Auditors write down what you say. That is the first thing to understand about talking to them, and the reason the words matter more than in most workplace conversations. A statement in a walkthrough becomes part of the auditors’ understanding of the process, and they will test it. A comment at the closing meeting can end up in the report as “management represented that”. An offhand “we always do it this way” is an invitation to find the one time you did not. None of this makes auditors adversaries, and most conversations with them are ordinary and friendly. But a handful of phrases reliably make audits longer, findings harsher and relationships worse, and a better alternative exists for every one of them.
This guide is a phrasebook for people being audited, organized by stage: the kickoff, requests, walkthroughs and interviews, the moment an exception appears, the closing meeting and the written response. For each, it sets out what not to say, why it backfires and what to say instead. It covers the few things that should never be said at all, decodes the phrases auditors use, and ends with the same closing meeting conducted two ways. It was rewritten in September 2026 and is part of the site’s guide for people being audited.
In this guide
- Why words matter in an audit
- At the kickoff and during planning
- When requests arrive
- In walkthroughs and interviews
- When an exception turns up
- In the closing meeting
- In your written response
- Emails and chat: saying it in writing
- Tone: the part that isn’t words
- The things never to say
- If you manage the team: what your words signal
- What auditors say, and what they mean
- Ten phrases that help at any stage
- Worked example: one closing meeting, said two ways
- Questions people ask
- Related guides
Why words matter in an audit
Auditors form conclusions from evidence, and what people tell them is a form of evidence, the weakest form, but one they rely on to decide what to test. If you say a control happens every month, they will test whether it did. If you say a report is reviewed, they will ask to see the review. When statements turn out to be inaccurate, auditors do not just record a finding about the control; they start to discount other things they have been told, and they test more. The opposite is also true. People whose statements prove accurate find the audit getting shorter, because the auditors can rely on what they say to direct their work.
Almost all of the advice in this guide follows from five principles.
| Principle | What it means | Example |
|---|---|---|
| Accurate beats complete | A partial answer that is right is better than a full answer that is partly wrong | “I know the first three steps; Sam does the last one and can show you.” |
| Specific beats general | Absolutes invite testing; specifics can be checked and believed | “We reconcile weekly, usually by Tuesday; two weeks in March were late.” |
| Process, not person | Describe what the process does, not who is to blame | “The system lets the same person enter and approve” rather than “Jo never checks.” |
| Offer evidence, not assurance | A document settles what reassurance cannot | “Here is the log for that week” rather than “Trust me, it was done.” |
| Promise only what you can deliver | A missed commitment costs more than a later date | “Items 1 to 8 by Friday; item 9 needs IT, so the following Wednesday.” |
At the kickoff and during planning
The kickoff sets the tone for the whole audit, and the phrases people reach for when they are nervous are often the ones that set it badly. Confidence is good; certainty about things you have not checked is not.
| Don’t say | Why it backfires | Say instead |
|---|---|---|
| “You won’t find anything here.” | A challenge; auditors hear it as a prediction to test | “We think the process is in good shape. These are the areas we would most value your view on.” |
| “We have nothing to hide.” | Unprompted, it suggests the opposite | Say nothing, or: “Ask for whatever you need; our coordinator is Sam.” |
| “Why us again? You audited us last year.” | Sounds like resistance to the plan the committee approved | “Can you tell us what is driving this year’s audit, so we can focus our preparation?” |
| “Everything is fully documented.” | Almost never true, and the first gap undermines it | “The main procedures are documented; the month-end steps are mostly in people’s heads, and we can walk you through them.” |
| “We’re really too busy for this right now.” | Everyone is busy; it signals low cooperation | “The first week of the month is our close; could fieldwork start on the 8th?” |
| “Just tell us what you need and we’ll send it.” | Misses the chance to shape the audit | “Before you send the list, here is what has changed this year and what worries us.” |
| “Who complained?” | Assumes a motive; puts the auditors on the defensive | “Was there a specific event behind this audit, or is it from the annual plan?” |
The most useful thing to say at a kickoff is something most people never do: tell the auditors what you know is not working. “Two things you should know about: the vendor master clean-up is behind, and we lost our reviewer in June” changes the audit’s tone immediately. Auditors who are told about problems spend less time looking for others, and the problems themselves are usually reported with the credit of having been disclosed. The site’s guide to preparing for an internal audit explains how to prepare that list.
