"As Capital One embraces the 21st-century digital revolution that we all experience and live every day, it’s become clear that we need to rethink how to address the risks of a bank building a leading technology company that can thrive in a world being revolutionized by software and data, and be part of the company’s journey."
- Chris Kyriakakis, Chief Technology Auditor - Managing Vice President, Technology Audit, Innovations and Analytics
Capital One, headquartered in McLean, Virginia, is a diversified bank that offers a broad array of financial products and services to consumers, small businesses and commercial clients in the United States, Canada and the United Kingdom. It is also one of the most widely recognized financial brands in the United States. That’s due, in no small part, to its highly successful “What’s in Your Wallet?” campaign, which it first rolled out in 2000 with the goal of making its brand a household name.
This year, Capital One will celebrate its 25th anniversary as a public company. It has reached the top 100 of the Fortune 500, built one of the nation’s largest credit card businesses and the second-largest auto finance company, and is now the fifth-largest consumer bank in the U.S. and the eighth largest bank overall.
"Teams across the enterprise — including internal audit — are finding new ways to work and help deliver on the company’s efforts to continually break new digital ground and maintain its competitive edge in an increasingly tech-driven industry."
Each month, tens of millions of customers visit Capital One’s online and mobile customer servicing platform. The company uses credit card transaction data and machine learning to deliver proactive insights to customers about their spending and to help detect problems they might miss. They have features that help online shoppers save money by automatically searching for the best prices across the internet, finding online coupons, and offering merchant-funded rewards. Across the company, Capital One is building customer experiences that are real-time and intelligent.
Delivering real-time, intelligent solutions is just one example of how Capital One is constantly working to improve how it engages with and serves its consumers. The bank also drives innovation through its Capital One Labs — experimental product and technology incubators that work with financial technology (fintech) startups and emerging technologies like artificial intelligence (AI) and machine learning. Through the labs, which are located in tech hotbeds like New York City, San Francisco and the Washington, D.C. metro area, Capital One is evolving the mobile banking experience for consumers. It’s also designing and delivering new services and products, like its AI-powered virtual assistant, Eno, for credit card customers.
Innovation at Capital One is not just the domain of Capital One Labs, however. Teams across the enterprise — including internal audit — are finding new ways to work and help deliver on the company’s efforts to continually break new digital ground and maintain its competitive edge in an increasingly tech-driven industry. “Technology is core to Capital One’s business. We think about banking as an inherently digital product, and we are intently focused on the customer experience,” says Chris Kyriakakis, chief technology auditor and managing vice president, Technology Audit, Innovations and Analytics (Tech Audit), at Capital One. “Capital One has been on a journey to build a technology company that does banking and competes with banks that use technology.”
Pursuing a Data-Driven, Multifaceted Innovation Agenda
Chief Audit Officer (CAO) Celia Edwards Karam leads Capital One’s 300-person internal audit function. She reports directly to the audit committee of the Capital One board of directors. Internal audit staff are distributed across several of Capital One’s U.S. and international offices and provide assurance to the bank’s various business lines and functions. The Tech Audit team, which Kyriakakis leads, has about 80 auditors focused on auditing all of Capital One’s technology and data risk. Tech Audit also has a Data Analytics and Innovation unit, which serves the whole department; Kaleen Love, vice president of business analysis, leads that group.
While the Analytics and Innovation (A/I) organization within internal audit is new — a little less than a year old — the use of data analytics in Capital One’s internal audit function is not. “Capital One has been a data-driven company since its inception,” says Kyriakakis. “It’s also had an internal audit department from the start, so the function, like our company, has always been very data-driven.” About 20 people on the core internal audit team focus on analytics, he says.
The A/I unit, meanwhile, includes data scientists and other specialists who work closely with those internal auditors but are also focused on “deep innovation aspects of audit,” according to Love. She says her group’s innovation agenda includes the following areas:
- Machine learning and AI — The A/I team is exploring how internal audit can apply machine learning models, data science techniques, and other advanced technology products and functionality to Capital One’s vast and ever-growing trove of data “to power deep and broad risk-based insights” for the business, Love says.
- Data products and automation — “We’re looking at how to use data products and automation to support the work that’s done in internal audit,” Love explains. “We’re stepping back and thinking more broadly about how data products can give internal audit line of sight into what’s happening in the business and support processes like continuous monitoring.” She says one objective is to equip auditors with self-serve dashboards and other tools that will help them plan, prioritize and prepare for engagements more effectively.
- Analytics to support audit delivery — The third component of the team’s agenda is generating high-quality analytics to support audit delivery. “That’s the bread and butter of what we do,” says Love. “We need to make sure internal audit uses the right data for every audit and brings quantitative, data-driven insights to the table as part of its assurance work.” The A/I team provides analytics support that includes full-population testing, exception testing, script reviews and more.
