An audit closing meeting, also called an exit meeting or exit conference, is the meeting at the end of fieldwork where the internal audit team walks the management of the audited area through every finding before the draft report is written. Its purpose is to confirm the facts, agree the causes and the actions, explain the ratings, and surface any disagreement while it can still be resolved in conversation rather than in writing. A good closing meeting contains no surprises: every finding has already been discussed with its owner, so the meeting confirms and completes rather than reveals. It usually takes 60 to 90 minutes, and it decides how quickly the report is issued and how the findings are received.
This guide is the full playbook. It covers what the Standards expect, the no-surprises rule and how to pre-wire findings, who should attend and what each person does, a 60 to 90 minute agenda, a four-minute structure for presenting each finding, a triage for the disagreements that arise in the room, what to concede and what to hold, the summary that goes out afterwards, variants for clean, adverse, advisory and fraud-adjacent engagements, and a worked example from a distributor’s order-to-cash audit. It starts where the opening meeting left off, and the guide to negotiating audit findings goes deeper on the pressure tactics that sometimes surface at the end.
In this guide
- What the closing meeting is for
- The cardinal rule: no surprises
- Who attends and who does what
- The agenda: 60 to 90 minutes
- The finding walk: four minutes per finding
- Handling disagreement in the room
- What to concede, and what to hold
- After the meeting: the summary and the draft
- Variants: clean, adverse, advisory and fraud-adjacent engagements
- Measuring whether your closing meetings work
- Mistakes that make the report harder
- Worked example: MidState’s order-to-cash closing meeting
- Questions about audit closing meetings
- Related guides
What the closing meeting is for
The Global Internal Audit Standards describe engagement communication as running from initial through ongoing and closing communications to the final report, and the guidance under Standard 13.1 names the closing communication, also called an exit conference, as one of the usual forms. Three requirements give the meeting its shape. Standard 14.3 asks internal auditors, when they evaluate potential findings, to work with management to identify root causes where possible, determine potential effects and evaluate significance. Standard 14.4 requires recommendations to be discussed with management, and a set method for resolving disagreement about recommendations or action plans. And Standard 13.1 requires that when auditors and management disagree about the results at the end of an engagement, the auditors discuss the issue and try to reach a mutual understanding; if that fails, the auditors are not obliged to change the results without a valid reason, and both sides get a way to state their positions. The site’s guide to Domain V of the Standards covers these in full.
Put together, those requirements give the closing meeting five jobs.
| Job | What “done” looks like | How it usually fails |
|---|---|---|
| Confirm the facts | Management agrees that each condition is accurate, or evidence is produced that changes it | Facts disputed in writing after the draft, adding weeks to the report |
| Agree the causes | Each finding’s root cause is one management recognizes and can act on | Causes written by the auditors alone, producing actions that miss the point |
| Explain the ratings | Management understands how each rating follows from the published definitions | Ratings argued on feelings, or quietly softened to end the argument |
| Settle the actions | Owners and target dates are agreed, or the gap between audit and management is clear | Actions left to the response stage, where they arrive vague and late |
| Record any disagreement | Where agreement is not reached, both positions are understood and will be stated | Disagreement discovered in the management response, after the draft is circulated |
The cardinal rule: no surprises
The single most important thing about a closing meeting happens before it: every finding in the meeting has already been discussed with the person who owns the process. That is what pre-wiring means. It is not a courtesy. A finding heard for the first time in front of a manager’s executive produces defense, not engagement, and it turns the meeting into an argument about fairness rather than a conversation about the control. A finding the owner has seen, questioned and corrected three days earlier produces a nod.
Pre-wiring runs on a simple rhythm through fieldwork.
| When | What happens | Why |
|---|---|---|
| As each potential finding is confirmed | The lead auditor tells the process owner what was found, with the numbers, and asks whether anything is missing | Facts are corrected while the evidence is fresh, and the owner hears it from the auditor rather than from a report |
| At every weekly status update | Open potential findings are listed, with their status | Nothing arrives in the closing meeting that was not on a status update |
| Three to five working days before the meeting | Each owner receives the draft finding sheets: condition, criteria, cause, effect, proposed rating, proposed action | The owner can check facts and prepare questions rather than react |
| One to two days before | The lead auditor or manager speaks to each owner about anything they queried in the finding sheets | Disputes about facts are resolved before the room, not in it |
| The day before | The audit manager briefs the accountable executive on the overall result, especially if it is adverse | The executive is not surprised in front of their team |
The last row matters most when the result is bad. An executive who learns in the meeting that their area’s overall rating is Unsatisfactory will spend the rest of the meeting managing their own reaction. An executive who heard it the day before, with the reasons, arrives ready to talk about what happens next. The site’s guide to the life of a finding sets out the service standards for each of these stages, including how quickly a potential finding should reach its owner.
