Internal audit’s difficult conversations are unusually predictable. The same five come round in almost every audit function: telling a manager that their team missed something, facing an executive who wants a finding softened or dropped, dealing with an auditee who does not produce what was asked for, giving a staff auditor a review that tears their work apart, and raising a suspicion that someone has committed fraud. None of them can be avoided, and each gets easier with a structure and a few prepared lines. The structure is the same every time: prepare the facts and the outcome you need, open with the purpose and the facts in plain words, let the other person respond and show you heard it, agree the next step, and confirm it in writing.
This guide gives opening lines, a structure and recovery moves for each of the five, a general method that works across them, four further moments worth rehearsing, what to do when a conversation goes sideways, what to write down afterwards, and a worked example from a bank’s reconciliation audit in which three of the five happened in the same engagement. It sits beside the site’s guides to negotiating audit findings, which goes deep on one of the five, and to the closing meeting, where many of these conversations come to a head.
In this guide
- Why audit conversations get difficult
- A structure that works for all of them
- The ten-minute preparation worksheet
- Moment 1: “Your team missed this”
- Moment 2: “Can we leave this out?”
- Moment 3: The auditee who stonewalls
- Moment 4: The review-note explosion
- Moment 5: Escalating a suspicion of fraud
- Four more moments worth rehearsing
- When it goes sideways: recovery moves
- What to write down afterwards
- Worked example: three conversations in a bank’s reconciliation audit
- Questions about difficult conversations in audit
- Related guides
Why audit conversations get difficult
Some of the difficulty is structural. An auditor’s job is to form a judgment about someone else’s work, often work that person is proud of, in a way that may be read by their boss and summarized for the audit committee. The auditor usually knows the evidence better than the auditee knows the audit, and the auditee usually knows the process far better than the auditor. The consequences for the auditee, in reputation, workload and sometimes bonus, are more visible than the consequences for the auditor. And auditors are often not trained for these conversations, which is why so many of them are handled by email when they should not be.
The most useful framework for understanding what is going on is the one in Difficult Conversations: How to Discuss What Matters Most, by Douglas Stone, Bruce Patton and Sheila Heen of the Harvard Negotiation Project, first published in 1999. It argues that every difficult conversation is really three conversations at once: one about what happened, one about feelings, and one about identity, meaning what the conversation says about who we are. In an audit, each has a familiar shape.
| The conversation | In an audit it sounds like | What helps |
|---|---|---|
| What happened | “That’s not what the evidence shows.” “You don’t understand how this process works.” | Separate the facts, which can be checked, from the judgment, which can be argued. Check the facts together |
| Feelings | Anxiety, embarrassment, anger, sometimes relief, usually unspoken | Acknowledge them without dwelling: “I know this isn’t what you wanted to hear” |
| Identity | “Am I a bad manager?” “Is my job at risk?” For the auditor: “Am I being unfair?” | Make clear what the finding is about (the control, the process) and what it is not about (the person’s worth or competence) |
Most difficult audit conversations go wrong on the identity conversation. The auditor talks about a control; the manager hears a verdict on their career. Naming the difference explicitly, early, removes much of the heat.
A structure that works for all of them
Each of the five moments below has its own lines, but they share a structure. Rehearsing the structure matters more than memorizing the lines.
| Step | What you do | What it sounds like |
|---|---|---|
| Prepare | Know the facts, the evidence, the outcome you need, and what you are willing to concede | Two lines on a card: “The facts are… What I need from this conversation is…” |
| Open | State the purpose and the facts in plain words, without softening them into vagueness | “I want to talk about the reconciliation reviews. We found one reviewer approved 210 in forty minutes.” |
| Listen | Let the other person respond fully before you answer. Summarize what you heard | “So your point is that nobody ever told reviewers what a review had to include.” |
| Separate | Distinguish what you agree on (usually the facts) from what you do not (usually the judgment) | “We agree on the numbers. Where we differ is on whether that’s a finding.” |
| Agree the next step | Settle on something concrete, even if it is only a date to reconvene | “I’ll look at the review guidance you mentioned, and we’ll talk again Thursday.” |
| Confirm | Put the outcome in writing the same day | A short email: what was discussed, what was agreed, what happens next |
For conversations that are really feedback, such as a review of a staff auditor’s work, the Center for Creative Leadership’s Situation-Behavior-Impact model is a useful tool: describe the situation, the specific behavior, and its impact, without judging the person. “In the payroll test workpaper (situation), the sample wasn’t linked to the population count (behavior), which means a reviewer can’t tell whether the 25 items came from the whole year (impact).” It keeps feedback about work rather than character, which is the same discipline an audit finding needs.
