An audit opening meeting, also called an entrance meeting or kickoff, is the first formal conversation between the internal audit team and the management of the area being audited. Its job is narrow and important: confirm that management understands and supports the engagement’s objectives, scope and timing, learn what management already knows about the risks, agree how the two sides will work together, and set the rules for how findings will be communicated. It usually takes 30 to 60 minutes. Done well, it shortens fieldwork, cuts the number of disputed facts at the end, and makes the closing meeting a formality. Done badly, it teaches the people you are about to audit that the audit is something being done to them.
Most guidance on the opening meeting stops at an agenda. This guide goes further, into what to actually say. It covers the five jobs the meeting has to do, the preparation that decides it, a 45-minute agenda with minute allocations, word-for-word scripts for every segment, the stagecraft that lowers defenses in a room and on a video call, answers to the twelve questions auditees ask most, five openings that go wrong and how to recover them, the confirmation memo that locks in what was agreed, and a worked example from a UK group’s financial close audit. The slides that go with the meeting are in the auditee communication pack, and the planning that comes before it is in the engagement planning memo template.
In this guide
- What the opening meeting is for
- Before the room: the preparation that decides the meeting
- The agenda: 45 minutes in eight segments
- The script: what to actually say
- Stagecraft: the room, the call and the first five minutes
- Handling the hard questions
- When the room turns: five difficult openings
- After the meeting: the confirmation memo
- Variants: advisory, remote, multi-site and regulatory engagements
- Mistakes that cost the engagement later
- Worked example: Pennine Foods’ financial close audit
- Questions about audit opening meetings
- Related guides
What the opening meeting is for
The Global Internal Audit Standards require internal auditors to communicate an engagement’s objectives, scope and timing to management, and to tell management promptly when any of them change. That requirement sits in Standard 13.1, Engagement Communication. The Standards do not make the opening meeting itself mandatory, but the implementation guidance under 13.1 describes it as a common first communication and says the results of the engagement risk assessment and the initial objectives and scope should preferably be discussed in a meeting, so that management can confirm it understands and supports them, adjustments can be made, and expectations can be set for further communication, including who will receive the final report. It also says the discussion should be documented in the workpapers. The site’s guide to Domain V of the Standards covers 13.1 and its neighbors in full.
In practice the meeting has five jobs. Each has a test of whether it was done, and a characteristic way of failing.
| Job | What “done” looks like | How it usually fails |
|---|---|---|
| Confirm objectives, scope and timing | Management can restate what is in scope, what is out, and when fieldwork runs | Scope is read aloud from a slide and nobody checks it was understood |
| Learn what management already knows | Two or three risks, changes or known problems are named that were not in the planning file | The auditors talk for forty minutes and ask nothing |
| Agree how the work will run | Named contacts, a request list with dates, access arrangements, a status rhythm | “We’ll send the list later” and three weeks lost to chasing |
| Set the communication rules | Management knows findings arrive as they are found, how they are rated, and who receives the report | The first time management hears of a finding is the draft report |
| Start a working relationship | People leave knowing who the auditors are and what the audit is for | The meeting confirms every fear the area had about being audited |
It helps to be equally clear about what the meeting is not. It is not a fieldwork interview, and it should not turn into one: the detailed questions about how the process works belong in walkthroughs and interviews, which the guide to audit interviewing covers. It is not a negotiation of the audit’s scope under pressure; changes to scope are possible, but they are decided afterwards and confirmed in writing. And it is not the place to present early conclusions from planning, however tempting it is to show you have done your homework.
