Working Through Difficult Conversations in an IT Controls Audit

An IT controls audit can put people in an uncomfortable position. Someone is asking how they do their job, requesting evidence, and evaluating whether the processes they manage are working. Even when the purpose has been explained, it can feel personal. As an auditor, I need to understand that reaction while still gathering the information necessary to complete an accurate assessment.

Resistance can take different forms. Someone may challenge every question, provide very short answers, or repeatedly explain why a control does not apply. Others agree to send documentation that never arrives. Occasionally, the conversation becomes openly confrontational.

I think it is worth taking a little time to understand what is behind the response. The person may have inherited an environment with years of deferred maintenance. They may be working with limited staff, supporting systems they have repeatedly asked to replace, or following decisions made above them. They may also be worried that the report will make them responsible for problems they have been trying to get addressed. Those circumstances do not eliminate the risk, but they matter when we explain the finding and identify who needs to help resolve it.

A useful place to start is asking someone to walk through the process. “How would you recover this system if it failed?” gives them room to describe what happens. We can then ask about responsibilities, documentation, testing, and evidence. That conversation may reveal a control that was not explained well in a questionnaire, or show that different staff members have very different understandings of the same process. Either way, we have learned something we need for the assessment.

We also have to be willing to hear that our initial understanding was wrong. If someone challenges a finding and provides evidence that changes the conclusion, we should update it. An auditor who becomes defensive about corrections can make people less willing to participate. I want respondents to bring forward information that makes the report more accurate, even when it means rewriting something I thought was finished.  You can always add management updates to the report, just be truthful in what was originally said, and what was updated, that in itself can be a finding, especially if they come from different people and/or were drastically different.

Not every disagreement produces new evidence, though. Sometimes the response is that the process has always worked, that nothing bad has happened, or that the recommendation would take too much time or money. We should listen and understand those concerns, then explain the observed condition and the risk it creates. There may be several reasonable ways to address that risk, and the respondent may have valuable ideas about what would work. We can consider those options without removing a supported finding simply because it is uncomfortable.

Repeated delays require a different conversation. If requested information is not being provided, we need to document the requests, establish what remains outstanding, and explain how that affects the assessment. When necessary, that goes to the audit sponsor. Allowing delays to continue without communicating their effect can leave leadership with the impression that we had access and evidence that were never available.

Our reporting needs to remain precise in those situations. If documentation was not provided, say that. If a process could not be verified, explain what prevented verification. Missing evidence does not automatically prove that a control is absent, and frustration with a respondent cannot become the basis for a finding. The report should reflect what we can support, including any limitations on the work.

We should also consider whether our own behavior is contributing to the problem. Are we making clear requests? Have we reviewed the material already provided? Are we asking several people for the same documents without realizing it? Respondents still have jobs to do while participating in an audit. Being organized and respectful of their time helps establish that we expect a professional working relationship in both directions.

I try to keep difficult conversations focused on the condition and its effect on the organization. “The recovery process has not been tested” gives us something specific to examine. Speculating about someone’s competence or motivation usually takes the conversation somewhere less useful. The people answering our questions will often be the same people responsible for implementing improvements, so how we treat them can affect what happens after the report is delivered.

We will not finish every audit with everyone agreeing with us. People may disagree with a finding, its severity, or the decision to report it to leadership. What we can do is make sure they had a fair opportunity to explain the environment, provide evidence, and correct factual errors. I want the final assessment to be accurate, supported, and fair, even when the conversations needed to get there were difficult.