Who attends and who does what
Closing meetings go best when every attendee knows why they are there. The table below is the usual cast; smaller engagements merge roles.
| Role | Who | What they do in the meeting |
|---|---|---|
| Chair and presenter | Audit lead | Opens, presents the findings, keeps time |
| Rating and escalation authority | Audit manager | Explains ratings against the definitions, decides what is parked, handles disputes the lead cannot |
| Senior presence | Chief audit executive, for adverse or high-profile results | Opens briefly, stays for the overall conclusion, is available if a dispute needs escalating |
| Accountable executive | The executive who owns the area | Hears the overall result, commits to the actions, resolves disputes among their own team |
| Process owners | Managers who own each finding’s process | Confirm facts, agree causes, propose actions and dates |
| Note-taker | Staff auditor | Records what was agreed, changed and parked, with owners and dates |
Two attendance decisions deserve care. The first is whether the accountable executive attends. If the result is routine, it is often better to hold the detailed meeting with the process owners and brief the executive separately in fifteen minutes. If the result is adverse, the executive should be in the room, because the actions will need their authority. The second is who from audit speaks. The lead auditor who did the work should present it; the audit manager should hold the ratings, because a rating defended by the person who wrote the finding looks personal, and a rating defended by the manager against published definitions looks like the method it is.
The agenda: 60 to 90 minutes
Sixty minutes suits an engagement with up to six findings; ninety suits one with more, or with a High finding that needs time. The segments below are for a 75-minute meeting.
| # | Segment | Minutes | Led by | Output |
|---|---|---|---|---|
| 1 | Purpose and ground rules | 3 | Audit lead | Everyone knows the meeting confirms facts and actions, and that the draft follows |
| 2 | The headline: what we tested and the overall result | 5 | Audit lead or manager | The verdict is known before the detail, so nobody spends the meeting waiting for it |
| 3 | What worked | 5 | Audit lead | Controls found effective are named, specifically |
| 4 | The findings, in order of significance | 45 | Audit lead, with owners | Each finding confirmed or parked, with actions and dates |
| 5 | Parked items and how they will be resolved | 7 | Audit manager | Each parked item has an owner, a question and a date |
| 6 | Next steps | 5 | Audit lead | The draft date, the response date, the report’s distribution |
| 7 | Close | 5 | Accountable executive or CAE | The executive’s commitment to the actions, in their own words |
Two choices in that order are deliberate. The overall result comes early, not at the end, because people cannot listen to findings while they are waiting to hear whether they have “failed”; the site’s guide to writing the executive summary makes the same argument for the report. And the findings go in order of significance rather than process order, so that the time runs out on the Lows, not on the High.
The finding walk: four minutes per finding
Each finding in the meeting should follow the same structure, so that people know what is coming and can see that every finding is being treated the same way. The structure below takes about four minutes for a Medium and eight for a High, including discussion.
1. The condition, in one sentence with numbers. “Of 48,000 credit memos issued in the year, 2,300 were approved by the person who issued them.”
2. The standard it is measured against. “The credit policy requires a second approval for every credit memo.”
3. The cause, as discussed with the owner. “The system allows the issuer to approve, and at the acquired depots the approval step was set up without a second approver.”
4. Why it matters. “It means a credit could be raised and approved by one person with nothing else checking it, which is the mechanism that hides a diverted payment.”
5. The rating, and the definition it meets. “We’ve rated this High. Under the definitions we sent you, a High is a weakness that could lead to a significant loss or misstatement if it isn’t fixed, and this one meets that because nothing else in the process would catch a false credit.”
6. The action, owner and date. “The proposed action is to require second approval in the system for all credits, owned by the credit manager, by the end of the quarter. Does that date work?”
7. The check. “Is there anything in what I’ve said that isn’t accurate?”
The seventh step is the one that matters. Asking whether anything is inaccurate, every time, turns disagreement into a routine part of the meeting rather than an interruption of it. It also produces the only kind of disagreement worth having in a closing meeting: a specific fact, with a specific correction.
For findings the owner has already agreed in pre-wiring, the walk can be brisk: condition, rating, action, date, and a question. For a High finding or one the owner has queried, slow down and let the owner speak before you move to the action. The site’s guides to the five Cs of audit findings and to root cause analysis cover the substance of each element.
