You may also note the change of name: as the podcast has grown, it has attracted a broader audience. Our new name – Beyond Finance – reflects that broader remit, while still anchoring us to its finance and accountancy origins.
Host
Philippa Lamb
Guests
- Baroness Ayesha Hazarika
- Jo Fairley, Co-Founder, Green & Black’s
- Tim Doubleday, CFO, Burger King UK
- Ololade Adesanya, Global Head of Audit – Insurance, Asset Management, Branding and Marketing, HSBC
- Glenn Wilkinson, CEO, Agger Labs
- Neil Cutting, ICAEW Vice President/Transformation Director, Oracle
Producer
Natalie Chisholm
Series Lead
Mark Rowland
Transcript:
Philippa Lamb: Welcome back, and as you can hear today, the podcast team is out and about at the ICAW annual conference at the Intercontinental Hotel, right next to the O2 in London, with hundreds of experts right outside our podcast booth, and you can probably hear the coffee machine in the background. We're going to be interviewing hand-picked selection from a range of sectors about the specific challenges facing their businesses right now, and how they're rising to them. We'll hear from organizations as diverse as Burger King and Green and Black. The conference theme this year is turning business complexity and change into value. So, how exactly are they doing that?
Baroness Ayesha Hazarika: I do think that devolution, if it's done the right way, is a very, very good idea. We are quite a centralized economy and quite a centralized political country. A lot of our decisions are taken in Westminster and Whitehall. It just makes sense that sort of local decisions are best taken with greater proximity to the area that they're covering.
Jo Fairley: I think the danger is that businesses sort of wait for some sense of calm and for things to kind of sort themselves out and the world to become a calmer place. And actually, I think that the volatility and the unpredictability is the new normal, and that that's what we've got to adapt to.
PL: Just before we make a start, I'm also really delighted to announce a brand new name for the podcast. It launched over six years ago to talk to accountants about accountancy, but like so many other startups, it's grown into something far bigger, broader, and more ambitious. 1000s of you listen in every month, and while many of you do hold accountancy roles, many of you don't. We feel that it's business and finance that connect you all, so we're renaming the podcast to reflect that. Welcome to the first episode of Beyond Finance.
Before we hear what businesses have to say, we're going to talk to Baroness Ayesha Hazarika MBE, peer, political commentator, broadcaster, and journalist. She's just about to go on stage for the State of the Nation session. Thanks for joining us.
AH:Pleasure.
PL:What do you see as the biggest problem for business across the piece right now?
AH:I think it's a really difficult time for businesses of all sizes, but particularly small and medium-sized businesses. I feel like they are facing a very, very harsh climate. There's no doubt that the raising of national insurance for employers has caused a lot of cost, but also a lot of administrative costs.
I know, for example, just in my own anecdotal experience, you know, my local beauticians, for example, which is a small kind of thriving high street enterprise. It's exactly the sort of thing that the government wants to see. It's young women becoming entrepreneurs, training up other young women in the area to be apprentices and all of that. So it's really sort of good. All the boxes are being ticked. It's good for the community, but they are really struggling in terms because their margins are not huge.
So they're really struggling with the rise in national insurance and also the additional admin that puts on as well, so I think that is something. But I think just the general economic climate is very difficult for businesses right now. There's a definite squeeze on people's spending because people are very nervous about what's coming down the track. The cost of living is very, very high. The other thing is energy costs are really, really difficult for companies of all sizes at the moment. You know, the cost of doing business feels like it's quite high, so it does feel like there are quite a lot of challenges for business right now.
PL:Now, Andy Burnham's administration is new. Any policies that you're seeing so far that you're really liking the look of in this space?
AH:I do think that devolution, if it's done the right way, is a very, very good idea. We are quite a centralised economy and quite a centralised political country. A lot of our decisions are taken in Westminster and Whitehall. And I, having been both a civil servant and a political advisor, now member of the House of Lords and a journalist that covers a lot of business stories and local government stories as well, it just makes sense that sort of local decisions are best taken with greater proximity to the area that they're covering.
But it has to be in the execution. You know, devolution can't just be a beautiful organigram. It actually has to deliver tangible change. And I feel like, I think something that worked very well back in the day was the old regional development agencies, the RDAs, and I think why they were quite good is that they were doers. They got things done. They were very, very good at bringing together the sort of magic alchemy of local businesses, the local universities and colleges. You know, all of that sort of together, the workforce, local government. All the kind of ingredients you need to get sort of growth. So I do hope that devolution can try and sort of recreate some of that.
PL:Yeah, we saw that model right here in Docklands, didn't we? The development agency up in the northeast works well, and enterprise zones as well.
AH:Yeah, absolutely. I do always remember, you know, back in the day when we would go out and about visiting when I was a civil servant and a special adviser in government, businesses or people had good things to say about the RDAs, and then they were sort of stripped away.
