Every internal auditor has met the auditee who answers questions with one word, the manager who produces documents a week late, the team that seems to have agreed in advance to say as little as possible. It is tempting to read this as resistance, and occasionally it is. Far more often it is something more predictable and more useful to understand: a threat response, produced by a situation that has most of the features known to make people defensive, and partly created by the way audits are run. Auditors cannot remove the threat, because evaluation is the point of an audit. But they can avoid adding to it, and they can reduce the parts of it that serve no purpose, and the payoff is practical: better evidence, faster fieldwork, more accurate causes, and auditees who tell you about problems before you find them.
This guide, written for internal auditors, sets out what research on stress, fairness, loss and blame suggests about why audits feel threatening, how each finding shows up in an engagement, and what auditors can change at each stage from notification to follow-up. It covers difficult situations, what empathy does not mean for an objective function, how to measure the auditee’s experience, and a worked example of one audit function that surveyed its auditees and changed its practice. It was rewritten in September 2026. For the auditee’s side of the same experience, the site has guides to audit anxiety and common fears about internal audits, and a hub for people being audited.
In this guide
- Why audits trigger a threat response
- A working map: status, certainty, autonomy, relatedness, fairness
- Fair process matters as much as fair outcomes
- Loss, framing and why findings land badly
- Blame and the attribution trap
- Psychological safety and disclosure
- What auditors can change, stage by stage
- Difficult situations
- Remote audits, hierarchy and culture
- What empathy does not mean
- Measuring the auditee’s experience
- Worked example: what one function changed
- Questions auditors ask
- Related guides
Why audits trigger a threat response
Stress research has a fairly settled view of which situations produce the strongest stress responses in people. A widely cited 2004 review of laboratory studies by Sally Dickerson and Margaret Kemeny found that tasks combining social-evaluative threat, the possibility of being judged negatively by others, with uncontrollability produced the largest physiological stress responses of any conditions studied. An internal audit contains both by design. People’s work is examined and judged by others, in writing, for an audience that includes their superiors; and the audited area controls neither what is examined nor how it is judged. Add uncertainty, which is high in any first audit, and the conditions for a strong threat response are complete before the auditors have said a word.
What a threat response does to behavior matters to auditors more than what it feels like to auditees. Barry Staw, Lance Sandelands and Jane Dutton described in 1981 what they called threat-rigidity effects: individuals and groups under threat tend to restrict the information they take in and give out, fall back on familiar routines and concentrate control. In an audit, that looks like short answers, guarded disclosure, reliance on the written procedure rather than a description of real practice, and decisions pushed up to the manager. It is the behavior auditors most often complain about, and it is in large part the normal response to the situation audits create. The practical conclusion is not that auditors should be less rigorous, but that the parts of the threat which do not come from the evaluation itself, the uncertainty, the surprises, the sense of unfairness, are worth removing, because they cost the audit evidence.
A working map: status, certainty, autonomy, relatedness, fairness
A convenient way to organize the sources of threat is the SCARF model, proposed by David Rock in 2008, which groups social threats and rewards into five domains: status, certainty, autonomy, relatedness and fairness. It is a practitioner’s framework drawn from social neuroscience rather than a settled scientific theory, and it should be treated as a checklist rather than a law. As a checklist it is useful, because an audit touches all five domains, and each suggests something specific that auditors can do.
| Domain | How an audit threatens it | What auditors can do |
|---|---|---|
| Status: one’s standing relative to others | Work is judged by outsiders, sometimes junior ones, and reported upward | Treat the auditee as the expert on the process; acknowledge what works; keep findings about processes, not people |
| Certainty: knowing what will happen | Unknown scope, criteria, ratings and timing; surprises at the closing meeting | Explain objectives, period, criteria, rating definitions and timetable at the start; discuss exceptions as they arise |
| Autonomy: a sense of control | The auditors decide what to examine; requests arrive with deadlines | Ask for input on risks and timing; agree deadlines rather than impose them; leave management the choice of remedy |
| Relatedness: being with “us” rather than “them” | Auditors arrive as outsiders with a mandate from the board | Introduce the team as people; explain the shared purpose; keep contact regular rather than only when something is wrong |
| Fairness: being treated justly | Findings that seem to ignore context, ratings that seem arbitrary, no chance to respond | Share the basis for findings, apply ratings from written definitions, give a real chance to correct facts before the report |
Notice how many of the actions in the right-hand column are also requirements or expectations of the Global Internal Audit Standards. Standard 13.1 requires auditors to communicate an engagement’s objectives, scope and timing to management. Standard 14.3 requires auditors, when they evaluate potential findings, to work with management on root causes where possible, on potential effects and on significance. Principle 11 asks the function to build relationships and communicate effectively with stakeholders. Much of what reduces threat is simply the Standards done well.