Handling disagreement in the room
Disagreement in a closing meeting is normal and usually useful. The skill is to recognize which of six kinds it is, because each is handled differently.
| Type of disagreement | What it sounds like | How to handle it |
|---|---|---|
| Fact | “That number is wrong. Those twelve accounts were closed in March.” | Take it seriously. If the evidence is in the room, check it and correct the finding on the spot. If not, park it with a date for the evidence |
| Rating | “This is a Medium at most.” | Walk through the definition the rating meets. A rating changes only if the facts change or the definition was misapplied, not because it is disputed |
| Cause | “The cause isn’t training. We’ve never had the staff.” | Listen: the owner often knows the real cause better than the auditor. Agree a cause that points to an action that would work |
| Action or date | “We can’t do that by March. The system release is in June.” | The action is management’s to own. Ask what interim step reduces the risk until June, and whether the June date is realistic |
| Wording | “Can you not say ‘failed’? It sounds like someone is to blame.” | Concede freely if the meaning is kept: “did not operate on 14 of 60 occasions” says the same thing with less heat |
| Scope | “That’s outside what you said you were auditing.” | Check the confirmation memo from the opening meeting. If it is in scope, say so and show where; if it is genuinely outside, move it to a separate observation or a future engagement |
Whatever the type, three moves carry most disagreements through the meeting without either side retreating.
Acknowledge. “I understand why you see it that way, and I don’t want to put anything in the report that isn’t right.”
Park. “Let’s not try to settle it in the room. Can you send me the March account closures by Thursday? If they show those accounts were closed, the number changes.”
Follow up. “I’ll come back to you on Friday either way, before anything goes in the draft.”
The move to avoid is conceding a rating or dropping a finding in the room to keep the peace. It feels like good relations at the time. It teaches every manager in the organization that ratings are negotiable in closing meetings, and it undermines every report that follows. The Standards are clear that internal auditors are not obliged to change results without a valid reason; they also require a set method that allows both parties to state their positions, which in most functions means management’s disagreement is recorded in its response. The guides to evaluating management responses and to risk acceptance by management cover what happens when disagreement survives the meeting.
What to concede, and what to hold
Most closing meeting disputes end with a concession of some kind, and the art is knowing which concessions cost nothing and which cost the finding.
| Concede freely | Hold |
|---|---|
| A factual correction backed by evidence | A rating, unless the facts behind it change |
| Softer wording that keeps the meaning | Wording that removes the numbers or the scale |
| A realistic target date with an interim step | An open-ended date, or “ongoing” |
| Recognition of actions management has already taken | Dropping a finding because action has started |
| Combining two findings with the same root cause | Splitting a finding to lower each part’s rating |
| Crediting management for identifying the issue | Describing an audit finding as self-identified when it was not |
The fourth row catches many auditors out. When management has already started to fix a problem, the Standards require the report to acknowledge the action, and it should. But the finding usually still stands, because the report is about the state of the control during the period audited, and a fix that started last week has not yet been shown to work. The report can say both things: the weakness existed, and management is already acting on it. The site’s guide to writing management action plans covers the other side of that conversation.
After the meeting: the summary and the draft
A closing meeting that is not summarized in writing leaves each attendee with their own version of what was agreed. Send a summary within one working day. It is the natural record of the discussion for the workpapers, and it stops the draft report from being the first written version of the meeting’s outcomes.
Subject: Order-to-cash audit: summary of today’s closing meeting
Thank you all for the discussion today. This note records what we agreed and what we will follow up.
Findings confirmed as discussed. All nine findings, with the actions, owners and dates we agreed, subject to the parked item below.
Changes agreed in the meeting. Pricing: wording changed from “unapproved discounts” to “discounts without an approval record”; the numbers and the rating are unchanged.
Parked item. Credit holds: the credit manager will send the list of accounts closed during the year by Friday. If any fall inside the count, the finding will be restated before the draft.
Actions already taken. The rebate accrual correction booked before the meeting will be acknowledged in the draft.
Next steps. Draft report within eight working days. Management responses due ten working days after the draft. The final report goes to the chief financial officer, the vice president of sales and the credit manager, with a summary to the audit committee.
The draft report should then follow within the time your methodology sets, usually five to ten working days. The longer the gap, the more the meeting’s agreements soften in people’s memories, and the more likely it is that the draft is read as a new document rather than a record of what was already agreed.
