When internal audit notifies you that your division is in scope, three things in the next eight weeks are yours and nobody else’s: the scope and timing conversation with the chief audit executive in the first week, the validation meeting near the end of fieldwork where facts and ratings are settled, and the management response that carries your name into the audit committee pack. The requests, the walkthroughs and the samples belong to your managers. The most common executive mistake we see from the audit side is doing their job instead of your own: sitting in on interviews and arguing about a sample of forty while the question of what the division will commit to goes unanswered.
This guide follows a typical eight-week engagement week by week from the executive’s seat, then covers the five decisions only you can make, how to read the chief audit executive, the audit committee appearance, how to use the audit to get things done, and the relationship between audits. It is written for the senior vice president, division head or chief financial officer whose function is being audited. The operating guides for the people doing the work are on the Being Audited? hub; the standing relationship between a finance chief and the function is in The CFO and Internal Audit, which this guide does not repeat.
In this guide
- What this audit means for you, specifically
- The eight weeks at a glance: the executive’s calendar
- Week 1: notification and the scope conversation
- Week 2: the kickoff and ten minutes of tone-setting
- Weeks 3 to 5: fieldwork, informed without interfering
- Week 6: preliminary findings and the validation meeting
- Week 7: the draft report, your review and your response
- The five decisions only you can make
- Week 8: the final report, distribution and the committee pack
- How to read the chief audit executive
- If you are asked to attend the audit committee
- Using the audit to get things done
- After week 8: owning the actions
- The relationship between audits
- Worked example: eight weeks at Alder Mutual Insurance, from the SVP’s chair
- Questions readers ask
- Related guides
What this audit means for you, specifically
Your name is in the report. Standard 15.1 (Final Engagement Communication) requires the final communication to carry the findings, the conclusions and the recommendations or management’s action plans, to name the individuals responsible for addressing each finding and the planned completion dates, and to go to the parties who can ensure the results get due consideration: in practice you, your boss, usually the chief executive and chief financial officer, and the audit committee in summary or in full depending on the rating. The action plans are commitments under your name with dates attached. Standard 15.2 (Confirming the Implementation of Recommendations or Action Plans) requires the function to confirm that each one was implemented and, when a date passes without progress, to obtain management’s explanation and put the matter to the chief audit executive, who decides whether management has, by delay or inaction, accepted a risk beyond the organization’s tolerance. A finding in your division is not an event; it is an open item with your name on it for as long as it takes.
The audit committee sees your division through the quarterly pack, not the report. A well-built pack lists reports by significance with ratings and shows open issues by age, with extensions and risk acceptances called out; Reporting to the Audit Committee describes the document, including its view of remediation by executive owner. The IIA’s practice guide on communicating results (December 2025) observes that boards pay particular attention to engagements rated unsatisfactory and findings rated high. Translated: a Satisfactory report earns a line, a High finding earns a paragraph with your role next to it, and an overdue High earns a question from the chair.
The chief audit executive does not work for you. Standard 7.1 (Organizational Independence) rests on a direct reporting relationship between the function and the board, in practice the audit committee: under the Standard’s essential conditions the board authorizes the CAE’s appointment and removal and has input into the CAE’s evaluation and pay, and in many organizations the committee decides both outright; management provides an administrative home, not direction. The CAE can be reasoned with on timing, wording, emphasis and action plans, and cannot be instructed on scope, facts or ratings; a request to soften a conclusion is, on the audit side, a recorded event that moves up the escalation ladder. And the controls are yours. The IIA’s 2026 Statement of Position on the Three Lines Model says management, as the first line, owns and manages risks and is responsible for the design and operation of processes and controls, while internal audit provides independent and objective assurance on how well that is done. Most of those controls predate you; what is attributed to you personally is the response.
| Phase | What the audit team is doing | What it means for you | Your move |
|---|---|---|---|
| Notification and planning | Confirming objectives and scope from the approved plan, reading prior reports, drafting the scoping memo and request list | The last point at which timing and scope boundaries can be shaped by information you hold | Hold the scope conversation; name the coordinator; disclose what you already know is broken |
| Kickoff | Presenting scope, timeline, team and request list to your managers | Your team takes its cue from your ten minutes | Set the tone in person, then leave |
| Fieldwork | Walkthroughs, sample testing, analytics, interviews; findings emerging and being discussed with owners | Low visibility by design; the risk is interference, not neglect | Weekly twenty-minute status; clear access blockers with peers |
| Preliminary findings and validation | Confirming facts, agreeing causes and actions, explaining ratings against definitions | The meeting where your credibility with the function is set | Pre-brief with your managers; accept facts fast; dispute only with evidence |
| Draft report and response | Writing the report; collecting management responses within a fixed window | The only part of the report written by you; read by the committee as a character reference | Own the response; decide the rating question; start interim fixes |
| Final report and committee pack | CAE approval, distribution, summary into the quarterly pack | Your name reaches the chief executive and the committee | Brief your boss before the pack lands; offer to attend if asked |
| Follow-up | Tracking actions, validating evidence, reporting aging and extensions | Months of visibility in the pack under your role | Monthly status upward; raise slippage the day you know |
The eight weeks at a glance: the executive’s calendar
The model used throughout is an eight-week single-process engagement: notification and planning in week 1, kickoff in week 2, fieldwork in weeks 3 to 5, validation of findings in week 6, draft report and response in week 7, final report in week 8. A standard audit runs six to ten weeks from kickoff to final report and multi-site work runs longer; How Long Does an Internal Audit Take? explains the drivers, of which the two largest, document turnaround and report review layers, are partly within your gift. Your own time is measured in hours. Practitioner judgment: a division head spends between a dozen and twenty hours on a routine engagement, concentrated in the scope conversation, the kickoff, a few short status calls, the validation meeting and its pre-brief, and the draft report and response. The calendar is a practitioner’s model, not a survey finding; your function’s own timeline letter takes precedence.
