April 8, 2025 • 18 mins
The Institute of Internal Auditors Presents: All Things Internal Audit
In this episode, Mike Levy speaks with Adam Neifach about the challenges of late audit responses — what they call the “dreaded 5:00 p.m. response.” They discuss why audit clients delay engagement, how to foster collaboration, and practical strategies for improving responsiveness.
Host:
Mike Levy, CIA, CRMA, CISA, CEO and managing principal, Cherry Hill Advisory
Guests:
Adam Neifach, CIA, CPA, CISA, senior manager of Internal Audit, Frontier Airlines
Key Points:
- Introduction [00:00-00:43]
- The 5:00 PM Response [00:44-02:28]
- Explanation of the "5:00 PM response" and its impact on audit processes.
- Discussion on why audit clients delay engagement.
- Explanation of the "5:00 PM response" and its impact on audit processes.
- Challenges and Causes [02:29-03:36]
- Adam Neifach shares his experiences with late responses and the challenges they pose.
- Exploration of potential reasons behind delayed responses, including inefficiencies and reluctance.
- Adam Neifach shares his experiences with late responses and the challenges they pose.
- Building Relationships [03:37-05:32]
- Importance of building relationships with audit clients to improve responsiveness.
- Strategies for fostering collaboration and understanding client perspectives.
- Importance of building relationships with audit clients to improve responsiveness.
- Proactive Communication [05:33-07:03]
- The role of proactive communication in preventing late responses.
- Techniques for maintaining open and constant communication throughout the audit process.
- The role of proactive communication in preventing late responses.
- Real-world Tactics [07:04-09:35]
- Adam Neifach shares real-world tactics from his own experience.
- Practical strategies for encouraging earlier engagement and ensuring smoother audits.
- Adam Neifach shares real-world tactics from his own experience.
- Cultural and Generational Differences [09:36-11:08]
- How cultural and generational differences impact audit responses.
- Adapting communication styles to different stakeholders.
- How cultural and generational differences impact audit responses.
- Tactical Solutions [
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
(00:02):
The Institute of Internal Auditors presents
all things internal audit.
In this episode, Mike Levy speaks
with Adam Neac about the challenges of late audit responses,
what they call the dreaded 5:00 PM response.
They discuss why audit clients delay engagement, how
to foster collaboration
and practical strategies for improving responsiveness.
(00:23):
They discuss why audit clients delay engagement at a foster
collaboration and practical strategies
for improving responsiveness.
Adam shares insights from his experience at Frontier
Airlines, offering real world tactics
to encourage earlier engagement and ensure smoother audits.
Hi everybody. My name's Mike Levy.
(00:44):
I'm CEO of Cherry Hill Advisory,
and the guest host today
for the All Things Internal Audit podcast.
We're joined today by Adam.
Adam, if you don't mind just
introducing yourself to the audience. Yeah,
Of course. Uh, my name is
Adam Neac.
I am the senior manager
of internal audit at Frontier Airlines,
headquartered in Denver, Colorado.
And it's, uh, good to be in some humidity for a little bit.
Amen. We have, we have a really interesting topic today,
(01:04):
the, the 5:00 PM response,
encouraging earlier engagement and audit responses.
So, Adam, I have a lot of thoughts on this topic,
and I know you and I talked a little bit before the session,
but I'd love to hear your thoughts.
You know, what does the 5:00 PM response mean in the,
in the world of internal audit? Yeah.
It tends to mean that your, uh, evening gets changed.
So that is the unfortunate side of what we do.
(01:25):
Um, I, throughout my career,
there have been multiple times we work with people who, um,
we try to engage with them early on, um,
and for whatever reason, they just aren't taking to it,
and they decide to provide us everything we need right when
the bell's ringing at five o'clock.
Um, and it just throws everything for a loop.
I've experienced this more times than I can count,
(01:46):
and it's frustrating.
And I also don't think it's productive
in the, in the audit cycle.
I sometimes, I have to be honest, I sometimes wonder if it's
because they want us to have less time to look at things so
that we have less observations.
I wonder if it's that, I wonder if it's related
to inefficiency in their process
where they're just not prioritizing.
What do you think the cause of those things are?
I think a lot of times they just don't want us there,
(02:07):
and so they delay it as much as possible
and then they realize that, you know,
we have a mandate we need to carry out
and, um, we want to engage with them.
We want it to be a fruitful conversation,
and, um, we want things to go smoothly
and be able to help them ultimately.
But sometimes it takes till 5:00 PM
and the bell ringing for them to that to click.
And I think that needs to change, though. Ultimately,
(02:28):
What are you doing to navigate that with your customers?
Do you find that it's different departments
that are more trouble than others?
Do you think it's something with relationships
or how do you, how are you navigating that internally?
What I've found trends overall throughout my career is
that if an individual has a background in the accounting
or compliance space, for the most part, they understand
what we're doing and why we need to be there.
(02:50):
And o overall the types
of questions we ask, the why behind it.