Fair process matters as much as fair outcomes
The most robust body of research relevant to auditing is the work on procedural justice. Beginning with John Thibaut and Laurens Walker’s studies of dispute resolution in the 1970s, and developed by Allan Lind and Tom Tyler among many others, it has found consistently that people’s acceptance of a decision depends heavily on whether they judge the process that produced it to be fair, and not only on whether the outcome favors them. People accept unfavorable outcomes much more readily when they had a voice, when the process was applied consistently, and when they were treated with respect. Gerald Leventhal’s widely used criteria for a fair procedure, published in 1980, read almost like a description of a well-run audit: consistency, suppression of bias, accuracy of information, correctability, representation of the views of those affected, and ethicality. Later work by Robert Bies and Joseph Moag added interactional justice: whether people are treated with dignity and given honest, adequate explanations.
| Fair-process criterion | What it means in an audit | What undermines it |
|---|---|---|
| Voice | The auditee’s account of the process and the cause is heard before conclusions are drawn | Findings presented for the first time at the closing meeting |
| Consistency | The same rating definitions and standards of evidence apply to every area | Ratings that seem to depend on who ran the audit or how the auditee behaved |
| Accuracy | Findings rest on verified facts | Errors in the population, the period or the criteria |
| Correctability | There is a real chance to correct facts and a route to record disagreement | Defensive responses to correction; no disagreement route |
| Bias suppression | Auditors are objective and free of conflicts | An auditor with a history in the area, or visible preconceptions |
| Respect and explanation | Auditees are treated courteously and told the reasons for requests and conclusions | Unexplained requests; condescension; findings without their basis |
The implication for auditors is encouraging. Auditees do not need to like a finding to accept it; they need to believe it was reached fairly. The Standards build much of that in: Standard 14.3’s collaboration with management on the causes, effects and significance of potential findings gives voice and correctability, and Standard 13.1 requires a way for both sides to state their positions when they disagree. Functions that treat these requirements as formalities lose the benefit; those that use them as genuine conversations tend to find that even Unsatisfactory reports land without lasting damage to the relationship. The site’s guide to negotiating audit findings covers the conversation itself.
Loss, framing and why findings land badly
Daniel Kahneman and Amos Tversky’s prospect theory, published in 1979, established that people weigh losses more heavily than equivalent gains, a pattern known as loss aversion, and their later work on framing showed that the way a choice is described changes how people respond to it, even when the substance is identical. Both matter in audits. From the auditee’s side, an audit offers mostly potential losses, of standing, autonomy and time, and few visible gains, so the same objective risk is felt more intensely than an auditor might expect. And audit language frames almost everything as loss: findings, deficiencies, exceptions, failures, weaknesses.
This is not an argument for softer language about real problems. A control that did not operate did not operate, and the report must say so clearly. It is an argument for precision and balance. “The reconciliation was not independently reviewed in 9 of 12 months” is more precise and less inflammatory than “management failed to review reconciliations”. Recognizing controls that work, which many reports omit, is accurate and it changes how the rest is heard. And framing the action in terms of what it protects, rather than only what went wrong, costs nothing. The site’s guide to writing the impact of a finding shows how to state consequences precisely without inflating them.
Blame and the attribution trap
Social psychologists have long documented what Lee Ross in 1977 called the fundamental attribution error: the tendency to explain other people’s behavior by their character or effort while underweighting the situation they were in. Auditors are as prone to it as anyone. Faced with a missed review, the easy explanation is that someone did not do their job; the harder and usually more accurate one is that the process made the miss likely, through workload, system design, unclear ownership or a target that rewarded speed. Auditees know auditors are prone to the easy explanation, which is a large part of why they fear blame.