| Week | What the audit team is doing | Your time | Your move | Watch for |
|---|---|---|---|---|
| 1 | Notification letter; planning interviews with you and your managers; scoping memo; request list drafted | About two hours | Scope and timing conversation with the CAE or audit director; appoint the coordinator; disclose known issues; ask for the rating definitions | A scope that reflects an old org chart; a timing clash with a close, cutover or peak season |
| 2 | Kickoff meeting; first requests issued; walkthroughs scheduled | Fifteen minutes plus a team briefing you delegate | Open the kickoff, set the rules, leave; confirm your managers have briefed their teams | Requests landing on people who do not know an audit is happening |
| 3 | Walkthroughs; population requests; first samples | Twenty minutes | First status call: are they getting what they need, on time | Slow turnaround on data your division does not own |
| 4 | Testing; analytics; emerging observations discussed with process owners | Twenty minutes | Second status call: anything emerging I should hear now; has scope moved | An observation your managers are arguing about rather than evidencing |
| 5 | Testing completes; draft finding sheets to owners; audit manager briefs you ahead of validation | About an hour | Third status call; read the finding sheets; sort disputes into facts, cause, rating, wording | A proposed High you are hearing about for the first time |
| 6 | Validation (closing) meeting; written summary within a day or two; parked items resolved | Two to three hours | Pre-brief with your managers; attend; accept facts; commit to actions in your own words | Your own urge to negotiate the rating by seniority |
| 7 | Draft report issued; management responses due within the stated window | Three to four hours | Read the executive summary first; run the fact-check through your managers; write or own the responses; decide on contesting and on risk acceptance | A response written by the person the finding is about, in a defensive register |
| 8 | Final report approved by the CAE and distributed; summary drafted for the quarterly pack | One hour | Brief your boss before distribution; agree with the CAE whether you attend the committee; tell your organization | Your boss hearing the result from the pack instead of from you |
Week 1: notification and the scope conversation
The notification is a letter or email from the CAE or an audit director naming the area, the objectives, the planned dates and the engagement lead. Standard 9.4 (Internal Audit Plan) requires the plan to rest on a documented risk assessment, refreshed at least annually, with input from the board and senior management, and the committee approves it; When Will Internal Audit Come? explains how areas are scored. Selection is not an accusation, and the executive who treats it as one has lost the first week.
You can shape timing, within reason: a financial close, a system cutover, a peak season or a regulatory examination already under way are legitimate grounds to move fieldwork by a few weeks; “we are busy” is not. You can shape scope boundaries with information: a process that moved to another division, a system scheduled for decommissioning, a review of the same area by the second line or the external auditor that the function could rely on under Standard 9.5 (Coordination and Reliance). You can shape the team’s understanding by disclosing what you already know is broken; an issue logged with an owner, a cause and a dated plan before the auditors find it is reported as self-identified in most functions, and Self-Identified Issues covers what qualifies. And you can shape who they talk to by naming a coordinator and the people who run the process.
You cannot veto the audit, remove an objective because it is uncomfortable or require that interviews be routed through you. Standard 6.3 (Board and Senior Management Support) sets out, as an essential condition, that the board and senior management enable the function’s unrestricted access to the data, records, information, people and physical property it needs; a refusal becomes a scope limitation reported to the committee, and What Internal Audit Can and Cannot Do sets out its breadth and its limits. The one document to ask for in week 1 is the scoping memo, which states the objectives and scope required by Standard 13.3 (Engagement Objectives and Scope); How to Write an Engagement Scoping Memo shows what a good one contains. Ask at the same time for the rating definitions; arguing from the definitions, or correcting a fact that drives the rating, is the only way a rating is ever changed, and week 7 is too late to read them for the first time.
| Topic | Say | Don’t say | Why |
|---|---|---|---|
| Timing | “Fieldwork in the second half of the quarter lands on our close and the system cutover on the 14th. Can we start two weeks later, or sequence the payments work after the cutover?” | “This is the worst possible time.” | A specific clash with a specific alternative is usually granted; a general objection is heard as resistance |
| Scope | “Vendor onboarding moved to Procurement in March; the plan still shows it under us. Here is who owns it now.” | “You don’t need to look at that.” | Information corrects scope; preference does not, and the second sentence is written down |
| Known problems | “We identified in January that the authority matrix had not been re-approved since the reorganization. The owner, cause and plan are in the issue log; here is the entry.” | “We know about that already.” | A logged issue with a plan is self-identified; an unlogged one you “knew about” is rated more severely than a surprise |
| People | “The operations director will coordinate. The three people who run the process day to day are these; talk to them directly.” | “All questions should come through me.” | Direct access is the Standard; routing through you reads as control of the evidence |
| What you want from it | “If you find the manual-payment process as fragile as I suspect, say so plainly. I have been trying to get the role redesign funded for two quarters.” | “I’d like a clean report.” | Telling the team what you need the report to settle gives them a reason to be precise where it helps you |
| Prior history | “The last report rated us Needs Improvement on reconciliations. Two of the three actions were validated; the third is due in June. Start there.” | “That was before my time.” | They will start there anyway; owning the history is cheaper than being reminded of it |
Week 2: the kickoff and ten minutes of tone-setting
The kickoff is the audit team’s meeting, and your part is the first ten minutes. Everyone in the room calibrates how to behave for the next five weeks by what you say and whether you stay. Three messages, in your own words: why this audit is useful to the division, who coordinates and how requests flow, and the rules for anyone the auditors speak to. Then thank the team and leave. An executive who stays is read by the auditors as supervision and by the staff as a signal to be careful, and the careful answer is the one that generates follow-up requests.
