Governance Unplugged – Episode 8

“Culture in the Spotlight: Where Tone, Behaviours and Risk Intersect”

Culture isn’t just a “soft” topic—it’s a core driver of behaviour, and behaviour drives risk. In this episode, Thomas Michel is joined once again by Kevin Martin to explore one of the most elusive yet impactful areas of internal audit: auditing culture.

Together, they unpack why culture matters, the risks of ignoring it, and how auditors can approach this sensitive area with credibility and value. Auditing culture is not about passing judgment, but about understanding behaviours, assessing tone, and connecting the dots between risks, incentives, and the control environment.

Key Topics Discussed

• Why culture is a critical risk factor—and what’s at stake if we ignore it

• The link between tone at the top, individual behaviours, and organizational outcomes

• How to approach auditing culture without making it personal or confrontational

• Warning signs of cultural weakness: from mandatory training to incentive schemes

• Embedding culture assessment into every audit instead of treating it as a standalone exercise

• The role of auditors as both analysts and “organizational anthropologists”

• Why whistleblowing, psychological safety, and trust are central to healthy culture

• Practical ways to spot “cliff edge” risks and unintended consequences of incentive programs

Takeaway

Auditing culture requires courage, curiosity, and sensitivity. By focusing on behaviours, incentives, and tone, internal auditors can shine a light on cultural dynamics that either strengthen or undermine resilience. Culture, when understood well, becomes not a minefield—but a source of meaningful insight and lasting organisational strength.

Listen now on Apple Podcasts, Spotify, or your favourite platform—and join the conversation on LinkedIn at KeyStone Governance.

Governance Unplugged – Episode 7

“Beyond the Hype: Using AI with Integrity in Internal Audit”

Guest: Gavin Martin, seasoned internal audit executive and technology risk expert with leadership roles at UBS, Credit Suisse, and Lloyds Banking Group.

How can we embrace Artificial Intelligence in Internal Audit, without losing our professional skepticism?

In this episode, host Thomas is joined once again by Gavin Martin to explore one of the most pressing topics in today’s assurance landscape: the rise of AI. Together, they unpack how internal auditors can leverage AI responsibly, without falling into the trap of blind adoption or over-reliance.

Drawing on decades of experience and sharp observation, Gavin explains how to distinguish between efficiency and effectiveness when applying AI, and why focusing on outcomes is more critical than ever.

Key Topics Discussed:

• The real value of AI: boosting efficiency and audit effectiveness

• Why outcome thinking must come before AI adoption

• How unconscious biases and “authority bias” can mislead auditors

• What “AI drift” is, and how to spot it before it erodes trust

• Risks of over-relying on AI-generated audit evidence and reports

• How internal audit can audit AI-enabled business processes

• What it takes to build responsible AI governance frameworks

• Deepfakes, model risk, and the return of old-school audit techniques

• Human roles in an AI-driven audit world: recalibrating expectations

Takeaway:

Adopting AI is inevitable, but it must be done with clarity, curiosity, and integrity. Don’t just follow the trend. Define the outcome, align the tools, and empower the humans behind the process.

Gavin’s Advice to Auditors:

“Focus on the outcome. Know whether you're targeting efficiency, effectiveness, or both. Then ask the right questions, of the AI, and of yourself.”

Don’t forget to follow or subscribe to Governance Unplugged on your favorite podcast platform and connect with host Thomas Michel on LinkedIn. Have a guest or topic in mind? Visit keystone-governance.ch to get in touch.

Timeless Risks & Integrated Assurance: Rethinking the Audit Lens

Guest: Gavin Martin, Experienced Internal and External auditor having worked with some of the largest banks in the world. (Linkedin: https://www.linkedin.com/in/gavin-martin-ukch/)

🔍 Why do “forever risks” demand a different audit playbook?

Host Thomas sits down with Gavin with nearly 30 years of experience across internal and external audit functions at organizations like UBS, Credit Suisse, and Lloyds Banking Group. Gavin shares how how Internal Audit, and the wider 3-lines ecosystem, can stay ahead of risks that never really disappear (think cyber, AML, climate) while orchestrating truly integrated assurance.

🎧 Key Topics Discussed

• Defining timeless risks vs. short-lived “hot topics”

• Moving from photo-snap audits to a full-length film of control maturity

• Why annual planning may block a multi-year risk view… and how to fix it

• Continuous insights: spotting stress points before they become findings

• Integrated assurance in practice: same destination, different vantage points

• Sampling, taxonomies & maturity models, aligning on the fundamentals

• Internal Audit as orchestrator: nudging first & second lines without losing independence

• Small-step pilots: starting with one risk (e.g., cyber) and scaling what works

💡 Takeaway

Sustainable assurance isn’t about more audits, it’s about shared outcomes, aligned methods and continuous storytelling. Start with one enduring risk, agree on what “good” looks like together, and build momentum from there.

🎯 Gavin’s Advice to Auditors

“Pick one area, unite the right people, agree on the outcome, and prove it works. Then replicate. Progress beats perfection.”

📌 Subscribe to Governance Unplugged on Apple Podcasts or Spotify, and connect with host Thomas Michel on LinkedIn (https://www.linkedin.com/in/thomas-michel-ksg/).

Have a guest or topic suggestion? Visit keystone-governance.ch and let us know!

Guest: Gavin Martin, Experienced Internal and External auditor having worked with some of the largest banks in the world.

🔍 What should audit committees really be asking internal audit?

In this episode, host Thomas Michel is joined by governance, risk and control expert Gavin Martin to explore how audit committees can further enhance their effectiveness as stewards of internal audit.

