57. Michael Drechnowicz, Head of Internal Audit, TK Elevator

Embracing Internal Audit Evolution: A Conversation with Michael Drechnowicz, Head of Internal Audit at TK Elevator

In this episode, Michael shares his insights on the evolution of IA in his role as Head of Internal Audit with a major player in the global elevator and escalator industry. 

His work demonstrates a shift from traditional finance-focus towards extensive business process coverage, ranging from sales to purchasing and fraud investigations. 

We discuss the increasing importance of diversity in global audit teams and how technology, particularly Artificial Intelligence (AI) and data analytics, are transforming internal audit processes. 

The conversation further touches on AI's importance in identifying and managing risks, improving process efficiency, and augmenting the learning experiences of junior auditors. 

Looking ahead, Michael sees a promising and dynamic future for internal auditors amidst rapid digital transformation.

About this podcast
The podcast for performance auditors and internal auditors that use (or want to use) data.
Hosted by Conor McGarrity and Yusuf Moolla.
Produced by Risk Insights (riskinsights.com.au).

Transcript

Yusuf: 0:00

Hello and welcome to The Assurance Show. today we have a special guest, Michael from TK Elevator. Michael, I am not going to try to pronounce your surname, so I'm going to leave that for you. Michael, welcome to the show.

Michael: 0:14

Thank you Yusuf, thanks for inviting me and I get it a lot with my last name. So it's not even worth mentioning, I guess Michael is completely fine.

Yusuf: 0:24

Thanks for coming on the show, Michael. Really interested in understanding, your background, and a bit about the organization that you work for as well.

Michael: 0:32

I currently work as the head of internal audit at TK Elevator. PrIor to this, I worked quite some time at DHL, also in the internal audit area, mainly in the finance audit area. And prior to that, a few months in the company, I was studying and learning ThyssenKrupp Steel in the accounting. So I have mainly a finance and accounting background, but since I switched to TK elevator it's much more than about finance. We are covering every business process, from sales to purchasing we also do a lot of fraud investigations. So really the entire process is A to Z, we are covering with our internal audit team. And, we have a team of about 16 auditors, all around the world. We have offices in South America and Asia Pacific. In Europe, and we try to cover the around 100 entities we have in our company. And of course we also do some functional audits, which are not based on entities, but also based on our functional structure. We also have advisory projects in the area of lecture service centers. during implementation. So my finance background was definitely extended in the last four and a half years at TK elevator, which is great, which is very interesting. Personally. My parents are from Poland, so I speak Polish, German, English, and that's also where this difficult surname comes from.

Yusuf: 2:07

Talking about multiple countries, you said you operate in over a hundred countries. Of course, everybody at some point would have stepped into a TK elevator or maybe uses it two, three times a week when they go into the office, jumping into an elevator that was provided by yourselves. And you know, 50, 000 employees across the globe. But what was really interesting is you mentioned that your team, so you said you have a team of 16 auditors, but 10 nationalities. So a lot of diversity just in that itself. Do you want to talk a little bit about your thoughts on DEI and what that has looked like within your team?

Michael: 2:42

Yeah, I think diversity is extremely important, especially when you do audits in different countries. You also have to somehow ensure that there is some sort of cultural fit as well. I would say currently we are female dominant in the team. And we can also see it on the market to be honest, because we are currently recruiting. And I would say 80 percent of the people we are actually inviting to interviews, or the headhunters give to us, are female. So I can sense some sort of change in this, because I remember every time a new colleague came, I would say it was 60-70 percent male probably. But I can see definitely some sort of switch I think this is great because maybe internal audit in the past was seen as a male job because of the traveling. beCause of the stigma say that this is definitely not the case. We have also many, many female colleagues with kids. And we just try to be very, very flexible for them when it comes to traveling. So instead of saying you have to travel in this particular two weeks we very early ask them what the best week is. Of course, there are sometimes ad hoc investigations or audits. Where you need the flexibility but we always try to be flexible and yeah, due to the fact that we have strong markets also in China, for instance, so we have also an office, in China with, colleagues from China as well. But also in our European teams, we have really different kinds of nationalities and we almost do not speak German, so all of our repos are in English as well, even though we are a German company coming from ThyssenKrupp. So it's extremely important and it's also, I think, value adding and everybody grows personally because if you did not have all of these different nationalities, you would miss all of these conversations and aha and wow moments when people talk about how they see things how their culture is. And yeah, it also creates a great spirit I would say. And just great to see it.