Safety-critical industries have developed a useful discipline for this, often called just culture, associated with the work of James Reason and David Marx. It distinguishes human error, an inadvertent slip, from at-risk behavior, a drift into shortcuts whose risk is not recognized, and from reckless behavior, a conscious disregard of a substantial risk, and it responds to each differently: error by redesigning the system, at-risk behavior by coaching and removing the incentives for shortcuts, and only recklessness by sanction. Root cause analysis in internal audit points the same way. A cause statement that names an individual rarely produces an action that prevents recurrence; one that names the condition that allowed the error usually does. The site’s guides to root cause analysis and writing cause statements set out the method, and auditees notice very quickly which kind of audit function they are dealing with.
Psychological safety and disclosure
Amy Edmondson’s research on psychological safety, the shared belief in a team that it is safe to take interpersonal risks such as admitting a mistake or raising a concern, began with a finding that surprised her: in a study of hospital units published in 1996, better-led teams appeared to report more errors, not fewer, because their members were more willing to report them. Her 1999 study of work teams established psychological safety as a predictor of learning behavior. The relevance to internal audit is direct. Disclosure, an auditee telling the auditors about a problem before it is found, is an interpersonal risk, and people take it only where they believe it is safe.
Auditors cannot create psychological safety in an organization on their own; it depends mostly on how management responds to bad news. But auditors can destroy it quickly, by treating a disclosed problem exactly like a discovered one, by naming the person who disclosed it, or by responding to candor with an expanded scope and a harsher tone. The functions that receive the most disclosures are those whose reports visibly credit management for issues it identified, and whose auditors respond to “there is something you should know” with thanks rather than suspicion. Where an organization’s culture itself suppresses disclosure, the question becomes one for the audit plan rather than the engagement, and the IIA’s Organizational Behavior Topical Requirement gives auditors a structure for examining it.
What auditors can change, stage by stage
The research translates into a small number of practical changes, most of which cost little time. The table works through an engagement; the site’s notification letter and kickoff templates put several of them into model wording.
| Stage | What adds threat | What reduces it |
|---|---|---|
| Notification | A terse memo; no reason given for the selection; jargon | Why the area was selected, the objectives, the period, the timetable and a named contact, in plain language |
| Kickoff | A presentation to the auditee; no time for questions | A conversation: ask what worries them, what has changed, and what they would like looked at; share the rating definitions |
| Requests | Long lists with short deadlines and no explanation | Requests tied to objectives, deadlines agreed, the purpose explained when asked |
| Walkthroughs | Interrogation; testing the auditee’s knowledge | Learning the process from its expert; using the live system; asking how it really works |
| Interviews | Staff taken aside without the manager knowing; unexplained purpose | Telling managers who will be interviewed and why; explaining the purpose to each interviewee |
| Exceptions | Exceptions collected silently and revealed at the end | Raising exceptions within a few days, as questions, while there is time to explain them |
| Potential findings | A finding’s first appearance in the draft report | Discussing each potential finding, its cause and its likely rating before the closing meeting |
| Closing meeting | Reading findings out; defending every word | No surprises; genuine openness to factual correction; clarity about what can and cannot change |
| Report | Language that names or blames individuals; only problems reported | Findings about processes; precise language; credit for actions already taken and controls that work |
| Follow-up | Contact only when actions are overdue | An offer to look at the design of a fix before it is built; recognition when actions close |
One rule captures most of the table: no surprises. Every finding in a report should have been discussed with the people responsible before they read it, with its facts, its cause and its likely rating. The rule is not a courtesy; it is how the Standards’ expectation that auditors work with management on potential findings becomes real, and it removes the single largest source of threat in the whole engagement. The site’s guide to soft skills for internal auditors covers the communication skills behind it.
Difficult situations
Some auditees are harder to work with than others, and understanding what is likely driving the behavior helps choose the response. The situations below come up in most audit careers.
