Anton Dam on Betting on Human Creativity in AI, Risk, and Internal Audit

Russ Fordyce 🏆 (00:01.1) Welcome back to the winner's circle, everybody. I'm here with Anton from Optro, and they are building kind of that regulatory AI that's good for risk and analysis. And we're going to talk to Anton all about how he built the program. Anton, welcome to the show and congratulations on the award. Anton Dam (00:08.804) Thank you. Anton Dam (00:16.062) Thank you. Thank you for thank you for having me Russ Fordyce 🏆 (00:20.534) So before we get into the deep, deep guts of this, tell us a little bit about Optro and kind of what the company's all about. Anton Dam (00:27.997) Yeah, so Optro, some of you may know it as Audit Board. So we changed our name about two months ago. But the company is an audit risk and compliance company, or the way we think about it is for enterprises around the world, a risk management platform across various different functions. And so what we try to do, we are sort of our mission is to help global enterprises turn risk into opportunity, of really manage the risk, go from risk mitigation to risk management in a more increasingly dynamic and regulated world. Russ Fordyce 🏆 (01:09.72) Yeah, and it is becoming more regulated, especially with AI. The Europeans are trying to do some regulation there. I know we're fighting it here in the US. But before we get into it, you've built some pretty amazing products. You were at LinkedIn and Workday before. What kind of drew you into Optro and this very different GRC space? Anton Dam (01:24.603) Mm-hmm. Anton Dam (01:28.475) Yeah, so I've worked at enterprise software my entire career. And the way I describe it is like I've worked for enterprise software in various different functions, your startups and big companies, but companies like Coca-Cola have always been sort of a customer, meaning that like, sort of all different types of things that they do, hiring, hiring, retaining people, new market entry, that's the kind of stuff that I've always been interested in, which is That's to say, like really how the world works behind the scenes. And so when I was looking for sort of my next opportunity prior to Optro, I was looking for really sort of a good management team in a sort of narrow but large enough space that is about to be transformed. Because I saw that I've been at Optro for about two years. And what I saw was a world was about to change with you know, the release of chat GPT and large language models becoming widespread. And so that's what I saw in in sort of Optro and GRC. It was a very strong management team. was a highly loyal, dedicated and passionate customer base, which is really what you really, really need in order to transform, call it like bluntly like What we're about to enter into is every function in enterprises is going to transform itself. people at work, sort of at their jobs can do what people do. They really have one choice in a changing environment. They can sort of sit back and wait or jump head first and try to ask themselves, hey, what kind of future do I want to live in? and especially sort of recognizing that while the specific aspects of any type of knowledge work may go away, may be automated away in the near future, the knowledge worker will not be. Or rather, let's just say that the knowledge worker that adapts and understands what they are trying to do for their business and for their customers is actually going to thrive in this next era with additional tools. And so that's what I saw when I came to Shrove. Anton Dam (03:53.335) you know, I saw at Audit Board or Optro, which is a highly, highly motivated and passionate user base that totally honest, I actually had never seen such passion for a product, for a technology in what is reputationally always been sort of like what people say, what people have always said about audit and risk teams as like offices of no, or the ones that bother bother you to do stuff, which you know, no one's gonna lie, that's a part of their job that they don't like to do, but it's a necessary part of it. But that said, the passion that they bring to, the of the passion, the intelligence that they bring to their work on a daily basis was something that I found pretty exciting. Russ Fordyce 🏆 (04:41.516) Now you said publicly that your philosophy is to bet on human creativity. So in this world where AI companies are kind of working to replace kind of that, not replace, but automate those kind of human tasks, that's a pretty distinct position. Where does that principle come from? Anton Dam (04:45.528) Mm-hmm. Anton Dam (04:49.095) Mm-hmm. Anton Dam (04:59.083) More broadly outside of pure enterprise software or even Optro, my view on that is that there are those that are going to speak to AGI and ASI and those things and that's a healthy debate, that's a healthy discussion and a healthy dedication that a lot of people are putting their minds towards. For me though, whatever happens, At the end of the day, it's about people and what kind of society we want to live in. So like, you know, when we think about, say, you know, say our customers, 75 % of what they do and where they spend their