Audit & Beyond 2025 | Amrita Kapoor, Snowflake

Clips
More from Audit & Beyond 2025

Amrita Kapoor

VP, Head of Internal Audit

Snowflake

Enterprises are confronting critical shifts in business auditing

Business auditing is undergoing a major transformation. While financial accuracy and regulatory compliance remain front and center, auditors are increasingly taking advantage of artificial intelligence to shift their focus from being primarily compliance checkers to delivering strategic value.Snowflake Inc., a cloud-based data platform provider, finds itself at the center of this shift. The company focuses on developing a framework of foundational controls to deliver compliance with regulations such as the Sarbanes-Oxley Act

play_circle_outline Introduction of Amrita Kapoor, head of internal audit at Snowflake.

play_circle_outline Transforming Internal Audit: Embracing Data-Driven Methods and Snowflake's Technology Post-COVID-19 Pandemic

play_circle_outline Transition from traditional compliance to being a trusted advisor for stakeholders.

play_circle_outline Enhancing Audit Models: Automation and Data-Driven Techniques for Effective Access Management with Snowflake Analytics

Info
Transcript

Amrita Kapoor, Snowflake

Amrita Kapoor

VP, Head of Internal Audit Snowflake

In this Audit & Beyond interview, Amrita Kapoor, head of internal audit at Snowflake, joins theCUBE’s Rebecca Knight and Rob Strechay to unpack how a hyper-growth, AI Data Cloud company is redefining internal audit. Kapoor explains how her team evolved from SOX readiness at IPO to a data-driven assurance function that partners with the business. She details Snowflake’s use of analytics for access controls and key report testing, the push toward 100% coverage (moving beyond sampling), and a target of ~40% automation in the SOX program by pairing analytics with... Read more

explore Keep Exploring

What significant changes have occurred in the role of internal audit since the beginning of the COVID pandemic? add

What was the person's experience of joining Snowflake just before the global shutdowns and how did it impact their role? add

What was the initial focus of the company's efforts related to SOX compliance and how has that evolved over time? add

What are the approaches being considered to scale the audit model in response to growth, and how do they plan to incorporate automation and data-driven techniques? add

bolt Powered by CUBE AI

Amrita Kapoor, Snowflake

search

Rebecca Knight

>> Sure. Good afternoon everyone, and welcome back to theCUBE's Live coverage of AuditBoard's, Audit and Beyond here in San Diego. I'm your host, Rebecca Knight, alongside of Rob Strechay. Rob, we're talking about Snowflake now.

Rob Strechay

>> Yeah, I'm excited.

Rebecca Knight

>> ?

Rob Strechay

>> I'm a data geek, to put it mildly, and this is something that's right in my wheelhouse is I've gone through the audit side. I was on the IT side for a while, and I've been audited more than I'd like to.

Rebecca Knight

>> More than you'd like to remember.

Rob Strechay

>> I'd like to remember. But I think that this will be fun to talk about it. They have a unique view on this and how they're able to really... Because of the cloud nature of what they do. So, I think it's fun.

Rebecca Knight

>> Indeed, indeed. Well, with that, I would like to introduce our next guest here is Amrita Kapoor, head of internal audit at Snowflake. Thank you so much for coming on the queue.

Amrita Kapoor

>> Absolutely. Happy to be here. Thank you.

Rebecca Knight

>> So, you joined Snowflake right at the beginning of COVID when we have also experienced massive, massive change and technological technological disruption. How has the role of internal audit evolved since you had your first day one on the job?

Amrita Kapoor

>> Yeah, it's interesting. I actually remember signing the offer letter a week before the global shutdowns, and I was wondering if I made the right decision, but that became so clear right when we had our Blockbuster IPO in September 2020. But no, in all honesty, it's been a great opportunity to build a data-driven function at an iconic company like Snowflake. Snowflake as an AI data cloud also gives my team a unique dual opportunity. It challenges us not to just stay ahead on top of these emerging tech and data risks, but also forces us to use our own product to drive efficiencies within audits. What I absolutely love about my role is that I'm actively partnering with the sales team and partners to champion audit transformation using Snowflake's data and AI capabilities. So, it's truly amazing. But double clicking a little bit into your question on evolution of the role. Initially, it was very much focused on getting us set up for SOX, control, the foundational controls and compliance in efforts of our IPO and growth trajectory. But as that matured, we took this as an opportunity to leverage Snowflake Analytics for various control use cases, operational audits as we kick those off. And since then I would say it's been a continuous journey. We've been onboarding a lot of systems and controls onto this framework and that has really helped us to move away from being a traditional compliance shop to being more of a trusted advisor and assurance partner for our stakeholders. So, yeah, it's been a great journey and as I look ahead, I see us continuing to be a trusted partner for our stakeholders, leveraging AI data to see how we could continue to help Snowflake to stay ahead of the risks in a very fast-paced tech environment and hopefully also be a thought leader and share knowledge in the broader audit community.

