so when we talk about the political pressures and challenges that certain auditors have to deal with, it is a very real factor and cannot be ignored. You know, after your tenure as the chairman, I think you maybe had hopes that you could kind of go a little bit into a quiet retirement. And then the next thing you know, I ring you up one day and ask you, when I'm still the CEO of the IA, if you might be willing to chair the standards board.

And you graciously agreed, even though you knew that I was going to be talking with the board about the need for a major refresh of the standards. And you led the standards board through that. And the outcome, I think, as our listeners will know, particularly those who are internal auditors, is the global internal audit standards that came out, well, became effective last year. Can you talk a little bit about that process, the process that the IA went through and that the standards board went through to get us to a place where arguably it's the most significant overhaul of the internal audit standards since the beginning of the century?

Yes. And I will start off by piggybacking your comment to say, I vividly recall the conversation in the meeting that we had where you asked me to do that. And I think I almost went kicking and screaming. But honestly, it was one of the most rewarding things I've done that I've had the opportunity to be a part of in my professional career.

And, you know, you reference the standards, and there aren't many hard copies because digital age, everything, what's that? But I have to have a hard copy, and this particular copy is special to me because it may not see there, but I had the opportunity to have all the standards board members who participated with me sign this, and I'm going to reference it in just a minute. But, you know, the standards are just such... They are the crux of everything to a profession.

And to have standards gives us consistency, gives us credibility, gives us guidance. And it was just a tremendous responsibility and challenge to do the update and to do justice to it because we knew as a standards board that this was a kind of a once in a career kind of a thing. And we did, it was a four-year journey that we went through. I had the opportunity to work with, honestly, some of the most amazing colleagues that I've worked with in my career, 21 folks from around the globe, all different, diverse aspects.

And relevant to today's conversation, including, well, I have been in the public sector, but also another standards board member who's just had been involved in the public sector for so long. And so, you know, going through that, going through the discussion, going through the development, the research that we did to look at the objectives and how we restructured a lot of things to hopefully make the standards more usable, more concise and direct. It was just a great opportunity.

And relevant to the public sector element of it, we really did, there were only two groups that we kind of carved out and called out in the new standards. One was small audit functions, and the other was internal auditors in the public sector. And we wanted to, walk the line between saying, you know, you're still internal auditors. I mean, because you audit in a small function or a public sector or private organization or publicly traded company, I mean, you still have the same standards and all that.

But we also couldn't be blind to the fact that there are differences. And so two of the things that we did in the new standards, the global internal audit standards, are that instead of just having an introduction at the beginning, which I don't know how many people ever really read an introduction to something, but we. Reclassified that and we called it the fundamentals of the global internal audit standards. And in the fundamentals at the very beginning, we referenced public sector internal auditors in that they have unique environments in which they work and unique responsibilities.

And then at the end, and if you're not in the public sector, you probably wouldn't have noticed this, but at the end after Domain 5 of the standards, we have a three or four page section that is called implementing the standards, applying the global audit standards in the public sector. And it goes into further discussion about some of those differences, and it actually even then references back to the standards that might have some unique treatment for public sector auditors.

And coincidentally, just earlier this week, I was speaking at a conference on the standards and someone from the public sector came up and said how excited they were that. Their group was recognized here in the Red Book. So that overall was the approach that the standards board tried to take. Yeah.

Well, you guys did a phenomenal job. I've said that publicly. I've certainly shared that with you privately and with other members of the standards board. I could take no credit other than the fact that maybe I convinced you to take on that immense challenge.

So thank you on behalf of the profession for doing that and for the amazing outcome. You know, Mike, you are still a practitioner and a very influential one. So as sort of our closing question here, let me ask you, what are you hoping that the internal audit profession will be able to achieve in these next five years? Because there are a lot of people, myself included, who are talking about some of the risks and challenges, you know, embracing AI, all of that, that the profession really needs to recognize and address.

So what's your hope for the internal audit profession in 2030? I think I really have to tie it back to what we've just been talking about today in this kind of historic period of time where we have new global internal audit standards. And what I have been talking throughout the four years that I've been talking about it, and even at the meeting this week, I titled that session, Applying the Global Internal Audit Standards for Impact. And again, if you tie back to what I said my theme was as chairman, hashtag purpose, service, impact.

We as internal auditors must be making an impact in our organizations or we're going to be irrelevant and not sought after and not valued. And so we don't want that to happen. To your question, I think that this is a time where chief audit executives and their teams can take advantage of the new standards. And I would also point many of you, whether whatever industry segment you are in, domain three around governance is one of the most significant, I think, things that we did in the new standards.

Use that as opportunities to have conversations with your boards or whoever your leadership group is. In the public sector, that's very often not a board necessarily. But whomever, whatever group, use this opportunity to have those discussions and to really use perhaps the new global internalized standards as you look at them, as you look perhaps for gaps from things that you had before, as you get ready for your next external quality assessment around that. Use as an opportunity to proactively better yourselves.

And that fits into whatever category it is. Now, we're all talking about artificial intelligence. We're all talking about the tools and the things that are out. There will always be something new.

I mean, there will just always be something new. So we as internal auditors need to be progressive, need to be on top of that, need to be engaging with our organizations. And so I hope that over the next several years in particular, that the internal auditors will use the standards, will use this opportunity to reassess where they're at and really be able to make the maximum impact that they can. Well, great advice as always, Mike Peppers, and thank you for joining me on this podcast.

And to our audience, I thank you for listening in. For Audit Board, I'm Richard Chambers, the senior advisor.