| Situation | What is often going on | What tends to work |
|---|---|---|
| The hostile senior manager | Status threat, often with a real grievance about workload or a previous audit | Acknowledge the burden; ask for their view of the risks; keep the conversation on evidence; escalate only after trying directly |
| The team that says nothing | Low psychological safety; possibly instructions from above | Explain the purpose to each person; interview individually; watch for signs of coaching and consider whether the culture is itself a finding |
| The auditee who becomes upset | Acute threat, often about personal consequences | Pause; offer to continue later; explain what the finding is and is not about |
| The confident expert who says everything is fine | Status invested in the process; genuine belief it works | Respect the expertise; ask them to show you; let the evidence speak |
| The auditee who discloses something serious | A decision to trust you, usually after hesitation | Thank them; do not promise confidentiality you cannot keep; follow the organization’s procedures for reporting and protecting them |
| The auditee who tries to befriend you | Sometimes warmth, sometimes an attempt to soften the outcome | Stay courteous and professional; keep evidence standards unchanged |
| The auditee burned by a past audit | Learned threat from a function that once blamed or surprised them | Say what you will do differently, then do it; trust returns over engagements, not meetings |
In every one of these situations, the first move is the same: slow down and ask a question before drawing a conclusion about the person. Most difficult behavior in audits turns out to have an ordinary explanation, a workload crisis, a bad previous experience, a manager’s instruction, and the explanation usually points to what will help. The rare case of genuine obstruction becomes clear quickly enough, and the charter deals with it.
Remote audits, hierarchy and culture
Remote and hybrid audits change the psychology in ways that are easy to miss. Most of the cues people use to judge whether they are safe, tone of voice, facial expression, the small talk before a meeting starts, are weakened or lost on a video call and disappear entirely in email and chat, where a short request can read as curt and a question can read as an accusation. Requests arrive as a stream of messages with no conversation around them. The practical responses are simple: a short video conversation before the first written request, cameras on where people are comfortable with it, a sentence of context with every request, and a phone call rather than a message for anything that might be read as bad news. The site’s guide to remote and hybrid auditing covers the wider practice.
Hierarchy and culture matter too. Geert Hofstede’s research on national cultures introduced the idea of power distance, the extent to which less powerful people accept and expect that power is distributed unequally, and it applies within organizations as well as between countries. Where power distance is high, junior staff may not contradict a senior colleague in front of auditors, may agree with whatever an auditor seems to expect, and may find a direct question about a mistake deeply uncomfortable. Individual interviews, open questions rather than leading ones, and care about who is in the room help. So does remembering that silence in a group meeting, in such settings, is not agreement. None of this means applying national stereotypes to individuals; it means noticing how people in a particular team respond, and adjusting.
What empathy does not mean
Attention to the auditee’s experience is sometimes mistaken for going easy, and it should not be. The Standards require auditors to be objective, and Standard 2.1 asks them to maintain an impartial, unbiased attitude; nothing in this guide qualifies that. Understanding why an auditee is defensive does not change what the evidence shows. Reducing unnecessary threat does not mean lowering ratings, shortening findings or leaving out uncomfortable facts. In practice it tends to have the opposite effect: auditees who feel fairly treated disclose more, dispute less and accept harder findings, so functions that manage the auditee experience well often report more significant issues, not fewer.
A few lines are worth stating plainly. Do not promise outcomes: “this won’t be a High” is a promise the audit manager may overrule. Do not promise confidentiality you cannot keep, particularly about fraud or misconduct, which you may be obliged to report. Do not become the auditee’s advocate within the organization, however sympathetic their situation; describe the constraint accurately in the cause and let management decide. And do not let a good relationship relax the standard of evidence you apply. The site’s guide to GIAS Domain II covers the ethics principles that set these boundaries.
Measuring the auditee’s experience
A function that wants to know how its audits feel from the other side has to ask. Most quality programs include a short post-engagement survey, and the site’s QAIP self-assessment templates include a six-question version. The questions that tell a function most about the psychology of its engagements are about process, not satisfaction: whether auditees understood the objectives, were told about potential findings before the closing meeting, understood how findings were rated, felt their explanations were heard, and found the report accurate and fair.
Two cautions. Surveys must go out after difficult reports as well as easy ones, and results should be read with the rating in mind: fairness scores that are low on hard reports and high on easy ones may say more about how difficult messages are delivered than about the function’s quality, and a function whose scores are uniformly high may not be delivering many difficult messages. And auditee scores should never become targets that individual auditors are rewarded on, because that creates exactly the pressure to soften findings that objectivity forbids. They are information for the chief audit executive about how the process is working, alongside the quality assurance program‘s other measures.
Surveys are not the only evidence. Several measures a function already holds say something about the psychology of its engagements: the share of findings that management identified and disclosed itself, the number of findings whose facts were disputed for the first time at the closing meeting, the time from the end of fieldwork to the final report, and the proportion of findings accepted without a recorded disagreement. Rising disclosure and falling late disputes are good signs; the reverse is worth investigating, engagement by engagement.