Before the kickoff, confirm that your managers have briefed their own teams; the three-minute version of that talk and the reasons scripted answers backfire are in Briefing Your Team Before an Audit. The auditor’s view of the meeting is in The Audit Opening Meeting. The request list that follows is the coordinator’s problem, and The PBC Survival Guide is written for that person.
| Moment | Say | Don’t say |
|---|---|---|
| Opening | “I asked for the payments process to be in this year’s plan. We changed the system roles in the reorganization and I want an independent view of whether the controls kept up.” | “I’m sure you’ll find everything in order.” |
| Coordination | “Dana coordinates. Every request goes to her, every answer comes back through her, and she has my authority to prioritize your work over routine work for the next five weeks.” | “Let’s see how it goes and sort out logistics as we need to.” |
| The rules | “Answer the question you were asked. Describe what actually happens, not what the procedure says. If you don’t know, say so and find out. If something seems odd, tell Dana.” | “Remember, we’re all on the same side here.” (It is heard as a warning.) |
| Candor | “You will find things. I would rather hear about them from you in week 4 than read them in week 7.” | “Run anything significant past me before you write it up.” |
| Exit | “I’ll leave you to the logistics. My door is open to the audit manager at any point.” | Staying for the request list walkthrough |
Weeks 3 to 5: fieldwork, informed without interfering
Fieldwork is the part of the audit you should feel least; Audit Fieldwork: What Happens, Week by Week describes the walkthroughs, sampling and analytics from the inside. Your job is a twenty-minute weekly call with the audit manager and three questions. Are you getting what you need, on time? Is anything emerging that I should hear now rather than at the end? Has the scope moved? The first stops a slow data turnaround from becoming an escalation about access. The second enforces a deal the Standards already impose: Standard 13.1 (Engagement Communication) requires the auditors to communicate with management throughout the engagement, and an executive who first hears of a proposed High at the validation meeting has either not asked or has a function that is not doing its job. The third catches scope creep in either direction.
Interference is rarely deliberate. It looks like sitting in on an interview “to help”, asking that questions for your team come to you first, reviewing evidence before it goes out, or calling the CAE in week 4 about a sample. Each is recorded. Two things are worse. Any pressure, however oblique, on an employee who spoke to an auditor: Standard 1.1 (Honesty and Professional Courage) requires auditors to report what they found and conceal nothing, regardless of who dislikes it, and Standard 5.2 (Protection of Information) is why the lead will not tell you who said what. And any request to change a conclusion without new evidence, which the escalation ladder treats as a matter the auditor never negotiates alone and takes to the audit manager immediately.
Where you earn your keep in fieldwork is with your peers. The vendor master sits in Procurement, the access logs with the chief information officer, the contracts with Legal, and the auditors’ second unanswered request to any of them is the trigger that moves an access matter up a rung. A call from you clears in a day what the ladder would take three weeks to clear. And if interviews shift to specific transactions, legal or HR appear and requests become preservation holds, the engagement has changed character; When Internal Audit Suspects Fraud in Your Area describes the different rules that then apply.
| Behavior | How the audit team reads it | Do this instead |
|---|---|---|
| Weekly twenty-minute status with the audit manager | An engaged sponsor; a channel for early warnings | Keep it; ask the three questions; take actions away |
| Sitting in on staff interviews | Supervision of witnesses; answers will be re-tested another way | Make yourself available for your own interview and for the validation meeting |
| Asking for questions to be routed through you | Control of the evidence; a possible access issue | Route through the coordinator, who logs and forwards |
| Reviewing evidence before it is sent | Curated evidence; the sample will be extended or re-pulled | Ask the coordinator to flag anything you should know about after it is sent |
| Asking which employee said something | Pressure on a source; recorded | Ask what the population shows, not who described it |
| Calling your peer to clear access to their data | A sponsor removing a blocker | Do it the day the coordinator tells you a request has stalled |
| Calling the CAE about a sample result mid-fieldwork | A seniority call on a matter not yet validated | Wait for the finding sheet; bring evidence, not rank |
| Fixing something the moment you learn it is broken | Management acting; the final report must acknowledge actions already started (Standard 15.1) | Fix it, document the date, and tell the audit manager |
Week 6: preliminary findings and the validation meeting
This is the meeting where executives earn or lose credibility with the audit function, and the verdict travels into the CAE’s private session with the chair and into the next risk assessment. The meeting, usually called the closing meeting, confirms facts, agrees causes and actions and explains ratings against the published definitions; The Audit Closing Meeting Playbook is the auditor’s script, including the pre-wiring rules that make the meeting a confirmation rather than a reveal. Standard 14.3 (Evaluation of Findings) requires the auditors to work with management to identify root causes where possible and to evaluate significance, and Standard 14.4 (Recommendations and Action Plans) allows the action plan to be management’s rather than the auditor’s recommendation; both are settled in this room.
Prepare with your managers the day before, finding by finding, in four buckets: facts we dispute with evidence in hand, facts we accept, cause we see differently, and rating we question against the definitions. Anything in the first bucket without the evidence attached moves to the second. In the meeting, accept confirmed facts in one sentence and move on; every minute spent on a fact that stands is credibility spent. Ask about populations and design, not people: “how many payments in the year, and what is the design gap” rather than “which supervisor.” Never negotiate a rating by seniority; Negotiating Audit Findings names eight pressure tactics and the auditor’s response to each, and the seniority call is one of them. Close by stating the actions your division will take in your own words; that sentence is what the report will be judged against.
