Internal Auditing Around the World, Volume 15: DriveTime

Internal Auditing Around the World Vol 15 Profiles
Internal Auditing Around the World, Volume 15: DriveTime
DriveTime

"Our team doesn’t want to be a hindrance to change and innovation, but a creative solution provider — a solutions architect — and a valued business partner."

- Erik Rasmussen, Managing Director of Internal Audit


DriveTime is one of the largest used vehicle dealership enterprises in the United States, with a focus on serving the subprime market. Its business model — developed over the past 25 years — integrates the acquisition, reconditioning and sale of quality used vehicles and related products with financing for its customers. The company uses a proprietary credit-scoring model and point-of-sale retail system to provide its customers with vehicle and financing options based on their income, down payment, vehicle needs and overall affordability.

"DriveTime’s work environment is very open and collaborative."

DriveTime operates 138 dealerships in 27 U.S. states, 20 vehicle reconditioning facilities and four loan servicing centers. The fast-growing company opened 21 new dealerships in the past three years alone. For the year ended December 31, 2018, DriveTime reported that it had sold more than 129,000 vehicles and generated US$3.1 billion of total revenue. DriveTime’s sister company, Bridgecrest Acceptance Corporation, directs the company’s financing and loan servicing operations.

“DriveTime is a complex business,” says Erik Rasmussen, managing director of internal audit. “We often think of the company in different divisions: inventory, retail, ancillary products and finance. But we’re highly integrated, and we work together.”

DriveTime’s work environment is very open and collaborative, according to Rasmussen. “We are a flat organization,” he says. “No one in the company, not even the CEO, has an office — just a workstation. There are no doors to open. Anyone in the organization can provide ideas, and work with their team and management group to foster those ideas. I think one of the beauties of the company is the fact that everyone here has an opportunity to make a difference every day.”

Three Pillars of Focus for DriveTime’s Internal Auditors

Rasmussen has been with DriveTime for almost 14 years, initially overseeing the company’s inventory acquisitions and reconditioning and warranty work. He spent over a year helping to start up SilverRock, a DriveTime sister company, which primarily sells and administers ancillary products, such as gap waivers, vehicle global positioning systems (GPS) and vehicle service contracts. In 2016, he transitioned back to DriveTime to lead the internal audit department — a seven-person team that includes an assistant director, manager, senior auditor and staff auditors.

According to Rasmussen, the internal audit function at DriveTime structures their work primarily around three areas, or “pillars.” The first pillar is compliance. “We’re a large participant under the Consumer Financial Protection Bureau (CFPB) lending rules,” says Rasmussen. “So, we have a significant compliance function, and our team provides the third line of defense.”

The other two pillars of focus are DriveTime’s decentralized field operations — its dealerships and vehicle inspection centers — and its business process management group, “which includes any centralized function, high-risk area or hot topic (auditable entity) we might engage in,” Rasmussen says.

DriveTime’s team uses ACL GRC software to help manage audit projects and Microsoft programs like Excel and Visio for performing day-to-day work. They also need to work with the SQL programming language. “We’re a very data-driven organization,” says Rasmussen. “We use SQL and macros to develop and write various audit procedures. We’re now doing a bit of continuous monitoring, as well. We’ve designed a lot of our operations so that we can use technology and leverage data from our previous work instead of starting from scratch on every project.”

When the internal audit team wants to dig deeper on data, they turn to DriveTime’s data analytics group for help with generating reports or building data views. Rasmussen says, “I’ve thought about embedding a data specialist within our team, but I haven’t done it because I think it benefits our work to have access to multiple data scientists and analysts who can help us better understand what’s happening throughout a complex company.”

Internal Audit — a “Natural Fit” to Spearhead RPA

When DriveTime is looking to do something new, whether it’s rolling out a product, launching a division or implementing technology, internal audit is invited to join the discussion, according to Rasmussen. “We’re at the table,” he says. “Sometimes, we have a good role to play and say, ‘We can help you.’ Other times we say, ‘We’re not a good fit for that.’ I think knowing when to raise our hand and when to step back helps our team to earn respect in the organization.”