Yusuf: 4:51

Excellent. So Michael, what is it that brought you into internal audit? Like why, explore a career in internal audit? Obviously there's links to accounting, but what specifically about IA attracted you?

Michael: 5:05

Definitely the dynamics of this job. So I always tell people who don't know what internal audit is about, that you wake up having a look into financial figures. Then before lunch, you look into IT topics. Then after lunch, you finalize maybe a fraud investigation. And then at the very end, you look how to make sales processes more efficient. So I would say that an internal auditor is the employee who knows the company the best. It's definitely nothing for someone who likes to to do always the same or repeat the task. It's definitely for people who, yeah, enjoy being challenged every day with new topics. And it's, and it's difficult. I mean, new joiners always very often struggle because in the end, sometimes in a very short time frame, you have to be able to challenge people who work in an area for 10, 20 years and you just started like two weeks of preparation and you need to tell this person who already works 10, 20 years on a topic how to improve or how he or she can improve. And this is challenging. This is also nice because you can see that if you really allow yourself to go into this process and really think about it, that people will actually appreciate this outside perspective. And I think that from my perspective, the dynamics of this job, it's really great. It is also challenging from a travel perspective, of course. Even though now more and more can be done remotely, of course, the COVID times showed us that some things just can be done remotely, but if you talk about operational audits, if you want to go to the guys in the factory, you just have to be on site. And this is not always easy because it requires two weeks outside of your family when you have family. And then, in our case there are people who really enjoy also the fraud investigation team because you really feel sometimes like an agent, I would say, but some people just enjoy more to have a more regular working life, meaning regular audits, six weeks, then the next one for six weeks, So they can really plan better the private life as well.

Yusuf: 7:24

Fantastic. Michael, you, you use data a lot in your audits. and you've been encouraging broader use of data. What is it about using data that makes the audit better? And how did you get into that as a team?

Michael: 7:41

The general thought of using data analytics is about giving more assurance to the management and also to understand really the processes completely. So in the past auditors tend to do a lot of sampling. So for instance, we selected 10 invoices. Which was sent to the customer and five of these invoices were incorrect or five of these invoices were only sent after two weeks instead of directly after the service was provided. With data analytics, you don't do these statements anymore. You just tell the management that 20 percent of our invoices with a value of millions of euros to you. We're sent too late, so our cash flow was impaired by X days. And then of course we do sampling to verify the data analytics efforts we had. Because also data is not always 100 percent or does not always give the opportunity to be interpreted 100 percent correct. So is, this is a big game changer because you really can not only improve the security of processes, but also the efficiency. So so what we always do also is we have a look into the whole picture, like how fast we do things, how fast do we issue invoices or how many invoice cancellations that you have. Otherwise in sampling, you would only give an idea And then you would extrapolate it, but everybody knows that when you extrapolate, room of error is very high. Because you could test a very bad choice in the sampling and have like nine incorrect samples, 90%, but it doesn't mean that your entire population is incorrect or 90 percent of it. So I would say that this is the main reason why we went into this approach. So you will see only very few findings which are based on the few samples. You would usually see findings which really say, for instance, 20 percent of our vendor invoices did not have a relating PO, which on the one side shows you that a process would be very insecure because you didn't use purchase orders and you didn't follow the process. On the other side you also, let's say, see the complete extent of it. So you know that, okay, 20 percent of my purchasing process is actually at risk. And we didn't follow it. Otherwise, in sampling, you always get into discussions with auditors where, Ah, but it's because you just took the wrong sample. No it's 20%. And you can see since when you're using data analytics, all findings speced up by data analytics usually are not discussed, are not disputed. The ones which are disputed the most are the sample ones. So this makes also, let's say, the definition of measures very easy because everybody can see that it's actually the case and it's in the data. So I think it's, first of all. Perhaps also to give to the management a very good overview about the entire process maturity, security, and efficiency. And on the other side, it also reduces, in the end, the work, the post audit work, with discussions, with with measure implementation. And then also the room of error of measure is quite low, because if you do measures or action items based on a sample, it doesn't mean that these measures will really be effective because you actually don't know about the extrapolated piece of it. So I would say that yeah, this also makes it much more efficient to, to have a concrete measure and to have really effective measures in the end.

