Nine Strategies to Ease Tension with Internal Audit Clients

As the saying goes, “you can’t make an omelet without breaking a few eggs.” It’s likely an expression internal auditors have heard or even used themselves to characterize the tension that can result from auditing a particular function or process.

The role of internal audit is to provide independent assurance that an organization’s risk management, governance, and internal control processes are operating effectively. This role is unique because the internal auditor is an agent that monitors the actions of other managers, whom are employed by the same organization. The process of expressing an opinion on the client’s operations, financials, and controls unavoidably leads to a certain amount of conflict or tension between the internal auditor and the auditee or audit client.

According to Richard Chambers, president and CEO of the Institute of Internal Auditors, tension between internal audit and management can arise from inequitable distribution of resources to the internal audit unit, disclosure of risks to the audit committee, unflattering internal audit reports, disputed ratings and opinions of the internal audit, and internal audit’s unique relationship with the audit committee.

While some conflict may be unavoidable, internal audit doesn’t have to have a strained relationship with the managers of functions and processes it audits. Indeed, by using a few strategies to manage tension and involve audit clients in the planning and decision-making process, internal auditors can keep those tensions to a minimum. Here are nine measures to manage tension with auditees during audit assignments.

1) Involve auditees in audit plan development
The audit plan is the framework for the performance of audit work. For effective execution of an audit it becomes imperative that internal audit involves the audit client in the planning of the audit. This will bring about mutual understanding on the scope of the audit. Accepting input from the auditee will reduce or eliminate the elements of tension as they are aware of what the audit is to do at their function or process to improve the system. Typically managers will be far less critical of a process that they had a hand in developing. Not only does it increase the transparency of the audit process, but it also lessens the idea that an outsider is coming in to look over someone’s shoulder. A copy of the audit plan should then be made available to the auditee to prepare them for the audit assignment.

2) Hold an entry conference
The opening conference is the initiation of the audit work or the formal introduction of the internal auditor to the client. An entry conference provides an opportunity for the audit team to explain the key audit thrust areas to the auditee as a means to add value to the entity or auditee operations and not to act as a detective to find faults with the auditee. Aside from conveying the goal of adding value, it is the means to outline the audit plan and audit program to the auditee. This is one of the avenues to educate managers on the purpose of the audit assignment. It also provides an opportunity to again gather feedback from the audit client and hear any concerns the audit clients have so they can be addressed early, before they develop into points of contention.

This opens the door for the management or the auditee to ask questions and get responses that can help settle any misunderstandings, which in the long run will reduce or prevent tension between the internal audit and the auditee.

3) Use care during field work
During the audit process the internal auditor uses interviews as one of the instruments to solicit information. Interviews, inquiry, and observation are used to gain an understanding of the audit environment, regulatory environment, and activities that are carried out by the auditee. It’s important to be thorough in this information gathering, but internal auditors should also use what doctors would call, “good bedside manner.” Show appreciation for the auditee’s schedule and work to create as little disruption as possible.

It’s also important to provide auditees the chance to make clarifications to assumptions gained during field work. The auditor should get clarification on matters that are raised as a finding by writing to the auditee to respond to them before including them in the audit reports. Proper documentation is critical to the audit work as it is the only evidence of the work done. Documenting events will help reduce tension since auditors will have evidence to substantiate, authenticate, and prove the findings raised in the audit.

4) Write balanced audit reports
Audit reports that only include deficiencies and problems are sure to provoke the ire of process owners. Be sure to also mention things that are working well in audit reports. Audit reports should be a representation of the events and transactions that have taken place. The report should highlight the successes, failures, and challenges of the auditee. When auditees feel appreciated for their successes and wins are celebrated, they will be far more likely to accept negative findings and work to improve them. This helps reduce the tension between the auditor and the auditee. It’s also important to ensure that the recommendations in the internal audit report are achievable. Unrealistic recommendations or those that can’t be achieved with existing resources will certainly breed frustration and create tension between the auditor and the auditee.

5) Use care in the wording of the audit report
Language can be an effective way to ease tension when it comes to report writing. Avoid words that are inflammatory or convey opinions more than factual findings. The wording of sentences is also important as communication ends with how the recipient understood the report and not how the auditor intended to communicate findings. This makes the auditor responsible for the contents of the audit report and thus should be particular about the wording and the intent to communicate his or her findings. Be sure to get impartial readers of audit report drafts to ensure the intended message is indeed the message that is being communicated. Internal auditors should also take care not to dilute or reduce the impact of the internal auditor report.

6) View auditees as customers
Before the audit, the auditee may have a prejudiced opinion that the internal auditor’s intent is to find fault with them and not necessarily to improve the system. When the internal auditors’ attitudes suggest they are acting to find fault with them, auditees will become defensive to protect themselves against the auditor rather than cooperating to improve the system.

Internal auditors should carry and conduct themselves in a way to suggest that they are partners with the shared goal of process improvement. The internal auditor should respect the auditee and not treat them as wrongdoers and also not to take the auditee for granted. In fact, viewing them more as customers can go a long way to changing the relationship from adversarial to cooperative.

7) Follow standards and abide by all policies
When auditors carefully abide by professional standards, such as the IIA’s International Standards for the Professional Practice of Internal Auditing, they have a strong basis and justification for their actions. When they can show that they are following approved standards and guidelines, audit clients will be less likely to push back on internal audit’s methods. When required, bring the standards to the attention of auditees.

Internal audit must also closely adhere to the policies and standard procedures of the organization. When the auditor flaunts the same rules that he wants the auditee to comply with, it will leave much to be desired of the auditor and can lead to conflict and tension.

8) Avoid surprises
Nothing will create conflict faster than when audit clients feel sideswiped. The auditee should always have a chance to address contentious findings before they are included in the report or discussed with others in the organization. The auditee will almost always become frustrated when they are sidelined and matters of the report are discussed with third parties who could either be their boss in the chain of command or a person who has no connection to the audit process. Contents of the audit report should be discussed; however, to avoid tension the draft report should be made available with ample time to prepare a response in order to avoid tension.

9) Conduct a well-organized exit conference
An exit conference is one of the ways to resolve tension between the auditor and the auditee. It is at the exit conference that the audit report is discussed. At this point, if care is not taken, tension can heighten and could result in verbal exchanges. Possible audit findings should be made available to the auditee to respond to before the exit conference to enable a smooth exit meeting.

Communication of Risks
When the audit is over and an exit meeting for the discussion of audit findings is arranged, that is when the battle lines are drawn. In a tension-filled atmosphere audit stands resolute, ready to argue with management, and armed with the fully supported, cross-referenced audit report. Management is equally prepared with standard catch phrases to disarm the audit team such as: “Oh that’s just a paperwork problem;” “This issue doesn’t seem report-worthy;” “That is what we have been doing all these years;” or “If management already fixed the problem, then why do we need to have it in the report.” After a few hours of debate, one thing becomes very evident: both sides have a very clear, but totally different view of risk to the organization. It will take some good communication to arrive at a consensus on what the underlying risks are and how they should be addressed.

Before the internal auditor issues any report, be it satisfactory or unsatisfactory, the internal auditor must showcase a high sense of professionalism and ensure that any issues that have arisen throughout the audit are resolved. Over-communicate rather than under-communicate, treat everyone involved in the process with respect, and keep an open mind on the views and arguments of auditees and the occasional tension that arises between internal audit and auditees and can eased dramatically. 

Daniel Quainoo is an internal auditor at the University of Cape Coast in Cape Coast, Ghana. He has more than 15 years of experience working as an internal auditor.