Rob Strechay

>> Yeah, I mean, I think, again, like you said, you got the S1 out there, you're joining the company, the pandemic's going on, you're growing exponentially at that point in time and you're built into an infrastructure that is, again, it's on the different hyperscalers and things of that nature. How have you seen things evolve over the last five years since the IPO and what you've had to do and what you've had to handle? Because again, like you said, SARBOX and all of that aside, there's a lot more to what you guys do as well.

Amrita Kapoor

>> Yeah, I mean, I do have to say it's an exciting time for Snowflake right now in a hyper-growth environment comes tremendous opportunity, but also a lot of evolving risks with respect to scaling systems and processes, yet staying on top of being compliant, ensuring that you're good on the data side, security and so, for us, I would say we've been really focused on three key aspects. One is how do you scale the audit model and not just headcount. We obviously cannot keep pace with this growth by simply adding headcount. So, we have to look for more automated and data-driven techniques to drive efficiencies in our world. And so, on that front, we have shortlisted a lot of control use cases, specific audit areas where analytics and AI can best be leveraged. So, for instance, we are currently using Snowflake Analytics for some of our access management controls, for key reports testing. And then on the AI side, we are looking to partner with the AI agentic workflow as a native app within Snowflake to drive some efficiencies on the SOX testing and documentation front. So, yeah, very exciting. We look forward to driving at least 40% automation in the SOX program and looking forward to track the time savings and time savings and cost savings there. And then, second I would say is prioritizing strategic and emerging risks. Because in a hyper-growth environment, usually the greatest risk is where your newest growth is happening. So, we've really invested in doing early assessments on controls design prior to systems and product roll-outs, so we can really help our stakeholders stay ahead of these risks from the start. We have really good relationships with leadership in engineering, products, sales, so we can keep an eye on the strategic shifts and then focus our audits on the biggest future concerns of our stakeholders, which really helps our work be a lot more relevant and valuable. And then lastly, I would say being an efficiency catalyst to the business. Internal audit is usually that department that sees processes and systems end to end. And so, we are very well situated to identify those use cases for driving efficiencies with use of AI data technology. For us personally, we're also leveraging Snowflake for a lot of this work, so we can also be an internal advocate and proof point for efficiency. So, in a nutshell, I would say being agile, data-driven, strategic to really help the business be protected from risks, but also enabling them in their continued acceleration.

Rebecca Knight

>> Moving on from that, you've talked a little bit about digital upscaling. How are you helping your team as well as the broader organization, build, maintain, cultivate the data fluency that's needed to compete today?

Amrita Kapoor

>> Yeah, that's a great question. I would say cross-training. I really think that business and IT skills these days are converging. So when my team comes to me and says, "Hey, key reports testing or testing these configurations or looking into code is not my thing. I need to punt it over to my IT team." I'm like, "No, you need to understand basic coding too." Because as a business professional, most of our key reports are query-driven. So, I think what I'm forcing my team right now to do is a lot of cross-training. I'm having my IT folks really build business acumen and then have my business folks really work with IT-related aspects of the audit. And that's really how you cross-train, because I truly believe that the auditors, the future is one that has a good blend of both business skills and IT skills, and honestly, data skills. Because I truly believe that the future of audit is data-driven, so you have to embrace it. Now, with generative AI, obviously the key there is data again and you need to have good data governance around it. So, it's very important for us to speak that language and honestly get hands-on with looking at data and driving data-driven results with our stakeholders.

Rob Strechay

>> How are you leveraging AuditBoard's technology along with Snowflake's technology? Like you said, I'm very knowledgeable. I've actually deployed Snowflake and run it in production. That's great. So, I'm one of the few probably and like I said, I'm a geek, right? But I think how are you leveraging AuditBoard's technology? Again, you do have a lot of AI and a lot of chops and a lot of data inside of Snowflake itself.

Amrita Kapoor

>> Yeah, I would say a combination of both of these technologies is really bringing the best of analytics and AI capabilities to drive proactive controls monitoring effectively. So we are partnering with AuditBoard as a connected app whereby you can connect to Snowflake, you can configure queries and trigger alerts for exceptions monitoring all within the control pane view in AuditBoard. We've tested a few use cases on the access side and are continuing to expand on that. So, I'm really looking forward to having AuditBoard be that one-stop shop for me when it comes to controls effectiveness and retaining the evidence. But I would say, in essence, Snowflake is the data power that enables scale and speed and AuditBoard happens to be that overall workflow and governance layer that then takes this data and turns it into actionable risk insights. So, yeah, looking forward to have a lot more customers embrace this.