But I'll say that for groups that aren't as familiar with
that or don't have that background
or upbringing in their career, career, for lack
of better word, um, it's most
of the times it's a teaching moment for them, um, for them
to learn what we're trying to do
and how it's, how we're trying to help them
and help the organization.
Um, it's taken time we're,
(03:11):
it's definitely a work in progress for throughout my career.
Um, but ultimately meeting people with where they're at, um,
and understanding where they're coming from,
why they do something a certain way, um, maybe it's
because it's the way they've always done it
or there's a policy that they've always followed
and doesn't necessarily make sense nowadays,
but most importantly, it's meeting them where they're at
and understanding it, um, to be able to have that dialogue
(03:33):
and be able to, um, build those relationships. Yeah.
I found that to your point, there's a huge distinction
between folks that have been auditors in the past
or in served in some kind of compliance role where they have
to request things commonly Yeah.
And their timeliness to response
and then folks that haven't.
And to your point, the only way I've been successful,
there's some tactics that I'm sure we can talk about here
that I've, that I've seen, and I'm sure you have too.
(03:54):
But ultimately, the only real remedy is our ability
to develop those relationships with our customers.
And if they like, hate to say it, but if they like you
and they feel like they have a collegial environment,
it's sometimes more that than the actual importance
of your audit request that Sure.
That's driving the responsiveness. How are you encouraging
your team and even yourself as you're going through some
of these and you pick up a relatively difficult audit
where you're not getting timely responses, what are some
(04:16):
of the things you're often doing to try to make that better?
Yeah. Uh, well, I'll say
that early in my career I learned, um,
I learned from a few mentors that to approach audit
as new surprises.
So you're there to have constant, um,
constant open communication with them so
that if something does come up, they're not taken back by it
or it's brought up late in the game, um, it's brought up
(04:38):
as the audit's occurring so that they don't feel
as it's a gotcha or we're out to get you type situation.
Um, so communicating that upfront when you, you know,
first make the introduction of, Hey, this is who we are,
we're internal audit, this is, uh,
why we're performing this engagement,
and we want you to know that we're not here to,
to necessarily write up problems and other things like that.
(04:59):
We're really here to help understand what's going on, um,
and help point out areas that can be improved, not just
because it costs money even, um, but
because it can make your lives easier. Right?
I don't know how many times I've said in a, in the middle
of an audit that we're not the, we're not the police.
Oh, yeah. And I feel like I'm just
constantly reminding people of that.
Totally. And it's unfortunate,
but it's a fact of life, unfortunately.
(05:20):
Yeah. It's part of it.
But you know what, I think I've found that once you engage
with them and have show that you have, you're a person, um,
and you do, you work for the same company, right?
You're not there to find the problems and make them feel bad
or so on and so forth,
like you ultimately do want the the company to do well, um,
and you're giving information
to leadership so they're able to do that. Do you
(05:42):
Have any ideas for auditors that are listening maybe,
that are thinking about this is a constant problem
that they're, they're often experiencing, you know,
how do you position yourself as more
of the partner rather than the police
or the enforcer in the organization?
Is there, is there anything that they can do on a daily
basis to try to make that better internally?
Yeah. I, I, you know, it's, it's taken time, right?
Just going from different industries, um, to, you know,
(06:04):
I'm currently in the airline sector and
before that I went into, I started out in public
and that has their own perception.
And then, you know, go to internal audit for, um, ticketing
and entertainment company that has
its own set of challenges.
Um, I've found it's really getting to know them.
It's really getting to know what makes them tick.
Um, some people are very results driven.
(06:25):
Some people just want to know, tell me what you need
and I'm gonna give it to you, um,
because they want you out of your hair.
Um, and some people ask the why,
and I have found that when people ask the why behind it,
it makes me a better auditor as well
because I'm, I'm explaining to them why we're doing
what we're doing and
what we're attempting to achieve out of it.
And you know, I always do this comparison back
(06:46):
to when I was a kid, right?
My mom always told me when I asked her,
why do I need to eat broccoli?
And she said, because I said, so
that was never a good answer for me.
And so as I've progressed in my career, when you talk
to someone, you, you can't just say, the reason you need
to do it is because I said, so
that doesn't get buy-in from that.
Um, so I'd say, if you are doing
that, stop that immediately.
(07:07):
I wish that was effective. But to your point, you,
I like the broccoli analogy.
It doesn't, it does not work if
you just say, because I said so.
Yeah. I mean, it's the, it's the, uh,
the proverbial big stick
approach, I think is what we're talking about.
And it just can be effective on certain sporadic things,
but it's really not the right way to, uh, adopt a, uh,
culture of trust and transparency within your organization.
(07:28):
Yeah. Unless you want people to walk away as soon
as you walk in the room to get water. So
I, you know, I did as an aside, I mean, it's one
of the barometers for me is terms of whether in terms
of whether a department is functioning well
or not, it's a how many requests are management?
Are they coming, are they seeking you
out or do you have to go find them?
And that also, I think that really does, to your point,
dovetail into requests and the 5:00 PM responses
(07:48):
and making sure that we have responsiveness.
