Been sitting with maturity models today, specifically why they feel simultaneously useful and wrong.
The useful part: they give people a shared vocabulary and a sense of direction. “We’re at level 2, we want to get to level 3” is a lot easier to discuss than trying to describe in the abstract what capability looks like. The framework creates common ground.
Most audit analytics programs get stuck somewhere between spreadsheets and scalability. The obstacles aren’t usually technical.
Most audit functions that try to govern their analytics start in the wrong place. They focus on policies when the real problem is clarity about what they’re governing.
Skills assessments in audit analytics often measure confidence rather than capability. Here’s a more honest approach.
Analytics and automation serve different purposes in internal audit. Conflating them leads to bad strategy and wasted investment.