There are quite a few articles and blog posts that bemoan the situation where management fails to implement the recommendations in the audit report.
One example that merits our attention is by Richard Chambers, Whose Risk Is It, Anyway? When Management Says ‘No’ to Internal Audit.
I believe there is a fundamental problem that is simply not being addressed.
That problem is that auditors believe that one of the reasons for writing a report is to persuade management to take action,
Sorry, that is not realistic.
People are rarely persuaded to act differently by a report.
It is far better to talk to management, agree on the facts, and then see if you can agree on the severity of the situation. Only then, work as a trusted partner with management to agree on the corrective actions that are right for the organization.
The auditor needs to listen respectfully to management – something that many auditors do poorly if at all.
Don’t issue a report, even in draft, until after the auditor has had a meaningful discussion with management.
If there is disagreement on the facts, the auditor should understand why. It may be necessary to do more work.
If there is disagreement on the severity of the situation, the auditor needs to ask why management disagrees. What is their assessment and why?
The auditor needs to listen…