Yeah. Um, as a leader in your department, to me,
culture is so important.
Talk to me about how you're instilling that culture in teams
and in the company, because I think
that downstream trickle impact to any staff
that are working on audits and making sure that, you know,
they're not just auditing behind a keyboard, for example,
and working with management to develop some
of those relationships you're talking
(08:09):
about is critically important.
Yeah. And I mean, if we think about it,
the world's changed so much since Covid, right?
It used to be that you have to, you almost have to walk up
to someone to have a conversation or engage,
but you know, especially as, um,
the younger generation enters the workforce, it's,
it's not the traditional route
of you're always in face-to-face in front of someone.
There's a lot of, um, hybrid and remote work styles,
(08:31):
and you have to be able to develop that relationship,
um, in a different approach.
One thing that we do, uh, that we've done
and throughout my career is trying to get the buy-in
of stakeholders, um, by showing them that we,
that we want to help, right?
Um, so approaching them
and trying to figure out what are they doing currently,
like understanding what they're doing
(08:52):
and be able to articulate that back, right?
Because I, I received some, again,
from another great mentor, received some words of wisdom
that internal audit should be a mirror, right?
So we are not identifying anything that's new
or a blemish that doesn't exist.
It's just being brought to your
attention that it does exist.
And I found that it's most effective when you have
(09:14):
that dialogue to understand why someone
doing something a certain way.
Um, maybe it's because they,
that's just how they were trained.
Maybe it's because they,
the risks were different a few years ago.
Maybe it's an outdated policy, who knows what it is.
But if you don't start at a state of trying to understand
where someone's coming from, they're not gonna want
to engage with you and they're not gonna
want to hear what you have to say.
(09:35):
I think that's critically important.
And to your point, making sure that the teams are engaged in
that and that they see the value too.
And it's not just, you know, it's a top
that it's a truly a top-down approach.
I think that does go a long way.
So getting into the more tactical,
'cause I know if I was, if I was listening to this
and I was thinking about this,
we've talked a lot about the whys behind it
and the relational side of it,
but tactically, I'm sure you know,
(09:56):
and I'd love to hear any examples that you may have had,
but I'm sure you've had experiences where these kinds
of delays ha have negatively impacted an audit.
Do you have any where you've had any really significant
impacts to an audit and the whys behind that?
Yeah, we can talk about some of the tactical
solutions on the proactive basis.
Yeah. So I mean, throughout, you know,
I have a few throughout my career.
You know, the one that comes to mind
(10:17):
quickest is there was a point in an engagement
where we were trying to wrap up
and there were, you know, random pieces
of documentation that were missing.
And it's been on the open items list for,
you know, weeks at that point.
And we've been trying to get in front of stakeholders
for them to understand what we're asking for.
It was clearly, um, it was clearly articulated
(10:38):
what we needed and they just weren't providing the
information and we weren't sure why they were doing that
or why they weren't doing it.
But, um, we ultimately had to write up the audit report
'cause we were coming up against a deadline
and we presented to them what our findings were.
We obviously need to confirm, um, what you've identified.
And they said, oh, that's inaccurate
(10:59):
because we have X, Y, and Z.
And we're sitting there thinking, you know, why
we're in our heads, we're like, why didn't we
have this conversation earlier?
Right? Because we've talked about what we need, um,
and we've tried to be as open and available as possible
and you're just not engaging.
So, um, definitely learning opportunities with it.
And we had conversations after the fact
and it came out to be just a resource constraint on there.
(11:22):
Um, which we all understand. We, we definitely get that.
Um, but having the conversation earlier upfront about, hey,
if you're constrained at these times of the month
or with these areas,
or you just don't have the background with it
or the information, let's talk about that, um, earlier.
So we're not, you know, writing up an audit
report that's gonna be presented
To, to me. And I
(11:42):
think that's, that's all very well,
very well said and articulated.
Um, to me, if I'm walking away with like two tactical things
that I've seen be very effective is, you know,
one have the five o'clock thing does tend to happen
and it's like, a lot of times it is resource constraints.
Sometimes it's a dislike
for someone looking over your shoulder from an audit
perspective and that perception that exists there.
But sometimes, like in a very tactical sense,
(12:03):
if you can't get past that from a relational perspective
and you're, you're getting there, you get to the deadline,
one of the things I've done is you set up a meeting
with them for three o'clock
before that five o'clock deadline, somehow magically
before that three o'clock meeting,
the requests seem to trickle in.
So to me that becomes like a really tactical,
effective way to do it.
And then the other thing I found is a lot of times
where we have this happen
(12:23):
and especially it slows things down, it's one
of my biggest pet peeves and
frustrations is in the reporting cycle.
'cause you're trying to get an audit report out the door,
you have to get management's feedback, you have
to get buy-in, and it just takes so long, right?
To get through reporting that sometimes your reporting phase
takes longer than the actual field work itself.
And to me, that's hugely frustrating.
So I think that when you look at your reporting cycles,
(12:43):
sometimes if I look at root cause of why that's happened,
it's 'cause management hadn't seen those
observations before.