Rebecca Knight

>> Well, speaking of that, how are you communicating with those customers who are just beginning to think about AI governance and how are you talking them through it holding their hands and helping them figure out where to start?

Amrita Kapoor

>> Yeah, great question. I mean, AI is top of mind for everyone these days. I think AI is really changing the conversation and audit as well, both in terms of how we're leveraging AI to drive efficiencies within our audits, but then also in terms of how we're advising our stakeholders on using AI in the controls operation and in their processes. So, on the first piece, I would say huge opportunity in the world of audit with disruption, with AI and transformation with AI in terms of driving efficiencies and better risk coverage. But, actually, I would say broadly even in the controllership and finance function, frankly. But we all have to embrace it. We all have to make sure that even simple things like leveraging Q&A agents for doing quick research on risks or compliance requirements or summarizing documents or retrieving information from documents, lots of use cases there. So we're definitely looking into leveraging Q&A agents for expediting some of this work in our operational audits and then also looking to leverage AI workflow agents for, as I mentioned, controls testing and documentation. A lot of times spent by auditors and documentation. And so, that's where you can leverage the power of AI to focus more on strategic and value-added insights and conversations with stakeholders. But moving to advising on risks, I would say first and foremost is staying on top of the evolving landscape. I mean, things are changing so fast in the world of AI and data privacy and security. So it's being on top of it to understand what are the associated risks so you can have a seat at the table and better educate your stakeholders, but then also looking into what is the right governance framework and structure that you want to put in place. So for us at Snowflake, we just attained the ISO 42001 certification, which gives our customers assurance on use of AI within our products. And internally we've also partnered with various stakeholders to put in the right policies and the processes and drive the right rigor with identifying, assessing and monitoring AI risks. So, it's been great and my advice would be for those folks who really want to have a seat at the table is really help your stakeholders understand what is the AI governance framework I want to put in place? What are those policies and associated processes? And then hopefully down the road even provide some assurance on internal controls.

Rob Strechay

>> Yeah, I was going to say that to me was one of the questions. You got... Snowflake's at the center of a lot of the most important data for many companies across all different industries. How do you see yourself... Do you help the rest of the organization understand... Data sovereignty's a big thing. You got the financial stuff like Dora in Europe, you have a number of other, not to mention GDPR and the CCPA and all of the other different acts that are out there. How do you see yourself as a resource to the rest of the organization? Because you talked a little bit about partnering.

Amrita Kapoor

>> Yeah, that's a great question. We do have a very well-educated team on these certifications. Our security compliance are second line that really gets ahead of what are those new markets and industries we're getting into and what are the certifications that we need to attain? And to your point, with data sovereignty, it's a whole different ball game now, right?

Rob Strechay

>> Yes.

Amrita Kapoor

>> So, yeah, we are definitely working with them very closely and then a lot of these data privacy and security controls, there's a common control framework. So, for some of these, they come to us too in terms of providing assurance on controls design and operating effectiveness over time. But we're very much working very closely with our second line and, in fact, the first line is they set up the infrastructure to support the attainment and the maintenance of these certs.

Rebecca Knight

>> So, final question. Looking ahead, what are you... Are there new initiatives, new areas of focus that are taking place at Snowflake that are exciting to you right now?

Amrita Kapoor

>> Yeah, absolutely. I would say on the internal audit front, we're continuing to move away from traditional ways of testing, moving away from sampling and going to how do we get more proactive, 100% coverage over the population? And so, as I mentioned, continuing to expand our use of analytics and AI on various audit use cases and controls. But personally, what I'm truly excited about is, as I mentioned, using this AI agentic workflow for expediting our SOX testing and documentation efforts. I think we expect to get a lot of cost savings and time savings there. So I can have my team move away from documentation burden to more strategic and valuable insights and conversations with stakeholders and then, on the Snowflake side, lots of exciting developments too within our product, both on the AI side and I would say on the overall data and application development life cycle as well. Which were announced, in fact, at our summit earlier this year. And they were all focused on how can we really help our customers get the most value out of enterprise data and Snowflake? And then clearly for us as auditors, it's how can we continue to build trust with our stakeholders through use of data and now AI. So, yeah.

Rebecca Knight

>> Well, lots of exciting new measures taking place, Amrita. Thank you so much for coming on theCUBE, a really fun conversation.

Amrita Kapoor

>> Thank you so much. Thank you for having me.

Rebecca Knight

>> I'm Rebecca Knight for Rob Strechay. Stay tuned for more of theCUBE's live coverage of Audit and Beyond. You're watching theCUBE, the leader in enterprise tech news and analysis.