Audit & Beyond 2025 | Richard Chambers, AuditBoard

Clips
More from Audit & Beyond 2025

Richard Chambers

Senior Internal Audit Advisor

AuditBoard

Board-backed risk management: How AI turns oversight into a competitive advantage

As artificial intelligence races through the enterprise, leaders are rethinking tools and tempo. AI-powered risk management is reshaping the audit and the organization’s control environment.But momentum is fragile. Many programs surge, stall and then slip into “perpetual pilot.” Therefore, the first move is always clarity, according to Richard Chambers (pictured), senior internal audit advisor at AuditBoard Inc.AuditBoard’s Richard Chambers talks to theCUBE about risk management in the AI era.“It starts with recognizing that risks are really the events that will keep you from achieving your strategy or your objectives,” he said

play_circle_outline Companies need clear strategic objectives to avoid the middle maturity trap.

play_circle_outline Transforming Organizations: Navigating AI Opportunities, Risks, and the Role of Executive Commitment in Effective Implementation and Leadership

play_circle_outline AuditBoard's technology helps streamline data analysis and oversight across organizations.

Info
Transcript

Richard Chambers, AuditBoard

Richard Chambers

Senior Internal Audit Advisor AuditBoard

In this Audit & Beyond conversation, Richard Chambers, senior internal audit advisor at AuditBoard, joins theCUBE’s Rob Strechay and Rebecca Knight to unpack findings from AuditBoard’s Risk Intelligence Report and what he calls the “middle maturity trap.” Chambers explains why many organizations show early momentum on risk and AI adoption (with June showing notable progress) only to backslide the following month, and how a crisp strategy with clear objectives helps break the stall. He stresses enterprise-wide commitment – starting with understanding risks bef... Read more

explore Keep Exploring

What factors contribute to a company's difficulties in achieving its strategic goals and managing risks effectively? add

What challenges do organizations face in adopting AI effectively? add

What features does AuditBoard's technology offer to improve oversight and data analysis in organizations? add

bolt Powered by CUBE AI

Richard Chambers, AuditBoard

search

Rebecca Knight

>> Good afternoon everyone, and welcome back to theCUBE's live coverage of AuditBoard's, Audit & Beyond here in sunny San Diego, California. I'm your host, Rebecca Knight, alongside Rob Strechay, the one, the only, Rob Strechay. So one of the things we're hearing here at AuditBoard is that risk management is not a necessary evil. It in fact can fuel growth.

Rob Strechay

>> Yeah, I think that's the... Behind all of this, there's a lot of data that actually backs up what's going on and how audit is really transforming itself. And I think I love it because, again, having been on the other side and been audited many times at the financial services company and having to work with audit, I saw them as keeping me out of trouble and I liked that. And I didn't like letters from the SEC and from FINRA, and others, and stuff like that. And we ran into FINRA in the elevator earlier, so it was pretty amusing.

Rebecca Knight

>> We did indeed.

Rob Strechay

>> But again, I think when you start to look at this, it's how do you partner together and help that be actually an advantage when you go to things like a new country or where have you?

Rebecca Knight

>> Well, have I got the perfect guest to talk more about this. I would like to welcome to the show, Richard Chambers, Senior Advisor Risk and Audit at AuditBoard. Thank you so much for coming on, Richard.

Richard Chambers

>> Well, thank you for having me. It's great to be here.

Rebecca Knight

>> Yeah. So we're talking today about AuditBoard's risk intelligence report, and in it you talk about this idea of the middle maturity trap. Can you talk a little bit about this trap and why so many organizations seem to get stuck there?

Richard Chambers

>> Yeah. Well, if you think about the normal distribution, some call it the bell curve, you're always going to have, on the one leg, you're going to have the high performers, those that are at the very top. The other end, you're going to have the underachievers. And then what typically happens in the middle is you have those that are trying to move, trying to gain some maturity. But what happens, particularly when it comes to things like risk management, adoption of AI, is that you find that there's an initial enthusiasm, there's investment, but then some really struggle with maintaining the momentum. Our risk intelligence report actually, revealed because we're able to look month by month at data, June was really good of this year. You saw a lot of investment, you saw a lot of companies making progress. And then you saw a little bit of a regression in July. And there could be any number of things that trigger that. Maybe there was a bad experience, maybe somebody got some data that was not reliable and then it undermined confidence, so then you see them step back. And so I think there's just a little bit of a lack of momentum that contributes to this. And some companies get stuck there. They just don't progress beyond that middle maturity trap.

Rob Strechay

>> So in the report and in the data there that you're looking through, what are some of the examples or some of the key things that people are doing to move beyond that and maybe using risk management to be a competitive advantage? And so how does that work out?