With nearly 30 years of experience across internal and external audit functions at organizations like UBS, Credit Suisse, and Lloyds Banking Group, Gavin shares how audit committees can engage more meaningfully, with the right questions, fostering a deeper understanding of risk appetite, and stronger collaboration.

🎧 Key Topics Discussed:

• Why understanding internal audit’s risk appetite choices is critical for effective oversight

• How to make audit planning and audit universes more transparent to the committee

• The power of generative AI in audit, and the behavioral risks it introduces

• Rethinking assurance: From single-year outputs to timeless risks perspectives

• How audit committees can better challenge, calibrate, and align with internal audit

• Why it’s time to balance audit calendars with flexible, risk-based interventions

• Building trusted relationships through onboarding, curiosity, and clarity

💡 Takeaway:

Oversight isn’t just about reviewing audit reports, it’s about surfacing and aligning on the assumptions and judgments that underpin them. True value lies in transparency, shared risk understanding, and honest dialogue between internal audit and the audit committee.

🎯 Gavin’s Advice to Auditors:

“Be brave enough to have the conversations. Focus on outcomes, not just tasks. The real power lies in understanding, not ticking boxes.”

📌 Don’t forget to follow or subscribe to Governance Unplugged on your favorite platform and connect with host Thomas Michel on LinkedIn. Have a guest or topic in mind? Visit keystone-governance.ch to get in touch.

Episode 3: Beyond the Checklist – The True Power of Internal Audit

Guest: Nicolas Steyaert Head of Internal Audit at Swarovski (Connect on LinkedIn)

In this episode of Governance Unplugged, we go beyond the checklist with Nicolas Steyaert, a seasoned internal audit professional with 28 years of global experience. Nicolas reflects on the remarkable evolution of internal audit—from a traditional watchdog function to a strategic partner that drives transformation, culture, and trust within organisations.

We explore:

• The mirror effect: how internal audit helps organisations reflect and evolve

• Why humility, curiosity, and integrity are the true superpowers of great auditors

• The future of internal audit in the age of AI, automation, and responsible governance

• How internal audit earns its seat at the table and influences corporate strategy

Nicolas also shares stories from his early career at WorldCom, and how that experience shaped his approach to ethical leadership and impact.

Connect with

Nicolas Steyaert on LinkedIn: linkedin.com/in/nicolas-steyaert-2529a83

Thomas Michel https://www.linkedin.com/in/thomas-michel-ksg/

Whether you're an auditor, a corporate governance leader, or simply curious about how internal audit can become a true co-pilot for organisational success, this episode is for you.

🛫 Step into the cockpit with us. This is internal audit like you've never heard it before.

Webpage: www.keystone-governance.ch

Email: [email protected]

In this energizing episode of Governance Unplugged, host Thomas Michel sits down with internal audit specialist and veteran Cynthia Boumann to explore how internal audit can evolve into a future-fit, value-adding function, without losing sight of governance principles.

With decades of experience as Global Head of Internal Audit, CFO, and Big Four leader, Cynthia shares powerful insights on:

• Why internal audit is often seen as a “square peg in a round hole” — and how to change that

• The importance of influence over enforcement in driving value

• How to build trust and credibility across senior leadership

• Embracing agility and design-focused auditing

• Practical ways to embed AI into the audit lifecycle (yes—even talking about scorpion stings!)

• The changing skillset of internal auditors in the age of automation

• How soft skills, curiosity, and joy drive career resilience and relevance

“The true power of internal audit lies in its influence — not in counting findings.” – Cynthia Boumann

Whether you're a Chief Audit Executive or just starting your career, this episode offers practical advice, real-world stories, and a refreshing perspective on audit's evolving role in today's fast-paced world.

Don’t forget to follow, share, and rate the show.

For feedback or topic suggestions, connect with Thomas via LinkedIn or visit www.keystone-governance.ch.

Together, let’s build stronger, more resilient organizations — one conversation at a time.

Welcome to the very first episode of Governance Unplugged! In this premiere, host Thomas Michel—a governance expert with 25 years of experience, including leadership roles at the World Economic Forum—sets the stage for an engaging journey into corporate governance, risk management, and internal audit.

In this episode, Thomas shares the vision behind the podcast, highlights key upcoming topics like the future of internal audit, risk management in a volatile world, digital transformation, and ESG governance, and explains why governance professionals must evolve from oversight functions to strategic enablers.

Join the conversation, subscribe, and be part of a growing community dedicated to driving governance excellence. Let’s build stronger, more resilient organizations—one conversation at a time!

The Global Internal Audit Standards (GIAS) 2025 are here! But what do they really mean for internal auditors, risk managers, and governance professionals? In this episode of Governance Unplugged, host Thomas Michel—a seasoned internal audit and risk expert—breaks down everything you need to know about the new standards.

Key Takeaways:

- Why the new standards matter and how they modernize internal audit

- The biggest changes in GIAS 2025, from a principle-based approach to data-driven auditing

- How to align internal audit with strategy, risk, and corporate culture

Practical steps to implement the standards while maintaining independence and impact

GIAS 2025 isn’t just an update—it’s an opportunity to elevate the role of internal audit and create true business value. Tune in to discover how to move beyond compliance and become a trusted, strategic partner in your organisation.

Don’t forget to subscribe, share, and leave a review to support the podcast and help bring more great conversations to the governance community!

Together, let’s build stronger, more resilient organisations—one conversation at a time.

Contact:

www.keystone-governance.ch