The conversation explores the future of governance, the role of internal audit in risk management, integrated assurance, simplicity and clarity in governance, accountability and oversight in the age of AI, adapting to technology and industry standards, the role of senior personnel in audit activities, data testing and assurance in internal audit, access to data and analysis for internal audit, understanding data trends and outliers, assurance and data reliance, proactive and dynamic risk management, intelligent risk management and business value, defining risk capacity and appetite, collaboration between internal audit and risk management, preventing assurance fatigue and maintaining accountability, transforming internal audit without losing credibility, educating the board on integrated assurance, the role of the board and management in organizing the assurance ecosystem, essential reading for chief audit executives, the importance of trust and assurance, the future of internal audit in 2030, high performing internal audit function in 2030, and the guiding principle of trust and accountability.

1. Recommended reading from Martin:
   1. Free Speech, A History from Socrates to Social Media, Jacob Mchangama
   2. Das Harvard Konzept, Sachgerecht verhandeln, erfolgreich verhandeln, Roger Fisher, William Ury
   3. Made to Stick, Why Some Ideas Survive and Others Die, Chip Heath, Dan Heath
   4. Radical Uncertainty, Decision Making Beyond the Numbers, John Kay, Mervyn King
   5. Corporate Fraud, The Human Factor, Maryam Hussain

Chapters

• 00:00 Exploring the Future of Governance
• 05:25 Integrated Assurance and Risk Management
• 11:47 Data Testing and Assurance in Internal Audit
• 16:53 Proactive and Dynamic Risk Management
• 23:30 Preventing Assurance Fatigue and Maintaining Accountability
• 28:38 The Role of the Board and Management in Organizing the Assurance Ecosystem
• 38:07 The Future of Internal Audit in 2030
• 43:16 High Performing Internal Audit Function in 2030

What happens when doing the right thing comes with real personal risk, to your job, your safety, or your reputation? In this compelling episode of Governance Unplugged – Internal Audit, Risk & Controls, we sit down with a highly experienced (and anonymised) Chief Audit Executive, whom we call “Michael.” Together, we explore what it truly means to lead with courage when the pressure is high, the stakes are real, and the risks are personal.

Key Discussion Points

·      Uncovering tax fraud and bribery at the highest levels – and the personal consequences that followed.

·      Facing direct death threats and even shots fired during intense fraud investigations.

·      Managing pressure from the board and management to overlook or suppress critical findings.

·      Dealing with missing evidence and leadership’s preference for silence when stakes are high.

·      Personal safety strategies when audit work becomes dangerous.

·      Staying fact-based, ethical, and humane in crisis situations.

·      Balancing the assurance role with genuine support – without becoming an “alibi function.”

·      The importance of emotional intelligence and communication, alongside technical skills.

·      Building and rebuilding trust with management, the board, and audit teams after tough times.

·      Future skills for Heads of Internal Audit: AI, analytics, and adaptive leadership.

·      Practical advice for auditors who see wrongdoing but fear the repercussions of speaking up.

Michael’s Message

Despite the dramatic stories, Michael’s message is not about heroics. It’s about calm, clarity, professionalism, and integrity, and how to maintain these values when everything around you accelerates. He emphasises:

·      Remain calm, even in the darkest moments.

·      Stay positive, seek clarity, and focus on facts.

·      Stick to your values; integrity is your anchor.

·      Recognise that dark times are often where you grow the most, professionally and personally.

In the second part of their conversation, Thomas Michel and Martin Studer (Linkedin: https://www.linkedin.com/in/martinstuder/ ) explore the future of internal audit and assurance. This episode focuses on how artificial intelligence (AI) and “alternative intelligence” are reshaping the profession, the impact on the Three Lines model, and the enduring value of human expertise. Martin Studer shares insights from his extensive experience leading global assurance and risk functions, challenging listeners to rethink the role and relevance of internal audit in a rapidly evolving landscape. Key Topics Discussed • AI and Alternative Intelligence • Digital Maturity in Audit • Governance Driving Transformation • The Sherpa Metaphor • Slow Pace of Change • Board Expectations & KPIs • Effective Audit Reporting • Team Board vs. Team Management • Next-Generation Auditors • The Human Edge • Assurance vs. Advisory Guest Profile – Martin Studer Martin Studer has nearly 30 years of experience in assurance, risk, and governance. He has led global internal audit and risk advisory functions at EY and Zurich Insurance Group, and now serves as Founder and General Partner of Bluerain Partners Group https://bluerainpartners.com . Martin is passionate about connecting governance, impact investing, and regeneration, driven by the question: “What if business became our most trusted platform for regeneration?” What You’ll Learn • How AI and digital transformation are changing internal audit • The importance of governance in driving innovation and accountability • Practical metaphors and strategies for effective audit leadership • How to write audit reports that truly influence decision-makers • Building resilient, courageous audit teams for the future • The critical distinction between assurance and advisory roles Looking Ahead This episode concludes Part 2 of “The Future of Assurance – Rethinking the Three Lines” with Martin Studer. Stay tuned for a next episode 15, where Thomas and Martin will discuss “Beyond Audit: Intelligence, Trust and the Next Frontier of Governance”, exploring how AI, trust, and intelligent risk management are redefining assurance. Subscribe to Governance Unplugged – Internal Audit, Risk & Controls to catch all future episodes.

Episode Overview In this first part of a two-part conversation, Thomas Michel sits down with Martin Studer, a distinguished leader in internal audit and risk advisory, to discuss the very foundations of assurance. Together, they explore the true purpose of internal audit, what makes the role genuinely impactful, and why the future of assurance will belong to those who demonstrate intellectual, emotional, and ethical resilience at the executive level. Martin also shares personal anecdotes—from family moments to reflections on rock icons and performance art—offering a glimpse into the human side of a career at the top of the profession. About Our Guest – Martin Studer With almost thirty years in assurance, risk, and governance, Martin has built and led internal audit and risk advisory functions worldwide. His career highlights include serving as Head of Global Internal Audit at EY and Head of Group Audit at Zurich Insurance Group. Currently, as Founder and General Partner of Bluerain Partners Group, Martin is dedicated to connecting governance, impact investing, and regeneration, driven by the powerful question: What if business became our most trusted platform for regeneration? Linkedin: https://www.linkedin.com/in/martinstuder/ Key Topics Discussed • Why Internal Audit and Internal AUDITORS Exist really: Delving into behavioral science (Daniel Kahneman’s “lazy brain”) and the principal–agent problem, Martin explains why internal audit is a structural necessity rather than a luxury. • The Auditor’s Right to Exist: Auditors must continuously learn and evolve alongside management to truly earn their place. • Internal Audit as a “Medal of Honour”: • Martin advocates for wearing the title with pride, rather than hiding behind more fashionable labels. • Designing Meaningful Careers: Insights on career rotations between internal audit and business functions, and why short-term “tourist” assignments can be counterproductive. • From Controls to Storytelling: The importance of senior judgment at board level and framing facts into coherent stories for decision-makers. • The Three Lines Model – Tool, Not Gospel: The model’s effectiveness depends on genuine leadership support and partnership across the lines. • Champions League Referee Analogy: Why a Head of Internal Audit must know the rules inside out and maintain respect from top executives. • Backbone of a Modern CAE: Martin’s three pillars: intellectual, emotional, and ethical resilience; and the importance of true independence. • Advice for Younger Auditors: Daily reading, seeking pressure, learning from strong leaders, and developing ethical sensitivity across cultures. Teaser: What’s Next in Part 2 This episode concludes Part 1 of the conversation. In Part 2, Thomas and Martin will delve deeper into the future of internal audit and assurance, discussing technology, data, and how the profession must reinvent its relevance. Subscribe to Governance Unplugged – Internal Audit, Risk & Controls so you don’t miss Part 2 of this compelling conversation.

