Blogs Eslam Elsamani, CIA, CISA, ISO 27001 Lead Auditor Aug 06, 2026
Eslam shares four ways that building trust through empathy, storytelling, and cultural awareness — alongside technology — strengthens client relationships and drives more effective audits.
I still remember trying to arrange a meeting with a client’s finance department. Despite sending multiple emails, there was no response. Requests for data went unanswered.
The silence made it clear the business unit was not interested in engaging with internal audit. I could feel the tension before we had even exchanged greetings.
I think of that experience as I am building a new internal audit culture within the client’s organization. I recognize that early discussions can lay the groundwork for trust — the critical element for successful collaboration and change.
With all the talk about artificial intelligence and machine learning in internal auditing, human capital is still important. Being able to build trust and understand what makes people tick has changed the way I do things in four ways.
When I started my audit career, I used the old checklist-and-compliance method. It didn’t take long to realize this just made process owners defensive. Instead, I shifted my strategy by asking, “What is it that makes this process difficult to control?” It made all the difference.
For example, as we began working with the finance team, the department was eager to prevent our review emails from being disregarded or data from being withheld. Instead of starting with “Why has Finance failed to adopt the International Public Sector Accounting Standards (IPSAS),” I inquired about what obstacles the department faced.
This question changed the conversation entirely. The mandate had caught Finance off guard because it was already partway through a transition plan. It wasn't resistance, it was simply a matter of timing.
Spreadsheet after spreadsheet of failed controls can feel impersonal, but sharing stories of how risks impact real people makes the work meaningful and encourages teams to care more.
On paper, the IPSAS gap was a single line: “Finance noncompliant with the mandate.” It was a simple deficiency to be recorded and moved past. But the dynamic shifted once I explained what the gap meant: The team was blindsided by a deadline, mid-transition, and now exposed to blame for a timing problem it did not create. The finding stopped being an accusation and became the team’s opportunity to get ahead of the issue.
Assessing the underlying culture of processes is essential. I inquire about workload, targets, and pressures from leadership because these elements influence behavior. Understanding the cultural background helps me pinpoint fundamental problems and craft strategies that foster a more human-centered, trust-enhancing atmosphere, rather than merely addressing isolated process issues.
I’ve lost count of how often I’ve found that the real reason for a failure wasn’t laziness or forgetfulness, but pressure from above or a culture that rewards shortcuts. Sometimes, skipping a step is the only way staff can keep up. That’s why I’ve learned to ask people about their workload, the targets they are under, and what’s really going on. Only then do we have a chance to fix what matters.
Now that technology and automation handle the routine stuff, I spend less time crunching numbers and more time listening, observing, and having real conversations with audit clients. A dashboard can’t tell you who’s worried about a change or why trust is low in a department. That’s where I try to make a difference by being present, not just plugged in.
Being an internal auditor isn’t about going easy or ignoring tough facts. It’s about remembering that every policy and control has a person behind it. The best changes happen when I mix technical know-how with real empathy. That’s what earns trust, and that’s what moves organizations forward.