Managing Sensitive Audit Conversations

After years of conducting audits across various organizations, I've learned that sometimes the most challenging part isn't reviewing the documentation—it's managing difficult auditees. Here's what I've found works: Start with empathy: Remember that audits can feel threatening. Your auditee might be defensive because they're worried about their work being criticized. Acknowledge their expertise and make it clear you're there to help improve processes, not to find fault. Set clear expectations early: Explain your process, timeline, and exactly what you need. When people understand the 'why' behind your requests, they're more likely to cooperate. I always start with: "Here's what success looks like for both of us..." Document everything professionally: A difficult auditee might challenge your findings later. Keep detailed notes of all interactions and evidence requests. But avoid using confrontational language in your documentation—stay objective and fact-based. Build informal relationships: I've found that grabbing a coffee with the auditee before diving into work can transform the entire dynamic. The walls come down when they see you as a person, not just an auditor. Use the "feedback sandwich" technique: When discussing findings, start with something positive, address the issues, and then end with constructive suggestions. It helps maintain a collaborative atmosphere even during tough conversations. Remember: The goal isn't to win an argument—it's to help the organization improve. Sometimes the most resistant auditees become your biggest allies once they understand you're on their side. What strategies have you found effective in handling challenging audit situations? Share your experiences below! 👇 PS: Below pic is just for LinkedIn algorithm and not at all related to this post, don't consider it as a tip :D #InternalAudit #Leadership #ProfessionalDevelopment #IA #AuditBestPractices #CorporateGovernance

How to Win Any Audit Conversation 5P Audit Talk Code Ever feel like you're walking into an ISO audit with a target on your back? You know your work is solid — but the moment the auditor walks in, your confidence walks out. One wrong word. One nervous ramble. One offhand comment — and suddenly, the conversation spirals. Let’s fix that. Here’s how to talk to any ISO Auditor — without slipping up or sounding unsure. 🧭 THE 5P Audit Talk Code **Think of it like your GPS for audit conversations 1. Polite – But Not Passive Tone rule: calm, respectful, not overly eager. → Avoid over-explaining or defending. → Don’t fill silences — let them ask. → Use neutral phrasing:  “Let me walk you through how we approach that”  “This is how it’s currently structured” 2. Precise – No Rambles Stick to the question. Answer what was asked. Nothing more. Nothing less. Auditor: “Do you monitor this?” Wrong: “Well… not really, but we tried to set it up last year…” Right: “Yes. We monitor it monthly using [X]. I can show you the last three reports.” → Think Twitter, not TED Talk. 3. Process-Based – Not People-Based Talk about the system, not individuals. Wrong: “John usually checks it.” Right: “The process requires a monthly review by the department lead, documented in [system/tool].” Use phrasing like:  “The process we follow is…”  “Our current procedure outlines…” 4. Proof-Backed → Don’t explain it — show it.  → If you say it exists, have it ready.  → Screenshots, logs, reports, checklists — whatever backs your point. Pull up real examples if asked: “Here’s the form we use” Don’t explain verbally what you can demonstrate visually. 5. Professional – Stay in Audit Mode No complaints. No sarcasm. No improvisation. And never (!) blame another person or team — even if you really want to. If you don’t know, say:  “That’s outside my scope, but I can connect you with the right owner”  “Let me confirm that and follow up — would you like that in writing?” 🔄 Bonus: When You’re Unsure – How to Stay in Control Even the best-prepared person hits a moment of doubt. When that happens, don’t guess. Use audit-fluent bridging phrases like: → “I want to be accurate on that — let me double-check the current setup” → “That’s owned by another team — I’ll loop them in so you get the full picture” → “We’ve been updating this area — can I show you where we are with it right now?” → “Give me a second — I’ll pull up the latest record so you can see exactly what we’ve got” → “That’s a fair question. The way we currently approach it is evolving, but here’s what’s in place today” These buy you time, maintain confidence and show that you know your process. *** Auditors don’t just listen to your words. They read your behavior and mindset. This Code helps you speak with clarity, alignment and credibility. Tell me — what you always use to stay cool during an audit? P.S. Want the 5P Audit Talk Code™ as a printable card? Comment “5P” and I’ll send it your way. #Auditor #Quality

