The Audit Report discussion gets entirely out of hand! The auditees are simply not convinced with your audit findings. The unit manager and two of his assistance surrounded you. They disagree with your risk assessment. The meeting is simply an argument session instead of an audit report discussion. Your evidence is being counter attacked. They claim that your audit report is entirely rubbish and does not add any value what so ever. You began to think what should I do?

Poor Joe...
Judging by your last 3 posts you are having a rough day (or week, or year). Keep your chin up. At least it's Friday!

When you can't run and you can't fight - flow.

All you can do is present the facts as you see them and ask for a response, in writing. You may not have considered everything, but the auditees have an open opportunity to respond, so you've done your job.

Report findings and response to Audit Committee and Audit Committe resolves dispute. Just make sure Audit Committee decision is documented in the minutes of the meeting.

And don't take it personally.

I agree with Donna Banker. Document your findings, including management's response/disagreement, and report it to your Board or Audit committee. My Audit Committee has only had to decide one dispute between me and management, but we were all agreeable in the end. Joe, I hope it works out for you.

Every conflict warrants some self-inspection, though. I always try to look first at my actions, the wording of my report, etc. to see where improvements can be made. After you've done that - then report to the audit committee and you have a clear conscience.

Joe,
I have walked a mile in your shoes lately. My audit department recently conducted an audit overRESPA's escrow account analysis requirements. We ended up finding 6 Techincal violations. The meeting with management was very tense and argumentative and the response to the report stated that they went back and reviewed the six accounts and that they were computed properly.

The sad thing is that we still have six accounts where the initial and annual disclosures were not prepared in accordance with the required accounting method as dictated by RESPA. Instead of allowing us to help them, they chose to see this as a "we gotcha", which is never the way we want to come across. In the end the ultimate decision will be up to the examiners when they come in.

Sometimes it does become very discouraging when the audit department is deemed a "Necessary evil" instead of one of the team. I certainly understand your frustration.

Joe,

I too have walked a mile in your shoes. I audited the Mortgage loan department in March. Management had 30 days to respond to my findings... on day 29 mgmt responded that my findings were BS and unfounded. I too went back and read the regs and backed every single exception with direct verbiage from the regulation as well as spoke with the ABA and even pulled past FDIC exams...Thinking I had won I left on maternity leave..I came back after 4 weeks and still had not received corrected responses. I spoke to management again and was told that I was young, had not ever worked in Loans before and there was no way I could be right due to the age and education despite the fact that FDIC had written us up on the same types of exceptions. I decided I would let the audit committee figure this one out.

The audit committee determined that the bank Pres. would make the determination on who was right and wrong....It took about a month for me to explain the reg's to the Pres. so she could make an educated decision...Nonetheless Loan management recieved a memo from the President, who in the end sided with me...Let's just say we had one very unhappy loan officer.

The final responses are going to the audit committee this month (5 months later)


Let it go, Louie!

I never say "so and so didn't do this or that"; I always say that the "procedures or controls need to be in compliance with" and quote the reg, policy, past examiner findings, outside CPA reports, or whatever, and say that I recommend that more training be held, etc. I never point the finger at any one but point the finger at the procedures or controls. I've never (knock wood) had an argument about findings.

As long as you document why you have a finding in your report (quote regs, etc.) then you have covered yourself. If the Audit Committee, President, or whomever decides not to follow your recommendation there is nothing you can do. But when your regulator asks you if there is anything going on that you need to discuss, you can certainly direct them to your report and workpapers for this particular audit. Works like a charm.

As an "auditee", can I make a recommendation? When quoting regs in your report, be sure you're accurate. I've been written up for reg. violations that weren't actually violations - they were procedural opinions of the auditor that were presented as violations. It' very helpful to make the report clear as to what are true violations and what are suggestions to improve procedures/controls.

I agree with Tenacious. Get their response on paper. Stick to your guns. You've done your research and feel you are right. Leave it to the Audit Committee & the examiners to decide. (having a "cold one" after work may help relieve pressure!) I've been in your shoes many times during my 25 years in banking. My heart goes out to you.

Having run the IT Ops for a regional bank for a number of years, I was regularly audited by internal, external, Fed, State, insurance, due diligence teams, etc. It was my ~intrinsic~ duty (whether motivated by pride or just to test the knowledge and credentials of the auditor) to question and challenge every finding in every audit report.

Ultimately, I think it came down to "if you are competent to criticize my operation, you had better know what you are talking about".

Now that I'm an IT/InfoSec auditor and the shoe is on the other foot, I expect to be challenged before any work begins. As a result, I better prepare myself and I'm not surprised when the inevitable happens.

-g

Thank you all for your input. The key is to be well prepared i.e. well documented working paper and to expect to be challenged. Also good communication plays a big role and keeping good relation with management.

I agree, you have to expect an argument after an audit report is issued. Everyone always gets defensive and thinks it is a personal attack. In my company, we are also just an expense, something the examiners made them have.

Difficult situation. Assuming you did a thorough job of planning and scoping the engagement and performing and documenting the audit, and you are focusing on items of real risk, then its best to try and limit the discussion to a review of the facts. This is what we found? Do you agree or disagree that this is "factually" correct? Does it reflect the operations of your business unit correctly? Is there other evidentiary material the auditee believes you should have looked at? If your dealing with facts...it takes some of the emotion out of it. If your arguing your opinions with them....you may neve when. It has become almost purely emotional. At the end of the day, your opinions are your opinions. Your recommendations are based on your evaluation of the facts and the relevant risk and exposure to the Bank. If they choose to disagree with your recommendations....or your comments....they should be prepared to do so with facts...such as transaction volumes, loss rates, examples of other mitigating controls and procedures that they currently perform, etc. Otherwise, it is your obligation to report what you find and make your best effort to recommend steps to mitigate what you see as unreasonable risk. They can dispute it in writing and ultimately, the Audit Committee and management will decide what is to be done.