Yusuf: 11:28

And that accuracy is important for German stakeholders. I remember traveling from Berlin to Dusseldorf with my wife after a NIME conference a few years ago, and it was either a two hour trip or four hour trip, I can't remember on the Dr. Bantrain, and a few minutes into the journey the conductor comes on and apologizes profusely for the delay. And we thought, oh, here we go, you know, it's going to be a long time before we get there. And the delay that he was apologizing for was two minutes, right? Two minutes. Oh, I'm really sorry, we're going to be late by two minutes. You know, and apologizing so much that, like I said, we thought it's going to be a long time and it ended up being two minutes and my wife and I just laughed because that's, ridiculous. So that, that's the level of precision , that you're looking for. And obviously data helps, with getting to that , with those sorts of stakeholders. Yeah.

Michael: 12:15

I think probably, and this is also about culture, I think one of the first things someone would tell you about Germans, I would say people think that we always like to be on time. We probably do more than other cultures maybe. But I think it's also driven by this because you have very often also people complaining about one or two minute delays. So that's probably also why, the conductors are trained to even apologize for such, for such a small delay.

Yusuf: 12:49

Not many other places. I mean, I'm in Australia and I catch a bus into work every day. Buses here are quite good, but you know, a 10 minute delay is, normal and there's no, it's just, it's just, it's just accepted. There's no, there's no problem with it. Um, you've been using KNIME and obviously, was born 600 or so kilometers south of, where you are right now. What is it that, attracted you to KNIME and how do you use it within the team?

Michael: 13:15

When we decided to go for KNILE, we were actually convinced of, let's say, the multidimensional use of it. So of course it is a data analytics tool where you can process a lot of data, where you can analyze a lot of data but you can use it also, for instance, for process automation. So you can use it in order to always create the same reports, always to update the same SharePoint site, which otherwise a team member would have to do and you can also use it as a working paper. Because you have all, all of these, let's say, knots which are connected and then you can just use annotations and say this is my database extracted from, from SAP or whatever system. This is the first audit step I did and this is how the data came out. And then at the end you have your result. So if you use KNIME completely, then you also get rid of preparing work or extra working papers. Because you can have everything in your online project and it's even easier for an external party. So if you have a quality audit by an external party on your internal audit department. Then there will be probably not so many questions anymore when it comes to traceability of findings mainly. Because you have everything in one place and it's clear which kind of data you use. It's clear that you reconcile the data with the system so that you can also ensure completeness and accuracy. So I think these three dimensional, I would call it, use of KNIME, really convinced us. And then we also really enjoy the portal of KNIME, where you can ask questions, where also other people share their use cases or their issues, and then there are discussions. So it was also very often the case that based on the discussions there with people, didn't even have to, let's say, join the discussion already discussions which happened one year, one week, one month before the problem arised for me, I could see, okay, someone had this problem already and I can now make use of it and it was always helpful. So that's why we went for KNIME and I think that we are now also having the plan to use it more and more and more. So that's, let's say our strategy when it comes to, to the data analytics tool. Yeah,

Yusuf: 15:38

obviously a lot of what we do, we have an objective in mind and we're looking to do, specific things, but, just understanding how different people have tackled different problems or even that they can, is interesting because we don't always know, what we don't know in terms of natural language processing or even some of the machine learning techniques and just how, frankly, just how easy it is when you pick up a low-code tool like KNIME Beyond that, within your team, or maybe even more broadly for internal audit, what do you think the future for data, for technology, AI use will be within internal audit practices?

