All Things Internal Audit: Stopping the 5:00 PM Response

00:00:02

The Institute of Internal Auditors presents all things internal audit in this episode, Mike Levy speaks with Adam Nethack about the challenges of late audit responses, what they call the dreaded 5:00 PM response. They discuss why audit clients, delay engagement, how to foster collaboration and practical strategies for improving responsiveness.

00:00:23

They discuss why audit clients delay engagement, how to foster collaboration and practical strategies for improving responsiveness.

00:00:32

Adam shares insights from his experience at Frontier Airlines offering real-world tactics to encourage earlier engagement and ensure smoother audits.

00:00:43

Hi everybody. My name is Mike Levy. I'm CEO of Cherry Hill advisory and the guest host today for the All Things Internal Audit Podcast. We're joined today by Adam Adam. If you don't mind, just introducing yourself to the audience.

00:00:52

Yeah, of course. My name is Adam Nafac. I am the senior manager of internal audit at Frontier Airlines, headquartered in Denver, Co, and it's good to be in some humidity.

00:01:01

For a little bit.

00:01:02

We have we have a really interesting topic today. The the 5:00 PM response encouraging earlier engagement and audit responses. So Adam, I have a lot of thoughts on this topic and I know you and I talked a little bit before the session, but I'd love to hear your thoughts. Yeah. What does the 5:00 PM response mean in the in the world of internal audit?

00:01:19

Yeah, it tends to mean that your evening gets changed. So that is the unfortunate side of.

00:01:24

What we do I throughout my career there have been multiple times we work with people who we try to engage with them early on.

00:01:33

And for whatever reason, they just aren't taking to it and they decide to provide us everything we need right when the bells ringing at 5:00 and it just throws everything for a loop.

00:01:44

I've experienced this more times than I can count.

00:01:46

And it's frustrating and I also don't think it's productive in the in the audit cycle, I sometimes I have to be honest. I sometimes wonder if it's because they want us to have less time to look at things so that we have less observations. I wonder if it's that I wonder if it's related to inefficiency in their process, where they're just not prioritizing. What do you think the cause of those things are?

00:02:04

I think a lot of times they just don't want us there and so they delay it as much as possible. And then they realize that, you know, we have a mandate we need to carry out and we want to engage with them. We want it to be a fruitful conversation, and we want things to go smoothly and be able to help them ultimately.

00:02:21

But sometimes it takes till 5:00 PM and the bell ringing for them to that to click. And I think that needs to change though ultimately.

00:02:28

What are you doing to navigate that with your customers? Do you find that it's different departments that are more trouble than others? Do you think it's something with relationships or how do you, how are you?

00:02:37

Navigating that internally, what I've found trends overall throughout my career is that if an individual has a background in the accounting or compliance space for the most part, they understand what we're doing.

00:02:48

And why we need to be there and overall the types of questions we ask the why behind it.

00:02:53

But I'll say that for groups that aren't as familiar with that or don't have that background or upbringing in their career for lack of a better word, it's most of the times it's a teaching moment for them, for them to learn what we're trying to do and how it's how we're trying to help them and help the organization. It's taking time. We're it's definitely a work in progress for throughout my career.

00:03:15

But ultimately, meeting people with.

00:03:16

Where they're at and understanding where they're coming from, why they do something a certain way, maybe it's because it's the way they've always done it or there's a policy that they've always followed and doesn't necessarily make sense nowadays, but most importantly to meeting them where they're at and understanding it to be able to have that dialogue and be able to build those relationships.

00:03:36

Yeah, I've. I've found that to your point, there's a huge distinction between folks that have been auditors in the past or in served in some kind of compliance role where they have to request things commonly, yeah. And their timeliness to.

00:03:47

Months. And then folks that haven't, and to your point, the only way I've been successful, there's some tactics and I'm sure we can talk about here that I've that I've seen. And I'm sure you have too, but ultimately the only real remedy is our ability to develop those relationships with our customers. And if they like need to say, but if they like you and they feel like they have a collegial environment, it's sometimes more of that than the actual importance of your audit request that's driving the responsiveness.

00:04:07

Ohh for sure.

00:04:09

How are you encouraging your team and even yourself as you're going through some of these, you pick up a relatively difficult audit. We're not getting timely responses. What are some of the things you're often doing to try to make that better?

00:04:19

Yeah.

00:04:20

Well, I'll say that early in my career, I learned I learned from a few mentors that.