They hadn't seen them in that format before.
And it's, and effectively what they're saying
by not responding timely is that they were surprised by 'em
and they're figuring out how to
respond in a way that's meaningful.
So I'd love to hear some of your tactical suggestions there,
but I mean, for me, bringing
that stuff forward into the field work cycle sometimes does
(13:04):
go a long way and help,
and that's be, that becomes really important, right?
Yeah, no, I totally agree with that.
There's many occasions where unfortunately it doesn't seem
to click for the people we're working with
until it's actually written down that, hey, this is,
this is what we actually found.
And because you can't prove
otherwise to us, this is what we're gonna have to report.
And it's a, oh no, uh, wait a minute,
(13:24):
let's give us another week.
We're able to find something.
And they are, and that's great
because we don't wanna report something
that's inaccurate, obviously.
But a lot of times we, we try to go back after the,
after the engagement and do a feedback session
and understand, was the communication not clear on our end?
You know, were we not understanding it correctly?
And a lot of times it comes down
(13:45):
to a communication standpoint.
And I'd say that we, you know, a lot of times when we work
with different people in the organization, we try
to understand how they best communicate, um,
what's their communication style?
Do they like to know upfront, um, at the beginning, this is
what we need and not the why behind.
Um, and it just, it just takes time.
Um, it takes time and takes attention.
(14:06):
It's such a finesse to your point,
because you don't wanna over communicate to the point
where they feel annoyed or bugged about it.
But you have, you sometimes have to get to a point
where you've showed them some of these things in advance
and that they've got that they're not, they're not surprised
to the extent that it takes them weeks to, to
Respond. Yeah. And on top
of that, I mean,
they have their day-to-day job to do, right?
We're, we're coming in
and we're not attempting to slow it down, but it does
(14:27):
because they have to pause what they're executed to do, um,
in order to fulfill what we need.
So being aware of that even is helpful. What
Are your feelings on escalations with management?
Because I've seen that done as well
where someone doesn't respond
and eventually gets escalated to their supervisor.
When is an escalation appropriate?
When is it not appropriate?
How do you feel about that from a relationship management
(14:49):
perspective and things like
That? I mean, it, it
kind of puts fire a big flame
to a relationship that either you have
or you're trying to build because that person,
the two people in this relationship,
this professional relationship are
not doing what they need to do.
So you're having to bring it
to someone's higher attention in order to encourage them
or push them to do it.
(15:10):
I don't like to do that
unless it's definitely necessary in,
there are times that it certainly is.
Um, but it's also understanding again,
where are people coming from, right?
If they're in the middle of a closed period or something
and it's our responsibility
or our shortcoming that we didn't request this earlier
and we're giving them 48 hours during that timeframe
(15:31):
that they're swamped, like that's a little bit on on us.
So before raising it up the flagpole, there needs to, not
to use too many audit terms,
but there needs to be some type of root cause analysis.
Is it they don't understand, is it the resource constraints?
Um, is it our communication style?
What, what, what is the actual problem?
One of the things I've done in that realm,
'cause I agree with you, I, he, I always hesitate about the
(15:52):
escalation side because I think if done incorrectly,
it can be damaging to the long-term relationship.
And so many times when we're doing an audit
and we're trying to get requests, if you get back to the,
the why we're doing all this, it's
to improve the organization and damaging a relationship.
Unless it is a critical high risk showstopper type
of observation, it's not always worth it.
One of the things I sometimes have done in the past is if
(16:13):
you establish the parameters for
how you're reporting status within your audit early on,
that you can effectively send a status report to
that person's supervisor just as part of the normal course
of process and let that person supervisor see
that we're delayed and we're behind schedule
and the y is right on that document.
So it does go to them and it's still getting escalated,
but it's not an escalation
because of this person doing something.
(16:33):
It's just sort of normal course part of the process. Yeah.
So I've seen that as an effective way without being
as damaging to the relationship.
But to your point, you have to be so careful with
how you do escalations so that it is getting
to the bigger picture issues
that you're trying to get to. Yeah,
Absolutely. Any other thoughts
or topics as it relates to how we can improve that process,
you know, improve the process or giving our listeners other
tactical things that they can do to try
(16:54):
to speed up response times from management?
I would say it's very much to me, I've found
to be a very proactive game as opposed to reactive,
really getting to know the people for who they are
and what their, what their roles and responsibilities are.
Um, rather than walking in after the fact just
because you have a mandate, this is what I need to do,
educating your, your organization formally
(17:16):
and informally about why you're there.
Um, you're not there to just necessarily check a box
and come up with a list of names.
I mean, no one, no one wants to work with that,
and that's not what we want to do either.
Um, so building those relationships and providing
and communicating what value we can add and do add
and have examples and be humble with, um, feedback.
(17:38):
I found that's the best way to get your foot in the door
and for people to answer before 4 59 and 5:00 PM
I would take a 4 59 response over a
5:00 PM response, if I'm
Being honest. Oh, I don't know about that.
