Every audit report is negotiated. The auditor who says otherwise has either never issued one or has stopped noticing the moment, somewhere between the closing meeting and the final, when a High became a Medium, a number became “a number of”, and a control that did not operate became a control that “could be strengthened”. The negotiation is not the problem; a report that management has engaged with is better than one they have ignored, and the Standards require management’s response to be sought and reported. The problem is that most auditors negotiate without a method, which means they concede what they should hold and hold what they could concede, and the report that emerges is softer where it should be hard and harder where it need not be.
This guide is the method. It covers what is negotiable in a finding and what is not, the eight pressure tactics management uses and the response to each, six scripts for the conversations that decide reports, the escalation ladder and its timing, the negotiation file to bring to the closing meeting, the concessions that cost nothing and the ones that cost everything, five negotiations from the engagements on this site with what was held and what was given, what gets written down afterward, and the mistakes auditors make on both sides of the table. It sits beside the management responses guide, which covers the action plan that ends most negotiations, and the risk acceptance guide, which covers the one that ends the rest.
In this guide
- What is negotiable, and what is not
- The eight pressure tactics, and the response to each
- Preparation: the negotiation file
- The closing meeting: agenda, roles and the ninety minutes
- Six scripts for the conversations that decide reports
- Concessions that cost nothing, and concessions that cost everything
- The escalation ladder and its timing
- Worked examples: five negotiations, what was held and what was given
- When the auditor is wrong: conceding well
- Negotiating with the second line and the external auditor in the room
- Building the function’s reputation for holding the line
- After the negotiation: what gets written down
- Common mistakes on both sides of the table
- Where to go next
What is negotiable, and what is not
The method starts with a line, drawn before the closing meeting and held through the final. On one side are the things that belong to the evidence and the methodology and are not negotiable: the facts of the condition once validated, the criteria and their source, the rating once it is anchored to the scale, the existence of a finding whose facts and criteria stand, and the reporting of a disagreement where one remains. On the other side are the things that belong to the reader and are negotiable freely: the words used to state the facts, the emphasis and order, the cause where management has a defensible alternative and the action plan reveals which one they believe, the specifics and dates of the action plan, and the context that makes a finding fair without making it smaller. The table sets the line; the rest of the guide is about holding it.
| Element | Negotiable? | What can change | What cannot |
|---|---|---|---|
| Condition (the facts) | No, once validated | Wording, order, the context sentence around them | The numbers, the denominators, the population, the period |
| Criteria | No | Which of two applicable criteria is cited first | The existence of a criterion, or its source |
| Cause | Partly | Management’s alternative cause stated beside the auditor’s; the auditor’s cause refined by what management knows | Replacing a design cause with a people cause because it is more comfortable |
| Consequence | Partly | The magnitude estimate refined with management’s data; the mechanism explained more carefully | Deleting the mechanism, the realized instance, or the magnitude |
| Rating | No, except against the anchors | Re-examined if management shows the finding meets a different anchor | Changed because of who is unhappy or how loudly |
| Title | Yes | Any wording that states the consequence accurately | A title that names the topic instead of the problem |
| Emphasis and order | Yes | Which finding leads, within rating order; what is in the summary’s three messages | Moving a High below a Medium |
| Action plan | Yes, within the five tests | The specific actions, the sequence, the dates within proportion | A plan that fails the cause test |
| Existence of the finding | No | A finding may be combined with another, or reported as remediated during fieldwork with evidence | Dropped because management objects |
| Disagreement | No | How it is worded | Whether it is reported |
The eight pressure tactics, and the response to each
Management’s pressure on a draft is rarely improper and usually predictable. The same eight moves appear in most negotiations, and each has a response that keeps the substance and the relationship. Naming the tactic to yourself is half the response; the other half is in the table.