The ten-minute preparation worksheet
Most difficult conversations go badly because they are unprepared, not because the auditor lacks skill. Ten minutes with the worksheet below, filled in by hand before the meeting, is enough for almost any of them. Its value is less in the answers than in the questions, because each one forces a decision you would otherwise make on the spot, under pressure.
The facts, in two sentences, with numbers. What happened, stated as you would state it in a finding’s condition. If you cannot write it in two sentences, you are not ready to say it.
The evidence, and where it is. What you will show if the facts are questioned, and whether you have it with you.
The purpose of this conversation. One of: to inform, to hear their view, to agree an action, to escalate. Not all four.
The outcome I need. The minimum that makes the conversation a success, for example “agreement on the facts and a date for their response”.
What I can concede. Wording, dates, the order of actions, combining related findings.
What I will not concede. The facts unless disproved, the rating unless the facts change, the finding’s existence.
How they are likely to react, and why. Anger, fear, silence, bargaining; and what in their position makes that reaction likely.
My opening line. Written out, word for word.
The next step I will propose. A date, a document, a meeting.
Who else needs to know, before and after. My manager, the CAE, their executive.
Two rows do most of the work. “What I will not concede” stops the slow drift in which a finding loses its numbers one reasonable request at a time. And “how they are likely to react, and why” turns an unwelcome reaction from a surprise into something you planned for, which is most of what keeps an auditor calm when the reaction comes. The site’s guide to the psychology of auditees explains why people react to audits the way they do, and the guide to audit anxiety describes the same moment from the auditee’s side.
Moment 1: “Your team missed this”
The situation: a control failed, the evidence is clear, and you have to tell the manager whose team runs it. They did not know. You suspect they will feel it reflects on them.
The mistake to avoid is the soft opening that hides the point. “We’ve got a few observations we’d like to run past you” gets a relaxed manager who is then blindsided three minutes later. Say the point early, and put it in terms of the control, not the team.
Opening. “I wanted you to hear this from me before it’s written up anywhere. In the sample of sixty reconciliations, fourteen had differences that weren’t investigated before the review was signed. I want to walk you through what we found and hear what you think is behind it.”
If they get defensive. “This is about how the control is set up, not about whether your team works hard. From what we’ve seen, they do. The question is whether the process is set up so that hard work catches the problem.”
If they ask whether it will go to their boss. “Yes, it will be in the report, and your executive will see it. That’s why I’m talking to you first. What will make the biggest difference to how it reads is what you decide to do about it.”
Closing. “Can you send me anything you think we’ve missed by Wednesday? I’ll come back to you before anything goes into the draft.”
The recovery move, if the manager hears it as a judgment on them, is to ask about the cause. People who are asked why something happened stop defending and start explaining, and the explanation is usually the cause the finding needs. The site’s guide to root cause analysis for audit findings shows how to turn that explanation into a cause statement.
Moment 2: “Can we leave this out?”
The situation: a senior manager or executive asks you to drop a finding, soften it, or keep it out of the audit committee summary. Sometimes the request is explicit; more often it comes as “is this really worth putting in the report?” or “I’d hate for the committee to get the wrong impression.”
This is the conversation in which auditors most often give ground they should not, because the request comes from someone senior and is usually made reasonably. The principle is that the report’s content is decided by the evidence and the rating definitions, not by who asks. The practice is to take the request seriously, separate what can change from what cannot, and escalate early if the pressure continues.
Opening, when the request arrives. “I understand why you’d prefer it wasn’t in the report. Let me explain how we decide what goes in, and then let’s look at whether anything about this one is wrong.”
If the request is to drop it. “We can’t leave out a finding that meets our definitions. If the facts are wrong, show me and I’ll change them. If they’re right, the finding stays.”
If the request is to soften it. “I’m happy to look at the wording. If there’s a way to say it that’s less loaded and just as accurate, I’ll take it. What I can’t do is take out the numbers or change the rating unless the facts change.”