I think that's something that people get very frustrated about, particularly from business, when there's changes of administration and changes of leadership. And let us be honest, we've had a lot of change at the top, particularly our Prime Ministers. There's been a revolving door of Secretaries of State and Ministers of State and all that stuff, that is quite hard for businesses to deal with as well. So I think a bit of, you know, if you're going to get devolution right, don't necessarily reinvent the wheel. The RDAs did quite a good job. Let's try and actually, instead of it all just being about hey, let's talk about the bureaucracy, let's make the doing happen.
PL:And they had broad powers, didn't they? They really could get stuff done quite fast, and they did.
AH:Yeah.
PL:Budget – it's coming, and it's soon. What are you looking for?
AH:Even though John Healey has been at pains to say I'm not going to do lots of speculation ahead, because –
PL:There's been a lot, though, hasn't there?
AH:I mean, there's always a lot of flight crying – kite flying, even. I think this is going to be a pretty difficult budget for him, and budgets can really make or break a new Chancellor. As we sort of saw with Rachel Reeves, she had a very difficult first budget. There was that rise in national insurance contributions, but also the winter fuel allowance, which ended up being very politically, I would say, devastating for the Labour Party. That was a combination of sort of economics and politics colliding badly, and it's something that people still remember now.
So I think John Healey and Andy Burnham will want to tread quite carefully. They're really trying to brief out: this is not going to be a big bang budget. There are likely to be, I think, tax increases. We've seen a lot briefed out, even this week, about potentially banks having to pick up more of the cost. I think that feels plausible because, I think at the moment they're not going to want to raise taxes on ordinary people or small and medium-sized businesses that they know are coping -
PL:They're fettered in many ways, on the big taxes, aren't they?
AH:Yes, exactly, and they're completely – they're held back. The other thing, which I think is quite hard with this budget, is the spending review is not going to happen until next year, and the spending review is really, really important, because that is when the Chancellor really sets out the allocation of resources to different departments. So I think they're going to want to have quite a low-key budget and then kind of steel themselves for the spending review, which will be tough because, for many nerds listening to this, they will remember that in Rachel Reeves's first few budgets, she basically backloaded the spending cuts to later on in the Parliament.
So there's not going to be a huge envelope. But I'll just say this finally: just the overall picture is going to be tough because we know that the energy bills are going to go up, the energy price cap is going to go up, inflation is likely to go up, interest rates are going to go up, the cost of fuel and food is going to go up. So all of these things are going to make for sort of just a generally very tough climate.
PL:And that delayed spending review-it's more uncertainty of a business.
AH:Correct.
PL:Thank you very much indeed.
AH:Thank you.
PL:So fresh from the same session, and you can hear the hubbub, all the delegates coming out of it. We have Jo Fairley, co-founder of Green and Blacks. Welcome, Jo.
JF:Thanks for having me.
PL:How was the session? Lively?
JF:I thought it was really lively, and I think that we all brought quite a different perspective to the event in that mine is kind of lived experience and the other two have very different experiences. So yeah, I think it was fun, actually.
PL:Good. That's what it's meant to be, right?
JF:Yes.
PL:I'm interested to hear you talk about your own specific experience because this podcast we're talking about challenges specific to different sectors. Baroness Hazarika talked about all sorts of things that face businesses. You know, energy costs, national insurance, a whole array of geopolitical events. But for your business, what is the big one right now?
JF:I think, whenever you are dealing with an agricultural product, as we are, and as the whole food industry is basically, your supply chain is the most important factor. Without your ingredients, you can't make food. I mean, I always think that farmers ought to have a bumper sticker that says: "I farm so you can stay alive".
I think that we tend to think of farmers as somehow wealthy landowners, etcetera, and actually they're keeping us all upright. But when you have particularly more unpredictable climate emergencies around the world, I mean we've had hurricanes to deal with in the Caribbean, etcetera. You have to get your plan B and your plan C worked out, so you have to have those in your pocket.
PL:Your raw materials come in predominantly from the Caribbean, do they?
JF:Cocoa comes from the tropics, essentially. Yes, it doesn't luckily flow through the Strait of Hormuz.
PL:Well, that was going to be my next question. So that hasn't affected your business?
JF:No, that aspect of it has not affected the business.
PL:Freight costs? insurance?
JF:Of course, and also actually cocoa has been subject to massive speculation price-wise in the last few years, where commodity prices just skyrocketed from about $3,000 a ton to around $13,000. They've gone back down now, but I think we've seen that unpredictability come in that we never really had before, and that's a worry that that might happen again.
PL:Because as you say, it's an organic product. You're always going to be thinking about the weather, local conditions, but now there's a whole raft of other things. You mentioned fallback plans. Tell me about it.
