[Music] foreign [Music] welcome students I am super thrilled to have Sam Beck with us who you're about to learn is an MSU grad he's going to tell you about his experience in MSU and since he graduated what he's been up to we know each other through the Denver IIA chapter Institute of internal Auditors chapter you know this by now since you have maybe even an intended an event by now but Sam helps us on the board last year with membership trying to get engagement up and and part of that includes the student membership so um Sam I'm going to let you introduce yourself further to the students and then I'm thrilled to talk to you about planning and engagement today yeah thanks for having me today Joe or I don't know if it's Professor Irvin um but they call me all right Professor Joe um I appreciate you giving me a chance to talk today and um thanks everybody for joining here for for for watching this interview here um so my name is Sam Beck I'm a managing consultant with the internal audit practice here at forvis I'll give you a little bit of my story of how I got there um and uh it started at CU Boulder um so I got my uh my undergrad degree at CU Boulder and economics um from there I went to work at a firm that sold life insurance and did some kind of personal financial planning um I worked there for about five years and by the end of it I absolutely hated it um it was very sales heavy I was really bad at sales um and I I did that for a while and I kind of decided that I wanted to make a career change um so I could maybe try to sell my time and expertise instead of these crazy Financial products that were really difficult to understand um so from there I did some research and and found MSU Denver's masters of professional accountancy program while I was you know working in life insurance personal financial planning I talked to a lot of CPAs I was really impressed by the way that um our our clients talk to their CPAs and see and sought the their CPAs guidance and expertise so I was always really interested in accounting too so that's kind of what drove me to want to go back to school and get my Master's in accounting um so while I was at MSU Denver I actually did my first internal audit engagement um as some of you may know the university has an internal audit projects class where you actually get to do in the the university doesn't have their own internal and audit function they have the students do it um so uh my fun fact that I'll kind of go through is that that class kind of changed the trajectory of my career going forward I was interested in audit you know I love debits and credits as much as the next person but I really loved that internal Auditors got to audit kind of everything and I really enjoyed that class it was really transformative for me um so my group and I actually did an internal audit over how MSU Denver tracks their graduation performance so we got to interview a whole bunch of different departments and we looked at some data and and all these ways that they're tracking this graduation performance and got to present that to the Board of Trustees and it was a really great presentation we got some great feedback and questions during that we were able to add a lot of value um through that internal audit and it kind of it made me really consider internal audit in the future as a potential career track after I got out of my Master's Degree so while I was at MSU Denver I found an internship opportunity through the MSU Denver career board for a small boutique internal audit firm here in the Denver area there's only about 10 or so people at this firm um doing outsourced internal Audits and sarbanes-oxley engagements for their clients so when I was interviewing for that internship they really liked that I had experience in internal audit through MSU Denver and that was really all they wanted to talk about they didn't really care about my five years of professional experience working in an office and all these stories that I had kind of prepared for my interview they really didn't care about that they just wanted to know what I learned from doing that internal audit which was a lot of things I mean when we started that internal audit it was almost like if I had started it after doing it I would have done things completely differently it was that we learned that much through that process um so uh they said that that that that experience at MSU Denver really helped me stand out from other candidates and I really think that it helped me land that internship which is kind of where why I'm at where I'm at right now um so to continue that story um that La that internship lasts about seven months it ended right before I graduated from the master's program so actually while I was walking for the MSU Denver graduation ceremony I got a voicemail from the owner of that small boutique internal audit firm and he said that he was merging that firm with a firm that was called bkd it was a national firm something like the one of the 15 biggest national uh public accounting firms in the nation um so he said he was merging and that he wanted me to come in as kind of a a full-time new hire in their they called it Enterprise Risk Solutions but that's kind of their um fancy word for internal audit practice so I started there as an internal audit consultant that'll be about six years ago in July of 2023 so so been there for about six years I've been working only in internal audit Consulting during that entire time um and uh for about a year ago bkd did a merger with a simile similarly sized firm called dhg and since they merged firms they wanted to get rid of the old names um and they changed their name to forvis which is a combination of forward and vision um so they kind of made up their own word like FedEx and so our internal audit practice more than doubled in size and geography as a result of that merger which is really exciting for me I get to work with all kinds of new people and different kinds of clients and so I'm currently a manager in that internal audit practice and we help clients with outsourced and co-sourced internal audit activities a lot of our clients at the size of our firm are mid or small size clients so they don't a lot of time have the staff or support that they need to complete