Michael: 16:16

I think AI is already a big part of our work probably, or should be already a big part of it because with, with AI and I know that some companies already go into this direction. We are also now going into this direction to use ai for instance to create report. So there are different, different solutions. Of course, you, due to the criticality of the data and the statements you do in the report, you need ai, which does not share this information to improve. The same AI. So there are already, let's say, company solutions where the data just remains within your company. You can still use, for instance, ShareGPT, but you will have a version which does not share the information you input there, like if you do it privately. So the chat GPT would not use the internal information you put in there to improve the product. So I think this is extremely important because sometimes we really have very sensitive and strictly confidential information. buT I do think also and I was A few weeks ago I was on the Congress in Poland in and the Institute of Internal Auditors of Poland. And we had a very interesting session also hosted by the ARC, the Audit Research Center. And we were talking also about audited the metaverse and new ways of of learning. And one thing which is actually very interesting in and I think education is also extremely important in development. It's one of the IIA standards that you have to regularly train your employees. And I think it, it goes into the direction that it's called serious business games. I was it's called. So you actually learn by playing a game and I think especially now the new generation do really enjoy it. So and we also learned about ways how to make remote meetings also with auditors much more real, let's say, so you would be like in a virtual room where people would see each other. Some companies even use holograms, as I learned, so it's completely like a science fiction movie, I would say. But I do think that one thing how to maybe make it more digital to make people learn and educate themselves. The other one is definitely to automate. Parts of the process which can be automated because you, as of now, I don't see how you can automate, for instance, someone going on an investigation and trying to get information out of whistleblowers or whoever. I think this is still, of course, something a human being has to do. But then how you use the data and how you process the data, definitely we want to go into the direction of AI. And to give you a very good example, in investigation, you also have a look into chat protocols, and you have a lot of them. So sometimes you maybe talk about 100 chats of one individual, because this individual has contact with a lot of people in the company. Thank you. And then you don't want to go through all the 100 of them, you want to identify which are the chats, which are relevant for you, where are the red flags. So, if you would put pieces of this chat into chat gpt, then chat gpt would also be able to tell you that in one chat protocol the relationship seems to be more private, and the other one very distant, there is a lot of distance, and professional. And I, I did some cases of it where I just created a fake chat, of course, not with real data, but the fake chat. And it was quite accurate the assumptions JetGPT had. So you can also, let's say, do these very, very subjective assessments by JetGPT. And it helps you at least, maybe not to identify everything, but to focus primarily on, on the first three or four chats. Which already take a lot of time. So also in this data processing activities, this could be of interest. And this is something we are currently exploring because it would make our process much, much more efficient.

Yusuf: 20:42

Okay, so you're using AI to help you sift through the various types of conversations to find those that you need to focus on and then a human will go in and actually focus on that and understand exactly what's going on.

Michael: 20:56

this is the plan. We are not quite there yet. I mean, it requires also a lot I mean, to ensure that the data is really safe and so on. But based on fictitious cases I could already see that this will be actually helpful. So now we, we made the decision that we want to go in this direction. Because it's quite amazing how accurate the assumption of chat GPT was. Which chat is more of relevant in terms of personal relationship, for instance, with the supplier or with another decision maker?

Yusuf: 21:29

So the question then is, you cutting out work that often more junior auditors would learn from. What does that do in terms of the learning experience and the learning journey for those younger auditors that are, starting out in , their career?