When you do disagree, say so in the room, say why, and ask for it to be recorded. Standard 13.1 requires a method for both sides to state their positions in the final communication, and the auditors need a valid reason to change results, so your reason has to be evidence or a misapplied definition rather than preference; When You Disagree With an Internal Audit Finding walks through the method. Make sure one of your managers owns every parked item in the written summary that follows; an unowned parked item becomes an unresolved disagreement in the draft.
| Do | Don’t | What the audit team concludes |
|---|---|---|
| Accept each confirmed fact in a sentence | Re-argue facts your managers have already confirmed | This executive separates facts from feelings; their word on other matters is reliable |
| Bring the evidence for every fact you dispute | Promise evidence “after the meeting” for a dispute you raise in it | Disputes from this division are worth checking; the ones without evidence are not |
| Ask about population, design and criteria | Ask which employee, which supervisor, which depot | Interest in the control, not in blame; the sources are safe |
| Ask what rating the finding would carry had the sample been clean | Argue that seven exceptions in forty is a small number | A design failure keeps its rating whatever the sample; an operating failure might not |
| Offer a cause the auditors have not seen, with the data | Offer “human error”, “training” or “workload” as the cause | Management understands its own process; the action plan will address the cause |
| Argue a rating from the written definitions | Argue a rating from your title, the absence of loss, or the volume of other work | A legitimate challenge the audit manager must answer, versus a pressure tactic that goes in the file |
| State the actions in your own words at the close | Leave the action plan to “the team” without a commitment from you | The actions have an owner with authority; the response will be credible |
| Say what is already fixed, with dates and evidence | Say “that’s already been dealt with” without either | The report will acknowledge the actions already taken, as Standard 15.1 requires |
Week 7: the draft report, your review and your response
The draft arrives a few working days after the validation meeting with a window for comments and responses, commonly five to ten working days. Your managers run the fact-check; The Draft Audit Report Has Landed gives them the 48-hour method. Three tasks are yours. Read the executive summary first, as the committee will, because it is the only page most readers will see; The Audit Report Executive Summary explains how it is built. Decide the rating question once, on definitions and facts rather than on how it feels. And own the response under each finding, which means writing the one that matters most yourself and reading every other one before it goes.
The response is the only part of the report your side writes, and the committee reads it as a character reference for the division. The anatomy is six lines: position, action, owner, date, evidence of completion, interim mitigation. Management Responses to Audit Findings gives fifteen complete responses by situation, and Writing Management Action Plans That Actually Close is the craft of dates from the critical path and owners who can deliver. Two things to add from the executive’s chair. Interim fixes you have already started belong in the response with dates, because Standard 15.1 requires the final communication to acknowledge actions management has already started or completed. And a response that depends on something outside your authority, such as funding or a system release, should say what you have done about the dependency, not merely that it exists. How the CAE assesses what you send back is in Evaluating Management Responses.
The five decisions only you can make
Five decisions sit above your managers’ authority, and if you do not make them the engagement makes them for you by default. The first is resourcing the response: whether the coordinator is backfilled and whether an analyst is assigned to pull populations. The default is that the audit lands on top of everyone’s day job and the request list slips, which is the largest single driver of a long engagement. The second is who coordinates. In most divisions the right answer is the director who owns the process, because the coordinator must know where the evidence lives and have the authority to prioritize. If the coordinator wants the scripts and templates in one working document, The Auditee’s Playbook is the paid PDF written for that job.
The third is whether to contest a rating. Contest when a definition has been misapplied or a fact that drives the rating is wrong, and contest once, in writing, with the definition quoted. Do not contest because the rating is unwelcome, because no loss has occurred or because the issue was self-identified; the self-identified context is already in the report and is worth more than a downgrade. A contested rating that stands is recorded as a disagreement, which the committee reads as management not accepting the risk, a worse position than the rating itself; Internal Audit Ratings Explained covers what is worth contesting at each level. The fourth is risk acceptance, legitimate on grounds such as a fix that costs more than the exposure or a risk within appetite, and only when made by someone with authority for that rating level, recorded, reported and revisited. Standard 11.5 (Communicating the Acceptance of Risks) requires the CAE to take an acceptance the function believes exceeds the organization’s appetite to senior management and, if unresolved, to the board; Risk Acceptance by Management sets out the authority ladder and notes that regulatory and legal findings cannot be accepted by management at all. The fifth is how to communicate to your own organization: the team that answered the auditors’ questions should hear the result from you or your managers before the pack circulates, with what was found and what is being done, and no names. If the result is adverse, Failed an Internal Audit? has the talking-to-your-team and talking-to-your-boss sections.
| Decision | Options | Consequences | Practitioner view |
|---|---|---|---|
| Resourcing the response | Absorb into day jobs; backfill the coordinator; assign an analyst for populations and evidence | Absorbing slips the request list and lengthens fieldwork; a part-time backfill usually pays for itself in weeks saved | Fund the coordinator’s time explicitly; an eight-week audit that runs eleven costs more than a backfill |
| Who coordinates | Process director; chief of staff; junior analyst; first-line risk or controls lead | The director knows the evidence and has authority; the chief of staff knows neither; the analyst has no authority; the controls lead is ideal where one exists | Director or controls lead; never the person whose work is most likely to be the finding |
| Contesting a rating | Accept; contest once from the definitions with evidence; contest repeatedly | Accepted ratings close quietly; a single evidenced challenge is answered on the merits; repeated challenges are recorded as pressure | Contest only a misapplied definition or a wrong driving fact; otherwise accept and let the response carry the context |
| Risk acceptance | Remediate; accept within your authority with a record and review date; take the acceptance to the executive or board with authority | A recorded acceptance within authority is a closed item with a review date; an informal “we’ll live with it” is an overdue action with your name on it | Use it for real cost-benefit cases; never for regulatory or legal findings; expect the CAE to escalate anything beyond appetite under Standard 11.5 |
| Communicating to your organization | Say nothing; a note from you before the pack; a managers’ debrief cascading down; a scapegoat | Silence lets the result arrive through rumor; a scapegoat tells the team the next audit is dangerous | A short note from you, then managers debrief their teams; name controls and fixes, never people |
Week 8: the final report, distribution and the committee pack
The CAE approves the final report and it is distributed, with your response embedded, to the accountable executive, senior management and the audit committee, which is also how the OCC’s handbook describes normal distribution in a bank. The report then becomes a few lines in the next quarterly pack: a rating and a one-sentence conclusion in the results section, a three-line summary for each significant finding, and, for months afterward, rows in the open-issue list by age and rating with the executive owner’s role alongside. The committee reads management responses only when something is unusual; make the unusual thing candor.