It's
still delaying my night, so
That's fair. Fair point.
Fair point. Adam,
thank you so much for your time today.
It was a pleasure talking to you
and looking forward to having
you back on the show in the future. Yeah, thank
You. Thanks so much.
(18:01):
Small internal audit teams boost your efficiency at the
2025 audit sphere.
This one day virtual conference on June 17th offers expert
strategies and practical tools just for you.
Register now@theiia.org.
If you like this podcast, please subscribe and rate us.
You can subscribe wherever you get your podcasts.
(18:24):
You can also catch other episodes on YouTube or@theiiaa.org.
That's T-H-E-I-I a.org.
The Institute of Internal Auditors presents
all things internal audit.
In this episode, Mike Levy speaks
with Adam Neac about the challenges of late audit responses,
what they call the dreaded 5:00 PM response.
They discuss why audit clients delay engagement, how
to foster collaboration
and practical strategies for improving responsiveness.
(00:23):
They discuss why audit clients delay engagement at a foster
collaboration and practical strategies
for improving responsiveness.
Adam shares insights from his experience at Frontier
Airlines, offering real world tactics
to encourage earlier engagement and ensure smoother audits.
Hi everybody. My name's Mike Levy.
(00:44):
I'm CEO of Cherry Hill Advisory,
and the guest host today
for the All Things Internal Audit podcast.
We're joined today by Adam.
Adam, if you don't mind just
introducing yourself to the audience. Yeah,
Of course. Uh, my name is
Adam Neac.
I am the senior manager
of internal audit at Frontier Airlines,
headquartered in Denver, Colorado.
And it's, uh, good to be in some humidity for a little bit.
Amen. We have, we have a really interesting topic today,
(01:04):
the, the 5:00 PM response,
encouraging earlier engagement and audit responses.
So, Adam, I have a lot of thoughts on this topic,
and I know you and I talked a little bit before the session,
but I'd love to hear your thoughts.
You know, what does the 5:00 PM response mean in the,
in the world of internal audit? Yeah.
It tends to mean that your, uh, evening gets changed.
So that is the unfortunate side of what we do.
(01:25):
Um, I, throughout my career,
there have been multiple times we work with people who, um,
we try to engage with them early on, um,
and for whatever reason, they just aren't taking to it,
and they decide to provide us everything we need right when
the bell's ringing at five o'clock.
Um, and it just throws everything for a loop.
I've experienced this more times than I can count,
(01:46):
and it's frustrating.
And I also don't think it's productive
in the, in the audit cycle.
I sometimes, I have to be honest, I sometimes wonder if it's
because they want us to have less time to look at things so
that we have less observations.
I wonder if it's that, I wonder if it's related
to inefficiency in their process
where they're just not prioritizing.
What do you think the cause of those things are?
I think a lot of times they just don't want us there,
(02:07):
and so they delay it as much as possible
and then they realize that, you know,
we have a mandate we need to carry out
and, um, we want to engage with them.
We want it to be a fruitful conversation,
and, um, we want things to go smoothly
and be able to help them ultimately.
But sometimes it takes till 5:00 PM
and the bell ringing for them to that to click.
And I think that needs to change, though. Ultimately,
(02:28):
What are you doing to navigate that with your customers?
Do you find that it's different departments
that are more trouble than others?
Do you think it's something with relationships
or how do you, how are you navigating that internally?
What I've found trends overall throughout my career is
that if an individual has a background in the accounting
or compliance space, for the most part, they understand
what we're doing and why we need to be there.
(02:50):
And o overall the types
of questions we ask, the why behind it.
But I'll say that for groups that aren't as familiar with
that or don't have that background
or upbringing in their career, career, for lack
of better word, um, it's most
of the times it's a teaching moment for them, um, for them
to learn what we're trying to do
and how it's, how we're trying to help them
and help the organization.
Um, it's taken time we're,
(03:11):
it's definitely a work in progress for throughout my career.
Um, but ultimately meeting people with where they're at, um,
and understanding where they're coming from,
why they do something a certain way, um, maybe it's
because it's the way they've always done it
or there's a policy that they've always followed
and doesn't necessarily make sense nowadays,
but most importantly, it's meeting them where they're at
and understanding it, um, to be able to have that dialogue
(03:33):
and be able to, um, build those relationships. Yeah.
I found that to your point, there's a huge distinction
between folks that have been auditors in the past
or in served in some kind of compliance role where they have
to request things commonly Yeah.
And their timeliness to response
and then folks that haven't.
And to your point, the only way I've been successful,
there's some tactics that I'm sure we can talk about here
that I've, that I've seen, and I'm sure you have too.
(03:54):
But ultimately, the only real remedy is our ability
to develop those relationships with our customers.
And if they like, hate to say it, but if they like you
and they feel like they have a collegial environment,
it's sometimes more that than the actual importance
of your audit request that Sure.
That's driving the responsiveness. How are you encouraging
your team and even yourself as you're going through some
of these and you pick up a relatively difficult audit
where you're not getting timely responses, what are some
(04:16):
of the things you're often doing to try to make that better?