Michael: 21:47

good question. I mean, you, get that a lot. there are, of course, sometimes concern from people who then think that their job will be cut because AI is taking over. But for us, to be honest we already automated some of the processes. And it's the same, like if you implement an audit management system, then you don't need so much resources anymore. In terms of maintaining different data sets, to put them together so also in our management system, we'll always reduce, your SG& A effort, I would say. But what we always do is we then assign people to, to more complex tasks where they can learn. I mean, instead of going through a chat and then tell the senior which chats from his or her perspective is more interesting the junior auditor can then use the chats suggested by ChatGPT, go already through them, and then make already suggestions to the senior, okay, I see here this and this indication, or maybe even I have the evidence, which we were looking for. So instead of using the time to go through the 100 chats and then identifying what could be interesting or relevant for the senior he or she can just go directly in the chat suggested by the chat GCT and then say, okay, please pay attention, especially on page two 100, because this seems to be very interesting, very suspicious. So, it's not about, I think, cutting the work and learning experience of juniors, it's probably more to already give them some more complex and more content related work, because what you get a lot also from working students, and I think the working students that we always had and have, they are the best example for it. You don't use the working students anymore to create Excel, of course, as well. This is also part of the job because you don't want a senior manager to, to do this work. But we have already cases where let's say a working student maybe contributed 50 percent to an audit, which requires mainly data analytics. So that the senior just went through it, confirmed it's okay. So in the end you can see also the new generation coming in. They also probably want more complex topics at the beginning. They get maybe even bored. quicker than maybe we did in the past because they already grow up with this very efficient AI solutions, with the very efficient systems and so on. So, I think that this is also important now for the new generation to give them complex tasks from the very beginning, which maybe do not require experience in this area, but which require the knowledge how to use AI, how to use different systems. And this is something they learn quite early. So I think that this actually will help to attract talent when you say, okay, listen, we use AI and this is how we use it instead of, okay, you will have to go through 100 chats manually. I think that like this, we will not be able to attract talent anymore and it's already very competitive market for talent.

Yusuf: 25:02

That's really interesting. I hadn't really had that, perspective explained and that's, it makes a lot of sense. So might. Elevate the work that internal auditors do and particularly coming in. So the quality of internal audit might actually just end up going up

Michael: 25:18

Yeah, I do think so. And I think also that you will be able to cover more risk because currently when you do an annual audit plan, you have a certain percentage of your manpower assigned to administrative tasks. So to maintain a database or to even do this work, which is required to go through chat, to go through emails or to go through documents. But if you reduce it already by, I don't know, 10 10 percentage points go to the real audit work and then you cover maybe one or two entities more and then your risk score is also higher. and then you can provide even more assurance to the management. So of course there is always the perception that, okay, now we can cut resources because we are automated. The other way is to say, okay, now we can use this safe time to even add more risk coverage into our audit plan or to even have whistleblower cases or fraud investigation cases. Faster or even more than we already do. So, there are, I think, two perspectives to it, and definitely the, the second one, I think, is the one where probably every audit department wants to go, but then, of course, it also depends on the company environment and, and how the company is currently performing. But I would see it rather from, from this perspective.

Yusuf: 26:42

Fantastic. So that's, for juniors. And just wanted to switch very quickly to, you know, for experienced auditors. You and I have been doing this for many, many years, or maybe intermediate auditors who've been around for five to 10 years. What do you think the learning curve is like? is it very steep? Is there a lot of time that's going to have to be spent over the next few years getting people up to speed that have been doing things in a particular way? Cause it's always harder to break, established habits and patterns than it is to learn something brand new for the first time, right?

Michael: 27:11

I definitely agree. So if you have people who work for 15 to 20 years in the sampling method, In this okay, I interviewed the auditee and generate my findings already through the interview. Then I just take a sample to confirm my interview findings, so to say. So then it's definitely more difficult for someone to get into this data analytic approach to get into AI. While people who just start with internal audit, and it's not only the juniors or the people who just come from university, you also see when someone from inside the company with already 10 to 15 years experience department. And we have it quite often because we also want of course, internal experts who then come to our department. Then for them, it's also then much easier to learn and adapt this approach. We have then by someone who was working, let's say 10 to 20 years in another audit department, only doing sampling and not really going into this level of detail. It's very, very difficult for them to learn it, but it's of course not with all people. I think in general human beings have sometimes problems with change or it's definitely more inconvenient to change your approach, of course. But what I experienced is that when you can really show the people that it's actually worth it, and then also if you have the feedback from the auditee. And then also when experienced auditors come to me and say, okay, how much do you discuss with your auditors? I say, not so much. I mean, it depends on the timing, but if you have a data analytics and if you have let's say statement on the entire population, you don't discuss so much. And this is also what motivates them that the work is appreciated. And that they don't have a lot of room for error in discussions. And I think that this is something which motivates them as well. But I think with every human being, not only in internal audit, but in general, when you do something for 20 years, of course, it takes some time to a new approach. But my experience, at least in our company we had always good and positive cases where people adapted quite quickly. But it didn't happen overnight definitely. And I think you cannot expect it from everyone. and you also want the expertise these people get in the 15 to 20 years. And this is also nothing AI or data analytics will replace. So that's why I think you have to give some people some time but it's very individually, it's not everybody the same but yeah, if you have someone who comes just freshly in to the department, it doesn't matter if it's If it's an experienced person or not then I think it's just easier to adapt to it because you do it from the very beginning. So you don't have to, let's say, break through this stigma you, had the last year. I think,

