Been sitting with maturity models today, specifically why they feel simultaneously useful and wrong.
The useful part: they give people a shared vocabulary and a sense of direction. “We’re at level 2, we want to get to level 3” is a lot easier to discuss than trying to describe in the abstract what capability looks like. The framework creates common ground.
Audit analytics face a unique constraint: the analysis must be explainable to someone who wasn’t in the room. Most analytics advice ignores this.
Most audit functions that try to govern their analytics start in the wrong place. They focus on policies when the real problem is clarity about what they’re governing.
Analytics and automation serve different purposes in internal audit. Conflating them leads to bad strategy and wasted investment.