He adds, “I think internal auditors, in general, need to be careful not to come across as ‘no’ people — no, you can’t do this, and no, you can’t do that. If we do, we won’t be invited to the table. Our team doesn’t want to be a hindrance to change and innovation, but a creative solution provider — a solutions architect — and a valued business partner.”

The emphasis on collaboration at DriveTime helps the company’s internal auditors to foster strong working relationships with other business groups and earn their trust. That, in turn, creates opportunities for the internal audit department to help the organization break new ground in its operations, including with technology. Recently, Rasmussen and his team stepped up to help DriveTime develop and pilot robotic process automation (RPA).

“We’re spearheading RPA for the whole company,” Rasmussen says. “That may seem a bit weird to some people, who might think, ‘Why is internal audit kicking off a process for automating business operations?’ But if you look at our staff and our core competencies, you can see we’re a natural fit. When you implement RPA, you need to look across the organization, at business operations, workflow and processes. That’s exactly what internal audit does. And we problem-solve. Our ability to think critically, and our natural curiosity, let us peel back the layers on how to stand up an RPA group.”

"When DriveTime is looking to do something new, whether it’s rolling out a product, launching a division or implementing technology, internal audit is invited to join the discussion."

On the Lookout for More Automation Opportunities

DriveTime enlisted help from an external resource for the technical development aspects of RPA, like coding. Since late 2018, when the RPA project was first launched, the company has deployed three robots, or “bots,” which are still in production. “They’re operating, and the business has now taken ownership of them — including the responsibility for their operation and design,” says Rasmussen. “Our team just helped to get everything started.”

Rasmussen says he’d like to see his team help DriveTime develop at least another dozen bots by the end of 2019. In the future, he expects the company will have a designated team or division responsible for overseeing the creation of more bots and the business development and strategy behind them. “It was never the idea to have internal audit be the long-term business operator of RPA,” he says.

Even though internal audit is deeply involved with deploying RPA at DriveTime, Rasmussen says he’s not sure if the technology is a good fit for his department — at least, not yet. “RPA benefits highly routine, standardized functions in our organization, like vehicle acquisition. But the internal audit department is pretty dynamic. Maybe in the future, we might be able to use RPA for routine, compliance-type work, but I don’t see it solving problems for our team right now.”

"Thinking about the skill sets that internal auditors will need in the future, Rasmussen says he believes adaptability, along with interpersonal savvy and intellectual curiosity, will be more valuable than many technical skills."

Rasmussen says he sees the opportunity for DriveTime’s internal audit team to automate tasks through different uses of SQL or sophisticated macros — and perhaps pass on new, technology-driven best practices to the business. “We’re always thinking about how we can make technology work for us, and also, what we can do to help and educate other groups,” says Rasmussen. “For example, we’ve made a commitment to our general counsel that, as we work on third-line audits this year, we’ll explore how we can help the business automate the process for these recurring audits.”

Adaptability: An Essential Quality for Next-Gen Internal Auditors

While the internal audit department at DriveTime is playing a pivotal role in introducing RPA into the business, Rasmussen says they are by no means the sole innovator at the company. “We have more than a hundred IT staff members innovating all sorts of new ways for how we go to market. I think our team and what we’ve been doing with RPA are just examples of DriveTime’s culture of innovation.”

Rasmussen attributes the diversity of his team to the function’s ability to maintain an innovative mindset. He explains, “I love hiring internal auditors with diverse backgrounds because they think about things differently. For example, I hired someone with a political science degree, who turned out to be a great auditor because of outstanding problem-solving skills.”

Thinking about the skill sets that internal auditors will need in the future, Rasmussen says he believes adaptability, along with interpersonal savvy and intellectual curiosity, will be more valuable than many technical skills. “I’m a big believer in hiring smart, dynamic people who can adapt to change,” he says. “Evolving your skills for the future isn’t just about learning this or that technology because, whatever the technology is today, it will be something different tomorrow.”

 

Click here to access the full list of profiles.

Ready to work with us?