JF:I'll tell you a funny story about a fallback plan, which was that initially, Craig and I did get our cocoa from West Africa when we launched Green and Black's, and there was a political uprising in Togo. Okay, and the beans did get blockaded in the ports, and we did have to fly them out, which was a bit of a kind of nail-biter and a head scratcher for an organic, green, sustainable business.
PL:And an early stage company.
JF:Yeah, an early stage company, and at that point you couldn't buy organic cacao via a trader. It wasn't for sale on the open market. As far as we knew, we pretty much had the only supplies. It was like: what are we going to do? So we realised we needed a backup plan, and rather hilariously, we turned to some farmers in Central America, where we had been on holiday and stayed in a cocoa growing area, okay, and literally that was the only place we could turn.
It was like, we got in touch with the cooperative. They'd been badly let down by an American well-known chocolate company, and they had beans that they could sell, so we actually found our secondary supply from being on holiday somewhere. But I think that's the kind of resourcefulness and ability to kind of be agile and nimble that small businesses have. And I spend a bit of my time now helping big businesses learn the lessons of the founder's mentality and that agility and that ability to pivot and you know just find solutions rather than be stuck like a rabbit in the headlights.
PL:Yeah, get away from the process and actually keep the business on its feet.
JF:Yes.
PL:I mean now, as you say, you've talked a bit about the challenges you're facing right now, there's still uncertainty. The Strait of Hormuz is not a problem for you. Who knows what else there will be, though, in those terms?
JF:I think that is the new reality. I think the danger is that businesses sort of wait for some sense of calm and for things to kind of sort themselves out and the world to become a calmer place. And actually, I think that the volatility and the unpredictability is the new normal, and that's what we've got to adapt to.
PL:So, do you do a lot of scenario planning then, running scenarios of what might happen? How you'd address it?
JF:I'm no longer responsible for the scenario planning, but I think that every business has to spend a bit more energy and invest some time in scenario planning, because otherwise, you lose that momentum when you've suddenly got to deal with a crisis and you haven't thought about what you might do if… it's absolutely worth investing time in that. And I learned very early on from my rather wise husband, who has a longer business experience than me, that we spend a lot of time in business focusing on the urgent rather than the important, and scenario planning is really important. And that means that you've got a plan when it becomes urgent.
PL:Talk to me about Europe, because there's been a lot of chat about the potential for closer ties with Europe again. I think perhaps it came up in your session. What would that mean for your business if that came to pass? Would it be beneficial directly?
JF:I think not just for our business, but for just about… you know, I deal a lot with very small businesses. I have a magazine about perfume, rather randomly, and I deal with a lot of kind of small niche fragrance brands who have been absolutely bound up in red tape and unable to sell their product to Europe, and had all sorts of restrictions placed on them, and I mean, have cleverly tried to find markets elsewhere. But I do think that that lack of free trade with the European bloc has been hugely detrimental across an enormous number of businesses, and it's not a political thing for me, but I just genuinely feel that making trade easier, rather than, say, imposing tariffs or tying people up in red tape, is how you build growth.
PL:We're talking of tariffs. Have Trump's tariffs directly affected your business?
JF:No, there are there is no tariff problem for us, but I know lots of other people who've literally, again, had to stop selling to America, and are looking instead to India and China and other markets. And it does make you think, and it does make you look around, and that's probably no bad thing, but at the same time, I think the sheer flipping unpredictability of it is very unsettling for everybody. The sort of, you never quite know when you wake up in the morning and look at your phone, exactly which goalposts will have been moved overnight on whatever whim.
PL:Talking of looking at your phone and what might happen next, the last thing I wanted to ask you: the budget is coming. What are you hoping for, Jo?
JF:I can't – I mean, I haven't got a crystal ball. Personally, I think, as somebody who lives in a town where there are a lot of small businesses, I would, if I could wave my magic wand, and I don't think it's going to happen, I would like to see the increase in national insurance rolled back, and I'd like to see the business rates increase rolled back, because those have, I have seen in my own community, businesses failing and fail because of those two measures.
I've also seen a black economy emerging, which is appalling because those little businesses, which have a very slim margin, can't afford to pay the higher wage with the national insurance, and that money is completely not in the tax system, then. I mean, it's not what we want. It's not what we want. And my ultimate feeling is that people can't do anything about world events. I mean, we vote for somebody every five years, but we don't usually, anymore, get who we voted for a couple of years down the line.
PL:Well, not in recent years, no.
JF:But we can work to build our communities and make them into better places. And I suppose that, of Andy Burnham's messages, that the understanding of the importance of local economies and local communities and the role that we can all play in them; that has a very direct impact on our sense of happiness and well-being, and that's where I would like to see a lot more focus put.
PL:Well, you and the Baroness are on the same page.