time, it will go away. It could even go as high as 80, 85%. But the function around sort of like managing risk, being adaptable, And actually really having goals and values is something that is intrinsically human. Right? And so the hot word, maybe not the hot word, but the key word in all of AI and machine learning is alignment. And so it has to align to something. And so I think there's a lot of people who will believe that, hey, if you sort of like let... let Claude or chat GPT, you know, like, just do your work, it will do it. And that's probably true, except what it can't do is come up with its own values that matter to you. And so that's to say that like, if a company wants to take more risk, there's judgment calls and evaluating what that might be. If a company wants to enter a new market, there are judgment calls, investments, trade-offs that really should be aligned to a business and their identity and what they want to do. And you can change that. And when you change that, people will behave differently. But I think of the great business of the world, like say, like Costco. If Costco wanted to go compete with Apple, I'm sure they could, or could try at least, but that's not who they are. Anton Dam (07:18.617) And the same reason when you talk about great businesses and great brands, it's about their identity and staying to that and being true to that and whatever they do, making sure that the people, the culture, the tools and the services that they leverage align to that. And so that's where, within that identity, that's human creativity. That's an area where human creativity can thrive. because as we automate more things, the things that we've already solved for, the things that we've already figured out, they get automated away. AI is sort phenomenal at that. But where do we go next? What do we want to be? How do we really think about an action on, let's see, for our customers, risk in aligning those things to the corporate goals and values is that sort of space for human creativity. Russ Fordyce 🏆 (08:16.846) So you guys are already working with a lot of the Fortune 500, and now you've introduced this Optro AI. What did a typical day look like for an internal audit team at a large enterprise before you guys kind of rolled out this AI? Anton Dam (08:34.418) Well, typical for an internal audit team, a typical day is pretty straightforward in the sense that like the bulk of the work is actually done, is actually spent on coordination and document review. And so you think about like, say, hey, I need to perform, I just need to do sort of an audit of privacy or password policies. And actually, whether and the controls around that and whether they're adhered to within the business. And so what they do is, so what an internal auditor would do is say, okay, here's where I want to focus on this business unit, this product line. And then they go identify the people, they go find the evidence that's supposed to support that like, hey, data is encrypted or passwords are being, password policies are being enforced. And they go get all that and they go review that, they align all the various policies and documents, whatnot. So you can imagine like a very like, labor intensive manual process where a person's just staring at a screen saying, hey, this one line over here, does it look like that line over there? Or is there something that off? Is there a period that's off? Is there like, is it a catch that the wrong service or business entity or whatnot? And so like that's where we spend our customers spend 75 % of their time. I think, you now I think sort of imagine your follow up question is going to be like, hey, what does it look like? now. And so we're in a journey. What it looks like now depends very much on actually the person who wants to use it. Now, what I mean by that is AI is so powerful, like it's clearly so powerful right now that you can actually do so much. But it does actually still require that you set things up appropriately so that it can work consistently, predictably. reliably, repeatably. And the ones that should really, really embrace that, that like, hey, they try to use it, you know, in a first pass, and it sort of doesn't work quite the way they want it to work. And they spend the time and figuring out, hey, maybe I have to rewrite this description. Maybe I have to sequence it in some specific way. Like they're the ones where, so that Anton Dam (11:02.159) 75 % spent on a particular task may go down by as much as 50 or 60 or 70%. Right, but going back to your earlier question, what that tells you is that alignment is still everything. And people in general have spent so much time, like people, we in our processes, in our day-to-day lives, we go through, we learn a lot of things, we distill things from our training, from our... from our training, from our experience, from our internal roles when we perform a particular task, at times it's actually sort of difficult to quickly just sit down and just write down exactly what you want. And that's actually real work to go figure out what all those things are so that someone else can understand. And if a person does that, I think they begin