Two groups of executives carry an extra obligation. If you are a finance executive at a US public company, findings in your area may bear on the certifications the chief executive and chief financial officer sign. Section 302 of the Sarbanes-Oxley Act makes the signing officers responsible for establishing and maintaining internal controls and requires them to have disclosed to the issuer’s auditors and the audit committee all significant deficiencies in the design or operation of internal controls, and any fraud, whether or not material, involving people with a significant role in those controls. Many companies run quarterly sub-certifications that roll up to those signatures, so an internal audit finding in a financial reporting process needs to reach your controller and the SOX team promptly; whether it is a deficiency under the SOX framework is decided separately from the internal audit rating, on the ladder in Evaluating Control Deficiencies. If you run a function in a regulated bank, assume your examiner may read the report; the Federal Reserve’s policy statement on internal audit, written for supervised institutions above $10 billion in assets, calls the timely remediation of open audit issues an essential component of an organization’s risk reduction efforts.
The one move in week 8 that is entirely yours is briefing your boss before the pack lands: one paragraph with the rating, the one finding that matters, what is already done, what is committed and by when, and what you need from them. A chief operating officer who learns of a High finding in your division from the committee pack has learned two things, and the second is about you. Agree with the CAE at the same time whether you should attend the committee: usually no for a Needs Improvement with a credible response, usually yes for an Unsatisfactory or a repeat.
| Phrase in the report or pack | What it signals at executive level | What to ask |
|---|---|---|
| “Management has already implemented…” | Credit for action before the report; the function is telling the committee you moved | Nothing; make sure the dates in the sentence are right |
| “Repeat finding” | The same condition was reported before and the fix did not hold; many functions rate a repeat at least one level higher | Which prior report, which action, and what the validation at the time concluded |
| “Pervasive” or “across all locations tested” | A design problem, not a performance problem; the rating will not move on sample size | What design change would make the condition impossible rather than less frequent |
| “Management is aware” or “known to management” | You knew and had not logged or fixed it; rated more severely than a surprise | Whether a logged, dated plan existed; if it did, ask for the self-identified label |
| “Scope limitation” | Something was not provided; the committee reads it as a refusal | What was requested, when, and why it was not provided; fix the access now |
| “Management disagrees with the rating” | Recorded disagreement; the committee reads it as the risk not being accepted by management | Whether you want that sentence in the pack more than you want the rating gone |
| “Risk accepted by management” | A formal decision with an approver and a review date, escalated under Standard 11.5 if it exceeds appetite | That the approver has authority for the rating level and the review date is in the log |
| “Action overdue” with an aging bucket | Your role next to a missed date in front of the chair | Why you did not hear about the slip before the date; fix the look-ahead |
| “Extension approved by issue owner” | A pattern the pack guide flags as a warning sign: the owner approved their own extension | That extensions in your division are approved one level up and logged |
How to read the chief audit executive
Two facts explain most of what the CAE does during your engagement. The first is where their authority comes from: a charter approved by the board, a functional reporting line to the committee that authorizes their appointment and removal and has a say in their evaluation and pay, and an administrative line to the chief executive or chief financial officer that provides a desk and a budget but not instructions; who decides what is tabulated in The CFO and Internal Audit. The second is what the committee asks them in private. The Audit Committee Playbook describes an executive session at every meeting, opening with whether there is anything the CAE would say if management were not present, and the CAE’s candid view of how responsive each executive has been is exactly what belongs there rather than in the pack. Your relationship with the CAE is with someone who will be asked, in your absence, what they think of you.
The CAE is not unreachable; the negotiable list is longer than most executives assume and the non-negotiable list is short: validated facts, the existence of a finding whose facts stand, a rating except against the scale’s own anchors, the reporting of any remaining disagreement, and access. A CAE who concedes something on the second list has given you a report the committee cannot trust, and a good one will not do it for any executive. The escalation ladder runs the same way in both directions: you are the sponsor-level rung, the CAE goes to your chief executive at the next and to the committee chair at the last, and the pre-escalation notice means you will be warned first. Hear the warning as the courtesy it is and resolve the matter; most of what we see reach the top rungs gets there through silence rather than refusal.
