Working with your external auditor without losing weeks

Auditors are not adversaries, and treating fieldwork as a negotiation is what makes it slow. Their job is to test whether your controls operated and to document what they find. The delays almost always come from how evidence moves between you - not from disagreement about the controls themselves.

Agree the ground rules before fieldwork

• Scope in writing - which entities, systems, criteria and period.
• The PBC list ("prepared by client") - everything they will ask for, ideally before the window closes so you can prepare rather than react.
• One channel for requests and responses. Email threads across five people is how items get lost and re-requested.
• Turnaround expectations in both directions, including how quickly they will confirm an item is satisfied.
• Named contacts on each side, with deputies.

Run a single request queue

The highest-leverage change most teams can make. Every request gets an id, an owner, a due date and a status. It gives you three things immediately: nothing is lost, you can see where you are blocked, and at the end you have a record of how long each side took - which is useful when the auditor's report mentions delays.

Log the time each request was received and fulfilled. Teams that do this discover their real bottleneck is usually one or two control owners, not the volume of requests.

Give scoped access rather than sending files

Emailing evidence creates version confusion, security exposure and a lot of re-requests. Providing the auditor read-only access to a scoped workspace - the controls in scope, their linked evidence, and nothing else - lets them self-serve most of the PBC list. Requests then narrow to genuine questions instead of retrieval.

Interviews

• Send the actual control owner, not a manager who will describe the control second-hand.
• Brief them: what they do, how often, and where the record lives. Nothing more elaborate is needed.
• Have the coordinator present to capture follow-up requests.
• Answer the question asked. Volunteering adjacent detail opens new lines of enquiry into systems that were not in scope.
• "I will confirm and come back within the hour" is a good answer. A guess that turns out wrong becomes a finding.

Handling findings

1. Ask for potential findings early, during fieldwork. Supplying clarifying evidence before the report is drafted is far easier than contesting it afterwards.
2. Separate factual errors from judgements. Challenge facts with evidence; arguing with a judgement rarely succeeds.
3. Agree remediation dates you can meet. Optimistic dates you miss are worse than realistic ones.
4. Fix root causes. Auditors return and check whether the cause was addressed, not just the sampled instance.
5. Feed findings into your risk register and next internal audit plan.

Between audits

The relationship is easier when it is continuous. Tell your auditor about material changes - a new system, an acquisition, a significant incident - as they happen rather than in the next kickoff meeting. Surprises during fieldwork cost time for both sides, and a change disclosed early is routine where the same change discovered late looks like concealment.

Key takeaways

• Get the PBC list early and run one tracked request queue.
• Scoped read-only access beats emailing evidence.
• Send real control owners to interviews, briefed but not scripted.
• Ask for potential findings during fieldwork, not after.