to see pretty magical things even today. Russ Fordyce 🏆 (12:00.876) Yeah, and now this risk and compliance space, especially with AI is getting complicated. It's a space where the stakes are super high for getting it wrong, right? You're going to, get regulatory penalties, legal exposure, and worst is like reputational damage. That raises the bar for AI, I think significantly. What does good enough AI look like in that context versus kind of consumer AI? Anton Dam (12:05.421) Thank Mm-hmm. Mm-hmm. Mm-hmm. Anton Dam (12:19.499) Hmm? Anton Dam (12:26.544) I think you have to think about it in multiple different types of interfaces. And so in my personal view, all AI, I'm not all AI, but all frontier AI today can deliver value. But, you know, you think about like assist sort of the way we think about it at Optro is assistive, you know, assistive AI, co-pilot and agentic or autonomous agent AI. And so in each of those, we bucket them. you know, we require a certain quality performance threshold. And so if it's purely, say, assistive, so for example, like, you just want to a you know, redraft of a particular type of description of a particular piece of text where you say, hey, I want this, I want to change it from the first person to the third person. I want it to make it slightly shorter, slightly more formal. The bar there's pretty low. because you're still there 100 % of the time and the changes are very minor. Then you get to co-pilots. Co-pilots are where it's sort of like working aside you, but you're still there 100 % of the time, but it's trying to perform something, like actually perform a task sort of independently just alongside of you. The quality threshold there is still... you know, it's still not, you know, like, it doesn't need to be like 99%. But the quality thresholds, they are significantly higher because if the performance is say like, hey, 50%, right, you're better off, your users better off just doing it themselves. And so when we think about this, this is like something as simple as, you know, sampling is something that's pretty common in audit workflows. And so sampling, you know, could be actually, It's agentic for us, but the example here would be like, you have 10,000 rows of a general ledger and you need to sample things according to a specific methodology. And so the specific methodologies can get sort of brittle depending on what you If you go beyond random sampling. And so we have a copilot experience that says, okay, this is how we interpret it. This is the sampling. Come back. Anton Dam (14:48.905) like the results are returned, do you, is this the, which we call it, know, like, does that work for you? If not, then let's, you know, let's edit it in some way. And then you get into agentic technologies, sort of agentic AI in which you want things to be pretty high. But going back to your actual question here, good enough here for us, one of the ironclad rules we have is nothing gets entered into a system of record without human review. Russ Fordyce 🏆 (15:00.75) Yeah. Anton Dam (15:18.984) So at the end of the day, everything sort goes through a person. We just want the person to go more and more towards the beginning, more towards the end of the process. Russ Fordyce 🏆 (15:29.334) Interesting. Now you're navigating this regulatory landscape that's different in every country, every state, and it seems to be changing faster than any compliance can contract it. How do you build an AI that's staying current with that moving target? Anton Dam (15:34.376) Mm-hmm. Anton Dam (15:39.26) Mm-hmm. Anton Dam (15:43.936) that's good question. So I think that like, we, you know, like the principle here is that everything's in the control of human and human judgment. And so how do we keep, how do we keep up to speed with everything? we follow everything around the world. we followed, we follow the regulations. We stay, try to stay on top of it. nothing comes into effect immediately, but whether it's regulations. whether it's new threat vectors that emerge or new industry standards in terms of how something's tested, we have to stay very, very, very adaptable. And so like where the world was, say a few years ago, where standards would change every five, 10, 20 years. Now, even if they haven't fully changed, we have to stay on top of it and work with our users. work with our customers and our partners to understand that highly evolving landscape. But the bottom line here is you have to move really fast and you have to track everything that you do. we build every... So, the two parts of the question is for our users, we follow the activity around the world. In our development, we don't take shortcuts just because it's AI in order to enable AI. We log everything in the backend. In our development process, you think about how we generate, collect, curate our data sets, how we train our models, how we tune our agents, all that's tracked in anticipation for whether we're working with customers and they want some transparency or with potentially upcoming standards and regulations. we have a pretty good sense of what we do and can adapt to that as as the regulators or as the standards settle down. Russ Fordyce 🏆 (17:44.623) Well, and as you mentioned earlier, it's all about trust. And what I found remarkable is I think you guys quoted 80 % of your AI customers are kind of accepting generative content into their systems. And even with human in the loop, that's kind of the catch. It's kind of the catch for the AI. How did you build enough trust in the system to kind of get to that 80 % level? Anton Dam (17:48.089) Thank Anton Dam (17:54.905) Mm-hmm. Mm-hmm. Anton Dam (18:04.111) Mm-hmm. Anton Dam (18:12.472) I think it comes down to quality for the type of task. And so we do a handful of different things. we're not an AI native company. And so we're trusted by almost 3,000 customers at this point around the world. We have half the Fortune 500. And so we've built up you know, really sort of strong customer base, a very large, very complicated enterprises, and we have the security, the security and the processes for them to trust us. And so, we were very intentional about when we were building AI, we were very intentional about number one, we want to introduce it sort of slowly and intentionally in the places where they do work. And so what I was describing assistive copilot and agentic workflows, We wanted to make sure that say, know, the stats you were mentioning now is like 80 % of our customers accept AI-generalized or AI-recommended content into the system of record. It's, if it's sort of really lightweight, like, you know, light redraft, we put that and we make that seamless baked into their existing processes. If it's more complicated, we put more... mechanisms for them to upload context, upload more things to make sure that things are right, but at the end of the day, it's still within their control and still should be natural to their workflows. And then finally, it's quality. Quality is everything, right? Like even just a quick glance of something looks wrong, at least for our customer base and our user base, they're going to reject and stop using it. And so it's just quality. Russ Fordyce 🏆 (20:03.554) Yeah. So you guys are deploying this in production for some ginormous corporations. They're not demos, but these are real audit teams, they're real companies. What happened when you did that that you didn't expect? Anton Dam (20:27.487) I think that the number one thing I did not expect here, so I've been working machine learning for quite some time. The adoption curve is slow. The thing I actually haven't expected, I did not expect, is I couldn't predict that, so typically historically the most regulated, the biggest companies have been the slowest. It's actually not what we're seeing. we're seeing that some of the largest, most historically a reputation with conservative companies are actually the most aggressive. Now that could be that could be that. audit teams when it comes to frontier technology adoption, go according to the or wherever their company, the top level drags them or pulls them. Which is actually another way of saying actually when I think about it now that You know, going back to the question around human creativity is that if you unleash your people, what you get is this flurry of adoption, this flurry of figuring things out, and audit teams are as aggressive or potentially even more aggressive than any other user base I've ever worked with. So that's probably the most surprising. Russ Fordyce 🏆 (22:02.06) Well, you know, it's, is, I would say that it's very surprising because those big brands are usually very slow to move and they usually watch somebody move before they moved. I worked in, I worked in big cable and it was like that, right? What one cable company would do something and the others would, you know, watch it for a while to make sure that that was the right decision. And so, but what you said is, think that on, I think what people have been doing is in, in especially a lot of boards, a lot of boards are now saying you've got to do a, Anton Dam (22:06.271) Mm-hmm. Mm-hmm. Mm. Anton Dam (22:17.663) Mm-hmm. Anton Dam (22:28.819) Hmm? Yeah. Russ Fordyce 🏆 (22:31.298) you've got to do it in a big way. We're going to fund the money. We're going to give you a chief AI officer or convert your CTO or whatever. And so the pressure is really on those guys to go figure it out. And I think it almost comes down to a numbers game too. They have the budget, they have the authority and they go do it. Where I think a lot of the smaller enterprises and small businesses are saying, how can I still do this? And what can I do? Where these guys are just, they've got the budget to go do it. Anton Dam (22:37.375) Mm-hmm. Anton Dam (22:41.758) Mm-hmm. Anton Dam (22:47.773) Mm. Anton Dam (22:57.597) Yeah, internal enablement is pretty significant. every function within our sales processes, like security is now on board, AI security review is pretty substantial, it's very real. And same thing with the enablement of, we get tons of requests, like how do we integrate into... into the AI ecosystem, so like Microsoft 365 Copilot and others in order to, you know, like, maybe this is sort of call it a prediction here, like the surprising thing that I probably didn't expect three years ago was, I