About AuditToolbox

The Journey Through All Three Lines

Hi, I'm Rich Penfil. My career has taken me on a journey that few data scientists get to experience—working across all three lines of defense. And let me tell you, it's given me a perspective that fundamentally changed how I think about audit and risk.

I started in the first line of defense as a data scientist, embedded in the business. I built models, automated processes, and learned firsthand how operational teams think about risk (spoiler: they often don't, until something breaks). It was exciting, fast-paced work—but I couldn't shake the feeling that there was a bigger picture I wasn't seeing.

Finding My Way to the Best Line

So I moved to the second line of defense—still as a data scientist, but now with a risk management lens. I got to see how controls were designed, how policies were written, and how the organization tried to prevent bad things from happening. Good work, important work. But something was still missing.

Then I found internal audit. The third line of defense. The best line. (I'll die on this hill.)

Why is it the best? Because internal audit is where you get the complete picture. You're not just building controls or managing risks—you're independently evaluating whether any of it actually works. You're the last line of defense before something truly goes wrong. And when you're working in a department with over 1,500 internal auditors, you realize just how critical—and complex—this work really is.

Building Tools for Auditors, By Someone Who Gets It

In that environment, I dedicated myself to building ML and AI tools specifically for internal auditors. Not generic analytics platforms that need to be awkwardly adapted for audit work. Not flashy dashboards that look impressive but don't actually help you close findings. Real tools, designed for the unique challenges that auditors face every day.

I've sat in the audit rooms. I've wrestled with sample selections at 2 AM. I've explained to business partners why yes, we really do need that documentation. I've felt the frustration of repetitive manual work when you know there has to be a better way.

AuditToolbox exists because I believe auditors deserve better tools. You're protecting organizations from risks that most people don't even know exist. You're the unsung heroes of corporate governance. The least I can do is build you something that makes your job a little easier.