Before the room: the preparation that decides the meeting
Most opening meetings are won or lost before anyone sits down. By the time of the meeting the area should already have received the notification letter, typically two to four weeks before fieldwork, telling it the reason for the audit, the proposed timing and the approximate duration, and asking for the documents needed to plan. The notification letter template in the communication pack is built for exactly that. The meeting then confirms and fills in what the letter started.
| When | Preparation step | Owner |
|---|---|---|
| Ten working days before | Confirm the attendee list with the sponsor: the accountable executive, the process owners, the day-to-day contacts, and anyone who controls data or systems access | Audit lead |
| Ten working days before | Finish the draft engagement risk assessment, objectives and scope, and have them reviewed and approved as the planning memo requires | Audit lead and manager |
| Five working days before | Send a one-page pre-read: why the audit, objectives, scope and exclusions, timing, the team, and the three things you will need from the area | Audit lead |
| Five working days before | Pull the status of prior findings and any open actions in the area, so you are not surprised by them in the room | Staff auditor |
| Three working days before | Draft the request list, split into “needed in week one” and “needed later”, so it can be discussed rather than just handed over | Staff auditor |
| Two working days before | Rehearse: who opens, who covers scope, who handles questions, who takes notes, and the two hardest questions you expect | Whole team |
| One working day before | Check the room or the video link, the screen share, and that the sponsor is still attending | Audit lead |
Two decisions deserve more thought than they usually get. The first is who attends. Invite the accountable executive for the first part of the meeting even if they will not stay, because their presence tells their team the audit matters; invite the people who will actually deal with requests, because they are the ones whose cooperation you need; and think twice before inviting people from outside the area, because an opening meeting with a compliance officer or a second-line risk manager in the room feels very different to the area than one without. The second is who speaks for audit. The lead auditor who will run the fieldwork should do most of the talking. If the chief audit executive or audit manager attends, a short opening from them signals seniority; a long one tells the area that the person they will actually work with is a junior.
The agenda: 45 minutes in eight segments
Forty-five minutes is enough for most engagements and short enough that busy executives will stay for all of it. Longer engagements, multi-site audits and areas being audited for the first time may need an hour. The segments below add up to 45 minutes; the questions segment runs through the whole meeting rather than sitting at the end, which is why it is shown with no fixed time.
| # | Segment | Minutes | Led by | Output |
|---|---|---|---|---|
| 1 | Welcome and introductions | 4 | Audit lead, or CAE for one minute | Everyone knows who is who and what their role in the audit is |
| 2 | Why this audit, and why now | 4 | Audit lead | The reason is stated plainly: annual plan, request, regulatory commitment or follow-up |
| 3 | Objectives and scope, including what is out | 10 | Audit lead | Management restates the scope; exclusions are explicit |
| 4 | What we already know, and where management would look | 10 | Audit lead asks, management answers | Risks, changes and known issues from the people who run the process |
| 5 | How the work will run: approach, timeline and requests | 8 | Audit lead and staff auditor | Contacts, dates for week-one requests, access, fieldwork calendar |
| 6 | How findings are handled | 6 | Audit lead | The no-surprises protocol, the rating definitions, the closing meeting, the report distribution |
| 7 | Questions | Throughout | Everyone | Concerns surfaced, not saved for the corridor |
| 8 | Recap and next steps | 3 | Audit lead | What happens next and what the confirmation memo will say |
The order is deliberate. Segment 4, where management speaks, comes before segment 5, where the auditors describe the work, because what management says in segment 4 sometimes changes the work. A risk named by the process owner that was not in the planning file is exactly the sort of thing the engagement risk assessment should absorb, and it is better absorbed in the meeting than discovered in week three. Segment 6 comes late because by then the area has heard what the audit covers and can think about what its results might mean.
The script: what to actually say
Scripts make people nervous, because nobody wants to sound read out. The point of the lines below is not to recite them but to have heard yourself say them before, so that the words are there when the meeting gets awkward. Each one does a specific job, which is noted before it.
Segment 1, the opening line. Its job is to establish that the audit team knows why it is there and respects the area’s time.
“Thank you for making the time. We have forty-five minutes and we’ll finish on time. The aim today is simple: to make sure you know exactly what we’re looking at and why, to hear from you where the risks are, and to agree how we’ll work together so this takes as little of your time as it needs to.”
Segment 2, why this audit. Its job is to answer the question everyone in the room is asking silently. The honest reason is almost always mundane, and saying it plainly removes most of the suspicion.