00:04:26

To approach audit as new surprises. So you're there to have constant, constant and open communication with them so that if something does come up, they're not taken back by it or it's brought up late in the game, it's brought up as the audits occurring so that they don't feel as it's a gotcha or we're out to get you type situation. So communicating that upfront.

00:04:46

When you, you know, first make the introduction of, hey, this is who we are. We're internal audit. This is why we're performing this engagement and we want you to know that we're not here to to necessarily write up problems and other things like that. We're really here to help understand what's going on and help point out areas that can be.

00:05:04

Improved not just because it costs money even, but because it can make your lives easier, right?

00:05:10

I don't know how many times I've said in a in the middle of an audit that we're not the we're not the police. I feel like I'm just constantly reminding people of that and it's unfortunate, but.

00:05:14

Oh yeah.

00:05:18

It's a fact of life, unfortunately.

00:05:20

Yeah, it's part of it. But you know what? I think I've found that once you engage with them and have show that you have your person and you do you work for the same company, right? You're not there to find the problem.

00:05:32

Things and make them feel bad, or so on and so forth, like you ultimately do want the the company to do well and you're giving information to leadership so they're able to.

00:05:42

Do that. Do you have any ideas for auditors that are listening maybe that are thinking about this is a constant problem that they're they're often experiencing. You know, how do you position yourself as more of the partner rather than the police or the enforcer in the organization? Is there, is there anything that they can do on a daily basis?

00:05:56

Try to make that better internally.

00:05:58

Yeah, I I you know it's it's taken time, right. Just going from different industries to you know I'm currently in the airline sector and before that I went into I started out in.

00:06:08

Public and that has their own perception. And then, you know, go to internal audit for ticketing and entertainment company that has its own set of challenges. I've found it's really getting to know that it's really getting to know what makes them tick. Some people are very results driven. Some people just want to know, tell me what you need. I'm going to give it to you.

00:06:29

Because they want you out of your hair and some people ask the why and I have found that when people ask the why behind it, it makes me a better auditor as well because I'm I'm explaining to them why we're doing what we're doing and what we're attempting to achieve.

00:06:44

And you know, I always do this comparison back to when I was a kid, right? My mom always told me when I asked her why do I need to eat broccoli? And she said because I said so. That was never a good answer for me. And so as I've progressed in my career, when you talk to someone, you can't just say the reason you need to do it is because I said so that doesn't get.

00:07:03

Buying from that?

00:07:05

So I'd say if you are doing.

00:07:06

That stop that immediately.

00:07:07

I wish that was effective, but to your point, you.

00:07:11

I like the broccoli analogy. It doesn't. It does not work if you just say because I said so. I mean it's the, it's the, the proverbial big stick approach, I think is what we're talking about. It just it can be effective on certain sporadic things, but it's really not the right way.

00:07:14

Yeah.

00:07:23

To.

00:07:24

Adopt A culture of trust and transparency within your organization.

00:07:28

Yeah, unless you want people to walk away as soon as you walk in the room to get water. So.

00:07:32

I you know, I did as an aside. I mean, it's one of the barometers for me in terms of whether in terms of whether a department is functioning well or not, it's a how many requests are management? Are they coming? Are they seeking you out or do you have to go find them and that also I think that really does to your point, dovetail into requests and the 5:00 PM responses and making sure that we have.

00:07:49

Lots of this as a leader in your department. To me, culture is so important. Talk to me about how you're instilling that culture in teams and in the company because I think that downstream trickle impact to any staff that are working on audits and making sure that they're not just auditing behind a keyboard for example and working with management to develop some of those relationships you're talking about is critically.

00:08:11

Yeah. And I mean, if we think about it, the world's changed so much since COVID, right. It used to be that you have to, you almost have to walk up to someone to have a conversation or engage. But you know, especially as the younger generation enters the workforce, it's it's not the traditional route of you're always in face to face in front of someone. There's a lot of hybrid and.

00:08:31

Remote work styles and you have to be able to develop that relationship and a different approach. One thing that we do that we've done and throughout my career is.

00:08:40

Trying to get the buy in of stakeholders by showing them that we that we want to help, right? So approaching them and trying to figure out what are they doing currently like understanding what they're doing and be able to articulate that back right because I I received some again from another great mentor received some words of wisdom that internal audit.

00:09:01

Should.

00:09:01

And mirror, right? So we are not identifying anything that's new or a blemish that doesn't exist. It's just being brought to your attention that it does exist. And I found that it's most effective when you have that dialogue to understand why someone doing something a certain way. Maybe it's because they that's just how they were trained. Maybe it's because.