Episode 12 From Trustless Code to Trusted Governance: Why Crypto Needs Boards and (Internal) Audit Guest: Marieke Flament: https://www.linkedin.com/in/mariekeflament/ Episode Summary Crypto was built on “don’t trust people, trust the code.” But code is written, maintained, and exploited by people. In this episode, Thomas sits down with Marieke — a crypto-governance expert and industry leader — to explore the paradox at the heart of Web3: trustless architectures still require trusted structures. We unpack how Bitcoin and Ethereum took different paths, what DAOs have actually taught us about decision-making, why “trustless ≠ riskless,” and how boards, risk management, and internal audit can bring credibility, resilience, and scale to this fast-maturing space. You’ll hear concrete examples (FTX, Terra/Luna), practical boardroom questions for M&A and partnership decisions, and a clear playbook for founders who want governance to be a growth multiplier, not a brake pedal. What We Cover • Bitcoin vs. Ethereum: two governance philosophies, one shared lesson • DAOs: transparency, participation—and the human layer that never disappears • “Trustless ≠ Riskless”: why accountability and oversight still matter • What TradFi can learn from Web3 (traceability, on-chain analytics) • What Web3 can learn from TradFi (boards, controls, audit discipline) • The role of Internal Audit in crypto: from “after-the-fact” to “at-the-table” • Crisis readiness: scenarios, controls, and board behaviour when things break • Founder–Board dynamics: co-creation over compliance theatre • A day-one governance checklist for crypto founders Key Takeaways • Governance is a capability, not a constraint. In crypto, it’s the difference between hype and scale. • DAOs increase transparency, not infallibility. Human incentives and bias remain—just more visible. • Internal Audit belongs at the table. Anticipate risks early, shape controls, and strengthen credibility. • Convergence is here. TradFi gains traceability; Web3 gains board discipline and structured assurance. • Trust is built before the storm. Scenario planning and control design are non-negotiable. Memorable Lines • “Trustless doesn’t mean riskless.” • “Founders who treat boards as partners unlock real, sustainable growth.” • “Governance isn’t the enemy of innovation—it’s a multiplier.”

Small but Mighty: Running a High-Impact Audit Function with Limited Resources with Ingo Hartmann Welcome back to Governance Unplugged! In Episode 11, Thomas sits down with Ingo Hartmann, Head of Group Audit & Consulting at Maxon, to unpack how lean internal audit teams can punch well above their weight. With 20+ years across internal audit, risk, and compliance (including Big-4 and industry roles), Ingo shares practical strategies for credibility, focus, and influence when you don’t have a big headcount. 🎯 Episode Highlights ✅ Closer to the business = earlier risk sensing. Small teams build trust faster, hear the “real story,” and spot issues before they escalate. ✅ Credibility through consistency. Deliver what you promise, meet deadlines, and show up prepared — reliability beats volume of reports. ✅ Focus where it matters (the 20% driving 80% of risk). Use risk-based planning across process, IT, and board/shareholder lenses; keep reporting sharp and succinct. ✅ Narrative over noise. Position audit as a connector and enabler — tell impact stories (risk reduction, safer operations, better decisions), not just lists of findings. ✅ Say “no” to protect “yes.” Avoid overcommitting; defend independence and quality by being transparent about priorities and capacity. ✅ Scale with partnerships. Use guest auditors (finance, procurement, etc.) with light training and clear guidance; co-/outsourcing for specialist topics (e.g., IT, ESG). ✅ Board engagement that counts. Regularly gather insights from directors; align on top risks and trade-offs (e.g., supply-chain stock decisions and their real costs). ✅ Pragmatic yet principled. Be approachable and solution-oriented while staying independent and compliant — clarity about the audit mission keeps the balance. ✅ Looking ahead. Smart use of AI in audit — and a cultural shift so leaders see audit as a driver of improvement, not a “pain.” 💡 Key Takeaway Lean audit teams win by focus, reliability, and storytelling. When you consistently deliver on the few things that matter most — and communicate the value — size stops being the headline. 🔗 Connect with Ingo Hartmann LinkedIn: Ingo Hartmann https://www.linkedin.com/in/ingo-hartmann-44a53a8/ Disclaimer The views expressed by the guest are personal and do not represent any current or former employer. 🎧 Listen & Join the Conversation Catch the full episode now on Spotify, Apple Podcasts, or your favorite platform. If it resonates, please subscribe, rate, and share — and let’s keep building smarter, more resilient organizations, one conversation at a time!