When requests arrive
Requests are where the day-to-day friction of an audit happens, and where small phrases have large effects on how long it takes. The aim is to be precise about what you will send, when, and in what form. The site’s PBC survival guide covers the request list in detail.
| Don’t say | Why it backfires | Say instead |
|---|---|---|
| “We’ll get you everything by Friday.” | Friday comes and half of it has not; trust drops | “Items 1 to 12 by Friday, 13 and 14 by Wednesday; 15 needs IT and I will confirm a date tomorrow.” |
| “Why do you need that?” | In the wrong tone, it sounds like obstruction | “Can you tell me what this will be used for, so I send the right thing?” |
| “Here’s everything we have.” | A data dump hides the answer and costs the auditors days | “Here is the report you asked for. The supporting files are in the folder if you need them.” |
| “That’s confidential.” | Internal audit’s access is unrestricted under the charter | “It contains personal data; can we send it with names replaced by IDs?” |
| “We tidied the data up before sending it.” | Filtered data cannot be shown to be complete | “Here is the full extract, the query we ran and the total, which matches the ledger.” |
| “That report doesn’t exist.” (said to end the conversation) | The follow-up is always “then how do you monitor it?” | “No standard report exists; this is how we monitor it instead.” |
| “I’ll have to ask IT.” (and then nothing) | The request goes silent and becomes an escalation | “I’ve raised it with IT under ticket 4471; I’ll update you on Thursday.” |
In walkthroughs and interviews
Walkthroughs and interviews are where statements become evidence. The auditors are building a picture of how the process works, and everything you say is part of it. Absolutes, guesses and deflections are the three habits that cause most trouble. The site’s guide to when internal audit interviews you covers the questions auditors ask and what each is testing.
| Don’t say | Why it backfires | Say instead |
|---|---|---|
| “We always do it this way.” / “That never happens.” | An absolute is a hypothesis the sample will test | “That is the normal process. Exceptions happen when the file arrives late; then we…” |
| “I think so.” / “Probably.” | A guess recorded as a fact | “I’m not sure. I’ll check and come back to you this afternoon.” |
| “The procedure says we…” | Describes the document, not the work | “The procedure says a manager signs off; in practice the senior clerk does, because…” |
| “That’s not my job.” | Sounds evasive, even when true | “That step is done by accounts payable. I can introduce you to the person who does it.” |
| “Off the record…” | There is no off the record in an audit | Say it on the record, or not at all |
| “Everyone knows that.” | If it is not written down, the auditors cannot rely on it | “It isn’t written down; it is how the team has worked since the system changed in 2024.” |
| “I’d rather not say.” | Invites more questions than an answer would | “I don’t know the full story. The person who would is…” |
| “My manager handles all that.” | Deflection | “My manager approves it. I prepare it, and I can show you how.” |
One phrase deserves special praise: “I don’t know, but I’ll find out.” Auditors hear it constantly from the people whose areas go well, and rarely from the people whose areas go badly, because the second group tends to guess. A guess that turns out to be wrong costs far more than the delay of finding the right answer.
When an exception turns up
Sooner or later an auditor will show you an item and ask about it: a missing approval, a late reconciliation, a transaction that looks odd. It is the moment people are most likely to say something they regret, because it feels like an accusation. It is a question. Treat it as one.
| Don’t say | Why it backfires | Say instead |
|---|---|---|
| “That’s just a one-off.” | Unless you know it is, the auditors will extend the sample to find out | “Let me check whether that happened anywhere else and come back to you.” |
| “That must be a system error.” | An unverified explanation that often turns out to be wrong | “I don’t recognize that. I’ll ask IT whether there is a system explanation.” |
| “It’s too small to matter.” | Size affects the rating, not whether the control worked | “The amount is small; the question of why the review missed it is fair. Here is what happened.” |
| “Can we just fix it and leave it out of the report?” | Asks the auditors to compromise their work | “We’ve corrected it. Can the report note that it was fixed?” |
| “Who gave you that?” | Sounds like looking for someone to blame | “Can you send me the details so I can trace it?” |
| “Everyone else does the same.” | Suggests a wider finding, not a lesser one | “I believe the process is the same at the other sites. If so, the cause may be in the design.” |
In the closing meeting
The closing meeting is where findings are presented before the draft report, and where the most damaging sentences of an audit are usually spoken. Disagreement is legitimate and expected; the Standards require audit functions to give management a way to state its position. What matters is whether the disagreement is about facts, causes and definitions, or about feelings. The site’s guide to disagreeing with a finding explains how each part of a finding is argued.