JF:We are.
PL:Thank you very much indeed.
JF:Thanks so much.
PL:Now, hospitality is always a tough sector. Recently, it's been hard hit by a succession of challenges. Tim Doubleday is UK CFO of one of the biggest fast food chains in the world, Burger King. Welcome, Tim. Thanks for sparing us a bit of time.
Tim Doubleday: Thank you.
PL:Run me through some of the big problems facing your business right now.
TD:The main things that we're concentrating on at the moment is really the macro environment. Obviously, the conflict in the Middle East has had quite an impact on oil and gas prices, and we start to see those come through in things like distribution costs and directly related products like plastics and packaging. But I think the concern for us is the secondary effects and how those will start to come through in 2027. Some of those we'll see in CPI. So wage increases, for example, public sector days that were already decided when everything happened in February 26, and obviously now they will be included there. So we'll see inflation, we'll see, probably, interest rate increases, but also things like… fertiliser isn't talked about much, but fertiliser coming out of the Middle East is something that the UK is very dependent upon.
PL:So this is a Strait of Hormuz problem?
TD:A Strait of Hormuz problem, yeah. We talk about oil, but fertiliser is another big one, and fertiliser coming in from North Africa as well will have an impact on yields; things like wheats, things like potatoes. So we see general inflationary pressures around those. Our product is fairly simple. You know, it's a bun, it's chips, it's a beef burger, it's salad. So the commodities that concern us are, I think, fairly self-evident.
PL:Where does most of the beef come from?
TD:So we actually split ours. Around half comes from Ireland, and the other half comes from a business based in Yorkshire. So it's in and around the north of England.
PL:Okay, so I was imagining South America, and that you would be having issues with supply chain there. But no?
TD:No, no. We are 100% UK and Irish beef. It's something that we see as very important to us from a provenance perspective, and in that, there's a perception of quality as well.
PL:So freight prices in that regard, and tariffs in the States, that's not been an issue for you around that?
TD:Not directly. Indirectly, it's quite interesting, as a lot of beef from Brazil, for example, has been going into Europe. And beef is an international commodity, so if there are impacts on things like tariffs and so on going into Europe, then that might reflect particularly, say, on Ireland and whether Irish beef comes into the UK or goes into Europe, and the cost of beef.
And beef is 35% of our procurement, it's been a cost that's been going up. There is, in 2027, we're seeing cost reductions through a number of things. One is an oversupply, but secondly is just changing consumer trends. Less beef is now being eaten. The supermarkets have eventually put the cost of beef into their products, so you know that's now starting to happen. So we are seeing a slight reduction there. But the other – one of the other main things for us for UK and Irish [products] is the carbon footprint, and we do quite a lot of work on sustainability and the carbon footprint and some of the regenerative work that we do really does help, from the sort of sourcing of Ireland, in particular.
PL:Obviously, some of the macro challenges you talked about, there isn't much as an organisation you can do about them. The ones that are close at home, the ones that are about the cost, you can perhaps control more readily. What sort of measures are you putting in place to deal with things like, as you say, you know, fertiliser is getting more expensive next year. I mean, are there things you can do now?
TD:There are. It's really about sourcing. It's about de-risking where product comes from. Most of our products, if it's not UK and Irish, it's mainland Europe. We are looking at chicken coming out of Thailand, which is quite common across hospitality. But we buy certain products as a global brand, and then we buy certain products closer to home, so it's looking at that sourcing and seeing what we can do to help mitigate some of those costs. And obviously, you know, we buy big volumes, so we can try and get a little bit closer to producers in doing that.
PL:So, thinking about continental Europe, obviously there is talk at the moment, isn't there, about closer ties again with Europe. Presumably that would be good news?
TD:Yes, yes. I mean, the markets in Europe, some of our products…you know, it gives us that ability to to spread our supply more more broadly. Yeah, obviously there's a Euro impact in all of that. So we manage currency closely as well, but anything that just simplifies bringing products into the UK, including from the Republic of Ireland, then that will just reduce red tape and make things easier for us.
PL:And having said there isn't much you can do about some of the macro problems, you do work with government, don't you?
TD:Yes, I work with the Hospitality Sector Council, which is sponsored by BIST, as it now is, or Department for Business and Trade for us, and we have a remit to co-create solutions with government around the sector's problems. And it came into being really through COVID, led by Dame Karen Jones, and it's chaired now by a lady called Jane O'Reardon, alongside the Minister Kate Dearden. I chair the sustainability committee for them, but obviously involved in the sort of broad spectrum of things.