Yusuf: 30:18

That's encouraging, right? So about a patience and support and helping people to, to cope with the changes really what we're going to be seeing over the next few years because I don't have stats and anecdotally, you'd think that, maybe half of our auditors are experienced and half new coming in. So there's a fairly large cohort of experienced auditors that. need some patience and need some encouragement to get to the next level. but the future is bright given the level of coverage that we. can start to enable and just provide more value particularly in those areas that we couldn't cover because we just didn't have enough budget or enough resources. So that's good. Michael, what's the future for you and, your team? What are you excited about particularly over the next couple of years.

Michael: 31:00

We really enjoy being back also with travel, with the direct contact with the companies. I mean, though COVID is already one and a half years or so ago we still have countries where it was difficult to travel to when we talk about China, for instance. So we did not have the chance in the last four years to have, for instance, our annual audit conference to meet everybody. And even though a lot of people are already here for two, three, four years it's really yeah, sad to see that most of the people did not meet each other personally. So what we are looking forward now as well is the personal contact, the, the physical meeting, we will have our audit conference. Now in a few weeks, the first time since we set up the internal audit department at TKElevator four years ago. So we are looking forward to more, let's say interaction between the teams to more joint audits between the regions. And we see it also in the employee survey our company is doing. on an annual basis. So in our department, people really miss let's say, the interaction. So they want they want joint audits. They also want to see other cultures. And they are also, let's say, interested because every time we have our global fix remotely people talk about their audits, about their cultures. And it's, I think, very interesting for the people to go there and also experience it, especially. For, for the younger people who did not travel so much to, to different countries. So we are definitely looking forward to more personal contact, not only within the team, but also with the auditees. And I think we are also pretty much looking forward to the fact that we have all the time and let's say new audit topics. And I would say that our company is quite on a digital journey, so we have digitalization also in elevator business also use of AI over there. But this, yeah, this always changing environment also in our company makes it exciting because we will have always new audit topics. Because our company is is developing very quickly, it's very dynamic very competitive market, the elevator market, of course. So, we recently also launched a new product which also required to set up new systems and processes. So yeah, I think the people in my department, they, they know that they will never do always the same, there will be always something new. This is what we are looking for. The dynamics of this job, I think this will never change. Doesn't matter if there will be AI or not, I think the people who work in internal audit will always have a dynamic job.

Yusuf: 33:53

That sounds really exciting. It sounds like a nice place to be at the moment. So well done on creating that level of excitement within an internal audit team for your existing, team members and also those looking to come in and join you. And I know you, you're always looking for good people to join you, Michael.

Michael: 34:10

Yeah, always search for people, if your everyday experience should be very dynamic. And you don't want to know when you go to bed, what will wait for you the next day and definitely this is the right place to be.

Yusuf: 34:25

Excellent. Michael, thank you so much for joining us today. Really interesting conversation that I'm sure a lot of people will take good info away from. What's the, for those that want to find out more about you and your team, think about joining, et cetera what's the best way to contact you?

Michael: 34:41

on LinkedIn I mean. The name will be written. So it's not so easy to find, but the good thing when it comes to my name is when you put it into LinkedIn, there are not so many people which will appear, so you'll find me quite quickly.

Yusuf: 34:55

Okay, so that, that uniqueness is definitely a plus. we'll put a link to your LinkedIn profile in the show notes, Michael. Thank you so much for joining us again.

Michael: 35:03

Thank you Yusuf, have a nice weekend.