everything on their internal audit plan where they may not have an internal audit department at all so they outsourced that or like we call it co-sourcing when they have an existing department but they maybe need additional resources maybe they don't have the right amount of staff or maybe they don't have the right expertise so we will actually go in there and perform internal audits on behalf of the client so it's kind of like a situation where I don't ever know what I'm Who I'm working for you know I work for four of us but then I'm actually a an internal auditor at this company and maybe you're working for their external Auditors or doing something for their regulator so it's a lot of that I get really major benefits from working at a firm I still think I'm early in my career even though they call me a manager here but um I get exposure to a lot of different kinds of clients a lot of different kinds of Industries a lot of internal audit professionals everybody I've kind of found everybody kind of does everything a little differently so there's not one way to go through and do an internal audit and I get a lot of exposure to different highly ranked individuals both in internal audit and c-suite people at companies to talk about risks and talk about areas um that you know where they're doing well where they're not doing well and I just get a lot of that from this career so that's kind of what's what's kept me here at this firm is I never get to do the same thing twice and I never really know what's going to happen next so it's kind of always exciting and that's also one something I want to impart to everybody is a lot of times sometimes they make it seem like you know you're getting a professional accounting degree you can go into audit or you can go into tax but um people think you need to do those for a long time before you can go go into areas like Consulting but there's professional high-ranked Consultants that need help too so just like me you can come straight out of college and work in Consulting if you can identify those opportunities and identify where you can help people with with what they're doing so don't ever think that Consulting is something that happens later sometimes you can be brought in straight out of college to do that so that's kind of a little bit about myself is there anything else that you wanted to do to go on uh Professor Joe I want to say thank you Sam because like literally that was probably the most valuable 10 I don't even know if that was how many minutes that was but you just gave so many brilliant pointers and plugs and thank you for that I was writing things down um you know obviously thank you for plugging the master's program a lot of the students watching this might be undergrad and thinking about it so I think that's great um the career services at MSU so c2hub go see them I think that's such a brilliant resource that we have um and then of course we're plugging my internal audit projects class which is now called risk assurance and advisory engagements so much like you said Enterprise Risk Solutions is what um I believe is that what it's called now so they actually just change it to internal audits so we're called the internal audit practice so it's easy for people to understand what we do well see now we've been we've been obviously talking about that at MSU and we went with this kind of fancy we wanted to use the word risk because I think that's a lot of of what um in the real world we're doing now and um the students actually watched a previous video with um Peter Shell at DaVita and they renamed their group Enterprise risk Services you know out of internal audit so I think we're seeing a lot of that so I liked that you mentioned that um and just your past thank you for for sharing all of that I think it shows that um you don't you can be non-traditional you can go in and out of fields and you can start over at any point in your in your life and so even students watching this didn't think they want to do external audit or tax just knowing that internal audit is another option out there one day uh is just great so um and I also love that you talked about how you get to do what we're about to talk about at many different clients so unlike some of the professionals that I've been having these interviews or conversation with um you know you get a lot of exposure to planning which is what we're going to talk about so um talk to us first about the importance of planning and engagement and I'm sure this is even more critical for you coming in is almost like I'm going to say an outsider although you obviously do your research and you know about the clients that you're going to work on but you probably have to do some pretty good planning when you start off so kind of talk to us about why we spend time in this and why it's important yeah I I kind of see planning is so critical that I don't like to differentiate it from tasks in an intern you know I don't know it's if that's a good way to say it but it's almost like planning should really be a part of everything you're doing and it's not like its own separate um task that you start with at the beginning so um right I mean when we talk about planning you're going to be maybe changing and looking at different things throughout so when we talk about agile auditing absolutely that'll be a module you know down the road the students will probably understand more of what that means from a textbook perspective they like to separate it out right but yeah I totally get what you're saying there yeah yeah so we've when I started here planning was you were you were we we track our our Audits and our engagements very strictly when it comes to hours because we're a consulting firm so that's what we sell is our time that's our inventory um we were usually given like 10 to 10 5 or 10 percent maybe of the budget should go towards planning activities and when I think of planning activities I'm thinking of um what are you going to audit how are you going to audit what are who are you going to talk to what's going to be included those kind of things that was usually something that was like they gave us a little bit of time to write out a scope document and that was it as we've tried to move to more of that agile um agile