A Root Cause of Conflict in Audit

I had the same thinking early in my career, especially when I started working for an audit firm. It always felt like people wanted to stay a safe distance away from auditors. But as I progressed, gained exposure, interacted with senior management, and later worked closely with management in industry, I realized something important: Most conflicts between auditors and management aren’t personal. They arise because each party thinks in completely different directions.

According to audit standards and The IIA’s Three Lines Model, management is a first-line role. Managers are responsible for managing risks within their processes and keeping those risks within the organization’s risk appetite. However, when management fails to do so effectively, auditors, whether willingly or not, are obligated to highlight those gaps. Independence and objectivity do not allow auditors to overlook weaknesses that could impact stakeholders or the organization.

To board members, auditors provide assurance that any weakness in the first or second line will be communicated promptly so corrective action can be taken. And herein lies a major mindset difference:

• Management focuses on performance, goals, and operations.
• Auditors focus on independence, controls, and risk.

In simple terms, management views matters through an operational lens, while auditors see them through a compliance and risk lens. When these two perspectives do not align, conflict naturally emerges.

But one question recently crossed my mind: Is conflict only caused by differences in opinion?

The answer is no.

I came across a quote that stayed with me: “Only 10% of conflict is due to a difference in opinion; the other 90% is due to the tone and delivery of the message.”

This quote felt very real because I experienced something similar a few months ago.

A Real Conflict and an Unexpected Lesson

My team and I were discussing an audit report with a process owner. One major issue in the report was the absence of proper policies and procedures. This gap had been causing recurring inefficiencies and unclear accountability, so it became one of our key recommendations.

Before I could fully explain, the process owner quickly responded: “Why don’t you auditors prepare the policy and procedures? You understand internal controls and segregation of duties better than we do.”

I understood his reasoning, but the responsibility clearly belonged to the first line. My colleague replied almost instantly and very bluntly, and that changed the entire tone of the meeting. The discussion suddenly felt tense and confrontational. It became obvious that the problem wasn’t what was being said, but how it was being said.

Because the process was important, I met the process owner separately afterward to talk more calmly. During our conversation, I clarified a few things:

• Drafting the policy should start from him because it is his process.
• The audit team would fully support him by reviewing the draft and identifying any gaps.
• We could point out missing controls, segregation issues, or compliance weaknesses.
• Together, we could shape a strong, comprehensive policy but the ownership would stay with him.

Then I explained something he hadn’t considered: Improving the policy wouldn’t just fulfill an audit recommendation. It would make his daily operations smoother, reduce repeated mistakes, and bring clarity to accountability.

As soon as he understood the personal benefit, everything shifted. He agreed immediately. The tension disappeared not because of technical arguments, but because the conversation became softer, respectful, and solution‑focused.

What I Learned

That small incident taught me lessons that no training or textbook could:

• Never compromise independence or objectivity.
• A right message delivered the wrong way becomes a wrong message.
• When you show a process owner how the change benefits them, resistance weakens.
• Conflict becomes manageable when facts are paired with empathy.
• Auditors aren’t police; we’re partners who still maintain objectivity.

In the end, an internal auditor’s role is far bigger than pointing out issues. We identify risks, highlight weaknesses, and recommend practical measures that help the business achieve its goals. When auditors and management respect each other’s roles and collaborate effectively, not only does the process improve — the entire organization grows stronger. Conflict will always be part of the job. But resolving it requires one simple shift: Focus less on what you say, and more on how you say it.