| The CAE can | The CAE cannot | Ask for this instead |
|---|---|---|
| Move fieldwork for a specific business reason | Drop an objective from the approved plan on your request | A reasoned deferral proposal the CAE takes to the committee |
| Change wording that keeps the meaning; add denominators and context | Change a validated fact, number or population | A factual correction with the evidence attached |
| Accept your cause where you can show it | Drop a finding whose facts stand | A cause statement with data, and an action plan that follows from it |
| Explain and re-test a rating against the definitions | Move a rating because of seniority, absence of loss or self-identification | The definition, the fact that drives the rating, and why one of them is misapplied |
| Record your disagreement alongside the finding | Omit the disagreement from the report | A disagreement written to be read by the committee: facts, not feelings |
| Report an action as already implemented, with evidence | Close a finding because you say it is fixed | Evidence of the interim fix, dated, and a validation request later |
| Keep names out of the report and in management channels | Tell you which employee said what | The population and the design gap |
| Hold a disputed matter at the sponsor rung for two to four weeks | Hold it until you agree; the report issues when the rung ends | A decision within the window, even if it is “we disagree, record it” |
If you are asked to attend the audit committee
Executives are usually asked to attend for one of four reasons: an Unsatisfactory report, a High finding, a repeat finding or an aged issue, or a theme across several audits of their division; the IIA’s practice guide on communicating results notes that boards commonly ask the management responsible for an unsatisfactory engagement or a high finding to present its action plans. The committee wants three things in five minutes: do you own this, what is the plan, and what has changed since the report was written. Presenting to the Audit Committee is written for the CAE but describes the room accurately, and the committee’s habit of asking for evidence of remediation rather than assertions of it is in the Audit Committee Playbook.
Prepare with the CAE, never against them: agree the facts, the status of each action and what each of you will say, because a split that surfaces in the room is remembered long after the finding is closed, as the executive’s doing. Bring one page: findings, actions, owners, dates, what is done, what is at risk and what you need. If you need something from the committee (funding, a decision above your chief executive’s delegated authority, a change to a policy you do not own), ask for it plainly; the committee can do things for you that your line cannot. Then stop talking. The answer to a question you cannot answer is “I don’t know; I will have it to you through the CAE by Friday.”
| Do | Don’t | Why |
|---|---|---|
| Pre-brief with the CAE and agree the facts and status | Surprise the CAE with a new position or a new date in the room | The committee reads a management–audit split as a governance problem, and attributes it to management |
| Open by owning the result in one sentence | Open with context, history or how the process was inherited | Ownership is the first thing the committee checks for; context sounds like excuse |
| Bring one page with actions, owners, dates and status | Bring a deck | Members have read the pack; they want what changed, not a presentation |
| Distinguish dates you control from dates you depend on | Promise a date that depends on IT, a vendor or a peer as if it were yours | A missed committee date is the most expensive kind |
| Ask plainly for what you need | Hint that the function was unfair or the rating harsh | The committee funds credible plans; it does not re-rate reports |
| Answer the question asked, briefly, and stop | Fill silence; speculate about other divisions; answer for your peers | Silence is the committee thinking; filling it changes the subject to you |
| Say “I don’t know” and give a date for the answer | Guess | A wrong answer in minutes is a credibility problem for a year |
| Report what has operated, not what has been designed | Say “implemented” about a control that has run once | Committees have learned the difference between designed, implemented and operating |
| Minute | Say | Purpose |
|---|---|---|
| 0–1 | “The claims payments audit was rated Needs Improvement, with one High finding on segregation of duties in manual payments. I own that result.” | Ownership, in the first sentence |
| 1–2 | “The design gap came from role changes in last year’s reorganization. We did not catch it. An interim weekly review by Finance of every manual payment over ten thousand dollars has operated since the 3rd; here are the first four weeks.” | Cause without blame; what has operated, with evidence |
| 2–3 | “The permanent fix is a role redesign in the claims system, scheduled for the March release. That date depends on IT and I will know by the 15th whether it holds. The other three actions are on dates we control.” | Dates you control versus dates you depend on |
| 3–4 | “The one thing I need from this committee is a decision on the authority matrix, which sits in a policy owned above my level. The CAE and I agree on the facts and the status.” | The ask; the alignment with the CAE |
| 4–5 | “I am happy to take questions.” | Stop |
Using the audit to get things done
An independent report that says a control is broken is the best budget memo you will never have to write. Executives who have been through several audits tell the team in week 1 what they need settled, and write the response in week 7 so that the fix they wanted becomes an action the committee is tracking; the table below covers the common cases. Why Welcome an Internal Audit makes the broader case, and Getting Audit Recommendations Adopted is the auditor’s view of the same mechanism.
Ask through the response, not through the CAE. “Remediation is subject to funding” reads as a hedge; “a funding request for the role redesign was submitted to the technology steering committee on the 12th; if it is not approved by the 30th, the interim control continues and the acceptance decision goes to the chief operating officer” puts the dependency where the committee can see it and gives your request a deadline. Do not use the auditors as a weapon against a peer; a finding that spans two divisions should produce a joint response. Do not ask the CAE to “mention” your budget to the committee; it compromises them and they will decline. The advisory route has its own rule: the function advises on criteria and tests and does not design or operate your controls, and under Standard 2.2 (Safeguarding Objectivity) the CAE must confirm that the advice did not impair objectivity before the function later audits the same area; Assurance vs Advisory explains what you can ask for.