I used to treat IT audit walkthroughs like a police interrogation.   Early in my career, I’d march in with a 50-question checklist and a serious face.   I thought my job was to prove how much I knew and find the "gotchas" immediately.   The result?   Terrified stakeholders. One-word answers. And zero insight into what was actually happening in the environment.   I was auditing the person, not the process.   Then I realized that if I wanted the truth, I had to stop acting like an adversary and start acting like a partner.   I’ve visualized the 5 steps to a perfect walkthrough in the guide below 👇   But here are 3 advanced rules I learned the hard way (that go beyond the guide):   1. The "Silent Wingman" Strategy: Bring a junior auditor, but give them one job: observe. While you manage the conversation flow, they catch the details you miss. Just make sure they know to stay silent unless something critical is being overlooked, two people firing questions at once feels like an ambush.   2. The "Souvenir" Tactic: If you map a process on a whiteboard (which you should), don't just take a photo for your workpapers and leave. Offer the diagram to the auditee for their own documentation. It turns the audit from a compliance exercise into free consulting, proving you're there to help, not just judge.   3. Watch Your "Red Pen": I once had an auditee panic just because I switched pen colors to mark a follow-up note, they thought I’d found a "major failure." Your physical cues matter as much as your questions. I swapped my red pen for a neutral one and used symbols instead. Don't let your note-taking habits derail the rapport.   Audit is 10% technical and 90% human.   What’s your go-to move to break the ice during a tense walkthrough?   #ITAudit #InternalAudit #RiskManagement #ProfessionalDevelopment #CorporateCulture #SoftSkills #Governance #CyberSecurity #Big4 #Auditlife

🎯 𝗜𝗻𝘁𝗲𝗿𝗻𝗮𝗹 𝗔𝘂𝗱𝗶𝘁 𝗦𝘂𝗰𝗰𝗲𝘀𝘀 𝗦𝗲𝗰𝗿𝗲𝘁: 𝗟𝗶𝘀𝘁𝗲𝗻 𝗙𝗶𝗿𝘀𝘁, 𝗔𝘂𝗱𝗶𝘁 𝗟𝗮𝘁𝗲𝗿𝗅 One game-changing lesson I learned as Chief Internal Auditor: before opening a single work paper, invest time in listening. When I first implemented "Coffee Chats with Audit," many were skeptical. But here's how this simple approach transformed our effectiveness: 𝗧𝗵𝗲 𝗣𝗿𝗼𝗰𝗲𝘀𝘀: ☕️ 1. 𝗡𝗼 𝗔𝘂𝗱𝗶𝘁 𝗧𝗮𝗹𝗸 𝗙𝗶𝗿𝘀𝘁 30 𝗠𝗶𝗻𝘂𝘁𝗲𝘀 🤫 - Focus on understanding their role - Learn about their daily challenges - Get to know them as people, not auditees 2. 𝗗𝗲𝗲𝗽 𝗗𝗶𝘃𝗲 𝗶𝗻𝘁𝗼 𝗧𝗵𝗲𝗶𝗿 𝗪𝗼𝗿𝗹𝗱 🔍 - Ask about their biggest concerns - Understand their department goals - Learn what keeps them up at night 3. 𝗣𝗮𝗶𝗻 𝗣𝗼𝗶𝗻𝘁𝘀 𝗗𝗶𝘀𝗰𝗼𝘃𝗲𝗿𝘆 💭 - What systems frustrate them? - Where do they feel blocked? - What support do they need? 4. 𝗙𝘂𝘁𝘂𝗿𝗲 𝗩𝗶𝘀𝗶𝗼𝗻 𝗦𝗵𝗮𝗿𝗶𝗻𝗴 🎯 - Their improvement ideas - Planned initiatives - Resource needs 𝗧𝗵𝗲 𝗜𝗺𝗽𝗮𝗰𝘁: 🌟 - Built trust before audits began - Received unsolicited calls for advice - More collaborative audit planning - Better-targeted recommendations - Higher implementation rates People don't care how much you know until they know how much you care! 💡 𝗣𝗿𝗼 𝗧𝗶𝗽𝘀 𝗳𝗼𝗿 𝗦𝘂𝗰𝗰𝗲𝘀𝘀: 📝 - Schedule regular, not just pre-audit meetings - Take notes and follow up on concerns - Share relevant insights from other departments - Keep conversations confidential - Follow through on commitments made Remember that every conversation is an opportunity to transform from "corporate police" to trusted advisor. 🤝 Would love to hear your experiences! How do you build trust with stakeholders? What relationship-building techniques work best in your role? Like and share if you found this valuable - let's help each other build stronger professional relationships! #InternalAudit #ProfessionalDevelopment #Leadership #BusinessRelationships #CommunicationSkills #AuditInnovation #ChangeManagement