| Don’t say | Why it backfires | Say instead |
|---|---|---|
| “This is completely unfair.” | Gives the auditors nothing to change | “I think the count is wrong: 54 of those items are system rounding entries. Here is the evidence.” |
| “You don’t understand our business.” | A personal criticism, and rarely the real issue | “I don’t think we explained the month-end process well. Can I take you through it again?” |
| “That rating is ridiculous.” | Argues from feelings, not the definitions | “Under your definitions, High needs exposure above $250,000; on the corrected figures it is $85,000.” |
| “We already fixed it, so it shouldn’t be in the report.” | The report covers the period tested | “We fixed it in August. Can the report reflect that?” |
| “We’ll be taking this to the CEO.” | A threat to the audit function’s independence | “If we can’t agree, I’d like our view recorded in the response.” |
| “Fine, put whatever you want.” | Accepting findings you believe are wrong, then resenting them | “We accept findings 1 and 3. We want to discuss 2, and I’ll send our evidence tomorrow.” |
In your written response
The management response is the part of the report you write, and it is read by your executive and often the audit committee. Its language is judged differently from speech: vague words look evasive in print, and dates look like promises. The site’s guide to writing management action plans that close covers the response in full; the phrases below are the ones that most often weaken it.
| Don’t write | Why it backfires | Write instead |
|---|---|---|
| “Management will ensure that…” | States an intention, not an action | “From 1 December, the regional finance manager will review ten reconciliations per depot each week, recorded by email.” |
| “Staff will be reminded of the procedure.” | Treats the symptom; rarely survives validation | “The system role will be changed so that preparers cannot approve their own entries.” |
| “As soon as possible.” / “Ongoing.” | Not a date; cannot be tracked | “31 January 2027, after the January system release.” |
| “Management disagrees with this finding.” | A position without a reason | “Management does not agree, because the policy cited does not apply to sites with fewer than three staff (section 1.2).” |
| “This issue has been resolved.” | A claim the auditors will have to test anyway | “The change went live on 12 August; the change record and the first month’s approvals are attached.” |
| “Owner: the finance team.” | Nobody in particular is accountable | “Owner: Regional Finance Manager, Central.” |
Emails and chat: saying it in writing
Much of an audit now happens in email and chat, and written words carry a permanence that spoken ones do not. An irritated message sent at the end of a long day can be forwarded, quoted and read by people who were not part of the conversation. The same principles apply as in speech, with a few additions that are specific to writing.
| Don’t write | Why it backfires | Write instead |
|---|---|---|
| “As I have already explained…” / “Per my last email…” | Reads as exasperation; escalates tone | “To confirm what I sent on Tuesday: the approvals are in the attached log, rows 12 to 40.” |
| Copying your executive or the chief executive on routine replies | Looks like pressure on the auditors | Copy only the people who need the information |
| “URGENT” or capital letters | Signals panic or anger | Plain subject lines: “Request 14: payroll change reports, February to April” |
| A bare attachment with no explanation | The auditors have to guess what it shows | “Attached is the override report for March. Column F shows the approver; all approvers differ from the preparer.” |
| Forwarded internal threads with comments about the auditors | They will be read | Start a new, clean email |
| A long reply to a short question | The answer gets lost | Answer first, in one line; add detail below if needed |
A simple test before sending anything to an auditor: would you be comfortable seeing this sentence quoted in the report, or read aloud at the audit committee? If not, rewrite it. Most people find that the rewritten version is also clearer.
Tone: the part that isn’t words
Auditors notice how things are said as much as what is said, and so do the people around you. A sigh when a request arrives, a meeting that always starts ten minutes late, a camera that stays off in every video call, replies that take a week when everyone knows the answer takes a minute: each tells the audit team something about how the area regards the audit. None of it is a finding, but all of it shapes how much the auditors feel they can rely on what they are told, and therefore how much they test.