actually think the notion of the web app is going to soften dramatically. And so the web app UI that we see in Optro or a competitor, an enterprise software broadly, is actually naturally going to extend where agents begin working with each other. so have to, vendors like Optro will actually have to work inside a codex with co-work, whatever that means, definitely within Copilot and Copilot Studio. And because how all of that works together is probably going to be the most interesting probably question in our fry software in the coming decade. Russ Fordyce 🏆 (24:24.886) Yeah, because then AIs are talking to AIs and work's being done that you programmed, but you kind of got to just got to go check. it's, it really is going to be an amazing time. I think you're right. I think that's the next kind of frontier is that AI to AI model. When you're, when you're launching one of these deployments, how do you measure whether the AI is actually helping not just the customers are using it, but it's that, you know, it's making those risk decisions better. Anton Dam (24:27.269) Mm. Anton Dam (24:30.575) Yeah. Anton Dam (24:53.019) I think that's too early to say whether it's for saying making risk decisions better because decisions are ultimately human and so and a lot of times the long tail of risk is The long tail of risk is what you really face in reality It's another way of saying that like when you have Like When stuff, you know, when you buy, know, when you, you know, if you have a roof that's working and you don't have water in your house, you don't, how well do you know that it's working versus like it hasn't, you know, it's the rain, the rain wasn't, there wasn't that much rain that year. So I think we'll see, I think, I think it's early in terms of whether decisions are better yet. But what we are seeing is that a lot more activity is made possible by AI. So that's from an efficiency and a capacity perspective. so people, user satisfaction's up and factors like that. People are able to perform more risk assessments, comply with more IT compliance standards. But whether risk management is better, I think it's a little too early because it has to diffuse to that point, which... We're not sure that it has entirely yet because change has to, know, the organizations have to change to mitigate those risks. Russ Fordyce 🏆 (26:23.318) Yeah, now you've a lot about kind of publicly about the AI principles. We talked about some of them here. What are the non-negotiables? What are those lines you don't cross and how did you deploy AI? Anton Dam (26:35.192) Well, lines we don't cross are we don't train on customer data. Our customers trust us with protecting their data. And so we view that as sacrosanct. Human fully in control is another line we do not cross. And those are the two big lines. Everything else sort of flows from there, whether it's like quality and relevance, whether it's, you know, whether it's like, you know, actually, no, that's it. protecting data, protecting their data, and that the user is fully, fully, fully in control. Russ Fordyce 🏆 (27:21.41) Well, and that's very interesting because I think you guys are doing something pretty remarkable, which is now you're building AI governance capabilities that help organizations actually govern their own AI, which is a fascinating recursive problem, right? You've got AI to govern AI. How do you think about that responsibility? Anton Dam (27:30.667) Mm-hmm. Yeah. Anton Dam (27:40.609) I mean, it's reality in the same way you build software. You build software and you, you know, to. to automate. Now, let me rephrase that. I think the responsibility is that there are two sides that every organization has to deal with. One is the adoption of AI simply because it's a new transformative technology, but also that the organization has to make sure that the use of that AI aligns with their security posture and ultimately, it's for the goals and their values. And the remarkable thing with AI governance is that The buyer, the buyer, so everyone needs the software in some ways. You may be a chief legal officer, short of GC, you may be head of compliance, head of audit, head of security, maybe a CISO. And everyone sort of has that demand, they have that need for it. And it's so early in the game that... we don't know who will be the primary coordinator or buyer of AI governance or ultimately responsible. If I were to make a bet, I would actually bet that AI governance goes the way of CISOs. And so if you remember, I guess almost a decade ago at this point, when GDPR was passed and came into effect, it was sort of the ultimate elevation of the CISO because... Anton Dam (29:16.917) know, security, data privacy took a central role in increasingly digital world. My bet is we're going to see the same thing with AI, CISO, whoever ends up being ultimately the chief AI or AI governance officer, will have that same responsibility as the CISO. Because it is so central to everything that we do where every single function, whether they want to or want to or don't want to realize or don't realize it, they'll be using AI for everything that they do. And understanding that how you