| Tactic | What it sounds like | What it is doing | The response |
|---|---|---|---|
| The delay | “We need more time to review the draft” | Aging the facts and hoping the auditor’s attention moves on | A fixed response window stated at the closing meeting; the report issues on the date with “no response received” if necessary |
| The volume | Forty tracked changes, most trivial, three substantive | Burying the substantive changes in the trivial ones | Accept the trivial ones in bulk, thank them, and return the three substantive ones with the reason for each |
| The context paragraph | “We would like to add background explaining the circumstances” | Diluting the condition with narrative that reads as mitigation | Context goes in management’s response, in management’s voice, not in the condition |
| The seniority call | “My director would like to discuss this with your CAE” | Moving the negotiation above the auditor’s head | Welcome it: the CAE brings the same file and the same line, and the ladder is followed in order |
| The already fixed | “This has already been addressed” | Converting a finding into a non-event | Ask for the evidence; if the cause is fixed, report as remediated during fieldwork with the evidence; if only the sample items, the finding stands |
| The rating appeal | “This is not a High; nothing was lost” | Arguing consequence from the absence of realized loss | The scale’s anchor for the rating, read aloud; the mechanism restated; the realized instance if there is one |
| The scope challenge | “That was not in your scope” | Excluding an inconvenient finding on procedural grounds | Check the scope memo; if the matter was in scope, say so; if it was not, report it as a matter arising with the same evidence standard |
| The personal appeal | “This will damage my team’s standing” or “we have worked well together” | Trading the relationship for the finding | Acknowledge the relationship and separate it from the report; the finding is about the control; the report can say what works |
Preparation: the negotiation file
Negotiations are lost in preparation, not in the room. The auditor who arrives at the closing meeting with the draft and a pen has one asset, the draft, and everything in it is on the table. The auditor who arrives with the negotiation file has six, and most of them settle arguments before they start. The file contains, for each finding: the fact validation record, showing which facts management already confirmed and when, so that a dispute of facts at the closing meeting can be answered with “your team confirmed this on the fourteenth”; the rating anchor, quoted from the function’s scale, so that a rating appeal is answered with the scale’s words rather than the auditor’s; the denominators, so that every number can be put in proportion on the spot, which is the concession that costs nothing and calms most rooms; two alternative wordings of the condition that keep every number and change every adjective, prepared in advance, so that a wording objection can be met with an offer rather than a defense; the evidence reference for the realized instance, if there is one, because it will be challenged; and the five tests, so that an action plan offered in the room can be evaluated in the room. The file takes an hour per finding to assemble from a well-kept finding record, which is one of the reasons the life of a finding keeps one.
The closing meeting: agenda, roles and the ninety minutes
The closing meeting is where most of the negotiation happens, and it goes better with an agenda that everyone has seen. It is chaired by the engagement lead, attended by the process owner and the people who confirmed the facts, and it runs to ninety minutes for a report with eight findings; a meeting that runs longer is either a meeting with too many findings or one in which the facts are being reopened. The audit manager attends for any report with a High. The agenda below is the one the engagements on this site use.
| Item | Minutes | What happens | What does not |
|---|---|---|---|
| Opening and ground rules | 5 | The line stated: facts confirmed, ratings anchored, everything else open; the response window and the ladder stated | Apologies for the findings; softening in advance |
| Overall conclusion | 10 | The rating and the rule that produced it, read aloud; management’s reaction heard and recorded | Negotiating the rating before the findings have been discussed |
| Findings, highest first | 50 | Each finding read at the level of condition, cause and consequence; wording objections taken with the alternative wordings offered; new evidence noted with a date to produce it; action plans discussed against the five tests | Re-reading the whole block; reopening confirmed facts without evidence |
| What is working, observations, prior findings | 10 | The positive sentence agreed; observations confirmed as observations; prior findings’ status agreed | Promoting observations to findings under pressure to look thorough, or the reverse |
| Next steps | 10 | The response window, the format of the response, who signs it, the escalation ladder, the report date | Leaving the date open |
| Written summary | Same day | What was agreed, what was disputed, what evidence is expected by when, sent to everyone present | Relying on memory of what was agreed |
Six scripts for the conversations that decide reports
The scripts below are openings, not speeches; the point of each is to put the line in the room before the pressure arrives, in words that are firm about substance and generous about everything else.
Opening the closing meeting. “Before we go through the findings, I want to say how this works so that nobody is surprised. The facts in each finding are the ones your team confirmed with us during fieldwork, so I am not expecting to reopen them, but if you have evidence that changes one, show me and it changes. The ratings come from our scale, and I have the definitions here; if you think a finding meets a different definition, I want to hear why. Everything else, the wording, the emphasis, the order, the action plans, is open, and I would rather get those right with you than without you.”
“The wording is too strong.” “Tell me which words. If it is the adjectives, I will change them; I do not need them. If it is the numbers, I need to keep them, because they are what the finding rests on, but I am happy to put them in proportion. Here is an alternative sentence that says the same thing with the denominators in it; does that read as fair?”
