Welcome back to the podcast, bribe, swindle, or steel.

I'm Alexandra Rogge and today we're talking about audits, what they are and what they aren't.

What they guarantee, what they don't guarantee, and how they can be and have been manipulated

for nefarious purposes. My guest is Ryan Murphy. He's a partner

at Pricewaterhouse Cooper's Cyber Risk and Regulatory Platform and leads PWC's U.S. Investigations and

Forensics Services Practice. Ryan, thank you for joining me. Thanks for having me, Alexander.

Can you just start with a quick

primer on the terminology? Many of our listeners are in compliance or our lawyers, but a lot of the

jargon around audits, I think, is confusing for people. I kindly like to tease my law firm

friends and clients a lot of times because they use the

word audit pretty universally describe what they may need us to do and to assist them with their

clients. But I really think about audit is a term of art, especially if you're at a CPA and

accountant. There's the concept of a financial statement audit. And then there's a concept of just an external

audit or assessment. It depends really what you're trying to accomplish. But I think very many

times it can be confused when we use the word audit and a CPA will say, well, that really means

a financial statement audit. I'd also sort of get into the differences a little bit between

an internal audit and an external audit. In internal also sort of get into the differences a little bit between an intro audit and an

external audit. In internal audit, typically the stakeholders are reporting to the management of the

company. It's typically voluntarily done. It's usually used to assess internal controls. It's usually done

internal to the organization, and there really isn't any external third parties

that are involved. When you contrast that with an external audit, typically it's an independent

accounting firm. You're reporting to third parties like shareholders and regulators, and in some

...