Yeah. Uh, well, I'll say
that early in my career I learned, um,
I learned from a few mentors that to approach audit
as new surprises.
So you're there to have constant, um,
constant open communication with them so
that if something does come up, they're not taken back by it
or it's brought up late in the game, um, it's brought up
(04:38):
as the audit's occurring so that they don't feel
as it's a gotcha or we're out to get you type situation.
Um, so communicating that upfront when you, you know,
first make the introduction of, Hey, this is who we are,
we're internal audit, this is, uh,
why we're performing this engagement,
and we want you to know that we're not here to,
to necessarily write up problems and other things like that.
(04:59):
We're really here to help understand what's going on, um,
and help point out areas that can be improved, not just
because it costs money even, um, but
because it can make your lives easier. Right?
I don't know how many times I've said in a, in the middle
of an audit that we're not the, we're not the police.
Oh, yeah. And I feel like I'm just
constantly reminding people of that.
Totally. And it's unfortunate,
but it's a fact of life, unfortunately.
(05:20):
Yeah. It's part of it.
But you know what, I think I've found that once you engage
with them and have show that you have, you're a person, um,
and you do, you work for the same company, right?
You're not there to find the problems and make them feel bad
or so on and so forth,
like you ultimately do want the the company to do well, um,
and you're giving information
to leadership so they're able to do that. Do you
(05:42):
Have any ideas for auditors that are listening maybe,
that are thinking about this is a constant problem
that they're, they're often experiencing, you know,
how do you position yourself as more
of the partner rather than the police
or the enforcer in the organization?
Is there, is there anything that they can do on a daily
basis to try to make that better internally?
Yeah. I, I, you know, it's, it's taken time, right?
Just going from different industries, um, to, you know,
(06:04):
I'm currently in the airline sector and
before that I went into, I started out in public
and that has their own perception.
And then, you know, go to internal audit for, um, ticketing
and entertainment company that has
its own set of challenges.
Um, I've found it's really getting to know them.
It's really getting to know what makes them tick.
Um, some people are very results driven.
(06:25):
Some people just want to know, tell me what you need
and I'm gonna give it to you, um,
because they want you out of your hair.
Um, and some people ask the why,
and I have found that when people ask the why behind it,
it makes me a better auditor as well
because I'm, I'm explaining to them why we're doing
what we're doing and
what we're attempting to achieve out of it.
And you know, I always do this comparison back
(06:46):
to when I was a kid, right?
My mom always told me when I asked her,
why do I need to eat broccoli?
And she said, because I said, so
that was never a good answer for me.
And so as I've progressed in my career, when you talk
to someone, you, you can't just say, the reason you need
to do it is because I said, so
that doesn't get buy-in from that.
Um, so I'd say, if you are doing
that, stop that immediately.
(07:07):
I wish that was effective. But to your point, you,
I like the broccoli analogy.
It doesn't, it does not work if
you just say, because I said so.
Yeah. I mean, it's the, it's the, uh,
the proverbial big stick
approach, I think is what we're talking about.
And it just can be effective on certain sporadic things,
but it's really not the right way to, uh, adopt a, uh,
culture of trust and transparency within your organization.
(07:28):
Yeah. Unless you want people to walk away as soon
as you walk in the room to get water. So
I, you know, I did as an aside, I mean, it's one
of the barometers for me is terms of whether in terms
of whether a department is functioning well
or not, it's a how many requests are management?
Are they coming, are they seeking you
out or do you have to go find them?
And that also, I think that really does, to your point,
dovetail into requests and the 5:00 PM responses
(07:48):
and making sure that we have responsiveness.
Yeah. Um, as a leader in your department, to me,
culture is so important.
Talk to me about how you're instilling that culture in teams
and in the company, because I think
that downstream trickle impact to any staff
that are working on audits and making sure that, you know,
they're not just auditing behind a keyboard, for example,
and working with management to develop some
of those relationships you're talking
(08:09):
about is critically important.
Yeah. And I mean, if we think about it,
the world's changed so much since Covid, right?
It used to be that you have to, you almost have to walk up
to someone to have a conversation or engage,
but you know, especially as, um,
the younger generation enters the workforce, it's,
it's not the traditional route
of you're always in face-to-face in front of someone.
There's a lot of, um, hybrid and remote work styles,
(08:31):
and you have to be able to develop that relationship,
um, in a different approach.
One thing that we do, uh, that we've done
and throughout my career is trying to get the buy-in
of stakeholders, um, by showing them that we,
that we want to help, right?
Um, so approaching them
and trying to figure out what are they doing currently,
like understanding what they're doing
(08:52):
and be able to articulate that back, right?
Because I, I received some, again,
from another great mentor, received some words of wisdom
that internal audit should be a mirror, right?
So we are not identifying anything that's new
or a blemish that doesn't exist.
It's just being brought to your
attention that it does exist.
And I found that it's most effective when you have
(09:14):
that dialogue to understand why someone
doing something a certain way.
Um, maybe it's because they,
that's just how they were trained.