“This is not a High.” “Here is the definition of High in our scale. The finding meets it on this element: a control that did not operate, with a demonstrated loss path. If you can show me that it meets the Medium definition instead, meaning the exposure is limited by a compensating control we have not tested, tell me the control and we will test it before the report issues. What I cannot do is change the rating because the consequence has not happened yet; the rating is about exposure.”
“We have already fixed it.” “That is good news and I want to reflect it. Show me the fix and we will test it now. If it removes the cause, the report will say the finding was remediated during the engagement, with the evidence. If it fixes the items we found and not the cause, the finding stays and the fix goes in your response as the first step.”
“This was out of scope.” “Let me check the scoping memo with you. If it was in scope, the finding stands as a finding. If it was not, I still cannot leave it out, because we found it and it is real; it will be reported as a matter arising, clearly marked as outside the planned scope, with the same evidence. Either way it reaches the same readers, so the question is only how it is labeled.”
“My director wants to see your CAE.” “Of course, and I will set it up this week. So that the meeting is useful, I will send the finding, the evidence and the rating definition in advance, and the CAE will bring the same things I have brought. If your director has evidence that changes a fact, the CAE will change it; if the disagreement is about the rating or the consequence and it is not resolved, the report will state both positions, which is what the Standards require of us.”
Concessions that cost nothing, and concessions that cost everything
A negotiation goes well when the auditor gives freely on the things that do not matter and holds firmly on the things that do, and goes badly when the auditor does the opposite, defending an adjective for twenty minutes and then letting a number go to end the meeting. The table sorts the common concessions by what they cost.
| Concession | Cost | Why |
|---|---|---|
| Replacing “failed” with “did not operate”, “inadequate” with “does not”, “management failed to” with “the process does not” | Nothing | Adjectives and blame carry no evidence; the numbers carry it all |
| Adding the denominator and the base rate | Nothing; it usually helps | Proportion is precision, and it makes the severe findings more credible |
| Adding a “what is working” sentence with evidence | Nothing | It is true, it is fair, and it does not change the finding |
| Reordering findings within a rating band | Nothing | The reader sees the same findings |
| Moving names off the report and into management channels | Nothing, and it is usually right | Findings are about programs; people go through the right channel |
| Stating management’s alternative cause beside the auditor’s | Little | The action plan reveals the operative cause, and the reader can judge |
| Extending an action date within proportion | Little, if an interim measure is added | Realism serves the follow-up; the interim measure keeps the risk covered |
| Softening “31 of 46” to “a number of” | Everything | The finding no longer has a condition; the validation a year later has nothing to test against |
| Removing the realized instance | Everything | The consequence becomes hypothetical and the rating becomes an opinion |
| Downgrading the rating without a new anchor | Everything | The scale stops meaning anything, in this report and the next |
| Dropping a finding that stands on its facts | Everything, and the function’s independence with it | The record shows it was found; a regulator will ask why it was not reported |
| Omitting a disagreement from the report | Everything | Standard 15.1 requires accurate communication; a report that hides a dispute is not accurate |
The escalation ladder and its timing
Most disagreements are resolved at the first rung, and the ones that are not are resolved faster when everyone knows the rungs. The ladder is published in the audit charter or the methodology, it is stated at the opening of the closing meeting, and it runs to a clock, because a report held while an argument runs is a report whose facts are aging and whose readers have moved on.
| Rung | Who | Trigger | What is on the table | Clock |
|---|---|---|---|---|
| 1 | Engagement lead and process owner | The closing meeting and the draft response | Wording, emphasis, action plan; facts on new evidence only; ratings against anchors only | Five working days for the response; two for the auditor’s reply |
| 2 | Audit manager and the process owner’s manager | A substantive disagreement unresolved at rung 1, or a response that fails the five tests twice | The same, with the negotiation file in front of both | Within five working days of rung 1 ending |
| 3 | Chief audit executive and the executive responsible | Unresolved at rung 2, or any dispute on a High | The same; the outcome is an adequate plan, a documented risk acceptance, or a stated disagreement | Within five working days of rung 2 ending; the report issues at the end of this rung regardless |
| 4 | Chief audit executive and the audit committee | A stated disagreement on a High, a risk acceptance the CAE judges unacceptable, or a report management has prevented from issuing | Both positions, presented fairly, with the CAE’s recommendation | The next committee meeting, or a call with the chair if the matter cannot wait |
The clock at rung 3 is the one that matters: the report issues when the rung ends, with the disagreement stated if it remains, and the escalation to the committee happens after issue, not instead of it. A function that lets rung 3 run until the disagreement is resolved has given management a veto over publication, which no charter grants and every regulator will notice.