Welcome to another episode of Governance Unplugged! In Episode 10, host sits down with Barry Franck (LinkedIn | www.tech-trust.ch), renowned board advisor, transformation leader, and founder of Tech Trust. This episode cuts through the buzzwords — AI, blockchain, cybersecurity, digital transformation — and gets to the heart of what truly matters in today’s boardrooms. 🎯 Episode Highlights • ✅ Why boards must become digitally savvy — and the crucial role internal audit plays in guiding this journey. • ✅ Translating complex technology risks into actionable board insights, not just technical jargon. • ✅ Why 75% of ERP and digital transformation programs fail — and what auditors need to watch for to ensure success. • ✅ Embedding culture into every audit — moving beyond checkbox exercises to truly shape organizational values. • ✅ Diversity and inclusion as governance strengths — discovering how varied perspectives help spot risks sooner and drive smarter decisions. • ✅ From defense to resilience in cybersecurity — shifting the mindset to thrive amid emerging threats. • ✅ Building credibility and influence as audit leaders — evolving from “trend chasers” to trusted strategic partners in the boardroom. 💡 Key Takeaway Internal audit earns its seat at the table not by reacting to headlines, but by translating them into clarity, foresight, and better decisions. 🔗 Connect with Barry Franck • LinkedIn: Barry Franck • Website: www.tech-trust.ch 🎧 Listen & Join the Conversation Catch the full episode now on Spotify, Apple Podcasts, or your favorite podcast

Founders Need Firepower: Why Smart Startups Build Smart Boards (w/ Marieke Flament) 🚀 Episode summary Boards aren’t a brake—they’re a launchpad. In this episode, Marieke Flament https://www.linkedin.com/in/mariekeflament/ (two-time CEO, builder, investor, and board member) joins host Thomas Michel https://www.linkedin.com/in/thomas-michel-ksg/ to demystify startup governance. We explore why smart founders build boards early, how to select the right people, and what a “smart board” looks like as a company scales. We also dive into crisis readiness, founder–board trust, and the practical role of risk, compliance, and internal audit on the growth journey. 💡🛡️ What you’ll learn • Why early boards matter: Build the governance “muscle” before investors require it. 🏋️‍♀️ • Debunking myths: Boards don’t slow you down—the wrong boards do. ❌🐢 • Designing a smart board: Complement founder skills, think in phases, evolve as you scale. 🧩📈 • Crisis firepower: How strong boards show up when things get tough. 🔥🧭 • Pragmatic assurance: Risk mapping, compliance, and (later) internal audit as strategic enablers. 🗺️🧰 • Founder–board trust: Rituals, communication, and the value of “coffee-machine” moments. 🤝☕ Who this episode is for Founders, co-founders, startup leaders, operators moving into governance roles, early investors, and anyone designing boards for growth. 🎯 Key takeaways (fast facts) • Treat your board like a product. Define requirements, iterate, and measure fit. 🛠️ • Pick for fit and value, not for logos. Big names ≠ right chemistry. 🏷️ • Build before you “need” it. Governance works best when it’s proactive. ✅ • Map your risks early. Decide what to mitigate vs. accept. ⚖️ • In a crisis, boards add altitude. Perspective, networks, and calm execution matter. 🧠 • “Know your place.” Great board members challenge, support, and don’t try to be the CEO. 🪑 Memorable quotes • “Build your board like it’s your product.” 🧪 • “Smart startups don’t build boards because they have to—they build them because they’re ready to go the distance.” 🏁 • “Governance isn’t a brake; it’s a launchpad.” 🚀 Guest Marieke Flament — operator, two-time CEO, investor, and board member at the intersection of innovation, governance, and impact. Connect with Marieke on LinkedIn: https://www.linkedin.com/in/mariekeflament/ 🔗 Host Thomas Michel — Founder of Governance Unplugged – Internal Audit, Risk & Controls. Senior audit & risk leader focused on making governance practical, impactful, and future-ready. Links & resources • Follow the podcast on your favorite platform and on LinkedIn for new episodes and extras. ⭐ • Interested in governance, risk & internal audit topics for your team? Get in touch. 📩 Disclaimer The views expressed by guests are their own and do not represent the views of any affiliated organization.