Worked example: what one function changed
Lakeshore Bancorp, the $9 billion regional bank used across this site, added a short post-engagement survey to every report in FY25. After a year, the chief audit executive looked at the results by question rather than as an overall score. The overall picture was comfortable: professionalism and courtesy scored well above four on a five-point scale. Three statements scored markedly lower, and all three were about process rather than people.
| Survey statement | FY25 average (1 to 5) | What the chief audit executive concluded |
|---|---|---|
| “I was told about potential findings before the closing meeting.” | 2.9 | The collaboration on potential findings that the Standards expect was happening late, often at the closing meeting itself |
| “I understood how the findings were rated.” | 3.1 | Rating definitions existed but were never shared with auditees |
| “The report described the issues fairly.” | 3.4 | Draft reports often named roles in ways that read as blame, and rarely credited actions already taken |
The function made four changes for FY26. The rating definitions went into every kickoff pack, with a short explanation of how report ratings are derived. A working rule required every exception to be raised with the process owner within two business days, as a question, and every potential finding to be discussed, with its likely rating, before the closing meeting, so that the closing meeting confirmed rather than revealed. Audit managers reviewed draft reports specifically for language that attributed findings to individuals, and for actions already taken by management, which the Standards require the final report to acknowledge. And each report’s cover note thanked the area for issues it had disclosed, by name of the issue rather than the person.
| Measure | FY25 | FY26 |
|---|---|---|
| “I was told about potential findings before the closing meeting.” | 2.9 | 4.3 |
| “I understood how the findings were rated.” | 3.1 | 4.2 |
| “The report described the issues fairly.” | 3.4 | 4.0 |
| Share of findings identified and disclosed by management | 9 percent | 22 percent |
| Share of findings rated High | 14 percent | 15 percent |
| Median days from fieldwork end to final report | 31 | 22 |
The last three rows are the ones the chief audit executive presented to the audit committee. Management disclosure more than doubled, which is the clearest behavioral sign that auditees felt safer. The proportion of High findings did not fall, which answered the committee’s natural question about whether the function had gone soft. And reports reached final faster, because fewer disputes surfaced for the first time at the closing meeting. None of the changes required new staff or tools. They required the function to take seriously what its auditees were telling it, which is the same thing it asks of management.
Questions auditors ask
Isn’t some anxiety useful? It keeps people honest.
The evaluation itself provides all the useful pressure an audit needs. The extra anxiety that comes from uncertainty, surprise and perceived unfairness mostly reduces what auditees tell you, which makes the audit less accurate, not more.
How do I tell resistance from anxiety?
Often you cannot at first, and it rarely matters, because the same responses help with both: clarity, consistency and patience. Persistent obstruction after the purpose and process have been explained is different, and the charter and escalation route exist for it.
Should I send auditees the site’s guides for auditees?
Many functions send a short explanation of how audits work with the notification letter. A guide to what happens during an audit, or to handling the request list, answers the questions most auditees are too anxious to ask, and it costs the audit team nothing.
Does any of this apply to investigations?
The research applies, but the procedures differ. Investigations have their own rules on notice, representation and confidentiality, set with legal and HR, and those take precedence. Fair process matters even more there, because the stakes for individuals are higher and the findings may be tested later by others.
What is the single change that makes the biggest difference?
No surprises. If every finding has been discussed, with its facts, cause and likely rating, before the people responsible read it in a report, most of the threat an audit creates is gone, and what remains is the evaluation itself, which is the part that should be there.
Related guides
- Being audited? — the guides for auditees, worth knowing when you work with them.
- Audit anxiety — the same experience from the auditee’s side.
- Common fears about internal audits, answered — what auditees worry about, fear by fear.
- Notification letter and kickoff templates — model wording that removes uncertainty.
- Negotiating audit findings — the conversation where fairness is tested.
- Root cause analysis for audit findings — causes that point at conditions, not people.
- Soft skills for internal auditors — communication, influence and adaptability.
- Influencing without authority — office dynamics for internal auditors.
- QAIP self-assessment templates — including the auditee survey.
- The Organizational Behavior Topical Requirement — when the culture itself is the issue.
Leave a Reply