If the request is to keep it from the committee. “The summary to the committee is set by our methodology, and this finding meets the threshold. What the committee will also see is your response, so the best way to shape how it lands is the action plan.”
If the pressure continues. “I’d like to take this to the chief audit executive, so that you’re hearing the decision from the person who owns it.”
The escalation line matters. A staff auditor or audit lead should never be left alone holding a finding against an executive; the chief audit executive exists to take that weight. And if the pressure becomes a pattern, it belongs in front of the audit committee: the Global Internal Audit Standards expect the chief audit executive to tell the board about disagreements with senior management that could affect internal audit’s ability to do its work. The site’s guide to negotiating audit findings has six scripts for this conversation and the escalation ladder that goes with them.
Moment 3: The auditee who stonewalls
The situation: requests go unanswered, deadlines pass, meetings are postponed, and when evidence does arrive it is incomplete. Sometimes it is overload; sometimes it is avoidance; occasionally it is concealment. You cannot tell which at first, so you treat it as overload until the pattern says otherwise.
| Stage | When | What you do | What it sounds like |
|---|---|---|---|
| 1. Friendly reminder | The day after a missed date | A short message to the contact | “Just checking on the payment data we’d agreed for Friday. Is there anything getting in the way?” |
| 2. A conversation | Two or three days later | Call or meet the contact; ask what the obstacle is | “We’re now three days behind on the data. Is it the extract itself, or the time to pull it? I’d rather adjust the request than keep chasing.” |
| 3. The process owner | A week behind | Speak to the manager above the contact | “We’ve agreed a revised date twice and missed it twice. I don’t want this to become an audit issue, so I wanted to raise it with you directly.” |
| 4. The accountable executive | Two weeks behind, or a pattern | The audit manager raises it with the executive | “The delays are now affecting the timetable we agreed at the opening meeting, and I need your help to get it back on track.” |
| 5. The chief audit executive | When the executive does not act | The CAE decides whether it is a scope limitation | “If we can’t get the data by the end of next week, our report will have to say we couldn’t complete that part of the work, and why.” |
Two things keep this ladder from becoming a war. The first is starting with a real question about the obstacle at stage 2, because most delays have a cause you can fix: the request was unclear, the data is harder to extract than you assumed, or the one person who can pull it is on leave. The second is saying what the consequence will be before it happens. A scope limitation that arrives without warning feels like an ambush; one that was named two weeks earlier is simply a consequence. The auditee’s view of the same problem is in the site’s PBC survival guide, which is worth sending to a contact who is struggling.
Moment 4: The review-note explosion
The situation: you are the reviewer, and the staff auditor’s workpapers need forty review notes. Some are small; several mean the test has to be redone. You know the person worked hard, and that forty notes will land as a verdict on them.
This is a difficult conversation that happens inside the audit team, and auditors who handle auditees well sometimes handle it badly, because it feels like it should be easy. It is not. A review that arrives as forty notes in a system, with no conversation, teaches the staff auditor to fear review; a review that is talked through teaches them how to do the work. The site’s guide to review notes covers how to write them; this is the conversation that goes with them.
Opening. “I’ve been through the payroll workpapers. There’s a lot of good work in there, and there are also some things we need to fix before this can go forward. I’d rather go through them with you than just leave notes.”
Sorting the notes. “Of the forty, about thirty are small: references, formatting, a couple of tick marks. Five are about how the sample was selected, and those mean we need to redo part of the test. Let’s spend our time on those five.”
Explaining the big ones. “The sample isn’t tied to the population count, so a reviewer can’t tell whether the 25 came from the whole year. That’s the thing an external reviewer would pick up first.”
Closing. “Which of these would it help to talk through before you start? And next time, bring me the sample selection before you test. It’ll save us both this conversation.”
If you are the staff auditor receiving the forty notes, the equivalent move is to ask for the conversation. “Could we go through the ones about the sample together?” is not an admission of weakness; it is how people learn to do the work faster than their peers.
Moment 5: Escalating a suspicion of fraud
The situation: something in the evidence suggests someone may be committing fraud. A pattern in the data, a document that does not look right, an explanation that does not hold up. You are not sure. You have to decide who to tell, what to say, and, just as important, what not to say.
This is the one conversation where the usual audit instinct, to go and ask the person, is wrong. Confronting a suspect before the matter has been handled properly can destroy evidence, alert anyone else involved, and expose the organization, and you, to claims if the suspicion turns out to be wrong. The right conversation is with your own chain of command, following your organization’s protocol for handling allegations.
