Resolving Disagreements with Management: A Complete CIA Exam Guide
Overview
Disagreements between internal auditors and management are a normal part of an engagement. Management may dispute a finding, question how significant it is, reject a recommendation, or propose a weaker action plan. How the internal audit function handles these situations is a recurring exam topic. It tests professional judgment, objectivity, communication, and escalation under the IIA's Global Internal Audit Standards (and the earlier IPPF Standards 2400 to 2600).
Why It Is Important
1. It protects objectivity and integrity. Internal auditors must not water down or remove a valid finding just because management objects. Giving in to pressure would weaken the credibility of internal audit.
2. It ensures accurate reporting. Management often has context the auditor lacks. Listening may show that a finding is wrong, incomplete, or overstated, which improves the report.
3. It gives the board a full picture. The board and senior management depend on internal audit for reliable information about governance, risk, and control. Unresolved disputes about significant risk must reach the right level.
4. It preserves the working relationship. Handling disputes respectfully keeps internal audit seen as a trusted advisor rather than an adversary.
5. It supports accountability for risk. Management owns risk. If management accepts a risk instead of fixing it, that decision must be transparent and approved at the right level.
What It Is
Resolving disagreements with management is the structured process internal auditors use when management does not agree with:
• The facts or conditions identified (the criteria, condition, cause, or effect)
• The significance or rating of a finding
• The conclusions or overall engagement opinion
• The recommendations, or the adequacy and timing of management's action plans
Key principles from the Standards:
• Internal auditors discuss findings, recommendations, and action plans with management before issuing the final communication. Typical forums are the exit or closing meeting and the review of a draft report.
• If disagreement remains, the final communication may state both the internal auditor's position and management's position, with the reasons for each.
• Management is responsible for deciding how to address risk. Internal audit recommends; it does not impose or implement.
• If the chief audit executive (CAE) concludes that management has accepted a level of risk that exceeds the organization's risk appetite or tolerance, the CAE must discuss it with senior management. If it is still unresolved, the CAE must communicate it to the board. This is GIAS Standard 11.5, formerly Standard 2600, Communicating the Acceptance of Risks.
How It Works: The Typical Process
Step 1: Communicate findings early. Share preliminary observations with the process owner during fieldwork, so there are no surprises at the end. Many disagreements are prevented this way.
Step 2: Hold the exit (closing) meeting. Present the findings, criteria, evidence, root cause, impact, and recommendations. Invite management to respond.
Step 3: Listen and understand management's position. Ask why management disagrees. Common reasons include:
• New information
• A different reading of the criteria
• Compensating controls
• Cost-benefit concerns
• Defensiveness
Step 4: Re-evaluate the evidence objectively. If management gives credible new evidence, the auditor should do additional work if needed and revise the finding. If the evidence still supports the finding, the auditor keeps it. Being objective means being open to correction but not giving in to pressure.
Step 5: Seek agreement on facts first. Agreeing on facts is often possible even when parties disagree on significance or remedy. Separating the two narrows the dispute.
Step 6: Negotiate the action plan. Management may propose an alternative fix. It is acceptable if it adequately addresses the root cause and risk. The auditor's recommendation does not have to be adopted word for word.
Step 7: Document the disagreement. Record both positions, the evidence, and the discussions in the engagement workpapers.
Step 8: Report both views. Where disagreement continues, the final report can present the auditor's finding along with management's response and reasons. This keeps the report transparent and fair.
Step 9: Escalate when necessary. The CAE takes significant unresolved matters to senior management. If the matter involves unacceptable risk acceptance and remains unresolved, the CAE takes it to the board.
Step 10: Monitor. Follow up on agreed action plans. Also track any risks that management accepted.
Common Scenarios
• Management disputes facts: Verify the evidence and correct any errors. If the facts are accurate, maintain the finding.
• Management agrees with the facts but disputes the rating: Explain the rating methodology. If disagreement remains, report both views.
• Management refuses to act: Treat it as risk acceptance. Assess the risk against the organization's appetite and escalate if it exceeds tolerance.
• Management pressures auditors to delete a finding: Do not remove a supported finding. This is an objectivity issue, and the CAE may need to get involved.
• Management offers an alternative solution: Accept it if it adequately mitigates the risk.
Exam Tips: Answering Questions on Resolving Disagreements with Management
1. Discuss first, escalate later. The best first step is almost always to discuss the matter with management, understand their reasons, and review the evidence. Answers that jump straight to the board or the audit committee are usually wrong as a first action.
2. Look for the 'include both positions' answer. When the question says agreement cannot be reached, the correct choice usually puts the auditor's conclusion and management's view, with reasons, in the final communication.
3. Reject answers that compromise objectivity. Be wary of options that delete the finding, soften it without new evidence, or delay the report indefinitely to avoid conflict.
4. Reject answers that override management's authority. Internal audit does not force management to adopt recommendations. It does not implement fixes itself or take on management's decisions. Management owns risk.
5. Know the risk-acceptance escalation path. The sequence is: CAE concludes the accepted risk is unacceptable, then discusses with senior management, then, if still unresolved, communicates to the board. The CAE's role is to communicate, not to resolve the matter personally.
6. Distinguish new evidence from pressure. If management provides valid new information, revising the finding is correct and shows objectivity. If management simply objects, the finding stands.
7. Remember that documentation matters. Workpapers should record the disagreement, the evidence, and how it was handled.
8. Watch key words. 'Most appropriate,' 'first,' and 'best' signal the need for proper sequencing. 'Unresolved' or 'cannot agree' points toward reporting both views or escalating.
9. Accept reasonable alternative action plans. If management's alternative addresses the root cause and the risk, accepting it is usually correct. Insisting on the auditor's exact wording is not.
10. Keep follow-up in mind. After the report is issued, the auditor monitors action plans and any accepted risks. Monitoring is part of the engagement results and monitoring domain.
Quick Memory Aid: L.E.A.D.
• Listen to management's position
• Evaluate the evidence objectively
• Agree on what you can, and document both views where you cannot
• Direct unresolved significant risk upward (to senior management, then the board)
Summary
Resolving disagreements with management means balancing openness with independence. Auditors communicate early and listen carefully. They change findings only on the basis of evidence and report both perspectives when consensus fails. The CAE escalates unacceptable risk acceptance to senior management and then the board. On the exam, choose answers that are objective, properly sequenced, and transparent, and that respect management's ownership of risk.