| What you want | How the report helps | How to ask | Limit |
|---|---|---|---|
| A system change stuck in the backlog | A finding with a design cause makes the change an audit action tracked by the committee | Tell the team in week 1 the change you have been seeking; write the response with the release date and the dependency | The change must address the cause the auditors found, or the action will fail validation |
| Headcount for a control role | An operating failure traced to a missing reviewer is evidence a budget memo cannot manufacture | Propose the role in the response with the interim control until it is filled | The function will not recommend headcount; it will describe the gap and let you propose the fix |
| A policy decision above your level | The finding names the policy owner’s decision as the cause | Ask the CAE to address the finding to the right owner, and offer a joint response | You cannot commit another executive to an action; you can commit to escalate |
| A peer’s upstream process fixed | Exceptions in your area traced to their input | Call the peer in fieldwork, before the finding is written; agree the response together | Joint findings need joint responses; blame in a response is read against the writer |
| Advice before a build | A follow-on advisory engagement on control design, before go-live | Ask the CAE at the close of the audit, while the team knows your process | The function advises; it does not design or operate controls |
| Fewer audits of a well-run area | A Satisfactory report with validated actions lowers the area’s score in the next risk assessment | Nothing; the risk assessment does it | Lobbying to be left out of the plan has the opposite effect |
After week 8: owning the actions
The report is final in week 8 and your exposure is not. Every action sits in the issue log with an owner, a date and your role as accountable executive, and appears in the pack each quarter until it is validated and closed or formally accepted. Three things are yours in this period. A monthly status upward, one line per action, so that your boss never learns of a slip from the pack. A rule that any owner who will miss a date tells you the day the critical path says so: a first extension raised before the date is routine, and a silent overdue action is what the chair asks about; Missing an Audit Action Due Date covers the request and how it reads upward. And a standard for “done”: the function will not close an action because it is implemented; it tests that the fix addresses the cause, operated for a period and is likely to stay fixed, and How to Get an Audit Finding Closed describes the evidence pack that passes first time.
Bank executives should know how examiners read the same log. The OCC’s handbook on audits lists holding management accountable for effective and timely response to deficiencies among the audit committee’s responsibilities, and says that multiple changes to issue ownership, target dates or plans, and repeat audit issues, should trigger additional root-cause analysis of management’s ability and willingness to correct deficiencies and manage risks. That sentence is about you, not about the control. The method for running remediation as a small program, with a weekly rhythm and an evidence binder built from day one, is in Remediating Audit Findings: The 90-Day Plan. If the report was Unsatisfactory, expect a full follow-up audit, commonly within about a year; Failed an Internal Audit? describes the twelve months that follow.
The relationship between audits
The executives whose audits are uneventful are not the ones with flawless processes; they are the ones the function already knows. Standard 11.1 (Building Relationships and Communicating with Stakeholders) puts the obligation to build that relationship on the CAE, but the executive who waits to be approached gets the risk assessment interview and nothing else. A quarterly half hour with the CAE or the audit director for your division is enough. The annual risk assessment interview under Standard 9.4 is your chance to put your own concerns into the plan, and the fastest way to be audited more is to lobby to be audited less. Living With Internal Audit Year-Round is the process owner’s version of this calendar; the checklist below is the executive’s.
| When | What | Why it matters |
|---|---|---|
| Monthly | One-line status on every open action to your boss and the issue owner’s manager; look-ahead for the next sixty days of due dates | No slip reaches the pack before it reaches you |
| Quarterly | Half an hour with the CAE or audit director: changes, worries, what is coming, actions at risk | The function plans around what it knows; surprises are what it tests hardest |
| Quarterly | Read the committee pack’s open-issue appendix for your division before the meeting | You should never be asked about an aging bucket you have not seen |
| On change | Written heads-up for a new system, reorganization, key departure, new vendor or product | Changes are where controls break; early notice turns an audit into an advisory review |
| Before a build | Ask for an advisory review of control design before go-live | Controls designed in are cheaper than controls audited in |
| Annually | Risk assessment interview: name your risks, your timing constraints and the audits you want | Standard 9.4 requires management input; input you give shapes the plan, input you withhold is inferred |
| Annually | Your own control self-check two months before any scheduled audit, with issues logged and dated | Logged issues are self-identified; discovered ones are findings |
| After every report | A note to the CAE on what the team did well and what slowed the engagement | Functions remember the executives who treat them as colleagues, and it shows in the next scope conversation |
Worked example: eight weeks at Alder Mutual Insurance, from the SVP’s chair
Alder Mutual Insurance is a hypothetical regional property and casualty insurer; the people, numbers and dates are invented. Its senior vice president of claims runs three claims centers and about six hundred staff. In the first week of September the CAE’s notification letter names a claims payments audit: payment authority limits, manual payments made outside the claims system, payments to repair vendors, and the quarterly review of payment authorities. Fieldwork is planned for the fourth week of September, which is storm season for the carrier’s coastal book.
| Week | What happened | The SVP’s move | Outcome |
|---|---|---|---|
| 1 | Notification letter; planning interview requested | Asked for the scoping memo and the rating definitions; asked to shift fieldwork one week for the storm-season peak; disclosed that the payment authority matrix had not been re-approved since the spring reorganization, with the issue-log entry attached; named the claims operations director as coordinator | Fieldwork moved one week; manual payments stayed in scope; the matrix issue entered the file as self-identified |
| 2 | Kickoff with forty people on the call | Spoke for four minutes: why she asked for the audit, who coordinates, the rules; left | First requests answered within three days |
| 3 | Walkthroughs; population of 1,140 manual payments requested; vendor master requested from Procurement | First status call; learned the vendor master request had stalled; called the head of procurement | Access cleared the same day |
| 4 | Sample of 40 manual payments over $25,000: in 7, the releasing supervisor also held adjuster authority to create the payment | Asked for the full-year population of payments released by a user with both roles, not which supervisors; asked the director to pull it alongside the auditors | Population showed 212 such payments; the design gap traced to a role change in the reorganization |
| 5 | Draft finding sheets: four findings, including 14 repair vendors without a contract on file | Pre-brief with the director; six of the 14 had contracts in the legal repository, evidence attached; no dispute on the role finding | Vendor finding corrected to 8 of 14 before the meeting |
| 6 | Validation meeting; proposed ratings: High (roles), Medium (matrix, self-identified), Medium (vendors), Low (exception report review) | Accepted the facts; asked whether the High rested on the seven exceptions or the design; accepted the answer; committed to four actions in her own words, including an interim weekly Finance review of manual payments over $10,000 starting the following Monday | Proposed report rating Needs Improvement; written summary the next day with no parked items |
| 7 | Draft report; seven working days for responses | Read the executive summary first; wrote the roles response herself; logged the IT dependency for the role redesign with the release date; declined to contest the rating; decided against risk acceptance; drafted a note to her staff | Responses accepted without change; the interim control’s first week of evidence cited in the report |
| 8 | Final report issued to the SVP, the chief operating officer, the chief executive, the chief financial officer and the audit committee | Briefed the COO in one paragraph two days before distribution; agreed with the CAE she would not attend the October committee unless asked | The chair asked one question about the role gap; the CAE relayed the plan; the SVP was asked to report progress in person in January |
Three moments did most of the work. The first was in week 1, when the SVP disclosed the authority matrix issue with the log entry attached rather than mentioning that she “knew about it.” The auditors tested it anyway, found the condition as logged, and reported it as self-identified; the same finding discovered by the team would have carried the words “known to management”, which the committee reads as worse than a surprise. The second was in week 4, when the sample showed seven payments released by someone who could also create them. She asked how many such payments there had been in the year and what design change had created the possibility, which turned a conversation about supervisors into one about system roles, and gave her the population figure for the budget case she had been losing for two quarters.
