Global Insights on Internal Audit, Risk Culture, and Third Party Accountability

In this episode of The Third Party Risk Institute Podcast, we sit down with Shagen Ganason, Group Chief Auditor at Liva Group, to explore the evolving role of internal audit, the impact of regulatory diversity, and why third-party accountability can never be outsourced. With over 30 years of leadership experience across insurance, banking, aviation, manufacturing, and the public sector, and having worked in seven countries, Shagen brings a rare global perspective to audit, risk, and governance.

Drawing on his books The Storyteller’s Ledger and The Auditor’s Secret Weapon, Shagen shares how communication, storytelling, and cultural adaptability are becoming essential skills for auditors and risk leaders. He also highlights why regulators in regions like the GCC are moving fast on cybersecurity, outsourcing oversight, and financial crime risks, and what that means for boards and executives.

What we cover in this episode:
• The three dimensions of modern internal audit: assurance, advisory, and strategic oversight
• How principles-based vs. prescriptive regulations shape audit and compliance practices across countries
• Building resilience through risk culture, and why it looks different in New Zealand, Korea, and the Middle East
• The link between risk appetite and corporate strategy, and how boards translate it into actionable decisions
• Concentration risk, fourth-party dependencies, and why cloud reliance creates hidden exposures
• Why accountability for third-party risk can never be outsourced, and how boards and auditors should address it

You’ll walk away with practical guidance on:
• Communicating audit findings through storytelling that sticks and drives action
• Aligning audit plans with organizational strategy and risk appetite
• Building credibility and independence while maintaining strong business relationships
• Understanding how regulatory diversity and cultural context influence governance effectiveness

This episode is perfect for:
• Chief Audit Executives, CROs, and Board Members
• Internal Audit, Compliance, and Risk Professionals
• Procurement and Vendor Risk Leaders facing regulatory scrutiny
• Anyone looking to strengthen their understanding of risk culture, assurance, and third-party accountability

🎧 Enjoying the podcast?
Explore more resources, expert insights, and certification programs at www.thirdpartyriskinstitute.com

📱 Follow us on LinkedIn for real-world conversations and industry trends: Third Party Risk Institute Ltd.

📬 Have a question or topic you'd like us to cover?
Email us at: info@thirdpartyriskinstitute.com

Chapters

• 0:00 Introduction
• 2:25 What a Group Chief Auditor Does
• 6:22 Navigating Global Regulations
• 12:29 Building Risk Culture Across Borders
• 16:08 Storytelling as an Auditor’s Secret Weapon
• 24:26 Defining Risk Appetite
• 29:42 Linking Audit to Strategy
• 33:23 Independence, Relationships, and the Seat at the Table
• 38:58 Reporting Lines and Governance Models
• 44:11 From Challenge to High-Risk Decisions
• 46:19 Concentration, Cyber, and Fourth-Party Risk
• 51:15 Final Advice: Accountability Cannot Be Outsourced