We're not one of the main eight industrial sectors, but we had our remit renewed this year, which was a real positive for us as a sector. And everything we're doing is looking at how we can align what hospitality needs to do with a growth lever. So it's all, with governments, everything is how can we get the sector to grow. And one of the things with hospitality, we employ three million people. That's about 10% of the UK workforce. Our supply chain is another three million people. And in times of growth, hospitality employs, depending on the statistics, you see one in three, one in five new jobs, and a huge proportion of those are in that NEET category. So you know what we say with hospitality, to coin a phrase, it's growth in every postcode, and also it's growth, you know, for young people and bringing young people into jobs.
PL:I imagine a lot of the stuff that's discussed behind those doors is confidential. But are you seeing policies beginning to emerge from this really very new Burnham administration that play into what you'd like to see for the business?
TD:I think there are undercurrents, positive undercurrents. Obviously, the Autumn Statement and what comes out in the Autumn Statement will be interesting. I think, as a sector, we have to reflect on the fact that the government doesn't really have any money, and lots of things that we would want – for example, there's been a large campaign on the 10% VAT rate – when you look at those sorts of things, it does cost money, but also it's very job creative.
So we have to be realistic about what government can achieve. My personal view is, it is actually a big win for the sector if nothing happens. Stability and a lack of headwinds will really help sectors like ours. And, you know, that sort of 'anything but consumer' position that a lot of investors have, we need to dispel that so money can come into businesses like ours and retail. The government can play a big part in that by creating a stable platform and actually just not throwing any more headwinds at a sector that's taken far too many.
PL:It must be really interesting sitting on those committees. Just the sense of, I'm assuming that people are pretty frank when they're in those rooms?
TD:Yes, yes, they are. Yeah, and we have access to a number of things that we can't talk about, but things like the Milburn report has talked about at the moment. We've seen drafts of that. We understand where that's coming from, so it really helps you understand the direction that government is going in. And then, from my own business perspective, we can then scenario plan around that. And you never know what's going to happen until it's going to happen. But yeah, it really does help us to think through the different scenarios that we might be faced with.
PL:Thank you very much.
TD:Thank you.
PL:So now onto financial services, a huge contributor to the UK economy, central to the government's industrial strategy, as we know. Ololade Adesanya is global head of audit at HSBC. Ololade, thanks so much for sparing the time to be with us.
Ololade Adesanya: Pleasure.
PL:Tell me, and again, I know this is a big question: the biggest challenges facing the sector in this moment.
OA:I see three interconnected challenges that impact on the financial services sector.
PL:Okay.
OA:So the first one is very macro, which is the geopolitical and macroeconomic risks, including the war in Iran, rising interest rates in some parts of the world, low interest rates in other parts of the world, and we see these affecting markets, affecting credit, affecting risks, liquidity, and customer experiences in real life, because its impact on consumers that use financial services products. So that's one.
The second one relating to that is technological risk, and technology is changing the sector, as with other sectors, significantly. It's having a very big impact on our industry, and the role of AI in that cannot be overstated. It's fundamentally changing processes, changing really products, changing how we interact with consumers, ensuring that we are connecting with a broad range of consumers as well, and driving efficiency. So it's linked to costs, it's linked to profitability, investment returns, but also operational efficiency in our organisation.
And the third bit that I will perhaps raise, which is also absolutely related to that, is the role of regulation in all of these changes. So, regulation is catching up with the pace of technological change. Regulation is coming in to moderate and ensure stability at a time where we're going through geopolitical and macroeconomic risk factors, and so there's a huge and unprecedented amount of regulation impacting on the industry now than we've ever seen before, and so for every organisation that wants to be successful in this era, it's really important to understand how those risks interplay and impact within their businesses in financial services, impact on the market, and continuously manage and assess and review the emerging risks that arise as a result of those three combination of you know bigger risks.
PL:You've laid it out really clearly for us. I'm interested to know, as head of internal audit yourself, what's top of your priority list?
OA:It's a really good question, and actually, internal audit as a profession needs to catch up with all of these changes. It's absolutely fundamental. And for me, it's important that – I mean my priority as head of audit is to provide independent, forward-looking assurance on the risks that matter the most for my organisation, for the business that I look after, and this starts with the fundamentals. So, financial and operational resilience in these times is important, ensuring that in spite of what's going on in the world and these risks, we're still really ensuring good customer outcomes, and we're focused on the customers and the consumers, so that drives conduct risk as well.
And financial crime is a big risk, actually – we know that cyber security is a global risk at the moment, but also underpinning that is financial crime risk, which is integral to cyber risk to an extent. So looking into all of that, ensuring data quality, ensuring regulatory compliance, is all very fundamental. But in addition to that, I think internal audit must also look ahead, essentially, into how AI is going to transform our profession, transform the businesses that we audit, and think about third-party concentration risks, and that that could manifest within our organisation, and so be aware of changing business needs.