To your manager or CAE, the same day. “I’ve found something in the payroll data that I think needs to go through the fraud protocol rather than the audit. Eleven people were paid after their termination dates, and two of the payments went to the same bank account. I haven’t raised it with anyone in payroll.”
If the person you suspect asks what you’re looking at. “We’re working through the payroll data for the whole year. I’ll come back to you if we have questions about anything specific.”
If the process owner asks why the fieldwork has paused on one area. “Something has come up that I need to discuss with my manager first. I’ll let you know how we’re proceeding as soon as I can.”
Notice what those lines do not do. They do not accuse anyone, they do not lie, and they do not reveal the suspicion. The work continues, the matter goes through the protocol, and the audit report deals with the control weakness, not the person. The site’s guides to the first 48 hours after internal audit finds fraud and to fraud red flags cover the protocol and the triage behind it.
Four more moments worth rehearsing
The five above are the most common. The four below come less often, and are harder because they are unexpected.
| Moment | Why it is hard | The move |
|---|---|---|
| Telling your CAE you made a mistake in an issued report | It feels like admitting incompetence | Say it the day you find it, with the facts and the fix. The Standards expect a function to correct significant errors or omissions in its communications, and the sooner the CAE knows, the smaller the correction |
| Disagreeing with your own manager about a rating | They outrank you and will review your work for years | Put your reasoning against the published definitions, once, in writing. Then accept the decision, or escalate if you believe the rating is wrong on the facts |
| Auditing an area run by a friend or former colleague | Every conversation is doubly awkward | Declare the relationship before the engagement, as the Standards expect for any potential impairment to objectivity, and let the CAE decide whether you should be on it. The site’s guide to independence and objectivity covers the rules |
| The executive who wants an off-the-record chat | Refusing seems rude; accepting risks your independence | Listen, but say plainly that anything relevant to the audit may need to be followed up. Nothing an auditor hears is truly off the record |
The first of these is the one auditors avoid longest, and the one where delay costs most. A mistake in an issued report that the auditor found and corrected is a quality process working. The same mistake found by the auditee, the external auditor or a regulator is a credibility problem for the whole function.
When it goes sideways: recovery moves
Even well-prepared conversations go wrong. The reactions below are the ones auditors most often meet, with a move for each.
| What happens | What is usually going on | The recovery move |
|---|---|---|
| Anger | The identity conversation: the person hears a judgment on them | Lower your voice and slow down. Acknowledge the feeling: “I can see this is frustrating.” Return to the facts only when the temperature drops |
| Tears | Stress that has nothing to do with the finding, as often as with it | Pause. Offer to take a break or continue another time. Do not withdraw the finding |
| Silence | Shock, or a decision not to engage | Ask a specific question: “What part of this surprised you most?” |
| “I’ll take this to the CEO” | A test of whether you will back down | “That’s entirely your right. I’ll make sure the CAE knows so that the CEO hears both sides” |
| A personal attack | Deflection | Do not respond in kind. “I’d rather keep this about the process. Can we come back to the numbers?” |
| A sudden new fact | Sometimes real, sometimes a delaying tactic | Treat it as real: “That could change things. Can you send me the evidence by Friday?” |
| Agreement that feels too easy | Occasionally, a plan not to act | Confirm the action, owner and date in writing the same day |
The move that works in almost every case is to stop trying to win the conversation in the room. Few difficult conversations need to end with agreement; they need to end with a clear next step. A pause, a date and an email are enough.
What to write down afterwards
A difficult conversation that is not written down will be remembered differently by each person in it, usually within a week. Write two things. The first is a short file note for the workpapers: date, who was present, what was discussed, what was agreed and what happens next. The second, for anything involving an agreement or a disagreement, is an email to the other person confirming the same points in neutral words. Keep the email factual; it may be read by other people later, including, in the worst cases, by lawyers.
If a conversation involved a threat, an attempt to interfere with the audit, or anything suggesting fraud or retaliation, tell your manager or the chief audit executive the same day, and keep your notes. The Standards give the chief audit executive the job of raising interference with the board, and they can only do it if they know.