Governance Unplugged – Episode 8 “Culture in the Spotlight: Where Tone, Behaviours and Risk Intersect” Culture isn’t just a “soft” topic—it’s a core driver of behaviour, and behavior drives risk. In this episode, Thomas Michel is joined once again by Kevin Martin to explore one of the most elusive yet impactful areas of internal audit: auditing culture. Together, they unpack why culture matters, the risks of ignoring it, and how auditors can approach this sensitive area with credibility and value. Auditing culture is not about passing judgment, but about understanding behaviours, assessing tone, and connecting the dots between risks, incentives, and the control environment. Key Topics Discussed • Why culture is a critical risk factor—and what’s at stake if we ignore it • The link between tone at the top, individual behaviours, and organizational outcomes • How to approach auditing culture without making it personal or confrontational • Warning signs of cultural weakness: from mandatory training to incentive schemes • Embedding culture assessment into every audit instead of treating it as a standalone exercise • The role of auditors as both analysts and “organizational anthropologists” • Why whistleblowing, psychological safety, and trust are central to healthy culture • Practical ways to spot “cliff edge” risks and unintended consequences of incentive programs Takeaway Auditing culture requires courage, curiosity, and sensitivity. By focusing on behaviours, incentives, and tone, internal auditors can shine a light on cultural dynamics that either strengthen or undermine resilience. Culture, when understood well, becomes not a minefield—but a source of meaningful insight and lasting organisational strength. Listen now on Apple Podcasts, Spotify, or your favourite platform—and join the conversation on LinkedIn at KeyStone Governance.

Governance Unplugged – Episode 7 “Beyond the Hype: Using AI with Integrity in Internal Audit” Guest: Gavin Martin, seasoned internal audit executive and technology risk expert with leadership roles at UBS, Credit Suisse, and Lloyds Banking Group. How can we embrace Artificial Intelligence in Internal Audit, without losing our professional skepticism? In this episode, host Thomas is joined once again by Gavin Martin to explore one of the most pressing topics in today’s assurance landscape: the rise of AI. Together, they unpack how internal auditors can leverage AI responsibly, without falling into the trap of blind adoption or over-reliance. Drawing on decades of experience and sharp observation, Gavin explains how to distinguish between efficiency and effectiveness when applying AI, and why focusing on outcomes is more critical than ever. Key Topics Discussed: • The real value of AI: boosting efficiency and audit effectiveness • Why outcome thinking must come before AI adoption • How unconscious biases and “authority bias” can mislead auditors • What “AI drift” is, and how to spot it before it erodes trust • Risks of over-relying on AI-generated audit evidence and reports • How internal audit can audit AI-enabled business processes • What it takes to build responsible AI governance frameworks • Deepfakes, model risk, and the return of old-school audit techniques • Human roles in an AI-driven audit world: recalibrating expectations Takeaway: Adopting AI is inevitable, but it must be done with clarity, curiosity, and integrity. Don’t just follow the trend. Define the outcome, align the tools, and empower the humans behind the process. Gavin’s Advice to Auditors: “Focus on the outcome. Know whether you're targeting efficiency, effectiveness, or both. Then ask the right questions, of the AI, and of yourself.” Don’t forget to follow or subscribe to Governance Unplugged on your favorite podcast platform and connect with host Thomas Michel on LinkedIn. Have a guest or topic in mind? Visit keystone-governance.ch to get in touch.