So, for me, I want audit not to be seen simply as a function that just provides assurance and identifies control gaps, and identifies issues, but to be relevant in helping the business to solve some of the fundamental problems that they're experiencing in this time, as a trusted partner that brings insight, challenges, and constructively help our organisations to act before emerging risks start to crystallise. Independence is essential, but also of relevance is pace and impact, just given the unprecedented times that we're operating in.
PL:Looping back to AI, as you say, in audit, it's not a question of will you; it's a question of how and when, isn't it? So, the pace of change, and we've covered this a lot on the podcast. Obviously, we're talking to people about AI, the opportunities, the savings, everything that's great about it, but obviously the risks as well. For you, as an audit chief, the pace of adoption, which is necessarily market-driven, is extraordinarily fast. Does it concern you?
OA:The pace of adoption is astonishing for AI because it's unbelievably quick, probably faster than we ever anticipated when the whole conversation and debate about AI came to life, and my biggest worry as head of auditors, you know, how do we ensure that we can keep up with the pace of change to understand really the changes enough to be able to provide impact, assurance impact.
PL:But without unintended consequences?
OA:Without unintended consequences within our organisation, because actually AI is multidimensional, and I do feel very strongly that internal audit really needs to be the conscience of AI. So we need to be able to understand the algorithms to ensure that it's driving the right customer impact. It's not driving detriment to some really demographics of customers, but also at the same time ensure that you know our challenge isn't injuring innovation within our organisation.
PL:How do you do that, in reality?
OA:So I think it's important to be part of really every AI initiative, rather than come to the table late. It's important that internal audit arrives early and arrives on time, whilst it's still conceptual, and provide ongoing challenges, constructive feedback, constructive ongoing continuous monitoring type assurance as the project is evolving.
PL:The things we talked about in regard to AI a year ago now seem so, so out of date, but you know, it's extraordinary to me how everything has changed so fast. That must for you, in that role, thinking about the adoption of AI within your organisation and generally, keeping abreast of that, it must be a challenge.
OA:It is, but internal audit has a role in ensuring responsible adoption of AI, not to hinder the pace of change, because you need to really innovate very quickly to continue to be relevant. I mean, the world is changing so rapidly. So if you're not innovating quickly, you might lose relevance, and actually that would impact on the third line if we're not being change agents.
PL:That's the driver, isn't it?
OA:Audit can be change agents, but as we're doing that, ensure that we help organisations to understand risks, and also understand opportunities. And as they're driving the opportunities, they're putting in the right controls and framework in place to manage and mitigate risks, as they're really sort of developing their AI transformation programmes.
PL:What keeps you awake at night?
OA:I like to sleep, but I would say that for me, it's really just the fact that we don't understand how enormous, really, sort of this change that AI is going to cause will be, and that impact on different aspects of not just the audit profession and the accountancy profession, but also different professions. I mean, there was a whole lot of talk earlier in the conference today around how AI is going to make a whole lot of roles redundant, essentially, and so we need to see how we train our teams within audits and our accountancy graduates to be very conversant in using the technology, in living with the technology to an extent that we get to a point where humans and AI are working, you know, and coexisting to drive value in our environment, in our society, but also in our organisations, and, you know, that's not an easy thing to achieve. I'm not sure we figured it out. That really sort of keeps me awake, because it's very difficult to anticipate where you know that debate would end.
PL:Thank you very much indeed. Now, if you're a regular listener to the podcast, you will know that we recently aired an episode about the extraordinary prevalence of identity theft and the threat it poses to business. Now, ethical hacker Glenn Wilkinson of Agger Labs has just finished demonstrating live on stage how hackers get into organisations. He's with me now. Glenn, how was it? Was everyone horrified?
Glenn Wilkinson: They were a little bit horrified. My whole thing is let me scare you enough to pay attention, but then let's not make it all fear and doom and gloom. Let me show you how hackers think, how they operate, and then what we can do about it.
PL:So what did you show them?
GW:So my whole thing on stage is cyber doesn't have to be boring. So let's tell stories, a bit of history of how we got here, hacker lore and mythology, and let's do a live demonstration. So actually, I spun a wheel of who we're going to hack live on stage, and I got the names of the companies from the audience beforehand.
PL:Did you?
GW:They were all a bit nervous, but then luckily it landed on my demo dummy organisation, called Bueno Bank. Then we do a live hack on stage of, this is how a hacker would approach Bueno Bank, hack into the bank, steal the money, and get out the door.
PL:So I imagine there were some pretty horrified faces in there. I mean, you demonstrated how easy it's done. Do you get a sense that most organisations really understand how vulnerable they are, even if they're a small organisation?
GW:It's almost like a medical condition. No one thinks they're going to get some horrible medical condition until it happens to them. It's the same with cyber. We all think it'll never happen to us, or I'm too small to hack, or I've got nothing interesting. But the problem is, a lot of hacks or hackers are more opportunistic; they might just stumble across you, or you're part of a bigger system, and hackers want to get to some larger entity, and you're the way in.