“This audit is in the annual plan the audit committee approved in March. The plan picks areas based on risk and on how long it has been since they were last looked at, and it has been four years since anyone audited payroll. It isn’t prompted by any incident or complaint.”
“This one comes from a request. The finance director asked us to look at the rebate process before the new contracts go live, so it’s partly assurance and partly a chance to catch design problems early.”
“This engagement follows up on the findings from our review two years ago. We’ll be checking that the agreed actions were implemented and are still working.”
If the audit has been prompted by something specific, such as an incident or a regulatory point, say so in general terms rather than letting people guess. If it has been prompted by something you cannot discuss, such as a whistleblowing allegation under investigation, you are not holding a normal opening meeting and should take advice before holding one at all.
Segment 3, scope. Its job is to make the boundaries of the audit concrete, including what is excluded, and to confirm they have been understood.
“We’re looking at the process from the point a supplier invoice arrives to the point it’s paid: invoice capture, matching, approval, payment runs and changes to supplier bank details. We’re covering the twelve months to June, all three sites. We are not looking at purchasing or contracting, and we’re not looking at the payroll payments that go through the same bank file. Could someone put that scope in your own words, so we know we’ve explained it clearly?”
The last sentence is the most useful line in the meeting, and the one most often left out. Asking management to restate the scope feels awkward the first time, but it catches misunderstandings that would otherwise surface as “we thought you were only looking at” in the closing meeting.
Segment 4, asking where management would look. Its job is to make management a contributor to the audit rather than its subject.
“You know this process far better than we do. If you were auditing it, where would you look first? What has changed in the last year: systems, people, volumes, suppliers? And is there anything you already know isn’t working, or that you’ve started to fix?”
Write down what comes back, and treat it seriously. Management’s own view of where the process is weak is often right, and a problem management raises in the opening meeting and then fixes during the audit deserves to be acknowledged in the report. The Standards require that actions management has started or completed before the final report are acknowledged in it, and saying so at the start is one of the most effective ways to get problems disclosed rather than hidden.
Segment 5, how the work will run. Its job is to make the requests reasonable and the timetable real.
“We’ll need three things in the first week: last year’s invoice and payment data from the system, the current approval limits, and a walkthrough of the matching exceptions queue with whoever runs it. The full request list has dates next to each item. If any date is unrealistic, tell us now and we’ll move it. It is much better to agree a date you can meet than to miss one we set.”
Segment 6, how findings are handled. Its job is to remove the fear of an ambush.
“You won’t read anything in the draft report that you haven’t heard from us first. When we find something that might be a finding, we’ll tell the process owner as soon as we’ve checked the facts, usually within a few days. We rate findings using definitions the audit committee has approved, and we’ll send you those definitions today. At the end there’s a closing meeting to go through everything together before the draft is written. The final report goes to you, your executive, and in summary to the audit committee.”
Segment 8, the recap. Its job is to leave everyone with the same understanding of what was agreed.
“To recap: the scope is invoice to payment, twelve months, three sites; purchasing is out. Priya is our main contact, with Tom covering systems access. The first requests are due next Friday. We’ll send a short note today confirming all of this, and we’ll send a status update every Thursday. Thank you.”
Stagecraft: the room, the call and the first five minutes
The content of an opening meeting matters less than the impression it leaves, and the impression forms in the first five minutes. Most of what creates it is small and physical: who speaks, who sits where, how the auditors describe their own work, and whether the people being audited get to say anything early on.