auditing way of thinking which I've seen a lot of our new incoming directors and managing partners and that kind of thing that have come in here um have been pushing towards is we're now spending at a minimum something like 25 percent of our time on what I would call planning tasks um and I think that the importance of planning is so important because it's real the whole overarching thing that we're trying to do here as a as internal Auditors is to add value and it is really impossible to add value if you don't take the time to learn and plan about where you can add value um so if if you're coming into an internal audit for the for the first time you can't just like brainstorm what areas you're going to audit and have a scope document developed without any input from who you're auditing or um or your client or your Oddity I'll kind of use those words um interchangeably as I go sometimes you're auditing for a client like if you work at a firm like I am or if you're internal edit at a company an internal audit Department your Oddity is really your client or your your company you work for is kind of your client so we really need to learn about these processes that you're auditing the specific circumstances of the control environment of your Oddity and what they see as those risks like we talk about Enterprise risk we talk about that word risk a lot um so this means you have to have kind of many conversations to learn about policies processes procedures and really most importantly the risks of the areas that you're auditing before you can decide on what your scope should be or where you can add value um so that that a lot of times we think okay we're going to do our planning have our scope document and then we're going to do our walkthroughs I try to push that planning as far as I can like if I can push that planning until right before I issue the report I think that's great the the MSU Denver audit that we did we were assigned to do an audit on commencement spending so the commencement is the sort of is the graduation ceremony um so like we were going to do an audit over how they're budgeting and spending dollars towards that commencement ceremony we went to the commencement committee we had some interviews we realized that we weren't going to add a whole lot of value in that process so the VP in finance and my professor at the time um pivoted us completely away from and they said as we were talking everybody they kept talking about well we keep hearing these stories about people who are close to graduating and not graduating and we have no idea how many people that is um and how we're tracking that data so we changed it from commencement spending to how they're tracking graduation performance overall which is kind of a whole big objective of the university and and that was kind of where it really got interesting if we kept with commencement and just went down our area we wouldn't really add much value so that's kind of an example of how that planning can in that scoping can change as you go and how important it is at adding value I don't know if that answers that question or not it does completely and what a great example of that I know my University Auditors last semester they they were looking at University advancement so the foundation and how they collect donations and we started with you know oh let's look at monthly recurring payments and how we can get more of those well that's a pretty automated process and how they they get those and then well then we ended up on um you know pledges and and so it shifts right as you get it and you talk to them you look at where the risks are that is when that scope can change and I think I just want to talk about that word scope for a little bit um I look at it as a lot of organizations at least in my experience they actually even write in objectives in a scope memo maybe at the beginning is that something that you all do or what does that look like for your clients or does it change per client I think that's another kind of thing that can be very unique to wherever you know whatever internal audit Department you're looking at right or working with yeah in my in my experience is I've heard different things from different people who come from working at a company versus working at a consulting firm so since we work at a consulting firm um the lawyers and the risk management people at our firm want to make sure that everything we do is clearly stated and clearly agreed to before we do it um so what that means in practice from an internal audit point of view is we do have to have a scope memo we call it like a scope letter or a scope document that's separate from our engagement contract that has all the terms and conditions that come with our engagement this is like an add-on to that contract to say okay here's here's the object in the way that it flows is it goes objective what we're what we're planning to help the company with or the client with and then the scope what areas are are included and excluded from our air from our procedures and then how we're going to achieve our objective which is really the procedures so it kind of flows through from objective scope and then to procedures is what our managing partner is expecting to see and this becomes a contract document that gets reviewed and approved through our managing partner and then also through our quality control team so what they actually do is we have to get a signed scope letter and again I push that sign scope letter as far down the audit as I can so I can try to capture as much areas that would add value to the client as possible in that scope and then the procedures that will actually add value to which often you don't understand until you've done a lot of walkthroughs and a lot of interviews but we get that scope document we get it signed by the client and then what's on that scope document has to agree to what we say in our report that we did so our report has a scope procedure section as well and we have we call it eqr engagement quality review they come in there's a separate person who's like director level who comes in and reviews our report and makes sure that the report wording they review a lot of things but one of the things they look for is the wording of those procedures in