The third was the response. The role redesign depended on an IT release she did not control, so the response said so, gave the release date, named the steering committee the funding request had gone to, and stated that the interim Finance review would continue until the redesign operated. The report acknowledged the interim control, as Standard 15.1 requires. In January she attended the committee with one page. The release had slipped three weeks; she had raised the extension five weeks before the original date with the interim evidence attached, and the chair’s only question was whether the interim review had caught anything. It had caught two payments, both corrected, which she reported as evidence that the control worked. The role finding was validated and closed in April, and the next risk assessment moved claims payments from high to moderate. Nothing in the example required the SVP to know how to audit; it required her to know which three conversations were hers, to ask about populations rather than people, and to tell her boss before the pack did. This guide is general and educational; it is not legal or employment advice.
Questions readers ask
What is the executive’s role during an internal audit of their division?
Three things: the scope and timing conversation at notification, the validation meeting where facts, causes, actions and ratings are settled, and the management response that goes to the audit committee under your name. Requests, walkthroughs and samples belong to your managers; during fieldwork your job is a weekly status call and clearing access blockers with peers.
Can I ask internal audit to postpone or narrow the audit of my division?
You can ask to move fieldwork for a specific business reason such as a close or a peak season, and you can correct scope with information, such as a process that moved to another division. You cannot veto the engagement or remove an objective because it is uncomfortable; the plan is approved by the audit committee, and a refusal of access is reported to it as a scope limitation.
Should I sit in on the auditors’ interviews with my staff?
No. The audit team reads it as supervision of witnesses and re-tests the same points another way, and your staff give the careful answer rather than the accurate one, which generates more requests. Be available for your own interview, the weekly status call and the validation meeting, and let the coordinator manage the rest.
Who sees the internal audit report on my division?
Standard 15.1 requires the chief audit executive to send the final report to the parties who can ensure the results get due consideration: in practice you, your boss, usually the chief executive and chief financial officer, and the audit committee, which sees the rating and a summary in its quarterly pack. The external auditor may read it if financial reporting controls are involved, and in regulated industries examiners may request it.
Can an executive get a finding’s rating changed?
Only by showing that a fact driving the rating is wrong or that the function’s own definition was misapplied, and only once, in writing. Seniority, the absence of a loss and self-identification do not move a rating, and a repeated challenge is recorded as pressure. A disagreement that stands is reported alongside the finding under Standard 13.1.
Will I have to attend the audit committee?
Usually only for an Unsatisfactory report, a High finding, a repeat or aged issue, or a theme across several audits of your division. If asked, prepare with the CAE, bring one page with actions, owners, dates and status, own the result in your first sentence, and ask plainly for anything you need from the committee.
Does an internal audit finding affect an executive’s performance review or bonus?
In some organizations, particularly in financial services, audit ratings and overdue actions feed scorecards and variable pay under the organization’s own policies, not the audit function’s. In practice the damage comes less from the rating than from the response: disputed facts, missed dates, repeat findings and attempts to have findings removed. A candid response with dates that hold is read as a strength.
Related guides
- Being Audited? hub — every guide for people on the receiving end of an audit, organized by stage.
- The CFO and Internal Audit — the standing relationship for the finance chief: five roles, legitimate asks and the independence lines.
- Reporting to the Audit Committee — the quarterly pack, and how your division appears in it.
- The Escalation Ladder — the rungs, triggers and notice the function uses when it goes over someone’s head.
- What Internal Audit Can and Cannot Do — where the access comes from and where it stops.
- Negotiating Audit Findings — the auditor’s method, the negotiable and non-negotiable lists, and the eight pressure tactics it names.
- Failed an Internal Audit? — the 72 hours, 90 days and twelve months after an Unsatisfactory rating.
- The Draft Audit Report Has Landed — the 48-hour review method for your managers.
- Management Responses to Audit Findings — fifteen complete responses by situation.
- Risk Acceptance by Management — the authority ladder, the record and Standard 11.5.
- Internal Audit Ratings Explained — scales, aggregation rules and what is worth contesting.
- Living With Internal Audit Year-Round — the process owner’s off-season calendar.
- Presenting to the Audit Committee — what the room is like and what members listen for.
- The Audit Committee Playbook — the committee’s own view of its job, including the executive session.
Leave a Reply