The audit announcement just landed.
Somewhere between the calendar invite and the request list, every manager has the same thought: what do they actually want from us? This is the answer — written by an internal auditor, for the people being audited.
Get the Playbook — $249Playbook
An audit is the most predictable stressful thing that will happen to your team this year.
The memo names a scope you didn’t choose and a date you weren’t asked about. The initial request list gives you eleven days. Your team starts appearing in your doorway. And the advice arrives in stereo: the veteran who says treat every question like a deposition, and the optimist who says just be helpful and it’ll be fine. Both are wrong, expensively.
Here is what they both miss: an audit moves in the same phases, asks in the same patterns, and rewards the same preparation — every single time. The teams that come out of audits with clean reports, calmer weeks, and better budgets aren’t lucky, and they aren’t the teams with perfect processes. They are the teams that know how the machine works.
The Auditee’s Playbook is that knowledge, in order: what to do the day the memo lands, the two prep weeks that decide everything, the fieldwork, the findings conversation, the response — and the seven unforced errors that turn routine audits adversarial.
Written from the other side of the table.
The author is a practicing internal auditor with a decade inside large U.S. financial institutions — the person who issues the announcement memos, runs the walkthroughs, writes the findings, and reads every management response with a red pen. He has watched hundreds of teams get audited well and badly, and the difference was never luck. It was rarely even the state of their controls.
Auditors, it turns out, badly want you to do well — a prepared auditee makes the audit shorter, calmer, and more accurate for everyone. This is the briefing an auditor would give a friend.
From the desk behind internalauditguide.com — 300+ practitioner-written guides and the free Examination Desk tools used by working auditors.
“The best auditees I ever worked with treated us like a free consulting engagement they intended to steer. The worst treated us like a health inspection they intended to pass. Both got reports. Only one got value.”
From the introductionYour announcement memo, decoded line by line.
Every sentence in that memo was chosen for a reason, and three of them tell you exactly how to spend the next two weeks — including the one item that is actually negotiable. Chapter PB–03 annotates the whole thing. These aren’t mockups — the pages below are rendered live from the book itself.
In accordance with the annual audit plan approved by the Audit Committee3, Internal Audit will perform a review of Wire Transfer Operations. The audit will evaluate the design and operating effectiveness of key controls4 over payment initiation, verification, release, and reconciliation, covering the period January 1 through December 31 of last year.5
Planning will begin the week of March 9, with fieldwork expected to run approximately six weeks from March 236. We will schedule a kickoff meeting in the coming days to discuss scope, logistics, and points of contact. Please identify a primary coordinator for the engagement.7
An initial request list is attached; we ask that items be provided by March 13.8 Additional requests will follow as work progresses. Please direct questions to the undersigned.
We appreciate your team’s cooperation and look forward to working with you.9
Your counterpart’s boss. Working questions go to the senior; disputes come here.
The entity name from the audit universe. Ask for the scope document behind it at kickoff.
Translation: this was scheduled months ago and approved by the board. Not personal, not optional.
= they test how controls are built and whether they ran, every time, all period.
The audit period. Samples come from these dates — messy months included (PB–06).
The one truly negotiable item — if you move fast, with a specific conflict and a concrete alternative (§3.1).
The SPOC decision — the most consequential choice of your prep window. Chapter PB–05 is about making it well.
Eleven days. Your responsiveness reputation is set by this first delivery — complete, organized, on time (PB–07).
Sincere, as it happens. A cooperative engagement is the best outcome available to both sides of this memo.
Three extractions drive everything: the scope sentence, the audit period, the initial request list. Timing negotiates; existence doesn’t.
The clock: a week-by-week map of your audit
Ten to twelve weeks, three effort peaks, and long stretches where the best thing you can do is answer fast and stay calm.
Three features of this map do most of the planning work for you. Your effort front-loads. The prep window (PB–05 through PB–08) is where preparation pays double: everything done before kickoff — self-assessment, evidence gathering, team briefing — is done calmly, on your schedule. The same work during fieldwork happens under deadline, with an audience. The middle is a marathon of small responsiveness. Weeks of fieldwork ask little of you beyond fast answers, good walkthroughs, and weekly status attention — but the smallness is deceptive, because responsiveness is exactly what is being informally scored (PB–02.3). The endgame compresses. Findings, factual review, and management responses arrive in a two-to-three-week burst, usually with five-to-ten-day windows attached. Block calendar time for it now, at announcement, while your calendar still has room to give.