PL:Yeah, you're on the supply chain.
GW:Exactly, that supply chain is such an interesting risk at the moment, I would say.
PL:That's interesting you say that, because our fantastic experts in our previous episode were all about that, and so this is the issue now that everyone creeps in right down the supply chain and works the way towards their objective, and that's what you're seeing?
GW:Exactly that. So you can be the most secure organisation in the world, and you understand your own risk, and you have everything in place, but then you have some new outsourced support channel who handles customer support or something, and they're badly configured, but they have an access channel back into your organization. And hackers know that. Let's go and target that little guy, rather than kicking down the front door of your big fort, and that's often a way in, we find.
PL:I mean, I know this is a huge question, but what is the biggest defense there? What do you do? Because everyone is connected to everyone else's business. You have a supply chain, however small you are.
GW:There's two ways to think about that. So one, what is interesting and useful for a hacker, and hackers like complexity and big, complicated systems. So, if you have tons of different systems, all interconnected, lots of suppliers, and and now you're on the AI bandwagon, you're just bolting on AI, that increases what we call your attack surface area, how much stuff you can attack, and increases the chances of things kind of going wrong. So that's the one thing to think about: managing your attack surface area.
And then, my advice that I give to everyone, if it's a massive company or an SME or my mom, it's get your basic cyber hygiene right. If you invest in the basics and then later get the harder stuff right, but get the basics right, because that's what's going to hurt you. It's things like password management. So use a password manager. Don't reuse passwords. Have some degree of complexity. Have MFA, you know, the little app. You put a little code in. Have your backups and test your backups.
If you're an organisation, make sure you do things like network segmentation and deception tech. There's all these almost fundamental things to get right. And if you're listening now, if you're a small organisation, go get Cyber Essentials. It's a government-funded programme that gives you a pathway to being more secure, and I would say getting the basics right will put you in the best possible position. Because you don't need to outrun the bear; you just need to outrun your mates. And if you're a bit more secure than everyone else, you're likely to be golden.
PL:That's a very ruthless defence strategy, but I take your point. There's also the reluctance to, in a very tight, you know, finance environment, to spend the money on cyber defences.
GW:Yeah, one more thing. You know, then we'll be secure. One more time.
PL:All that and the regularity of it, the idea, I think it's difficult for non-tech people to grasp, that this is not a 'job done' task. It's an everyday, all the time task.
GW:Ongoing business continuity is the key.
PL:So fatigue is a huge barrier, isn't it?
GW:Yep, yep, it absolutely is. My advice is: so one, cybersecurity should be a management rhythm; it should be on the board agenda every time. And two, I don't think it should be the problem of the IT guy or even the CISO. It should be, I think, the business continuity officer or the person who worries about economic turn down, pandemics, and fires.
Ransomware, hacking, those types of things, I think fall into those categories of an existential risk to your business. So let's take it a little bit away from IT, make it more of a business problem, and then I think it makes it easier, because the people who are business continuity people, they understand risk a lot better from a high-level view. Whereas the IT guy is just 'well, we need better firewalls, so give me more money for better firewalls'. It's kind of a narrow approach, I would say.
PL:Do businesses talk enough about it to their people, do you think?
GW:No, I don't. I don't think so. And I think there's two things to address. So one is, at the board, it should be discussed, and it should be this ongoing rhythm that we kind of understand and appreciate and fund. And two, it should be. That trickles down to the organisation, so people who work there understand it's a priority.
PL:There's a kind of cultural problem, isn't there? I sometimes think with tech teams anyway.
GW:Absolutely.
PL:Because, without wishing to be in any way derogatory, they sometimes can feel a bit 'other' and separate, and culturally can prefer to be that way on occasion. So reaching out to them if you have an anxiety or just thinking, was that a bit weird? Should I have clicked on that? Isn't always an easy thing to do, is it?
GW:It's not, and it's going to be a 'stupid user. Why did you do that?' Or 'stupid user, obviously that's safe'. But Bob in accounting doesn't know if it's server.microsoft.com or Microsoft.server.com, or is it HTTPS or the other thing? So I think we have failed as cybersecurity practitioners if the onus is on Bob. There should be better systems in place to keep Bob and the organisation secure. And there are lots of solutions in that direction and better ways of thinking. I think we're getting better as an industry, but also we need to put to bed those old ideas of – there's tons of them – change your password every month. Terrible advice. Bob in accounting should –
PL:But why is that terrible advice?
GW:So it's one of those things that we thought was a good idea. So 10 years ago, even at the NIST level, official advice was: change your password every month. And it's good because… it's good in the sense that we have a hypothesis. Our hypothesis is: if you change your password every month, it's harder for hackers to guess it, or if they steal a password, it won't work anymore. Good hypothesis.