| Move | Why it works | What to avoid |
|---|---|---|
| Let management speak within the first five minutes, even just introductions of their team | People who have spoken early are more likely to speak again, and to ask real questions | Twenty minutes of audit presentation before anyone else says a word |
| Describe the work in the area’s language, not audit vocabulary | “We’ll pick a sample of payments and trace each one to its approval” is understood; “attribute testing of the population” is not | Jargon that makes the audit sound like something done to the area |
| Name the anxiety if the area has never been audited | Saying “we know audits can feel like an exam; they’re closer to a second opinion” takes the pressure out of the room | Pretending the audit is purely friendly; people can tell |
| Sit with the area, not opposite it | A table with auditors on one side and auditees on the other stages a confrontation | Arriving early and occupying one side of the room |
| Bring a one-page scope summary, not a deck | A single page can be read, annotated and kept; a deck is watched | Thirty slides for a forty-five minute meeting |
| Write down what management says, visibly | It shows their input is being taken seriously | Nobody taking notes, then asking the same questions in week two |
| Finish on time | It keeps the promise made in the first sentence | Overrunning by twenty minutes, which the executive will remember |
On a video call the same rules apply with a few additions. Ask for cameras on for the introductions, even if they go off afterwards. Share a single page on screen rather than a deck, so that the discussion stays on the scope and not on the slides. Name people when you ask them questions, because open questions to a grid of faces get silence. Use the chat to post the scope summary and the request list during the meeting, so they are in writing before anyone leaves. And put the recap in the chat at the end, which does half of the confirmation memo’s job immediately.
Handling the hard questions
Auditees ask the same dozen questions at almost every opening meeting. Most are asked out of nervousness rather than hostility, and a clear, honest answer settles them. The trap answers in the right-hand column are the ones auditors give when they are unprepared, and each of them makes the next five weeks harder.
| Question | A good answer | The trap answer |
|---|---|---|
| “Why are you auditing us? Did someone complain?” | The actual reason, stated plainly: the annual plan, a request, a follow-up or a regulatory commitment | “It’s just routine” when it is not, which will come out later |
| “Is this about the incident last year?” | If it is partly, say so and say what aspect; if not, say it is not | Evasion, which confirms the rumor |
| “Can you do this after quarter-end?” | Possibly: tell us which weeks are hardest and we will look at moving fieldwork, then confirm in writing | “No, the plan is fixed”, or agreeing on the spot without checking the plan |
| “Who will see the report?” | The report’s distribution, including the summary to the audit committee | Vagueness, which suggests the report will be used against people |
| “Will we see findings before the report?” | Yes, as they are found, and all together at the closing meeting | “You’ll see the draft”, which means no |
| “Will this affect my performance review?” | The audit rates the process and its controls, not people; how findings are used in reviews is management’s decision, not audit’s | Promising it will not affect anything, which is not audit’s promise to make |
| “Why do you need a whole year of data?” | Because testing the full population with analytics is often faster and less disruptive than sampling files by hand | “Because the methodology says so” |
| “Can you leave out the system migration? It’s a mess right now.” | Explain why it is in or out of scope; if the risk is real, it usually stays in, but the approach can reflect that it is in transition | Dropping it from scope on the spot, or refusing to discuss it |
| “What happens if you find something serious?” | It is discussed with the process owner first, rated using the published definitions, and agreed actions are tracked to closure | “We’ll escalate it”, with no explanation of how |
| “Are you looking for fraud?” | The audit is designed to assess controls; if auditors come across indications of fraud they follow a set protocol, but that is not the audit’s purpose | “No”, which is not the whole truth, or “yes”, which is not either |
| “Can we just walk you through it instead of pulling documents?” | Walkthroughs are part of the plan, and they are how we learn the process; evidence still has to come from documents and data, because that is what the conclusion rests on | Accepting walkthroughs as a substitute for evidence |
| “Will you tell my boss before you tell me?” | No: findings go to the process owner first, then up the line, and the executive is not surprised either | Silence, or “that depends” |
Two of these answers need to be consistent with how your function actually works, which is why they are worth checking against your charter and methodology before the meeting. The distribution of reports is set in the function’s methodology and, for the audit committee summary, in the committee’s expectations. How audit findings are used in performance management is a matter for management and human resources, and the audit function should not promise either way. The site’s guide to what internal audit can and cannot do covers the authority questions that sit behind several of these answers.