that report matches exactly to what our science scope letter is um so it's really just a way that we can fence in what we're doing one of the big risks that we're also trying to alleviate with that scope document is this concept of scope creep a lot of times once you start interviewing folks they kind of see you as like an internal audit therapist or something where they just unload like their problems on you about whatever so you'll get a lot of situations where people want to talk about something over here but it's not necessarily in your in your scope um so that so having a clear document that's agreed to by the client on what we're auditing helps us prevent you know situations where they're they're either trying to get us to go into a different area or just have problems with a different area and maybe that should be something that's on a future audit or something else but the scope document really helps us stay within us within our you know within our lines of what we're what we've been agreed to do and it's usually something that I reference often as we go through an audit if you're if you're assigned to something that's an internal audit you should try to get that scope document and it's kind of like your best friend that you keep next to you as you go through is and you're kind of asking yourself is this something that's in our scope or outside of our scope and kind of seeking help when needed to uh um see if that scope should change or if what they're asking us to do is within the scope um it's always great to seek as much guidance as you can on that so yeah exactly how they introduced scope creep because we definitely talk about that in performing an engagement next because that is something that I know happens a lot and even at the new CFO at MSU told the students the student Auditors that last semester just watch out for scope creep that was his one uh point of of um advice I guess so I love that you mentioned that I think that how kind of um structured you all do the scoping process is actually something probably a lot of internal audit departments could use some structure and how they do it honestly um I'd say you know to students it's very similar in my experience when you're working for a company it's just probably a little more laid back it's not as contracty right you're not getting the legal department involved in those kind of things so obviously with the Professional Services or consulting firms like Sam's at um that scope memos is critical to being paid at the end of the day and those kind of things for us we just want to make sure it's more of of a um it's it's Rapport right it's trust it's making sure what we put in that scoping and objectives memo is what we do at the end of the day or we're very very communicative about why we're changing it and so I think you know in the in the internal audit the traditional internal audit sense that's probably the main difference there it's more about communication than than a contract change um so you mentioned obviously you like to do as many like kind of walk-throughs I like I used to call them kickoff meetings but I agree a couple even after that you need to have some walkthroughs to really make sure you've got that scope in line and you know what you want to look at what else do you use as a resource when you're planning um just as an example the students have already talked about uh risks and controls so they've heard this term a risk control Matrix which is sometimes I know um what I've looked at in planning and engagement I know I've done some surveys to get some to gather some data at the beginning anything else come to your mind or examples that you could provide yeah um a lot of times you're auditing something you have no idea about um so maybe it's uh I just did one for a Healthcare company on exclusion screening so it's this this process where they screen their providers and their vendors to make sure that they haven't hit on any bad lists that make it so they can't get reimbursed from like Medicare or something I had no idea what exclusion screening was when I started this so um doing some just Googling around to figure out what a regular kind of process like exclusion screening process looks like what are typical best practices and controls getting familiar with that but you don't need to be an expert on that process and and when you're with your with your Oddities you don't want to try to come across as an expert in anything either they're the experts in the process but we're experts in internal controls and and Performing these audits so we can still add a lot of value so just Googling around I like to Google for existing audit reports that are out there it's okay to cheat them little bit especially with these government audits we work with a lot of government clients it's likely if a government is asking you to complete an audit of an area that there's an a readily available audit report that's out there from the same area don't rely on those too much but they can give you a lot of really good ideas for potential areas of scope and potential things that you can do and then the resource that's their most important resource is the people you work with as you're getting started asking a lot of questions for people that are really busy like directors and managers challenge them to give you their insights on on these processes and then I we have such a big firm here that there's usually like a subject matter expert we just did one on leasing like how this this company that um leases a bunch of their buildings out so we actually had a an expert of in in leasing um out of one of our offices that we had a call with as we were planning to say okay what are some general controls and areas that we should be doing I like Google Alerts if you for your clients and for your Oddities you should always have Google alerts set up so that you know what's going on big major news stories that are coming out in those areas um uh and then the big big I think you know doing things like flow charts or two I think the risk and control matrices are great are great those are important things to do but drawing out a flow chart of your processes if they don't already have one which a lot of times they won't so once you kind of hear what their