In practice, what do users do? Well, they get so fed up of changing their passwords, they just put a number one on the end of it or a number two, or they choose bad passwords, or they write the password down. So it turns out that the outcome is unexpected, and it creates worse security. So we need to update our thinking to match that.
And the updated thinking from official guidance for NCSE or NIST or something is: don't enforce password changes. Rather, use good passwords, and we encourage things like pass phrases. 'The quick brown fox jumped over the lazy old dog' is better than ‘trombone’ with zeros and ones and things because it's easier for a human to remember and a bit harder for a machine to guess. But also two things: one, use things like password managers. I use one password. I remember one password, unlock it. Everything else -
PL:In a vault?
GW:Yes, in a vault. Or if you're not so tech savvy, literally, some IT people will poo-poo it, but get a book and write down your passwords and put it in your bedside table. Because what is your risk register? Are you more worried about someone breaking into your house and opening this book, or some Nigerian scammer guessing your password because you used the wrong one?
It's all about choosing your risk appetite and balancing that, and figuring out the right way. And then, in general, passwords need to die. Like passkeys are the future, and we're heading towards that. But as an example of advice we thought was good, it turns out it's not. So we update our thinking as an industry, and then… phishing simulations, I think, is another one that we need to put to bed.
PL:All good to know. Thank you.
GW:I will stand on my soapbox all day.
PL:Really fascinating to hear. Thank you.
GW:Yeah, of course.
PL:Now, one of the solutions to many of the issues facing challenge in organisations is obviously transformation, organisational or departmental change, to accommodate new ways of working. Neil Cutting is ICAEW's Vice President. He's also, in his day job, Transformation Director at Oracle. Now, Neil, we talk a lot about transformation. It is absolutely crucial for businesses now, isn't it? What are the biggest challenges, and actually making it happen?
NC:Transformations are really important, and the big challenge now, in my opinion, my personal opinion, is the same as it's always been. It's really understanding: why do your exec leadership, your board, want you to go through this big transformation? Why are they doing it? What benefits do they want? Revenue growth? Cash flow improvements? Governance, and AI improvements? And I always go back to my management gurus from my younger days, the Spice Girls. Tell me what you want, what you really, really, really want, and then we can do it. But not pinning that down early on in the transformation is a big problem.
PL:But as you say, there's always been transformation, and we still see organisations getting it wrong, don't we? Clarity at the C-suite is obviously absolutely vital with the transformation team themselves. What are the things that get in the way of it disseminating effectively throughout the organisation?
NC:So if I say things that maybe I got wrong earlier in my career in transformation. So one: with that exec sponsor angle, with exec sponsors, not collaborating with them enough about the honest situation. There's a lot of ambiguity and transformations and when you start, you don't know everything. I maybe tried to form too much of a perfect solution before going up the chain of command. Instead of saying 'I've got these problems', once I had more confidence later in my career, you know, and tried to work through those together with them, and we got much better answers. And I also got buy-in as well, and then I could help start driving the benefits of the transformation, because I knew what we really, really wanted.
PL:That is interesting. So rather than presenting it as a tried and tested, this is the plan, this is what we're doing, being open about that, it's organic and it's going to change over time. I mean, the trouble there, isn't it ,does create uncertainty for people, that anxiety you see in organisations where your talent starts walking out of the door. So, constant communication, I'm guessing?
NC:I think it's just that sort of confidence that is that you can't do it for everything. Otherwise, why are you employed? But picking those nuggets and working through, you know, going into those exec roles and seeing it from the other side, I like it if somebody comes to me with the honest assessment, and then we try and work through it together, because then I can work out how I can help them. Because I care. I'm the exec sponsor of the programme. I want those benefits. I know what I really, really want.
PL:Is there a new skill set now for transformation? Is it evolving?
NC:Yeah, so one of the challenges as chartered accountants we certainly have is we don't learn transformation programme management skills as part of our course to become an ACA. So one thing: again, I made mistakes earlier on. I always relied on finance people around us because, of course, finance people can do everything, is what I thought. What I realised is actually employing and working and collaborating with experts in their field, like project managers, schedulers, risk managers, who have a slightly different approach. Bringing them into the team brings a much more robust, arguably ruthless, approach to how you make sure you deliver on those benefits that you really, really want.
PL:Thank you very much.
NC:Thanks.
PL:Thanks again to Neil, and thanks to all our guests, and of course, thank you to you for listening. I hope we've given you a sense of the sheer energy and expertise in the room at this year's conference here in London's Docklands. If you're an ICAEW member, remember to click through from the show notes to the ICAEW site and log your listen to this podcast as CPD before it slips your mind. We'll see you next time.
