Will Smaller Audit Firms Lead the Future of Audit? | Guest: Sammy Chowdhury
Source: YouTube · GRC Engineering Club · published Nov 12, 2026 · 35:00
On the Anti-Checklist Podcast, Sammy Chaudhry, co-founder and audit leader at Prescient Security, shares how his firm is transforming auditing by demanding real evidence over "green checkboxes" and investing in GRC engineering upskilling 2:16.
Key Takeaways:
• Prescient found compliance automation tools were "smoke and mirrors and green checkboxes," so they now request raw JSON exports and dig into source systems 3:36
• Sammy enrolled all 150 employees in AJ's GRC Engineering training after rave reviews; it's now required for every new hire 5:51
• "If you don't train them and they stay with you, it's worse"—there's no quality without competency 13:55
• AJ bets nimble, AI-powered smaller firms—not top-20 CPA firms with 300+ partners—will lead the industry as customers prioritize outcomes over brand names 15:22
• FedRAMP 20X forces disruption: $150k–350k assessments must now deliver for ~$45k with 46 machine-readable KSIs, demanding risk-based approaches 18:50
• "Work out loud"—document your work like lawyers do, since promotions are decided by visible artifacts 31:27
The conversation shows auditing improves when people choose to get better—through upskilling and visible contribution, not just tools.
Sources:
- 2:16 Sammy's motivation for changing how audits are done
- 3:36 Automation tool gaps; raw JSON exports
- 5:51 GRC Engineering Club partnership scaled to 150 employees
- 13:55 Training despite retention fears
- 15:22 Smaller firms will lead the industry's future
- 18:50 FedRAMP 20X pricing disruption
- 31:27 Working out loud and the power of asking
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Compliance & GRC. Commonly maps to: Security and Risk Management, Asset Security. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Welcome friends to another edition of the Anti-Checklist Podcast. We listen it's I keep adding people, right? Last time I think we had Lauren on there now Abdi's jumping on and of course I I just want to get to the guest. I'm not even going to do like the full intro or the ha ha ha's. It's it's we have Sammy Chaudhry on the podcast. It's it's auditing royalty in my opinion. Sammy, welcome. Thanks thanks for hopping on. Yeah. >> Extremely humble. Thank you so much guys for for you know giving me an opportunity a platform to to speak. No I I I I lead the the Precient Security audit side of the business, co-founder second rodeo on founding you know companies. The last one was a technology consulting company that we focused on financial services and regulation. So coming out of the the 2008 fi…