00:09:22

A the risks were different a few years ago. Maybe it's an outdated policy. Who knows what it is. But if you don't start at a state of trying to understand where someone's coming from, they're not going to want to engage with you, and they're not going to want to hear what you have to say.

00:09:35

I think that's critically important and to your point, making sure that the teams are engaged in that and they they see the value too. And it's not just, you know, it's a that it's a truly a top down approach. I think that does go a long way. So getting into the more tactical cuz I know if I was, if I was listening to this and I was thinking about this, we've talked a lot about the whys behind it and the relational side of it, but tactically.

00:09:56

I'm sure you know I'm, and I'd love to hear any examples that you may have had, but I'm sure you've had experiences where these kinds of delays have negatively impacted an audit. Do you have any where you've had any really significant impacts to an audit and the whys behind that we can talk about some of the?

00:10:08

Tactical solutions on the proactive basis.

00:10:10

Yeah, so I mean.

00:10:12

Throughout, you know I have a few throughout my career, you know, the one that comes to.

00:10:16

Mind.

00:10:17

Quickest is there was a point in an engagement where we were trying to wrap up and there were, you know, random pieces of documentation that we're missing and it's been on the open items list for, you know, weeks at that point. And we've been trying to get in front of.

00:10:32

Stakeholders for them to understand what we're asking for. It was clearly it was clearly articulated what we needed and they just weren't providing the information.

00:10:43

And we weren't sure why they were doing that or why they weren't doing it, but we ultimately had to write up the audit report because we're coming up against the deadline and we presented to them what our findings were. We obviously need to confirm what you've identified. And they said, oh, that's inaccurate because we have XY and Z and we're sitting there thinking, you know why.

00:11:03

We're in our heads. Like, why didn't we have this conversation earlier? Right, because we've talked about what we need and and we've tried to be as open and available as possible, and you're just.

00:11:14

Not engaging, so definitely learning opportunities with it. And we had conversations after the fact and it came out to be just a resource constraint on there, which we all understand we we definitely get that. But having the conversation earlier upfront about hey, if you're constrained at these times of the month or with these areas or you just don't have the background.

00:11:35

With it or the information, let's talk about.

00:11:36

That earlier so we're not, you know, writing up an audit report that's going to.

00:11:41

Be presented to to me, and I think that's that's all very well, very well said and articulated to me, if I'm walking away with like 2 tactical things that I've seen be very effective is you know one have the 5:00 thing does tend to happen and it's like a lot of times it is resource constrained sometimes it's.

00:11:56

Dislike for someone looking over your shoulder from an audit perspective, and that perception that exists there. But sometimes, like in a very tactical sense, if you can't get past that from a relational perspective in your.

00:12:06

You're getting there. You get to the deadline. One of the things I've done is you set up a meeting with them for 3:00 before that 5:00 deadline. Somehow, magically, before that 3:00 meeting, the request seemed to trickle in. So to me, that becomes like a really tactical, effective way to do it. And then the other thing I found is a lot of times where we have this happen, and especially it slows things down. That's one of my biggest pet peeves and frustrations is in the reporting.

00:12:27

Cycle because you're trying to get an audit report out the door. You have to get managements feedback. You have to get by and and it just takes so long to get through reporting that sometimes your reporting phase takes longer than the actual field work itself. And to me that's hugely frustrating. So I think that.

00:12:34

Right.

00:12:41

When you look at your reporting cycles, sometimes if I look at root cause of why that's happened, it's because management hadn't seen those observations before. They hadn't seen them in that format before, and it's and effectively what they're saying by not responding timely is that they were surprised by them. They're figuring out how to respond in a way that's meaningful. So I'd love to hear some of your tactical suggestions there. But I mean for me.

00:13:01

Bringing that stuff forward into the field work cycle sometimes does go a long way and help, and that's that becomes really important.

00:13:08

Right. Yeah. No, I totally agree with that. There's many occasions where unfortunately it doesn't seem to click for the people we're working with until it's actually written down that, hey, this is this is what we actually found. And because you can't.

00:13:20

Prove otherwise to us. This is what we're going to have to report and say. Oh, no, wait a minute. Let's give us another week. We're able to find something and they are. And that's great because we don't want to report something. That's inaccurate, obviously, but a lot of times we we try to go back after the after the engagement and do a feedback session and understand was the communication.

00:13:41

Clearing our end that, you know, were we not understanding it correctly and a lot of times it comes down to a communications standpoint and I'd say that we.