Everyone says auditors need more empathy. After a 1,000 audits, I'll say it... too much empathy can destroy your effectiveness: Let me be clear: I'm not saying be heartless. I'm saying empathy without boundaries makes you useless. Here's what happens when auditors get too empathetic: 𝗬𝗼𝘂 𝘀𝘁𝗮𝗿𝘁 𝗺𝗮𝗻𝗮𝗴𝗶𝗻𝗴 𝗳𝗲𝗲𝗹𝗶𝗻𝗴𝘀 𝗶𝗻𝘀𝘁𝗲𝗮𝗱 𝗼𝗳 𝗿𝗶𝘀𝗸𝘀. "They're already stressed" becomes your reason to soften a critical finding. "They've been through a lot" becomes your excuse to delay the report. "I don't want to hurt their career" becomes why fraud goes unreported. I've been there. You probably have too. 𝗧𝗵𝗲 𝗺𝗼𝗺𝗲𝗻𝘁 𝘁𝗵𝗮𝘁 𝗰𝗵𝗮𝗻𝗴𝗲𝗱 𝗺𝗲...𝟮𝟬𝟬𝟰. I was auditing a department led by someone I genuinely liked. Great person. Struggling with budget cuts and staff turnover. I found control gaps. Significant ones. But I emphasized the "mitigating factors" too much in the report. Several months later, there was almost an incident. 𝗛𝗲𝗿𝗲'𝘀 𝘄𝗵𝗮𝘁 𝗜 𝗹𝗲𝗮𝗿𝗻𝗲𝗱: • Empathy helps you understand context. • Empathy helps you communicate findings effectively. • Empathy helps you build relationships that make audit work. But empathy cannot change facts. The control either works or it doesn't. The risk either exists or it doesn't. Our job is to report reality. 𝗧𝗵𝗲 𝗯𝗮𝗹𝗮𝗻𝗰𝗲 𝗹𝗼𝗼𝗸𝘀 𝗹𝗶𝗸𝗲 𝘁𝗵𝗶𝘀: ❌ "I know you're overwhelmed, so I'll downgrade this to low risk." ✅ "I know you're overwhelmed. Here's the risk as it exists. How can we help you address it?" ❌ "I don't want to hurt their reputation, so I'll leave it out." ✅ "This is uncomfortable to report, but it's my responsibility to be honest." ❌ "They're good people, so this can't be intentional." ✅ "They're good people, and the control gap still needs to be fixed." 𝗘𝗺𝗽𝗮𝘁𝗵𝘆 𝗶𝘀 𝗮 𝘁𝗼𝗼𝗹, 𝗻𝗼𝘁 𝗮 𝗽𝗵𝗶𝗹𝗼𝘀𝗼𝗽𝗵𝘆. • Use it to understand. • Use it to communicate. • Use it to build trust. But never let it override your obligation to tell the truth. We dive deeper into this tension on 𝗘𝗽𝗶𝘀𝗼𝗱𝗲 𝟲𝟵 𝗼𝗳 𝗔𝘂𝗱𝗶𝘁 𝗕𝗶𝘁𝗲𝘀: 𝗪𝗵𝗲𝗻 𝗘𝗺𝗽𝗮𝘁𝗵𝘆 𝗧𝗲𝘀𝘁𝘀 𝗜𝗻𝘁𝗲𝗴𝗿𝗶𝘁𝘆 𝗶𝗻 𝗜𝗻𝘁𝗲𝗿𝗻𝗮𝗹 𝗔𝘂𝗱𝗶𝘁𝗶𝗻𝗴. Link in comments.