Variants: clean, adverse, advisory and fraud-adjacent engagements
The structure above holds for most engagements. Some need adjustments.
| Engagement | What changes |
|---|---|
| No findings | Hold the meeting anyway. Say specifically what was tested and found effective; a clean result explained well is worth more to management than a clean report read alone |
| Adverse overall result | Brief the executive the day before; have the chief audit executive open; spend more time on the path to remediation than on the findings, which the owners already know |
| Advisory engagement | The meeting walks through observations and recommendations, not findings with ratings. Agree what management will do with them, which is management’s decision |
| Fraud referral during the engagement | Anything referred is handled outside the audit and outside the meeting. Present control findings as control findings, with numbers; route any question about individuals to the process that handles referrals, without confirming or denying anything |
| Multi-site | One meeting for the accountable executive and all sites, with site-specific findings summarized; separate short meetings with each site’s managers beforehand |
| Remote or hybrid | Share the finding sheets on screen one at a time; ask named people the accuracy question; put the parked items in the chat before the call ends |
| External auditor relies on the work | Say so, and do not agree changes in the room that the evidence file cannot support |
The fraud-adjacent case is the one where the closing meeting can do real harm if handled casually. An auditor who answers “which representatives?” in a closing meeting can compromise an investigation and expose the organization to claims from people who turn out to be innocent. The rule is simple: the report and the meeting deal with the control, and individuals go through the protocol. The site’s guides to what to do in the first 48 hours after finding fraud and to the CFE for internal auditors cover the protocol itself.
Measuring whether your closing meetings work
Closing meetings are rarely measured, which is odd, because their effect shows up in numbers every audit function already has. A function that tracks the six measures below for a year learns which of its auditors pre-wire well, which engagements drift after fieldwork, and whether its ratings are holding.
| Measure | How to calculate it | What a good result looks like | What a bad result usually means |
|---|---|---|---|
| Findings pre-wired | Findings discussed with the owner before the meeting, as a share of all findings | All of them | Findings being discovered late, or auditors avoiding the conversation |
| Facts disputed after the draft | Number of factual corrections requested in management responses | Close to zero | Pre-wiring skipped, or the meeting did not ask the accuracy question |
| Ratings changed after the meeting without a change in facts | Count per year | Zero | Ratings being negotiated rather than derived |
| Days from last fieldwork day to closing meeting | Median, per engagement | Five working days or fewer | Findings written up slowly, or meetings hard to schedule |
| Days from closing meeting to draft | Median | Within the methodology’s target, often five to ten working days | Drafting starting only after the meeting |
| Parked items resolved by their date | Share of parked items closed on time | Nearly all | Parking used to avoid decisions |
The second measure is the most revealing. A management response that disputes a fact means the fact reached the report without being checked with the person who knew it, and every such dispute adds days to the report. Functions that report this measure to themselves quarterly usually see it fall within two or three quarters, because nobody likes being the auditor whose findings keep coming back corrected. The site’s guide to the QAIP documentation kit shows how measures like these fit into a function’s quality metrics.
Mistakes that make the report harder
| Mistake | What it costs | The fix |
|---|---|---|
| A finding raised for the first time in the meeting | A defensive room and a disputed draft | Pre-wire every finding; if one is found late, call the owner before the meeting |
| Findings walked in process order | The High finding gets the last five minutes | Order by significance |
| Overall result held until the end | Nobody listens to the findings while waiting for the verdict | State the headline early |
| Ratings defended by the auditor who wrote the finding | The dispute becomes personal | The audit manager holds the ratings against the definitions |
| Conceding a rating to end an argument | Every future closing meeting becomes a negotiation | Change ratings only when facts change |
| No note-taker | Agreements remembered differently by each side | Assign a note-taker and send the summary within a day |
| Parked items with no date | Parked items that never come back, or come back as disputes in the response | Every parked item gets an owner, a question and a date |
| Discussing a referred matter | A compromised investigation and legal exposure | Keep referrals out of the meeting entirely |
Worked example: MidState’s order-to-cash closing meeting
MidState Beverage, the three-state drinks distributor used across this site, ran an order-to-cash audit in its FY28 plan: 2.6 million delivery invoices to 9,800 retail accounts, about 410 million dollars of revenue, 48,000 credit memos and a rebate program with the larger chains. It was budgeted at 360 hours and ran to 380. The full test results are in the site’s guide to auditing order-to-cash. This example follows the closing meeting.
Before the meeting. Eight of the nine findings had been discussed with their owners during fieldwork and listed on the weekly status updates. The ninth, the cut-off finding, was confirmed in the last two days, so the audit lead called the controller the afternoon before the meeting to walk him through it. The finding sheets went to every owner four working days ahead. The day before, the audit manager briefed the chief financial officer on the overall result, Needs Improvement, and on the one High finding. One further matter had been handled entirely outside the engagement: a settlement clerk at an acquired depot had covered a shortfall of 28,600 dollars by moving later customers’ payments between accounts, found by the cash application analytic and referred under the fraud protocol on day six. It was not in the report and was not mentioned in the meeting.