Front-load the effort, stay relentlessly responsive through the middle, and pre-block the endgame weeks. Teams that plan the clock experience an audit; teams that don’t experience an ambush in slow motion.
14.1The rewrite, worked
The same finding — wires released without documented callback under month-end volume — answered twice:
| Response as first drafted | Response that ages well | |
|---|---|---|
| Text | “Management acknowledges the observation and takes compliance very seriously. Staff will be reminded of the callback requirement and additional training will be provided. Management will also explore system enhancements to strengthen the control environment.” | “Management agrees. Root cause is month-end volume exceeding the staffing model’s assumptions. By Nov 30: (1) callback queue monitoring implemented with daily supervisor review — interim control effective immediately; (2) systemic block on release without logged callback, delivered with the payments platform’s Q4 change window. Owner: VP, Payments Operations.” |
| Read by validation, months later | Nothing testable: no owner, no date, “explore” commits to a verb without an object. Validation cannot close this — and an unclosable response becomes its own overdue-issue story. | Two dated, owned, testable commitments plus a live interim control. Validation checks the queue reports and the system config, sees the fix, closes the issue. Done means done. |
Notice what the strong version did not do: apologize, editorialize, or promise perfection. It converted the finding into a funded, dated project with a bridge — and notice, too, that the systemic fix is exactly the platform investment the team had been requesting. A finding answered this way is leverage banked (PB–01.3); the response is where the banking happens, in writing, with the board watching.
“We’d rather give you a date we’ll hit than one that decorates the report. The system change rides the Q4 release — that’s the honest earliest. The interim control is running now; here’s this week’s monitoring output. If the release slips, you’ll hear it from us before you see it on an aging report.”
Own it cleanly, fix the cause, one named owner, a date with air, an interim bridge. Write every response for the validation team reading it months from now — they are the audience that decides how the story ends.
Templates: team briefing & request tracker
- Tell the truth, always. Nobody here is ever asked to mislead an auditor. Pressure otherwise goes straight to me or the ethics line.
- Answer the question asked — accurately, then stop. Context that makes an answer correct: yes. Narrated anxieties: no.
- “I don’t know — I’ll find out” is a great answer. Checking the procedure or system mid-interview is allowed and encouraged. Confident guessing is the only way to fail.
- Speak to your own work. Other teams, history before your time, management intent — route to the SPOC.
- Describe; don’t characterize. Facts (“volume doubled in March”) over verdicts (“it’s a mess”).
- Everything in writing goes through the SPOC — requests, deliveries, follow-ups — so we keep one record.
- Known issues are already disclosed, with plans. Honest answers about them help us; only concealment can hurt us.
Walk this page out loud in the briefing meeting (PB–08). It works better spoken than circulated.
| # | Item (their wording) | Owner | Due | Sent | File / location & caveats |
|---|---|---|---|---|---|
| 01 | |||||
| 02 | |||||
| 03 | |||||
| 04 |
Review in the weekly stand-up; inbox and tracker at zero every Friday (PB–10). Naming convention: [item#]_[description]_[period] — a stranger could shelve it.
Forty pages of that, sequenced the way your audit will happen.Every sample above is the real page, rendered live from the book
By page 40, you will know:
- Why your area was picked — the risk machinery behind the memo, and why it’s almost never personal.
- The three facts that decode every auditor behavior: they answer to the board, everything must survive review, and they’re on a clock they didn’t set.
- How to choose your SPOC — the single appointment that carries your area’s reputation for ten weeks.
- How to audit yourself first — and why “we found it ourselves, here’s our fix” changes how the story reads at committee level.
- How to read the request list for the tests hiding behind it — and deliver evidence that makes you look like what you are.
- How to brief your team so nobody guesses, nobody freezes, and nobody narrates their anxieties into a workpaper.
- The four moves for the moment every auditee dreads: “we’d like to walk you through something we’re seeing.”
- Exactly what’s negotiable in a finding — facts, context, wording, sometimes severity — and the only currency that wins any of it.
- How to write management responses that won’t fail validation six months later, with a worked before/after rewrite.
- The seven unforced errors that turn routine audits adversarial — collected from two hundred engagements of watching capable teams commit them.
Seventeen chapters, in the order your audit will happen.
Not topics — a sequence. Part I orients you the day the memo lands, Part II converts the prep window into advantage, Part III runs fieldwork, and Part IV handles the documents that outlive the engagement.