Richard Chambers

>> Well, I think it starts with recognizing that risks are really the events that will keep you from achieving your strategy or your objectives. So if you don't have a really strong sound strategic plan with very crisp and clear objectives, it's going to be very difficult for you to maintain any kind of a corporate-wide view of risk and risk management. So the first thing that I think companies have to do that might find themselves stuck in this sort of the middle maturity trap is to say, "Why are we stumbling? Why do we make progress and then recede?" And maybe it's because there wasn't a very clear path to the kind of objectives that they needed to have from a standpoint of their strategic plan.

Rob Strechay

>> Let me dig in a little bit on that one because I think one of the things that I've been seeing and it's been talked about, especially on the InfoSec side of things, is like, hey, if you're not doing tabletop exercises, once a year at a minimum, if not once a quarter, and things of that nature, and institutionalizing a cadence of doing these different activities. Are you seeing that the more successful companies are instituting a cadence or have a good maturity of those processes so it becomes rote, I guess you could say?

Richard Chambers

>> Yeah, I think you're onto it there. I think if you have a commitment to effective risk management, then you understand that it's not optional, right? And if we find ourselves slowing down and maybe the enthusiasm for the kinds of steps that we need to take to mitigate the risk... It starts with making sure you understand what your risks are so you can make sure you've designed and implemented all the right controls. If you don't even do the first step, if you don't know what your risks are, it's going to be awful difficult to design and implement the controls. And so I do think there's got to be an enterprise commitment, and that enterprise commitment has to be to achieving our strategic objectives and to knowing what the risks are and making sure we're mitigating those that will undermine it.

Rebecca Knight

>> So it feels cliche to say this, but we are living through a period of unprecedented change, where the pace of technology really is head spinning. When you think about this moment and your career, having worked with so many risk and audit leaders, how do you talk about this moment feeling different to you?

Richard Chambers

>> I just wrote a piece on this last month, I think I called it From the Abacus to AI: My Journey in Technology. And I didn't really start in the era of abacus, but 50 years.

Rebecca Knight

>> Feels like it.

Richard Chambers

>> Yeah. When I came into internal audit, I think that 10 key calculator was the most sophisticated technology we had. And so I've been there really ringside seat, and hopefully getting my fingers into it, at every major technological innovation in the last 50 years. And this is just completely different. This is, I didn't coin this, but this is like the invention of electricity. You think about how transformational that was. I think AI is going to be as transformational to the human experience. And so then when you start to peel away some of that hyperbole, even if that's only like half right, think about how transformational it's going to be in the business and how much impact it's going to have on... I'm in the audit and risk field. We know that it's going to be impactful. I just hope we're up for the challenge and recognize, what is it that will differentiate us? How can we bring our superhuman skills to the table so that we can stand toe to toe with the capabilities of AI?

Rob Strechay

>> I think you hit on a really good spot. , even the MIT numbers that came out and said, only 5% of AI is in production and 95% fail, I think that number's a little overstated to put it mildly. But I think what it does propose is the fact that there are a lot of things that are in perpetual pilot and getting stuck in perpetual pilot. How do you see, again, the different organizations being able to build that stakeholder trust and help AI get out of pilot? Because I think a lot of people look at risk and are saying, like you said, hallucinations or what have you, they've had a bad experience.

Richard Chambers

>> Yeah.

Rob Strechay

>> They need help to understand how to put the right guardrails in place.

Richard Chambers

>> Well, I think it's a great question. I'm a big proponent to my own profession, the internal audit profession, that we've got to take a leadership role. But I fear that, all too often, we're kind of sitting in the back waiting for somebody else to go out there and be the first adopters. And I think that may be happening across the organization. I do think a lot of organizations have an appetite to use AI, but then when we survey and we look, a lot of organizations haven't put a real strategy together. They don't know what their tolerance for risk is with the use of AI. A lot of policies are still in place that maybe keep people from being able to use AI in the workplace. So I think that's part of the middle maturity trap. We hear organizations saying, "We're going to adopt AI," and then they kind of get in the middle of it and then they're not quite sure how to really make the value proposition play out.

Rebecca Knight

>> So then what are some best practices, Richard, in terms of how we improve communication between the risk and audit folks and the C-suite, and then how the leadership also communicates downward to the organization? What have you seen that is effective?