Worked examples: five negotiations, what was held and what was given
| Engagement and finding | What management pushed for | What was given | What was held, and how |
|---|---|---|---|
| Brightwater Foods, procurement: the sole-source program, High | The cause (buyer experience, not a missing standard) and the rating; the head of procurement took it to the chief executive | The cause statement expanded to acknowledge buyer experience as the compensating factor management relied on; two adjectives removed | The rating, held against the anchor for a control absent by design, and the condition, held by putting the six re-performed market checks on the table at rung 3; management accepted after seeing them |
| MidState Beverage, travel and expense: approval theater, High | The HR director asked for the six approvers not to be identifiable and for “94 percent of flagged items approved without comment” to be softened | The approvers’ names off the report and into management channels, which was right anyway | The 94 percent and the six seconds, held as population facts management had confirmed; the finding stayed about the workflow, not the six people |
| Pennine Foods plc, financial close: balance sheet reconciliations, High | The controller proposed to own the plan himself and to remove the reference to the external auditor’s open points | The wording of the reference, made neutral | The reference itself, held because the three open points were the strongest evidence of cause; ownership escalated to the chief financial officer at rung 2, because the controller had made the same commitment the year before |
| Lakeshore Bancorp, reconciliation program: certification over open exceptions, Medium | Business unit heads argued that delegates sign the certifications and the owners were unaware of the exceptions | The cause statement, which adopted management’s point: the form did not display the tool’s status and was completed by delegates | The condition and the rating; the argument that owners were unaware was the cause, not a defense, and the finding was written that way |
| MidState Beverage, order-to-cash: credit memo control, High | Sales management wanted the unsupported credits described as “isolated to two representatives” and the rating reduced | A sentence stating that the concentration was in fourteen accounts served by two representatives, which was true and already in the condition | The word “isolated”, refused, because 2,300 credits approved by their issuers was a population condition; the rating, held against the anchor for a control absent in the acquired depots’ system |
Every one of the five gave something, and none of the five gave a number, a criterion or a rating. The concessions were adjectives, names, causes refined by what management knew, and neutral wording; the things held were the things the file could prove. That is the whole method, and the negotiation file is what makes it possible to tell the two apart under pressure.
When the auditor is wrong: conceding well
Holding the line is not the same as never moving it. Sometimes management produces the evidence: the approval was in a system the auditor did not check, the exception was an authorized one under a rule nobody mentioned, the population included items that were out of scope. The auditor who concedes quickly and completely in that case gains more credibility than the one who never had to, because management learns that the facts decide, in both directions. Conceding well has three parts. The concession is explicit: “you are right, the condition was 31 of 46 and it is 24 of 39; the finding changes accordingly”, not a silent edit. The consequence of the concession is followed through: if the corrected condition no longer meets the rating’s anchor, the rating changes, and if it no longer supports a finding, the finding is withdrawn and the record says why. And the concession is recorded in the disposition history with the evidence attached, so that the file shows a finding that moved on evidence rather than one that was negotiated away. What the auditor does not concede is the method: a finding withdrawn because the evidence changed is a different thing from a finding withdrawn because the argument was tiring, and the file should make the difference visible.
Negotiating with the second line and the external auditor in the room
Two other parties sometimes join the negotiation, and each changes it. The second line, a risk or compliance function, may have rated the same control differently, and management will cite the difference; the answer is that the two functions apply different scales for different purposes and that the report can state the second line’s view beside the finding without adopting it, which is also the answer when the second line’s view is harsher than the auditor’s. The external auditor may have relied on the control or have raised the same point in a management letter, and management will cite either; reliance by the external auditor is not evidence that a control operated, and a management letter point on the same account is, as Pennine’s controller discovered, evidence of cause rather than a defense. In both cases the auditor’s position is the same: the finding rests on the function’s own evidence and scale, other assurance providers’ views are reported where relevant and never substituted for the function’s, and the evaluation of those views belongs in planning, where reliance is decided, rather than at the close, where it is argued about.