Eleven word-for-word scripts for the conversations that are easy to fumble.
Moving a fieldwork date without sounding like a stall. Disclosing a known gap on your own terms. Handling the thing that breaks live in the middle of a walkthrough. Each script comes with the reasoning, so you can adapt the words and keep the structure.
Here’s one — for contesting a severity rating without contesting the finding:
“We agree the gap is real and we’re fixing it — our disagreement is with ‘high.’ Here’s the exposure math for the period, and the two compensating controls that were operating, with evidence. On those inputs this rates medium under your own scale. Can we walk through how you weighted it?”
Concede the fact, argue the inputs, invoke their scale — the only severity argument that reliably gets a hearing.
Built for the people whose names are on the memo.
The manager whose memo arrived this week
Start with the fast path: decode the memo, learn the clock, run the first 48 hours — three chapters tonight, then stay one phase ahead of the audit team.
The team lead prepping people for interviews
The briefing chapter and its one-page template turn interview dread into format training: truthful, calm, and immune to the confident guess.
The operator who’d rather never scramble again
The audit-ready chapter and quarterly checklist build the standing posture — two hours a quarter that shrink every future audit.
Auditors, honestly
If you’ve ever wished your auditees understood the process, the timeline, and the no-surprises rule — this is the book you’d hand them.
What it is not: a manual for beating an audit. The bright lines — what never gets concealed, coached, or backdated — are stated more bluntly here than in most compliance trainings, because the author has watched what discovery costs. This is the other playbook: preparation, candor, and knowing how the machine works.
Fieldwork starts whether your team is ready or not.Read tonight: the memo decode, the clock, and the first 48 hours
One improved conversation pays for it. You’ll have a dozen.
A severity argued on inputs instead of adjectives. A response date with air in it instead of an overdue-issue slide six months from now. A team briefing that prevents one confident guess from becoming a written fact. Any one of these covers the book the first time it matters — and the professionals who advise on this by the hour bill in six-minute increments.
Most buyers expense it. Receipts are instant.
FAQ
We’re being audited right now. Is it too late for this to help?
No — the “how to use” page includes a fast path for exactly you: decode the memo, learn the clock, and run the first 48 hours tonight, then read one phase ahead of the audit team for the rest of the engagement. Preparation compounds, but the findings, negotiation, and response chapters pay off whenever they arrive.
Does it apply to external auditors and regulators, or just internal audit?
It’s built for audits by your company’s internal audit function — that’s where the author’s decade is. The posture transfers (evidence discipline, briefing rules, response craft), and sidebars flag where external and regulatory reviews run different plays. If your only concern is an external financial-statement audit, this is the wrong book, and you should keep your $249.
Is this… a book about gaming the audit?
The opposite, stated bluntly. Concealment converts “a control has a gap” — a normal, fixable, Tuesday-grade problem — into an integrity question, which is a different genre with a different audience. The Playbook’s bright lines are firmer than most compliance trainings, and the whole self-assessment chapter exists so you can surface issues on your own terms instead of hiding them badly.
What exactly do I get?
One 40-page PDF, US Letter, designed like the document it teaches you to survive: annotated memo, week-by-week map, eleven scripts, phrasebook, and four fill-in templates. Print it, share your screen with it, or hand your SPOC the tracker page an hour after buying.
When do I get it?
Instantly — the download link is on the receipt, and the receipt arrives the moment payment clears. If the memo landed today, you can be reading the first-48-hours chapter in about two minutes.
Can I share it with my team?
The $249 license is single-reader. For a team or department copy, ask about team licensing via the site’s contact page — it costs less than being the person who forwarded the PDF.
Refunds?
Digital product, all sales final — which is why the sample pages above are rendered straight from the book itself, not mockups. What you see is exactly what the other 35 pages look like.
The memo has a date on it.
Ten weeks from now the report is written either way — the rating, the findings, the version of your team it describes. The only question still open is whether the people in it knew how the machine worked. Two hundred forty-nine dollars settles that tonight.
Get the Auditee’s Playbook — $249
P.S. — The next thing your team does about this audit will either be from a plan or from instinct. Instinct is how capable teams commit the seven unforced errors in chapter PB–17 — every one of which is avoidable for less than the cost of the meeting where you’d discuss it.
Checkout opens this week.
The book is done; the store is being wired. Leave your email and the buy link lands in your inbox the moment it’s live.