The tone that works best is the one you would use with a colleague from another department who has been asked to check something important: courteous, businesslike, a little patient with questions that seem obvious to you, and frank about problems. It does not require warmth you do not feel or agreement you do not have. It requires treating the audit as a legitimate piece of work, which it is, and the auditors as people doing their job, which they are.
The things never to say
Everything above is about phrasing: better and worse ways of saying things that are fine to say. A few things are different. They are not unwise phrasing; they are requests or statements that can amount to misconduct, and they can turn an ordinary audit into an investigation of the person who said them.
- Anything you know to be untrue. Misleading an auditor is treated far more seriously than any control failure it hides.
- “Don’t put that in writing” or “let’s keep this between us”. Auditors cannot agree to it, and asking suggests something to hide.
- “Can you backdate that?” or asking anyone to create records after the fact. Falsifying evidence is misconduct in most organizations and can be unlawful.
- “Don’t talk to so-and-so” or telling staff not to cooperate. Obstructing an audit usually breaches the code of conduct.
- “If that goes in the report, you’ll regret it.” Any threat to an auditor, however lightly meant, is an attack on the function’s independence and will be reported.
- “I’ll make sure you never audit this area again.” The same, in a different form.
If you ever hear someone else say one of these, particularly if it is an instruction to you, do not go along with it. Raise it with the chief audit executive or through your organization’s ethics or whistleblowing channel.
If you manage the team: what your words signal
Managers shape what their teams say to auditors, often without meaning to. A throwaway instruction before fieldwork, “just give them the minimum” or “don’t volunteer anything”, tells people that the audit is something to be managed rather than helped, and it produces exactly the guarded, inconsistent answers that make auditors dig deeper. Teams notice, too, how their manager talks about the auditors afterwards. “What did they ask you?” after every interview sounds like surveillance, and people stop speaking freely.
| Instead of telling your team | Tell them |
|---|---|
| “Give them the minimum.” | “Answer what they ask, accurately.” |
| “Don’t volunteer anything.” | “If you know about a problem, it’s better they hear it from us.” |
| “Check with me before you answer anything.” | “If you’re not sure, say you’ll find out, and let me know if you need help.” |
| “Tell me everything they asked you.” | “Let me know if there’s anything you need from me.” |
| “We need a clean report.” | “We need an accurate report, and a plan for whatever it finds.” |
What auditors say, and what they mean
Auditors have their own phrases, and some of them sound more alarming than they are. A short decoder for the common ones follows; the site’s guide to internal audit jargon covers the vocabulary more widely.
| The auditor says | What it usually means | A good response |
|---|---|---|
| “Can you help me understand this item?” | An item from testing they cannot yet explain; often cleared by a document | Check it and answer, with evidence, by a stated time |
| “We’ll need to extend the sample.” | They found exceptions and want to know if they are isolated or systemic | Say what you know about how widespread it is |
| “Management represented that…” | They have relied on what you told them, and recorded it as your statement | Make sure it is accurate; correct it if not |
| “No exceptions noted.” | The test found nothing wrong | Nothing, except perhaps quiet satisfaction |
| “We were unable to obtain…” | Evidence they asked for did not arrive; a possible scope limitation | Find out what is missing and provide it, or explain why it does not exist |
| “This looks like a design gap.” | The control as designed cannot address the risk, whoever performs it | Discuss the design; the fix is usually a change of process, not people |
| “Is there a compensating control?” | They are looking for another control that covers the same risk | Show one if it exists, with its evidence |
| “This is a potential finding.” | Not final; it is being discussed with you before the report | Check the facts and the cause now |
| “It’s an observation.” | A minor point that may be reported outside the rating | Take it seriously; observations often become findings next time |
| “We’ll take that away.” | They will consider your point, not that they agree | Ask when they will come back to you |
| “It’s subject to review.” | Their manager and possibly the chief audit executive will review it | Expect some wording to change before the draft |
| “Is there anything else we should know?” | A genuine invitation to disclose | Use it |
Ten phrases that help at any stage
Most of this guide is about what to avoid. It is worth ending the phrasebook with the sentences that people whose audits go well use again and again. None of them is sophisticated; each one moves the audit forward, and together they signal an area that can be relied on.