When the room turns: five difficult openings
Occasionally an opening meeting goes wrong in a way that no agenda anticipates. The five situations below account for most of them. Each needs a calm response in the room and a follow-up outside it; the site’s guide to difficult conversations in audit covers the underlying technique.
| Situation | What it sounds like | Response in the room | Follow-up |
|---|---|---|---|
| The executive who wants the audit postponed | “We’re in the middle of a system rollout. Come back in Q3.” | Acknowledge the pressure, ask which weeks are worst, and say you will look at timing with the chief audit executive | A written decision within two days. Postponement is possible but is the CAE’s call, and if the area is high risk the audit committee may need to know |
| The live renegotiation of scope | “Let’s take the supplier onboarding piece out; it’s not ready to be audited.” | Treat “not ready” as information, not a reason: ask what is not ready, and note it | A scope decision confirmed in the memo. Things that are “not ready to be audited” are often exactly where the risk is |
| The silent room | Nobody asks anything and the executive does all the talking | Ask named people direct questions about their part of the process | Individual conversations with the day-to-day contacts in the first week |
| The pre-emptive confession | “We already know it’s broken. We’ve got a project to fix it.” | Welcome it: ask what the project covers and when it lands | Consider whether the scope should test the fix, the old process, or both. Record what management disclosed so it can be credited |
| The recording or the lawyer | “Do you mind if we record this?” or in-house counsel arrives uninvited | Stay calm. A recording of a scoping meeting does no harm, but agree that the confirmation memo is the record. Counsel’s presence at a routine audit is unusual and worth asking about politely | Check with the CAE whether something is going on that you have not been told about |
The pre-emptive confession deserves particular respect. An area that tells you about its own problems at the opening meeting is doing what the audit function should want every area to do, and how the audit treats that disclosure decides whether the next area does the same. If the problem is real, it will probably still be a finding, but the report should say management identified it and was already acting, and the rating should reflect the state of the remediation at the time of the report. The guide to writing management action plans covers the auditee’s side of that conversation.
After the meeting: the confirmation memo
An opening meeting that is not confirmed in writing did not happen in the way everyone remembers it. The confirmation memo, usually an email sent the same day or the next, records what was agreed and becomes the reference point when anyone later says “we thought you were only looking at”. It is also the simplest way to meet the guidance under Standard 13.1 that the discussion be documented in the workpapers: file the memo and any reply.
Subject: Payables audit: confirmation of what we agreed at today’s opening meeting
Thank you for your time today. This note confirms what we agreed. Please reply by Friday if anything here does not match your understanding.
Objectives. To assess whether the controls over supplier invoices and payments ensure that only valid, approved and accurately recorded invoices are paid, to the right supplier, once.
Scope. Invoice receipt to payment, including matching, approval, payment runs and supplier bank detail changes, for the twelve months to 30 June, at all three sites. Out of scope: purchasing and contracting; payroll payments in the same bank file.
Changes agreed today. The new e-invoicing portal (live since April) will be included, at the process owner’s suggestion.
Timing. Fieldwork from 8 to 26 September. Closing meeting provisionally 3 October. Draft report by 10 October.
Contacts. Priya Shah (payables manager) is our main contact; Tom Evans for systems access.
Requests. The attached list shows what we need and by when. Week-one items are due 12 September.
How findings are handled. Potential findings will be raised with the process owner as we find them. Rating definitions are attached. All findings will be discussed at the closing meeting before the draft is written.
Status. A short update every Thursday by email.
Distribution of the final report. The finance director and payables manager, the chief financial officer, and a summary to the audit committee.
The line asking for a reply by a date matters. Silence after a clear confirmation is agreement; silence after a vague one is not. If the memo prompts a correction, that is a good outcome: the misunderstanding has been found in week zero rather than week six.
Variants: advisory, remote, multi-site and regulatory engagements
The eight segments stay the same across most engagements, but the emphasis shifts with the type of work.