Richard Chambers

>> Well, I think first of all, it takes a real executive champion in an organization to help set the tone for the fact that we are going to be an adopter. We are going to be a pioneer in this. But then you have to understand, what are its capabilities and what are the risks? Because for all the opportunities that AI promises, I think right now, it's the risks that are the dark clouds that keep a lot of companies from jumping in with both feet. There's the security and data exposure concerns. So I think it has to start at the top within the C-suite. There has to be a commitment to it. There has to be board oversight. The board has to be in, all in. And then what you have to do is you have to forge a strategy for how you're going to use AI and then go at it meaningfully, and don't expose the organization to risks that maybe you haven't fully anticipated or fully thought out. But I do think it comes from the top, and it has to be a strategic initiative, a strategic priority. And we're a long way from knowing what the true potential of AI is going to be in companies, but if you wait for others to realize it, you're going to be bringing up the rear.

Rob Strechay

>> Yeah, I look at it, and it's one of these things that AI can help so much, but it has to be done purposefully and with what your outcomes, mapping to outcomes, and understand how those outcomes are going to impact. I like a lot of how AuditBoard is actually bringing the AI, and it's with trusted knowledge behind the scenes, that, hey, it's not going to go and hallucinate. It's not going to go down. Do you see that as a big piece of-

Richard Chambers

>> Yeah, I'm very enthused about what AuditBoard is doing. We unveiled this morning a lot of initiatives that enhance our current products. And when we survey internal auditors, the ones who are not adopting and the ones who are slow to adopt are very candid. They say, "I just don't understand AI. I don't know enough about it, and I'm afraid to try it." Well, AuditBoard is making it very, very easy for you to adapt and adopt that AI technology. And so for those who haven't tried our products, I would encourage you to get that demo right away because you're going to find that AI, the AI solutions you didn't understand, maybe aren't that complicated after all.

Rebecca Knight

>> Well, let's dig into that. Can you talk a little bit about AuditBoard's technology and how it helps break down these silos and helps organizations create a more unified approach to oversight?

Richard Chambers

>> Yeah. Well, I think what you're talking about is some of the features that we rolled out today or announced today. And I think what they will enable is for internal auditors, through the course of their normal processes or the risk managers, it will enable them to leverage the data that's already at their fingertips and to do it in a way that gives them tremendous amount of insight, that maybe they would've normally taken days or weeks to gather. And normally, we just don't even have the physical capacity to gather. And so whether it's analyzing existing data, whether it's analyzing maybe thousands of policies or vendors, and then being able to quickly identify the anomalies, I think that's going to excite a lot of folks in the audit field, because we don't have the capacity to do that. And if we did, it would take all the resources we have.

Rob Strechay

>> So I think that's a good jumping-off point to kind of think about, we're in the fourth quarter of 2025. What do you see as some of the risk predictions for 2026? What do you see coming onboard that people should really be paying attention to?

Richard Chambers

>> Yeah. Well, I've been the big proponent for this term permit crisis. We've been in a perpetual state of chaos and unpredicted disruption for the last six years. I've learned not to predict too much because inevitably the predictions don't come true. But if I were going to predict anything, it's that next year is going to be just as disruptive as this year. I think we will continue to see some momentum in the adoption of AI and some of the new technologies, but I think there will inevitably be some setbacks. I think, again, we are in probably for more geopolitical disruption. We're starting to see the geopolitical risks evolve a little bit away from the armed conflict and more toward economic conflict, if you will. And so if you think about what that means, tariff uncertainty and retaliatory measures and so forth, I think there's bound to be some of that next year. So what I advise internal auditors, who are supposed to be risk-based, is just be agile enough to recognize that what you see as the risk right now are likely to going to be the change. And if you put an internal audit plan together, write it out in pencil because you're going to need to make some changes and you're going to need to make them quickly. And that is going to necessitate some sort of continuous risk focus. Because even going and taking a snapshot every three months, if you think about what happened in this country with some of our economic policies from January to March, if you waited until March to take your first snapshot, you were already way behind the curve. And so that's my advice. It's hard to predict, but the one thing I will predict is that it's going to be volatile and so be ready.

Rebecca Knight

>> So you heard it here, more of the same. More of the same. And also agility, which I think is also a really important point in terms of making sure those internal auditors have that in their skill set, because that is what is going to be so necessary going forward.

Richard Chambers

>> Absolutely.

Rebecca Knight

>> Well, Richard, a pleasure having you on. You are our first guest. You were terrific. Thank you so much.

Rob Strechay

>> Yeah, thank you.

Richard Chambers

>> Thank you, guys.

Rebecca Knight

>> I'm Rebecca Knight, for Rob Strechay. Stay tuned for more of theCUBE's live coverage of Audit & Beyond. You're watching theCUBE, the leader in enterprise tech news and analysis.