use AI aligns with your responsibilities, your fiduciary responsibilities, the risk cost for your company, and protecting those interests, the company's interests, the stakeholders' interests, is as or more important than... than the CSOS responsibility. Russ Fordyce 🏆 (30:18.35) Yeah, I think you're right. I think it will end up in that CISO perspective. is, you know, it is a security issue after all. know that you guys did a lot of research. Anton Dam (30:22.225) No. I want to interject there. It's not just a security. It's not just security, but it is sort of alignment with goals. And so if you read through the EU AI Act, it's about security, but it's a cure in a very specific lens that people against people that's at the company, outside the company, interests, especially sort of human rights, privacy rights, are our honor. And then when you get into like the purely sort of outside the regulatory framework, that's where the security aspects come into play. So it's not just security. And that's why this is so important, because this will change, this is changing the world. And so security and sort of the rights of people, the people that are affected. Russ Fordyce 🏆 (31:17.326) Yeah. Now, as we've talked about, most companies are deploying AI somehow these days. And I think a lot of your own research shows that almost no company has really good visibility into how it's being used internally. And I talked to other companies and they say that too. They were surprised by the fact that there are 13 different... Anton Dam (31:32.902) Mm-hmm. Russ Fordyce 🏆 (31:40.204) tools being used by their organization and they had no idea all this was going on. From a risk perspective, what's actually at stake when that happens? Anton Dam (31:42.983) Thank Anton Dam (31:50.545) It's shadow AI, just like shadow IT from a decade ago. And so what's at stake? It's everything that we talked about. It's appropriate usage, leakage of company data. And so the only way to solve for this is to aggressively enable. The tool is so powerful and so powerful, so relevant to people's jobs. and what they do on a daily basis that if you don't enable it, people will find a way. They'll have their own separate laptop where they copy and paste. You think about the security risk when you're copying and pasting random things into your own personal chat GPT where you have control, but you may forget about the appropriate privacy settings. And so the risk vector is massive and... This only, only solution, aside from trying to lock down where you can, is to aggressively, aggressively enable. Russ Fordyce 🏆 (32:57.518) Yeah, I agree with that. remember the shadow IT really almost started with the Wi-Fi revolution back in the 90s. remember you wanted Wi-Fi because you wanted to move your laptop around. And then all of a sudden you'd be in the conference room and go, oh, there's a conference room. Wi-Fi. And IT had no idea about it. So I definitely think you're right. And I do remember two years ago, the company saying you can't use AI because they were Anton Dam (33:03.664) Mm-hmm. Anton Dam (33:12.941) Yeah. Yeah. Anton Dam (33:24.015) Mm-hmm. Russ Fordyce 🏆 (33:25.538) They were so fearful that proprietary code and secrets were going into ChatGPT, getting logged and out for public consumption. From your perspective, in five years, what does the internal audit function look like? Anton Dam (33:27.801) Yeah. Anton Dam (33:32.975) Mm-hmm. Anton Dam (33:40.495) In five years internal logic function is a strategic function. Whereas they spend most of their time today just trying to keep up with the amount of work that the business throws at them that really they're dealing with a lot of times, you know, last year's problem. And the reason why I say last year is that plans are set in a year, budget set in a year, but you know the world is way more dynamic. And so what you want to be able to do is to be more continuous, adaptable with the business. And the only way to do that is automate the work you have to do, but that is, you know, that's bogging you down. So, and then what it becomes then is a more, more advisory type of function, trying to understand the risk landscape, trying to understand the regulatory. landscape. And so the word the words of our most forward looking customers are are using is to go from risk mitigation to risk management, enabling a business to go into a new area when there is risk. And so again, go back a decade, two decades, they might say, hey, we don't do that because it's risky. Now it is like, hey, it's risky, but we understand that risk, we're willing to accept it. we're able to manage it. And so that's what an internal audit function is able to do for the business. And so again, from, it becomes an advisory function. Russ Fordyce 🏆 (35:12.834) Well, and I imagine that's how it was initially envisioned. It was an advisory function, not a task manager. So yeah, I think you're right on. Anton, fascinating conversation. Thank you so much for joining us. And thank you again for the nomination and congratulations on the award. Anton Dam (35:19.405) That's right. Yeah. Anton Dam (35:29.985) Thank you, thanks for having me.