Maybe it's because they,
the risks were different a few years ago.
Maybe it's an outdated policy, who knows what it is.
But if you don't start at a state of trying to understand
where someone's coming from, they're not gonna want
to engage with you and they're not gonna
want to hear what you have to say.
(09:35):
I think that's critically important.
And to your point, making sure that the teams are engaged in
that and that they see the value too.
And it's not just, you know, it's a top
that it's a truly a top-down approach.
I think that does go a long way.
So getting into the more tactical,
'cause I know if I was, if I was listening to this
and I was thinking about this,
we've talked a lot about the whys behind it
and the relational side of it,
but tactically, I'm sure you know,
(09:56):
and I'd love to hear any examples that you may have had,
but I'm sure you've had experiences where these kinds
of delays ha have negatively impacted an audit.
Do you have any where you've had any really significant
impacts to an audit and the whys behind that?
Yeah, we can talk about some of the tactical
solutions on the proactive basis.
Yeah. So I mean, throughout, you know,
I have a few throughout my career.
You know, the one that comes to mind
(10:17):
quickest is there was a point in an engagement
where we were trying to wrap up
and there were, you know, random pieces
of documentation that were missing.
And it's been on the open items list for,
you know, weeks at that point.
And we've been trying to get in front of stakeholders
for them to understand what we're asking for.
It was clearly, um, it was clearly articulated
(10:38):
what we needed and they just weren't providing the
information and we weren't sure why they were doing that
or why they weren't doing it.
But, um, we ultimately had to write up the audit report
'cause we were coming up against a deadline
and we presented to them what our findings were.
We obviously need to confirm, um, what you've identified.
And they said, oh, that's inaccurate
(10:59):
because we have X, Y, and Z.
And we're sitting there thinking, you know, why
we're in our heads, we're like, why didn't we
have this conversation earlier?
Right? Because we've talked about what we need, um,
and we've tried to be as open and available as possible
and you're just not engaging.
So, um, definitely learning opportunities with it.
And we had conversations after the fact
and it came out to be just a resource constraint on there.
(11:22):
Um, which we all understand. We, we definitely get that.
Um, but having the conversation earlier upfront about, hey,
if you're constrained at these times of the month
or with these areas,
or you just don't have the background with it
or the information, let's talk about that, um, earlier.
So we're not, you know, writing up an audit
report that's gonna be presented
To, to me. And I
(11:42):
think that's, that's all very well,
very well said and articulated.
Um, to me, if I'm walking away with like two tactical things
that I've seen be very effective is, you know,
one have the five o'clock thing does tend to happen
and it's like, a lot of times it is resource constraints.
Sometimes it's a dislike
for someone looking over your shoulder from an audit
perspective and that perception that exists there.
But sometimes, like in a very tactical sense,
(12:03):
if you can't get past that from a relational perspective
and you're, you're getting there, you get to the deadline,
one of the things I've done is you set up a meeting
with them for three o'clock
before that five o'clock deadline, somehow magically
before that three o'clock meeting,
the requests seem to trickle in.
So to me that becomes like a really tactical,
effective way to do it.
And then the other thing I found is a lot of times
where we have this happen
(12:23):
and especially it slows things down, it's one
of my biggest pet peeves and
frustrations is in the reporting cycle.
'cause you're trying to get an audit report out the door,
you have to get management's feedback, you have
to get buy-in, and it just takes so long, right?
To get through reporting that sometimes your reporting phase
takes longer than the actual field work itself.
And to me, that's hugely frustrating.
So I think that when you look at your reporting cycles,
(12:43):
sometimes if I look at root cause of why that's happened,
it's 'cause management hadn't seen those
observations before.
They hadn't seen them in that format before.
And it's, and effectively what they're saying
by not responding timely is that they were surprised by 'em
and they're figuring out how to
respond in a way that's meaningful.
So I'd love to hear some of your tactical suggestions there,
but I mean, for me, bringing
that stuff forward into the field work cycle sometimes does
(13:04):
go a long way and help,
and that's be, that becomes really important, right?
Yeah, no, I totally agree with that.
There's many occasions where unfortunately it doesn't seem
to click for the people we're working with
until it's actually written down that, hey, this is,
this is what we actually found.
And because you can't prove
otherwise to us, this is what we're gonna have to report.
And it's a, oh no, uh, wait a minute,
(13:24):
let's give us another week.
We're able to find something.
And they are, and that's great
because we don't wanna report something
that's inaccurate, obviously.
But a lot of times we, we try to go back after the,
after the engagement and do a feedback session
and understand, was the communication not clear on our end?
You know, were we not understanding it correctly?
And a lot of times it comes down
(13:45):
to a communication standpoint.
And I'd say that we, you know, a lot of times when we work
with different people in the organization, we try
to understand how they best communicate, um,
what's their communication style?
Do they like to know upfront, um, at the beginning, this is
what we need and not the why behind.
Um, and it just, it just takes time.
Um, it takes time and takes attention.