The room. The chief financial officer, the vice president of sales, the credit manager, the controller and the two acquired depots’ managers, with the audit lead, the audit manager and a staff auditor taking notes. Ninety minutes, because of the High finding.
| Moment | What happened | How it was handled |
|---|---|---|
| The headline | The audit manager opened with the overall rating and the reason: nine findings, one High, most of them concentrated at the two acquired depots | The CFO said he had expected it, which told the room the result was not a surprise to him |
| What worked | The route cash actions from the previous year’s audit, re-tested on the last quarter, were holding | The depot managers heard that their earlier remediation was recognized |
| The High finding | Credit memos: 2,300 of 48,000 approved by their issuer, 610 without support worth 410,000 dollars. The vice president of sales asked which representatives were involved | The audit manager said the finding was about the control, that the report would not name individuals, and that any questions about specific cases should go to general counsel. The VP did not press |
| A wording dispute | On the pricing finding, the VP of sales said the discounts had been approved verbally | The auditors asked whether any record existed for the lines in question. None did. The wording changed to “without an approval record”; the 190,000 dollars and the rating stayed |
| A rating dispute | The controller argued the allowance finding was Low, because the formula had been accepted by the external auditor for six years | The audit manager walked through the definition: coverage of balances over ninety days had fallen from 52 to 38 percent while those balances grew. The rating stayed Medium, and the controller asked for the analysis to take to the external auditor |
| A fact parked | The credit manager said some of the over-limit accounts had been closed during the year | Parked with a Friday date. The closures did not change the count, and the finding stood as written |
| Credit for action taken | The controller had booked the 310,000-dollar rebate accrual correction before the meeting | The draft acknowledged the correction, and the finding on rebate agreements still stood |
Afterwards. The summary went out the next morning. The draft followed eight working days later, and management’s responses came back without a single disputed fact, because every fact had been disputed, and settled, earlier. The allowance finding, the least dramatic in the report, turned out to matter most: it reached the annual accounts once the controller took the audit’s analysis to the external auditor. The site’s guide to presenting to the audit committee follows the same report into the boardroom.
Questions about audit closing meetings
Is a closing meeting required by the Standards?
The Standards require findings to be evaluated with management’s input on causes and effects, recommendations to be discussed with management, and a set process for resolving disagreement at the end of an engagement. The guidance under Standard 13.1 names the closing communication, or exit conference, as a usual way to do that. A function’s methodology can decide the form, but the discussion itself is expected.
Should the draft report be shared before the closing meeting?
Not usually. The meeting works best on finding sheets, which management can correct without feeling that a document has already been written about them. The draft follows the meeting and reflects what was agreed.
What if management refuses to agree a finding?
Follow the three moves: acknowledge, park, follow up. If agreement still cannot be reached after the evidence has been looked at, the finding stands as the audit’s conclusion and management’s disagreement is recorded in its response. If the disagreement is significant, the chief audit executive may need to raise it with senior management or, ultimately, the audit committee.
Can a rating change after the closing meeting?
Yes, if the facts change or the rating definition was misapplied. It should not change because it was disputed. Ratings that move without a change in the facts teach the organization that ratings are negotiable.
How long after fieldwork should the closing meeting be?
Within a week of the end of fieldwork, while the evidence and the conversations are fresh. Longer gaps let the pre-wiring go stale.
What if a new finding emerges in the closing meeting itself?
It happens, usually when management mentions something the auditors did not know. Do not rate it in the room. Note it, agree how it will be looked at, and decide afterwards whether it belongs in this report or a later piece of work.
Related guides
- The audit opening meeting — the scope agreed at the start is the reference point at the end.
- Negotiating audit findings — pressure tactics, scripts and the escalation ladder.
- Evaluating management responses — what happens when the response arrives.
- Risk acceptance by management — the formal route when management will not act.
- The life of a finding — service standards from potential finding to closure.
- The five Cs of audit findings — the elements every finding needs.
- Root cause analysis for audit findings — getting to a cause management can act on.
- Writing audit recommendations — actions management can actually implement.
- Finding severity ratings — the definitions ratings are held to.
- The executive summary — turning the meeting’s outcome into the report’s first page.
- Difficult conversations in audit — scripts for when the meeting turns.
- The auditee communication pack — the closing meeting agenda template.
- Disagree with an internal audit finding? — the same meeting from the auditee’s chair.
- How to audit order-to-cash — the fieldwork behind the worked example.
- Audit Fieldwork Explained: The Week-by-Week Guide — from kickoff to closing, week by week.
Leave a Reply