Yesterday I was on a call and a dispute over a SOC 2 audit finding got borderline unprofessional. The crux of the issue wasn't the audit finding itself (both parties actually agreed with the basic facts), but rather how the conversation went down. And after 2000+ engagements here are a few tools to handle conflicts like these. 𝗧𝗛𝗘 𝗖𝗢𝗡𝗩𝗘𝗥𝗦𝗔𝗧𝗜𝗢𝗡 Consultant: Explains audit finding. Client: I agree, but it is so low risk we should just call it an opportunity for improvement (OFI) and not include it in the formal report. Consultant: I agree it's low risk, but it is an exception from the control, so I have to include it in the report. Client: Further defends why it's low risk. Consultant: Goes on to explain 5 ways client could have avoided the issue. Client (Voice Raised): Are you willing to fight me on this? Consultant (Intensity matched): Yes. 𝗛𝗢𝗪 𝗜𝗧 𝗪𝗘𝗡𝗧 𝗕𝗔𝗗 1. Because a challenge was issued (and accepted) it didn't leave either party much room to save face. That never turns out well. 2. In fairness to the auditor, this was a pretty cut and dry finding. In fairness to the client, it was not socialized in advance and caught a lot of people off guard. 3. This was a routine meeting for the auditor, but the client felt like it was career ending. 𝗖𝗢𝗔𝗖𝗛𝗜𝗡𝗚 It is worth saying that this conversation was between two decent and competent people who would otherwise get along great. Yet, this is a situation that happens all the time with security, audit, and GRC pros. There's just a lot of conflict to navigate in this career and we have to learn to do it. So, here are a few tools I've seen work to find resolution and avoid escalating: 𝟭. 𝗔𝘀𝗸 𝗾𝘂𝗲𝘀𝘁𝗶𝗼𝗻𝘀 𝘁𝗼 𝘂𝗻𝗱𝗲𝗿𝘀𝘁𝗮𝗻𝗱 𝘁𝗵𝗲 𝗼𝘁𝗵𝗲𝗿 𝗽𝗲𝗿𝘀𝗼𝗻'𝘀 𝗽𝗲𝗿𝘀𝗽𝗲𝗰𝘁𝗶𝘃𝗲 - Do both parties agree on the facts? - Do both parties understand the options (eg. Change control language, add a management response)? - Are there hidden factors (eg someone's job or reputation on the line)? Seek first to understand. Always. 𝟮. 𝗚𝗲𝘁 𝗮 𝘁𝗵𝗶𝗿𝗱 𝗽𝗮𝗿𝘁𝘆 𝗶𝗻𝘃𝗼𝗹𝘃𝗲𝗱 Sometimes a trusted third party will see things more clearly, or at least have a voice both parties respect. Try saying something like: "I can see this is important to both of us, let's pull in Christian and see if he can add some perspective that helps. Is that ok with you?" 𝟯. 𝗦𝗹𝗲𝗲𝗽 𝗼𝗻 𝗶𝘁 Create some space to cool off. Try saying: "This is too important for me to answer on the fly. I really need some time to think on this one. Would it be okay if I sleep on it and give you a detailed response tomorrow?" 𝟰. 𝗗𝗼𝗻'𝘁 𝘁𝗮𝗸𝗲 𝗶𝘁 𝗽𝗲𝗿𝘀𝗼𝗻𝗮𝗹 If someone starts to get emotional or lobs a verbal punch your way - just remind yourself there's probably something going on in their life you don't see. A bad day. A personal issue. Who knows. I often use that as a mental trick to summon a little more patience. --- Good luck out there!