00:13:48

You know, a lot of times when we work with different people in the organization, we try to understand how they best communicate what their communication style. Do they like to know up front at the beginning. This is what we need and not the why behind and it just.

00:14:03

Just takes time. It takes time and takes attention.

00:14:06

It's such a finesse to your point, because you don't want to over communicate to the point where they feel annoyed or bugged about it, but you have to. You sometimes have to get to a point where you.

00:14:14

Showed them some of these things in advance and that they've gotten that they're not. They're not surprised to this extent that it takes.

00:14:19

Them weeks to to respond.

00:14:21

Yeah. And on top of that, I mean, they have their day-to-day job to do, right, we're.

00:14:24

We're coming in and we're not attempting to slow it down, but it does because they have to pause what they're executed to do in order to fulfill what we need. So being aware of that even is helpful.

00:14:36

What are your feelings on escalations with management? Because I've seen that done as well, where if someone doesn't respond and eventually gets escalated to their supervisor, when is an escalation?

00:14:45

Appropriate when is it not appropriate? How do you feel about that from a relationship management perspective and things like that?

00:14:50

I mean it it kind of.

00:14:52

Puts fire or a big flame to a relationship that either you have or you're trying to build.

00:14:57

Because.

00:14:57

That person, the two people in this relationship, this professional relationship, are not doing what they need to do. So you're having to bring it to someones higher attention in order to encourage them or push them to do it. I don't.

00:15:11

Like to do that, unless it's definitely necessary and they're times that it certainly is. But it's also understanding again where people coming from, right, if they're in the middle of a closed period or something and it's our responsibility or our shortcoming that we didn't request this earlier and we're giving them 48 hours.

00:15:30

During that time frame that they're swamped like that's a little bit on us. So before raising it up the flagpole, there needs to not to use too many audit terms, but there needs to be some type of root cause analysis is that they don't understand. Is it the resource constraints, is it our communication style, what what, what is the actual?

00:15:47

Problem one of the things I've done in that realm because I agree with you.

00:15:51

Has it I always hesitate about the escalation side, because I think if done incorrectly, it can be damaging to the long term relationship and so many times when we're doing an audit and we're trying to get requests. If you get back to the the why we're doing all this, it's to improve the organization and damaging a relationship unless it is a.

00:16:06

Critical higher risk, showstopper type of observation. It's not always worth it. One of the things I sometimes have done in the past is if you establish the parameters for how you're reporting status within your audit early on that you can effectively send a status report to that person supervisor just as part of the normal course of process, and let that person writers see that we're delayed and we're behind schedule and the why is right on that document.

00:16:29

So it does go to them and it's still getting escalated, but it's not an escalation because of this person doing something. It's just sort of normal course. Part of the process.

00:16:34

Part of your procedure, yeah.

00:16:36

So I've seen that as an effective way without being as damaging to the relationship, but to your point you have to be so careful with how you do escalation so that it is getting to the bigger picture issues that.

00:16:45

You're trying.

00:16:45

To get to, yeah. Absolutely. Any other thoughts or topics as it relates to how we can improve that process, you know, improve the process or giving our listeners other tactical things that they can do to try to speed up response times?

00:16:56

Management.

00:16:56

I would say it's very much to me. I found to be a very proactive game as opposed to reactive really getting to know the people for who they are and what their, what, their roles and responsibilities are, rather than walking in after the fact. Just because you have a mandate, this is what I need to do educating your.

00:17:15

Your organization formally and informally about why you're there. You're not there to just necessarily check a box and come up with a list of names. I mean, no one. No one wants to work with that, and that's not what we want to do either. So building those relationships and providing and communicating what value we can add and do add.

00:17:34

And have examples and be humble with feedback.

00:17:38

I found that's the best way to get your foot in the door and for people to answer before 4:59 and 5:00 PM.

00:17:45

I would take a 459 response over a 5:00 PM response. If I'm being honest.

00:17:47

Ohh I don't know about that, it's still delaying my night so.

00:17:50

That's fair. Fairpoint, Fairpoint, Adam, thank you so much for your time today. It was a pleasure talking to you and looking forward to having you back on the show in the future.

00:17:57

Yeah. Thank you. Thanks.

00:18:01

Small internal audit teams boost your efficiency at the 2025 audit sphere. This one day virtual conference on June 17th offers expert strategies and practical tools just for you. Register now at the dia.org.

00:18:18

If you like this podcast, please subscribe and rate US. You can subscribe wherever you get your podcasts. You can also catch other episodes on YouTube or at the iaa.org that's theia.org.