process is how they expect things to be done um drawing out a flow chart having them agree to it is a really good way to kind of find gaps and issues um that that are really prevalent when you see okay there's no controls here um as this process moves and or I can see that this process is being completed all by one person and there's no segregation of Duty so flow charts and infographics and all that stuff can be built into your report too and kind of provide backgrounds so developing those as you're going through these interviews and that kind of thing is are great resources to use alongside their policies procedures and all those kinds of things I'll be reviewing before we get started with our with our engagement and then data too trying to do some data analytics if you can if you can get data on transactions or whatever in the area that you're auditing and start looking at Trends asking questions about Trends trying to identify situ you know we there's a whole other data analytics class that's at MSU Denver that I could do I could give a 30 minute plug on that Adam with his class I've used more stuff from that data analyst class in my career than any other class that I've you know maybe entered a lot of projects is closed but um yeah that's kind of what I'll say as kind of resources I use when I start audits to try to figure out how to get started um it's also really important to understand your role on the engagement a lot of times they won't spell that out for you so understanding what your role is and maybe making sure to ask about that as well as your expectations and your guidelines or deadlines excuse me not guidelines are really important things to ask for at the beginning of that engagement too yeah I I love your full list I mean literally you you pretty much hit just the real world and the textbook definition of what planning is process mapping so flow charting definitely good um that analytics like you said you know getting policies procedures any narratives that they already have around their process I I always ask Auditors all jokes like what's the first step everybody does it's typically asked for uh policies procedures or asking for like all of last year's data right so you can do some some analytics and Trends so I think those are some common things I see and you can see also as as Sam's talking all of this stuff that we do during planning it's really going to start overlapping with performing right so uh we're about to in the next module talk about okay when do you really start performing you really already started that if you've gotten data analytics and you've gotten you know done some sorting and pivot tables and you see some outliers you might now know exactly what you're going to test right so it's really the this preparation into the next step if not already starting the next step right um so I love that um anything else you want to share with the students you've got given them some great advice already I've been asking the professionals you know if they could talk to their younger selves or back when they were in college anything you would change or do differently anything else Sam on your side um you know we talked about in the beginning uh careers change it's a journey to figure out what you want to do versus what you're good at what you think you're good at but first is what you're actually good at all these things are really challenging as you explore where you want to go in your career um and like you said you can always pivot just like you can pivot your audit into your internal audit you can always pivot what's going to happen in your career and um I don't know just just trying to to to figure out what that is the journey it's really difficult so don't think that you need to have it all figured out you know if you're an undergrad don't feel pressured it'd be like oh I need to figure this out before I graduate try things out go do as many of these internal audit engagements as you can if this is something you're interested in um see what you like and I also liked what you said about building trust I think building trust is one of the most challenging things we can do especially as young internal Auditors is to go into a process and have somebody that's been doing this for 30 years you know actually audit them and I think that really challenging and I think a big part about building trust is laying out what you're doing in this planning phase of making sure that the Oddity knows what's going to happen making sure that they know what the audit process is going to be and then when you report findings knowing that they won't be surprised about any of those findings because you've already discussed them with them and um that's that's one thing that I used to work with Charlie Wright who's the chairperson of the IIA or used to be the chairperson of the IIA Global um and his big thing that he said when he started engagements with clients was is that um you know he made this big speech about promises and how he doesn't promise his wife anything even and but he wanted to promise whoever he was auditing that there won't be any surprises once they get to the end of it so that's a big that goes a big way towards making this more of a collaborative thing and less like a gotcha kind of audit which you don't want to you don't want to get clients to think that you're going to try to get you're out to get them um so trying to build trust and make sure they know the process make sure they know they're going to get to review everything before it becomes part of your report is a big part of building that trust and that collaborative environment for the audit to thrive in yeah I love that and though and I think I've even said this on previous interviews but transparency right is the word that just keeps coming to my mind and transparency equals trust a lot of times even if it's vulnerability that you're showing to a client and you know asking those questions that you might feel like are dumb questions you know it's it's just being vulnerable and transparent to me so well Sam I greatly appreciate your time I think you've imparted a lot of wisdom uh on the students both personally and professionally and thanks for joining us for this interview thanks for having me I appreciate it