🔥 When you present your observations to your audit clients, tensions will get high. This simple 2,000-year-old technique will help you! . . . . For your audit client, their business is their baby. 👶🏽   So, some will not like it when you present your observations to them. 😠   They may think you're telling them their baby is ugly. … Even if they know it is they, ain't gonna like you pointing that out! 😅   But …   That's what you need to do as an internal auditor:   Report on the exceptions - those processes and controls which pose a risk to the organization’s objectives. ⚠️   When I asked most internal auditors how they prepare for difficult conversations like this, I usually get this answer:   “I check my facts and figures and run through my arguments.”   Okay, but how do you prepare for the emotional challenge? 🤔   I recommend using Lucius Seneca’s technique in his essay “On Anger”.   Seneca was the tutor to the paradigm psychopath Emperor Nero.   Lose your cool while tutoring Nero - you lose your head! 💀   Here's what Seneca did every day to keep himself alive.   TECHNIQUE:   Before a difficult conversation with a stakeholder, lower your expectations by describing the worst-case scenario to yourself.   EXAMPLE:   “I'm going to present a high-risk observation which my audit client is not going to like. They're going to get defensive. They're going to ask questions. They're going to challenge my facts and figures. They may even get angry and start shouting at me.”   RESULT:   If the worst-case scenario does happen, you're emotionally prepared for it.   As a result, you can stay calm and professional while proactively moving the conversation towards a solution by asking questions which let your audit client express themselves.   e.g. “You've gone quiet. Why?”   Ultimately, it's hard to stay angry with a calm and professional person who is genuinely listening to what you're saying." . . . I’m Andy Kovacs and I'm the Audit Communication Guy at ELC Consultants. 🔔 Do you want regular Audit Communication tips on LinkedIn? … Then let's connect! 😊 📺 Subscribe to Audit Communication TV on YouTube 👉 HERE: https://lnkd.in/e7wDVaVG 📩 And DM me today for an obligation-free 15-minute virtual call on how our bespoke learning programmes can help your team: ✅ Integrity Storytelling for Audit Insights ✅ Mastering Influencing for Auditors ✅ Audit Mission Dungeons & Dragons #AuditCommunicationTV #DarthVaderAuditCommunicationTips #InternalAudit #InternalAuditors

I thought the presentation went well. One NED disagreed. I'd just presented to the Audit Committee. By every measure, it was a well-constructed deck. And I was very happy with my delivery and progress stats. As the Committee finished, one of the NEDs stopped me. As people left, he looked up slowly. Waited until the last person had walked out. Eyes fixed. Voice low. Calm in a way that makes you listen. "Good presentation. But we can read the findings ourselves. We pay you to give us an opinion, not sit on the fence." I did not see it coming. It hit me like a curve ball. But as I reflected and digested the feedback, I realised that he was right. I'd confused completeness with clarity. The findings were all there. But my honest view wasn't. Where the real risk sat. What I'd be watching most closely. The culture. The tone. The environment people were operating in. That's what he wanted. Not just a report. A view. An opinion. Don't get me wrong. Board papers should be formal and professional. But Board also want straight answers to uncomfortable questions. Early signals before issues become crises. An auditor with an opinion, not just a report. Since that conversation, the last thing I ask myself before any Audit Committee isn't "is the deck complete?". It's "am I prepared to say the thing that's hardest to say?" That's where the value of internal audit really sits. Not in the report. In the conversation the report enables. #InternalAudit #Leadership #Governance

Difficult conversations are part of an auditor’s job. They don’t have to turn into battles. In my latest video, I talk about how auditors can handle tough conversations better. Not by winning arguments. But by influencing positive change. Some key reminders from the video: ↳ Prepare your mind and your evidence. Data is harder to argue with than opinions. ↳ Stay calm. Calm helps us think clearly and speak wisely. ↳ Look beyond the surface. Find the root cause, not just the finding. ↳ Be curious, not accusatory. Ask. Listen. Understand. Audit comes from audire: to listen. ↳ Acknowledge constraints, without losing your role. Empathy and professionalism can go together. ↳ Separate people from problems. Disagreements are about issues, not personalities. ↳ Focus on solutions. End conversations with clear next steps. ↳ Escalate when needed. Not to “win”, but to protect the organization. At the end of the day, an audit is not about proving we are right. It is about helping the organization become better. If you often struggle with difficult audit conversations, this video is for you. Watch the video: https://lnkd.in/g8URKNkG #internalaudit #Itaudit #digitaltransformation