There is a deeply embedded assumption in most technology organisations that auditors are adversaries — people who show up, ask difficult questions, produce long reports full of findings, and generate remediation work that nobody budgeted for. The goal, in this frame, is to survive the audit: answer what's asked, offer nothing extra, close the findings, and hope the next one is a long way away.
I'd like to suggest a different frame entirely.
What Auditors Actually Are
Internal and external auditors are, at their core, a free risk assessment. They are independent — which means they will surface things that internal teams are too close to, too comfortable with, or too invested in to see clearly. They have pattern recognition from dozens of other organisations. And they are motivated to find problems, which means they will find the problems you haven't found yet.
For a CIO, that is extraordinarily valuable. Technology organisations accumulate risk. Security vulnerabilities. Control gaps. Technical debt. Process failures. The question isn't whether your IT organisation has risk — it's whether you know about it before something goes wrong, or after.
The Shift in Mindset
The CIOs I know who have the best relationships with their audit functions all share a common approach: they treat the audit as a tool for their own agenda.
If you want to make a case for additional security investment, an audit finding is evidence. If you want to get a legacy system decommissioned, an audit finding is leverage. If you want to accelerate a controls project that's been deprioritised, an audit finding is the business case.
This only works if you're actually running a tight operation — if the audit findings are about real risks and not about your IT organisation failing to do basic things. But if you're doing your job well, there will always be real risks that external eyes surface better than internal ones, and those findings become your allies.
Building the Relationship
Practical things that have worked for me:
- Brief the audit team before they start. Don't wait to be called in. Go to them at the beginning of an audit cycle and tell them where you think the risks are. This demonstrates confidence, shapes the scope in a useful direction, and builds credibility.
- Provide context, not defensiveness. When findings come out, the instinct is to explain why the finding isn't as bad as it looks. Resist this. Acknowledge the finding, explain the context, and present a credible remediation plan. Auditors respond well to people who take their findings seriously.
- Follow through completely. Nothing damages your relationship with internal audit faster than repeated open findings. If you commit to a remediation timeline, hit it. If something changes, communicate early.
- Treat them as a resource, not an adversary. I've called internal audit for informal advice before a major technology programme. "What do you think the control risk is here?" They almost always have a useful perspective, and asking demonstrates the kind of partnership that pays back.
The External Audit Dimension
With external auditors — particularly in publicly listed or heavily regulated organisations — the dynamic is slightly different. The relationship is more formal and the stakes are higher. But the principle is the same: proactive engagement, transparency, and treating their work as a quality check you want rather than an intrusion you're managing.
The CIOs who struggle with external audits are usually the ones whose technology controls aren't where they need to be and who know it. The ones who do well have solid control frameworks, can evidence them clearly, and approach the audit process with confidence rather than anxiety.
If you're dreading your next audit, that's information. The question worth asking is: what are you worried they'll find?
A Final Thought
The best technology organisations I've seen are the ones where IT and internal audit have a genuine partnership — where findings are surfaced and closed quickly, where the audit team is treated as a trusted voice on risk, and where CIOs and audit directors talk regularly without an audit in progress.
It's not a natural relationship. But it's one worth investing in.