Worked example: three conversations in a bank’s reconciliation audit
Lakeshore Bancorp, the 9-billion-dollar public regional bank used across this site, audited its account reconciliation program across about 3,100 general ledger accounts, in 300 hours. The results are in the site’s guide to auditing reconciliations as a program: seven findings, one of them High, and an overall rating of Needs Improvement. Three of the five difficult conversations happened in the same engagement.
Moment 1, with a reviewer. The analysis of review activity showed that one reviewer had approved 210 monthly reconciliations in forty minutes, with no query recorded. The audit lead asked to see him before the finding was written. He arrived expecting to be accused of negligence and said so. The lead opened with the facts and the question: the timestamps showed 210 approvals in forty minutes, and what did a review involve for him? He explained that he had been told to approve anything with a zero unexplained difference, and that nobody had ever told him to look at the reconciling items themselves. The lead summarized it back and said that this was exactly what the audit needed to know: the problem was that the program had no standard for what a review was. The finding was written about the program, not about him, and it was rated Medium. He left having contributed the cause.
Moment 2, with a senior finance executive. The certification finding showed that 22 account owners had certified accounts carrying unexplained differences older than ninety days without noting them. A senior finance executive asked the audit manager whether the finding could be merged into the High finding, where it would be less visible to the audit committee, which reviewed the certifications. The manager took the request seriously: the causes overlapped, and combining findings with the same cause is sometimes right. But the certification failure had its own cause, the certifications being signed without anyone checking the tool, and its own action. The manager said so, offered to cross-reference the two findings, and held the separate Medium. The certification finding turned out to be the one the committee reacted to most, because certifications were the document the committee saw.
Moment 4, with the team’s own staff auditor. The staff auditor’s re-performance workpapers for the forty sampled reconciliations came back from review with 38 notes. The audit lead booked an hour instead of leaving them in the system. Thirty were references and formatting. Eight were about how the standard had been applied, which mattered because the re-performance result, 28 of 40 meeting the standard and twelve failing, was the heart of the High finding. They went through the eight together, re-scored two reconciliations, and the result held. The staff auditor’s next set of workpapers came back with nine notes.
What connects the three is that none of them was resolved by winning an argument. The reviewer’s conversation produced the finding’s cause, the executive’s produced a cross-reference and a firm position, and the staff auditor’s produced better workpapers. Each ended with a clear next step and an email.
Questions about difficult conversations in audit
Should difficult audit conversations happen in person or by email?
In person or by video call, whenever the news is unwelcome or the relationship matters. Email is for confirming what was said, not for saying it. An unwelcome finding delivered by email reads harsher than the same words said aloud, and invites a written reply that hardens positions.
What if the auditee is senior to the auditor?
Seniority changes the tone, not the content. Be more concise, bring the facts in a form that can be checked quickly, and involve your manager or the chief audit executive earlier. Never let a junior auditor carry a disputed finding alone against an executive.
How do you stay objective in a tense conversation?
Keep returning to the evidence and the published definitions. Objectivity is easier to hold when the argument is about facts that can be checked than about whether a finding is fair.
What if the auditee is right?
Say so, promptly and without embarrassment, and change the finding. An auditor who concedes a real error gains credibility for every finding that stays.
Is it ever right to escalate before talking to the person directly?
Yes, in two cases: suspected fraud, which goes through the protocol, and situations where the person’s own conduct is the subject, such as interference with the audit. In both, talk to your manager or the chief audit executive first.
Related guides
- Negotiating audit findings — six scripts and the escalation ladder for moment 2.
- The audit closing meeting — where many of these conversations come to a head.
- The audit opening meeting — setting expectations that prevent some of them.
- Audit interviewing — question design and listening for fieldwork.
- Review notes done right — writing the notes behind moment 4.
- Independence and objectivity — when a relationship means you should not be on the audit.
- When internal audit finds fraud: the first 48 hours — the protocol behind moment 5.
- Fraud red flags — triaging what you have found before you escalate it.
- Root cause analysis for audit findings — turning an explanation into a cause.
- The PBC survival guide — the auditee’s view of the requests behind moment 3.
- How to audit account reconciliations as a program — the engagement behind the worked example.
- Office dynamics and influencing without authority — the wider skill set behind these conversations.
- Essential soft skills for internal auditors — communication, influence and adaptability.
- The psychology of auditees — why audits feel threatening, and what auditors can do about it.
- Evaluating management responses — when the difficult conversation continues in writing.
Leave a Reply