- “Can you tell me what this will be used for, so I send the right thing?”
- “I don’t know, but I’ll find out and come back to you by Thursday.”
- “That’s the normal process. Here are the exceptions, and why they happen.”
- “There’s something you should know about before you find it.”
- “That’s right. Here’s why it happened, and what we’ve done since.”
- “Here is the evidence.” (Rather than “trust me”.)
- “How does that sit against your rating definitions?”
- “What would good look like here, in your experience?”
- “Is there anything you need from us that you haven’t got?”
- “Before the report, is there anything else we should discuss?”
The eighth deserves a note. Auditors see many versions of the same process across an organization, and sometimes across organizations, and asking what good practice looks like is one of the most valuable questions an auditee can ask. Auditors must stay objective and will not design your controls for you, but most will share what they have seen work elsewhere.
Worked example: one closing meeting, said two ways
MidState Beverage, the drinks distributor used in this site’s examples, audited route cash handling at all twelve depots. One finding was that depots re-keyed their deposit listings into spreadsheets instead of producing them from the ERP, so a keying error or a manipulated entry could pass into the bank deposit unnoticed. Below is part of a closing meeting with one depot manager, first as these conversations often go and then as it actually went.
| Moment | How it often goes | How it went | What the difference achieved |
|---|---|---|---|
| The finding is read out | “That’s not fair. Every depot uses spreadsheets; that’s how it’s always been done.” | “That’s accurate. Can I explain why we use the spreadsheet?” | The auditors listen instead of defending |
| The cause | “The ERP report is useless, and IT never fixed it.” | “The ERP deposit report doesn’t group checks the way the bank requires, so we re-key them. I raised it with IT last year; the ticket is here.” | The cause is recorded as a report design problem, with evidence of an earlier request |
| The effect | “Nothing has ever gone wrong with it.” | “We haven’t had an error we know of, but I accept we wouldn’t necessarily have seen one.” | Credibility; the effect statement stays factual rather than alarming |
| The rating | “Medium is way too harsh for a spreadsheet.” | “How does this sit against your definitions? Is there a compensating control we could point to?” | The auditors check the bank reconciliation as a compensating control; the rating is confirmed on the definitions, and the depot manager understands why |
| The action | “We’ll be more careful with the spreadsheet.” | “If IT changes the report grouping, we can retire the spreadsheet. I’d want IT as the owner, with me confirming when it’s live.” | An action owned by the function that controls the fix, with a real date |
Nothing in the second version is clever. It accepts what is accurate, gives evidence for what is not, asks questions instead of making claims, and proposes an action the manager can deliver. The finding stayed in the report, as it should have, but its cause pointed at the report design rather than the depot, and the spreadsheet was retired when the ERP change went live.
Questions people ask
Can I ask to see the auditors’ notes of what I said?
You can ask, and many auditors will share or confirm a summary of a walkthrough, particularly if it will be relied on. If you realize something you said was wrong, tell them; correcting the record is always welcome.
Is small talk with auditors risky?
No. Auditors are colleagues, and ordinary conversation is fine. The guidance in this guide applies to statements about the process, the controls and the evidence, not to talk about the weekend.
What if I said something wrong in an interview?
Correct it as soon as you realize, in writing if it mattered: “In our meeting I said the review is weekly; it is fortnightly.” Corrections are routine and reflect well on you; an error left to be discovered does not.
Should I tell the auditors about problems in another team?
If they affect your process, yes: factually, without blame, and ideally after telling the other team you are going to mention it. “Our reconciliation depends on a file from treasury that often arrives late” helps the auditors place the cause correctly; “treasury is hopeless” does not.
Related guides
- Being audited? — every guide for auditees and management, by stage of the audit.
- When internal audit interviews you — the questions and what they test.
- When you disagree with a finding — facts, cause and rating.
- Writing management action plans that close — the written response.
- The PBC survival guide — handling requests.
- Audit anxiety — the personal side of being audited.
- Disagreements beyond the findings — scope, timing, access and conduct.
- Internal audit jargon explained — the vocabulary.
- The Auditee’s Playbook — scripts and templates for every stage, as a working document.
- What to expect during an internal audit — the engagement from start to finish.
Leave a Reply