Lisa Whittemore is an internal auditor with over 20 years of experience across various industries. She is also the founder and CEO of Riverway Risk Advisory, a boutique consulting firm that officially launched in April of this year.
What is Riverway Risk Advisory?
Riverway Risk Advisory is a boutique firm that provides specialized internal audit and risk advisory services. Their expertise includes Enterprise Risk Management assessments, Sarbanes-Oxley (SOX) readiness and compliance, internal audits, internal control evaluations, fraud examinations, forensic accounting, cybersecurity, IT advisory, and corporate insurance assessments. The firm serves a variety of industries, including financial services, technology, life sciences, government, healthcare, and retail.
Why would a company bring in a risk consultant like you?
Companies typically hire consultants because the work we do is highly specialized and carries significant impact. You want experts handling this work to ensure it’s done correctly and to minimize the company’s exposure to risks.
For example, with Sarbanes-Oxley (SOX) readiness and compliance, if your SOX program falls short, your company is at risk for fraud or financial statement errors. If auditors find your SOX program inadequate, you could face serious consequences. Although SOX aligns with audit timelines, the work should be ongoing throughout the year to ensure controls are effective year-round. In the case of fraud investigations, a Certified Fraud Examiner would assess what happened, quantify the losses, and recommend controls to prevent it from happening again. For internal audits and control evaluations, you need an expert to ensure everything is properly managed and overseen.
What size companies do you typically work with?
It really depends on the specific job or project. Our focus is on small and medium-sized businesses, and we can tailor our services accordingly.
For smaller companies with lower revenues and fewer employees, we can customize the SOX program to fit their specific needs. A small company doesn’t need the same SOX program as a large corporation like Coca-Cola or IBM. We work directly with external auditors to tailor the program. For medium-sized companies with more complex systems, the programs are expanded and customized to their specific needs. We can handle clients with up to about $500 million in revenue; it’s just a matter of customizing the program to the company’s specific requirements and their external auditors’ expectations.
Is the work you do often the result of auditors making recommendations or identifying risk factors, or do you also do front-end work to help streamline the audit process?
When addressing deficiencies or material weaknesses, it’s essential to be fully engaged with external auditors to ensure everything aligns with their preferences. Different audit firms, and even different partners or managers within the same firm, have varying preferences. So, having a strong collaborative relationship with external auditors is key to a successful program, ensuring there are no surprises at the end of the year. For other types of work we do, like cybersecurity audits or fraud examinations, these aren’t necessarily tied to a specific time frame and can be conducted as needed.
When you work with companies, regardless of size, do you typically collaborate with their internal audit staff, or do you oversee certain functions?
In the current economic climate, where companies are leaner than ever, we’re often brought in as consultants to work alongside existing audit and finance teams. We work side by side with management and internal audit stakeholders. Given the specialized nature of our work, it makes sense to outsource to a specialized advisory firm like ours. You may not need a full internal audit team year-round, but we can provide the necessary support as needed, complementing and adding value to the client’s existing resources.
Are companies using AI or technology to manage risk?
In our industry, many are still in a wait-and-see mode regarding AI. However, most companies consistently use ChatGPT, often with some variation of an internal bot they’ve created for better security and efficiency. We plan to integrate AI into our tech stack in early 2025. In 2024, our focus was on building the business and laying the foundation.
The tools we’ll focus on are those that make audit life easier. These tools will ingest massive amounts of data, read documents, analyze them, and provide interpretations, saving auditors a significant amount of time. Additionally, other tools will help reduce the burden of every day, cumbersome administrative tasks that auditors typically handle.
How do you think AI will help attract and retain talent in the accounting and finance space?
In finance, accounting, and any business area, staying relevant requires quick adaptation. People need to understand how AI can make them more efficient, such as automating the testing of large data samples, allowing them to focus on adding real value to clients. Everyone should embrace AI and find the best ways to leverage it in their industry to make their work faster and more efficient.
What have you observed this year as you’ve established your business? Are companies investing in risk and audit services?
Yes, more than ever, companies are hiring outsourced internal audit and risk consultants. As a small boutique firm, we are agile and have the luxury of being highly adaptive in our strategic decision-making. This flexibility extends to our fees, which are more attractive to clients since they are substantially lower than those of larger firms. We can offer project-based fees and customize services to meet specific client needs without the burden of excessive overhead.
Any thoughts on the trend toward outsourcing or co-employment for internal audits?
Companies are indeed moving towards outsourcing or co-employment models for internal audits. This approach allows for flexibility and cost efficiency, enabling firms to manage smaller internal teams while relying on external partners. The variability and potential benefits of working with quality external partners are appreciated by many.
Any advice for finance and accounting leaders on hiring and developing world-class talent?
Focus on aptitude, attitude, and heart first, then consider education, experience, and credentials. The core personality of a person is more important than their technical skills because technical skills can be trained. This approach helps build a strong team culture.
What’s your recommendation for building a world-class team?
Prioritize culture and core attributes over technical skills. Technical skills can be taught, but the right attitude and cultural fit are crucial for long-term success.
Any final thoughts?
Emphasizing cultural fit and attitude is excellent advice. It aligns well with the practices of many successful companies.
To sum it up…
Lisa shared valuable insights into modern audit practices and team management. Drawing from her experience in risk consulting, she highlighted the growing trend of shifting from traditional internal audit teams to outsourced or co-employment models, explaining their benefits in flexibility and cost efficiency. Lisa stressed the importance of hiring team members based on core qualities, such as aptitude and cultural fit, rather than solely on technical skills. She provided a clear perspective on how prioritizing a positive attitude and alignment with company culture can lead to building high-performing teams. Through this interview, we can all gain an understanding of adapting audit strategies and effective talent management in today’s evolving business environment.