| Engagement type | What changes in the opening meeting |
|---|---|
| Advisory engagement | Spend longer on objectives, because they are agreed with management rather than set by audit. Agree what the deliverable will be and who owns the decisions it informs. Be explicit that the work does not provide assurance, which the guide to assurance versus advisory explains |
| First audit of an area | Allow an hour. Explain what internal audit is and how findings work before explaining the scope, and share the guide for people being audited |
| Follow-up audit | Open with the prior findings and management’s reported status; the scope is often “prove it”, so say so kindly |
| Multi-site or multi-entity audit | Hold one opening meeting for the accountable executive and all sites, then short local kickoffs. Agree a single coordinator for requests, or the same document will be requested five times |
| Remote or hybrid | Cameras on for introductions, one-page share, named questions, chat for the recap. Send the pre-read earlier, because people read less on screen |
| Regulatory-driven audit | Name the regulatory commitment and the date it must be met; agree how evidence will be retained for the regulator; be clear that the rating definitions still apply |
| Audit with an external auditor relying on the work | Say so, and explain that the testing will follow a set approach and documentation standard as a result |
| Unannounced work, such as cash counts | No opening meeting beforehand, by design. Hold a short one immediately after the count to explain the work and the next steps |
Mistakes that cost the engagement later
The mistakes below each feel small at the time. Every one of them has a cost that arrives weeks later, usually in the closing meeting.
| Mistake | What it costs later | The fix |
|---|---|---|
| Scope read out but never restated by management | “We thought you were only looking at” in the closing meeting, and a dispute about whether the finding is in scope | Ask management to put the scope in their own words |
| No discussion of how findings will be rated | Rating disputes argued on feelings rather than definitions | Share the rating definitions at the meeting and in the memo |
| Request list sent afterwards without discussion | Missed dates and three weeks of chasing | Walk through the week-one requests and agree dates in the room |
| The CAE speaks for twenty minutes | The area concludes the lead auditor is junior, and escalates everything | CAE opens for one minute, lead auditor runs the meeting |
| No confirmation memo | Nobody’s recollection matches anybody else’s | A memo the same day with a reply-by date |
| Promises the audit cannot keep | “You said this wouldn’t go to the committee” | Answer distribution questions from the methodology, not from the wish to be liked |
| Treating management’s disclosed problems as free findings | The next area hides its problems | Credit disclosure and remediation in the report |
| Discovering prior open findings in the room | The area raises actions audit did not know were still open, and audit looks unprepared | Pull the issue log before the meeting |
Worked example: Pennine Foods’ financial close audit
Pennine Foods plc is the 900-million-pound UK food manufacturer used across this site, with nine entities in the UK, Ireland and the Netherlands on one ERP and a separate consolidation tool. Its financial close audit was scheduled to observe the June close live, so the opening meeting was held in the last week of June. The audit was 340 hours and followed the quarterly program that tests the group’s top-side entries. The details of what the fieldwork found are in the site’s guide to auditing the financial close. This example follows the meeting that started it.
Preparation. The pre-read went out a week before. It gave the reason for the audit (the annual plan, and the close’s importance to the group’s first Provision 29 declaration under the UK Corporate Governance Code), the objectives, and the scope: the close calendar, cut-off, estimates, manual and top-side journals, balance sheet reconciliations, intercompany, consolidation and management review, for all nine entities, with tax and treasury accounting excluded. It also listed three week-one needs: the close calendar with completion times, a full year of manual journal data, and the reconciliation status reports. The audit manager rehearsed the team on the two questions they expected to be hardest: why the audit was testing a close the board already received a report on every month, and whether the Dutch entities could be left until later in the year.
The room. The meeting was hybrid: the group financial controller, the consolidation manager and the UK financial controller in the room, the Irish and Dutch finance leads on video. The chief financial officer joined for the first ten minutes. The head of internal audit opened for one minute; the audit manager ran the rest.