(14:06):
It's such a finesse to your point,
because you don't wanna over communicate to the point
where they feel annoyed or bugged about it.
But you have, you sometimes have to get to a point
where you've showed them some of these things in advance
and that they've got that they're not, they're not surprised
to the extent that it takes them weeks to, to
Respond. Yeah. And on top
of that, I mean,
they have their day-to-day job to do, right?
We're, we're coming in
and we're not attempting to slow it down, but it does
(14:27):
because they have to pause what they're executed to do, um,
in order to fulfill what we need.
So being aware of that even is helpful. What
Are your feelings on escalations with management?
Because I've seen that done as well
where someone doesn't respond
and eventually gets escalated to their supervisor.
When is an escalation appropriate?
When is it not appropriate?
How do you feel about that from a relationship management
(14:49):
perspective and things like
That? I mean, it, it
kind of puts fire a big flame
to a relationship that either you have
or you're trying to build because that person,
the two people in this relationship,
this professional relationship are
not doing what they need to do.
So you're having to bring it
to someone's higher attention in order to encourage them
or push them to do it.
(15:10):
I don't like to do that
unless it's definitely necessary in,
there are times that it certainly is.
Um, but it's also understanding again,
where are people coming from, right?
If they're in the middle of a closed period or something
and it's our responsibility
or our shortcoming that we didn't request this earlier
and we're giving them 48 hours during that timeframe
(15:31):
that they're swamped, like that's a little bit on on us.
So before raising it up the flagpole, there needs to, not
to use too many audit terms,
but there needs to be some type of root cause analysis.
Is it they don't understand, is it the resource constraints?
Um, is it our communication style?
What, what, what is the actual problem?
One of the things I've done in that realm,
'cause I agree with you, I, he, I always hesitate about the
(15:52):
escalation side because I think if done incorrectly,
it can be damaging to the long-term relationship.
And so many times when we're doing an audit
and we're trying to get requests, if you get back to the,
the why we're doing all this, it's
to improve the organization and damaging a relationship.
Unless it is a critical high risk showstopper type
of observation, it's not always worth it.
One of the things I sometimes have done in the past is if
(16:13):
you establish the parameters for
how you're reporting status within your audit early on,
that you can effectively send a status report to
that person's supervisor just as part of the normal course
of process and let that person supervisor see
that we're delayed and we're behind schedule
and the y is right on that document.
So it does go to them and it's still getting escalated,
but it's not an escalation
because of this person doing something.
(16:33):
It's just sort of normal course part of the process. Yeah.
So I've seen that as an effective way without being
as damaging to the relationship.
But to your point, you have to be so careful with
how you do escalations so that it is getting
to the bigger picture issues
that you're trying to get to. Yeah,
Absolutely. Any other thoughts
or topics as it relates to how we can improve that process,
you know, improve the process or giving our listeners other
tactical things that they can do to try
(16:54):
to speed up response times from management?
I would say it's very much to me, I've found
to be a very proactive game as opposed to reactive,
really getting to know the people for who they are
and what their, what their roles and responsibilities are.
Um, rather than walking in after the fact just
because you have a mandate, this is what I need to do,
educating your, your organization formally
(17:16):
and informally about why you're there.
Um, you're not there to just necessarily check a box
and come up with a list of names.
I mean, no one, no one wants to work with that,
and that's not what we want to do either.
Um, so building those relationships and providing
and communicating what value we can add and do add
and have examples and be humble with, um, feedback.
(17:38):
I found that's the best way to get your foot in the door
and for people to answer before 4 59 and 5:00 PM
I would take a 4 59 response over a
5:00 PM response, if I'm
Being honest. Oh, I don't know about that.
It's
still delaying my night, so
That's fair. Fair point.
Fair point. Adam,
thank you so much for your time today.
It was a pleasure talking to you
and looking forward to having
you back on the show in the future. Yeah, thank
You. Thanks so much.
(18:01):
Small internal audit teams boost your efficiency at the
2025 audit sphere.
This one day virtual conference on June 17th offers expert
strategies and practical tools just for you.
Register now@theiia.org.
If you like this podcast, please subscribe and rate us.
You can subscribe wherever you get your podcasts.
(18:24):
You can also catch other episodes on YouTube or@theiiaa.org.
That's T-H-E-I-I a.org.
Popular Podcasts
Crime Junkie
Does hearing about a true crime case always leave you scouring the internet for the truth behind the story? Dive into your next mystery with Crime Junkie. Every Monday, join your host Ashley Flowers as she unravels all the details of infamous and underreported true crime cases with her best friend Brit Prawat. From cold cases to missing persons and heroes in our community who seek justice, Crime Junkie is your destination for theories and stories you won’t hear anywhere else. Whether you're a seasoned true crime enthusiast or new to the genre, you'll find yourself on the edge of your seat awaiting a new episode every Monday. If you can never get enough true crime... Congratulations, you’ve found your people. Follow to join a community of Crime Junkies! Crime Junkie is presented by audiochuck Media Company.
24/7 News: The Latest
The latest news in 4 minutes updated every hour, every day.
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.