Building the function’s reputation for holding the line
Every negotiation teaches management something about the next one. A function that concedes numbers under pressure teaches that pressure works, and its closing meetings get longer every year. A function that gives freely on words and never on substance teaches that the meetings are about wording, and they get shorter. The reputation is built in small decisions: the report that issued on its date with “no response received” when the delay tactic was tried; the rating that was held against the anchor with the definition read aloud; the finding withdrawn in an afternoon when management produced the evidence; the disagreement stated in the report in two neutral sentences and presented to the committee without drama. Within two or three cycles the pressure tactics stop being tried, not because management has become docile but because they have learned where the line is and that arguing about it costs them more than it gains, and the negotiation becomes what it should have been from the start: a conversation about how to describe a problem both sides agree exists and what to do about it.
After the negotiation: what gets written down
The negotiation ends in the finding record’s disposition history, which records every change between the draft and the final with who requested it and why it was accepted or refused. The record protects both sides: it shows the process owner that the wording changes they asked for were made, it shows the reviewer and the external assessor that the substance was not traded, and it shows the next auditor what was argued about, which is usually where the next finding will be. Where a disagreement remains, Standard 15.1 requires the final communication to be accurate and complete, which means the report states management’s position and the auditor’s, in the auditor’s comment beneath the response, without heat and without an adjective. Where the disagreement is on a High or on an acceptance the chief audit executive judges unacceptable, the CAE’s report to the audit committee carries it, under Standard 11.5 where the matter is an acceptance and under Standard 11.3 where it is a dispute of results, and the risk acceptance guide covers how that communication is made without making an enemy.
Common mistakes on both sides of the table
The auditor’s mistakes: arriving without the file; defending adjectives and conceding numbers; letting facts reopen at the draft that were validated in fieldwork; arguing ratings on proportion instead of anchors; treating “we already fixed it” as a threat rather than an invitation to test; taking the seniority call personally; holding the report until the argument ends; and omitting the disagreement to keep the peace. Management’s mistakes, which the auditor should recognize and not exploit: disputing facts they have already confirmed, which costs them credibility for the rest of the report; using volume to hide substance, which trains the auditor to read carefully; escalating on wording, which spends the executive’s attention on the wrong thing; and arguing that the consequence has not happened, which is the argument every realized loss was preceded by. The best negotiations are the ones where both sides know the line, and the fastest way to that state is for the auditor to say where it is at the start.
Where to go next
Draw the line before the meeting, bring the file, give freely on words and never on numbers, follow the ladder on its clock, and write down what changed. The action plan that ends most negotiations is evaluated in the management responses guide; the acceptance that ends the rest is in the risk acceptance guide; the record the negotiation is written into is in the life of a finding; and the report the negotiation produces is structured in the anatomy of an audit report.
Related guides
- Evaluating management responses — the five tests the action plan on the table has to pass
- Risk acceptance by management — when the negotiation ends in a decision not to act
- The life of a finding — fact validation, the stage that makes the facts non-negotiable
- Anatomy of an internal audit report — where the auditor’s comment and the disagreement appear
- The 5 C’s of audit findings — the elements the line is drawn around
- Finding severity ratings — the anchors rating appeals are settled against
- Internal audit report examples — how a stated disagreement reads in a finished report
- Root cause analysis for audit findings — holding a design cause against a people cause
- When internal audit finds fraud: the first 48 hours — what is never negotiated: a referral
- How to audit procurement — the sole-source negotiation, in context
- How to audit travel and expense — the approval theater negotiation
- How to audit the financial close — the reconciliation ownership escalation
- How to audit account reconciliations as a program — the certification negotiation
- How to audit order-to-cash end to end — the credit memo negotiation
- Your first 90 days as chief audit executive — the reporting line the fourth rung depends on
- Findings and reporting guides and influence and stakeholder guides — the full collections
- Writing Airtight Audit Conditions — stating what is, without editorializing.
- Writing Cause Statements That Point to the Fix — causal logic on paper.
- Writing Impact That Lands — audit consequences in dollars, risk and plain sight.
- Writing Audit Recommendations Management Can Actually Implement — owners, dates and end states.
- Finding Makeovers — five real-shaped audit findings rewritten before your eyes.
- The audit closing meeting — agenda, scripts and how to handle disagreement in the room
- Difficult conversations in audit — scripts for the conversations auditors put off
- Getting to Yes by Fisher, Ury and Patton: Summary and Lessons for Auditors — agreeing findings without giving in.
- Crucial Conversations, Third Edition: Summary and Lessons for Auditors — holding the conversation when the stakes are high.
Leave a Reply