| Segment | What happened | What it produced |
|---|---|---|
| Why this audit | The CFO asked whether the audit had anything to do with the external auditor’s management letter points on reconciliations. The answer was partly: the plan had scheduled the close for this year, and the open letter points were one of the reasons it was not deferred | The CFO left saying he wanted the report before the committee’s November meeting |
| Scope | The group financial controller restated the scope and asked whether “consolidation” included the Dutch packs, which were prepared in spreadsheets rather than loaded from the ledger. It did | The Dutch packs were written into the memo as explicitly in scope |
| Where would you look | The consolidation manager said intercompany differences were being cleared at consolidation rather than by the entities. The Irish finance lead said the post-close journal volume was “higher than anyone admits” | Both became focus areas in the work program; both later became findings |
| The hard question | The group financial controller asked, with some edge, why audit was testing close timeliness when the board was told every month that the close took eight days. The audit manager said the audit would measure the close from the task logs as well as the calendar, and would report whatever it found, including if the eight days held | The question was answered on the facts, and the measurement approach was agreed in advance |
| Requests | The Dutch finance lead said the journal extract could not be produced until mid-July because of the June close. The date moved | A date the team could meet, rather than one it would miss |
| Findings | The rating definitions were shared, and the no-surprises protocol explained. The UK controller asked whether the external auditor would see the report. The answer was that the report would be shared with the external auditor under the usual arrangement | Nobody left expecting an ambush |
The memo. It went out the same afternoon with a reply-by date and one agreed change: the Dutch spreadsheet packs named in scope, at the group financial controller’s own suggestion. The Dutch finance lead replied to correct the journal extract date by two days.
What it bought. The fieldwork ran to the hours budgeted. Every one of the nine findings, two of them High, had been discussed with its owner before the closing meeting, and none of the facts were disputed there. The close-timeliness finding, that the board had been told eight days while the task logs showed a median of eleven, was rated Low and accepted without argument, because the way it would be measured had been agreed at the opening meeting. The two areas management itself had pointed to, intercompany and post-close journals, were credited in the report as management-identified. The site’s guide to the closing meeting picks up the same engagement at the other end.
Questions about audit opening meetings
Do the Standards require an opening meeting?
They require internal auditors to communicate the engagement’s objectives, scope and timing to management, and any later changes promptly. The opening meeting is the usual way to do that, and the guidance under Standard 13.1 prefers a meeting for discussing the risk assessment, objectives and scope, but a function’s methodology can set how and when it happens. What the Standards do expect is that the communication happens and is documented.
How long should an opening meeting be?
Forty-five minutes is enough for most engagements. Allow an hour for an area’s first audit, a multi-site engagement or a complex scope. Anything longer usually means the meeting has turned into fieldwork.
Who should attend from management?
The accountable executive for at least the first part, the process owners, the day-to-day contacts who will deal with requests, and whoever controls the data and systems access the audit needs. Think carefully before inviting people from outside the area.
Should the chief audit executive attend?
For high-profile, sensitive or first-time audits, a brief appearance helps. For routine engagements it is not necessary, and a long presentation by the CAE undermines the lead auditor who will run the work.
Should we share the engagement risk assessment with management?
The guidance under Standard 13.1 says the results of the engagement risk assessment should be communicated to management. In practice that means sharing the key risks the audit will focus on and asking management whether it agrees, rather than handing over the full planning document.
What if management will not attend?
Reschedule once. If the accountable executive still will not engage, hold the meeting with the process owners, send the confirmation memo to the executive with a reply-by date, and tell the chief audit executive. Repeated refusal to engage with the audit is itself something the audit committee may need to hear about.
Related guides
- The auditee communication pack — the notification letter, kickoff deck, status update and closing agenda templates.
- The engagement planning memo template — the planning the opening meeting confirms.
- The audit closing meeting — the other end of the engagement.
- Audit interviewing — the fieldwork conversations that follow the opening meeting.
- Difficult conversations in audit — scripts for the moments that go sideways.
- Being audited? — the guide to share with an area being audited for the first time.
- The PBC survival guide — the request list, from the auditee’s side.
- Audit anxiety — what the people across the table are feeling.
- What internal audit can and cannot do — authority and access, for the questions that test them.
- Finding severity ratings — the definitions worth sharing at the meeting.
- The life of a finding — what happens to a finding after it is raised.
- GIAS Domain V — Standard 13.1 and the rest of the engagement standards.
- How to audit the financial close — the fieldwork behind the worked example.
- Writing management action plans — the auditee’s side of disclosure and remediation.
- Audit Fieldwork Explained: The Week-by-Week Guide — from kickoff to closing, week by week.
Leave a Reply