- Internal audit’s technology stack — According to Love, this aspect of the team’s work involves making sure that internal audit has the right technology infrastructure and tools “to support machine learning and data products and quick-turn agile analytics in service of the audit plan and audit delivery.” She says, “We are partnering closely with the technology group at Capital One to think about how we can ensure internal audit has the appropriate infrastructure to consume data from the business, combine it with our own data, such as the historical issues and ratings in all of our working papers, and deliver data-driven insights consistently to our auditors.”
- Strategy, people and practices — “We can build fantastic models and data products, but if our auditors don’t feel like those things help them in their work, then what have we really done?” asks Love. Empathy research, which includes “design thinking sessions,” plays a key role in helping her team to engage the whole internal audit department in their work and to “really understand the needs of the auditors” so that the products her team designs add value and are easy to use. Love says, “We’re not just off in a corner trying to do something cool — we are tapping into the collective knowledge and wisdom of the department in everything we do.”
She adds, “We also need to make sure that we, as a team, are well-managed in our own processes and that we’re using best practices for what we build and maintain and for how we partner with and pull in data from the first and second lines of defense in the business.”
"Empathy research has been essential for helping internal audit leadership at Capital One to understand how both auditors and auditees experience audit processes — and to look for opportunities to change those experiences for the better."
Increasing Productivity and Transparency With Agile Practices
Empathy research has been essential for helping internal audit leadership at Capital One to understand how both auditors and auditees experience audit processes — and to look for opportunities to change those experiences for the better, according to Kyriakakis. Using the feedback that they receive and other learnings they gain from the research process, internal audit, as a whole, is developing new ways to visualize its audit universe and understand the connections between audit entities.
“How do these entities interact? Do they share applications? Data? Third parties? Do thematic issues link them, and can we present this information in a visual way to our auditors? This kind of thinking is helping us get to the point where we can provide dynamic assurance back into the company, even as things change in the business and the risk landscape,” says Kyriakakis.
Adopting agile work practices, and managing the related change effectively, is part of the effort to improve how the function interacts with and provides value to the business. Several years ago, Capital One embraced the agile methodology for deploying new products and capabilities to customers. Kyriakakis says that internal audit quickly saw the value of “agile pods,” which are small, cross-functional and multidisciplinary teams that focus on managing a specific task and its related risk, and which reprioritize their work every day. “It’s a nimble way to work,” says Kyriakakis, “and it got us thinking about how we could incorporate agile into our audit delivery framework.”
In 2017, Capital One’s internal audit function restructured its audit delivery operations into agile pods. “We empowered the pods to prioritize how they deliver work, what they should work on and when,” says Kyriakakis. “We’ve established routine cadences to identify any impediments that come through the audit process and allow the pods to resolve those issues as quickly as possible.” However, while the shift to agile is allowing internal audit to engage management earlier in the audit process and create more transparency in all aspects of how it delivers work, Kyriakakis says the transition has not been without its challenges.
“We knew the move to agile would be a significant change,” he says. “So, we spent about 18 months conducting research, developing and piloting our model, and then fully deploying it in a thoughtful way. Still, it takes time, energy and persistence from our team to embrace all the differences in an agile delivery framework versus a traditional audit delivery framework. There have been bumps along the way, but it’s been a fun journey so far.”
Embracing a Time of Inevitable Evolution for Internal Audit
In the months ahead, Love says that the A/I team will continue to pursue its innovation agenda, with support from the technology group at Capital One. Love says the tech team is staffing software engineers to support internal audit’s agenda, and she also recently recruited the department’s first product manager. “This person has decades of experience in banking and has led platform development in other lines of business at Capital One,” says Love. “With additions like these to our team, we’re bringing a product mindset to our work, which helps us set up the technology support that will allow internal audit to consume data from the business in intelligent ways, ultimately through real-time streaming.”
All of these initiatives, from moving to an agile delivery model to building the right tech stack to support the function, are part of a much bigger vision for internal audit at Capital One — and for the profession itself. Karam has established this vision for the team: “To be an industry beacon that has redefined internal audit by providing high-value, independent and proactive insights, innovating with technology and being a destination for top talent.”
"All of these initiatives, from moving to an agile delivery model to building the right tech stack to support the function, are part of a much bigger vision for internal audit at Capital One — and for the profession itself."
But even without the goal to become an industry beacon for other functions facing transformation challenges, Kyriakakis says his team would be compelled to modernize and innovate. He says, “As Capital One embraces the 21st-century digital revolution that we all experience and live every day, it’s become clear that we need to rethink how to address the risks of a bank building a leading technology company that can thrive in a world being revolutionized by software and data, and be part of the company’s journey.”
Click here to access the full list of profiles.