Stopping the 5:00 PM Response

The Institute of Internal Auditors presents all things internal audit. In this episode, Mike Levy speaks with Adam Neac about the challenges of late audit responses, what they call the dreaded 5:00 PM response. They discuss why audit clients delay engagement, how to foster collaboration and practical strategies for improving responsiveness. They discuss why audit clients delay engagement at a foster collaboration and practical strategies for improving responsiveness.

Adam shares insights from his experience at Frontier Airlines, offering real world tactics to encourage earlier engagement and ensure smoother audits. Hi everybody. My name's Mike Levy.

I'm CEO of Cherry Hill Advisory, and the guest host today for the All Things Internal Audit podcast. We're joined today by Adam. Adam, if you don't mind just introducing yourself to the audience. Yeah, Of course. Uh, my name is Adam Neac. I am the senior manager of internal audit at Frontier Airlines, headquartered in Denver, Colorado. And it's, uh, good to be in some humidity for a little bit.

Amen. We have, we have a really interesting topic today, the, the 5:00 PM response, encouraging earlier engagement and audit responses. So, Adam, I have a lot of thoughts on this topic, and I know you and I talked a little bit before the session, but I'd love to hear your thoughts. You know, what does the 5:00 PM response mean in the, in the world of internal audit? Yeah. It tends to mean that your, uh, evening gets changed. So that is the unfortunate side of what we do.

Um, I, throughout my career, there have been multiple times we work with people who, um, we try to engage with them early on, um, and for whatever reason, they just aren't taking to it, and they decide to provide us everything we need right when the bell's ringing at five o'clock. Um, and it just throws everything for a loop. I've experienced this more times than I can count, and it's frustrating. And I also don't think it's productive in the, in the audit cycle.

I sometimes, I have to be honest, I sometimes wonder if it's because they want us to have less time to look at things so that we have less observations. I wonder if it's that, I wonder if it's related to inefficiency in their process where they're just not prioritizing. What do you think the cause of those things are?

I think a lot of times they just don't want us there, and so they delay it as much as possible and then they realize that, you know, we have a mandate we need to carry out and, um, we want to engage with them. We want it to be a fruitful conversation, and, um, we want things to go smoothly and be able to help them ultimately. But sometimes it takes till 5:00 PM and the bell ringing for them to that to click.

And I think that needs to change, though. Ultimately, What are you doing to navigate that with your customers?

Do you find that it's different departments that are more trouble than others? Do you think it's something with relationships or how do you, how are you navigating that internally? What I've found trends overall throughout my career is that if an individual has a background in the accounting or compliance space, for the most part, they understand what we're doing and why we need to be there. And o overall the types of questions we ask, the why behind it.

But I'll say that for groups that aren't as familiar with that or don't have that background or upbringing in their career, career, for lack of better word, um, it's most of the times it's a teaching moment for them, um, for them to learn what we're trying to do and how it's, how we're trying to help them and help the organization. Um, it's taken time we're, it's definitely a work in progress for throughout my career.

Um, but ultimately meeting people with where they're at, um, and understanding where they're coming from, why they do something a certain way, um, maybe it's because it's the way they've always done it or there's a policy that they've always followed and doesn't necessarily make sense nowadays, but most importantly, it's meeting them where they're at and understanding it, um, to be able to have that dialogue and be able to, um, build those relationships. Yeah.

I found that to your point, there's a huge distinction

between folks that have been auditors in the past or in served in some kind of compliance role where they have to request things commonly Yeah. And their timeliness to response and then folks that haven't. And to your point, the only way I've been successful, there's some tactics that I'm sure we can talk about here that I've, that I've seen, and I'm sure you have too. But ultimately, the only real remedy is our ability to develop those relationships with our customers.

And if they like, hate to say it, but if they like you and they feel like they have a collegial environment, it's sometimes more that than the actual importance of your audit request that Sure. That's driving the responsiveness. How are you encouraging your team and even yourself as you're going through some of these and you pick up a relatively difficult audit where you're not getting timely responses, what are some of the things you're often doing to try to make that better?

Yeah. Uh, well, I'll say that early in my career I learned, um, I learned from a few mentors that to approach audit as new surprises. So you're there to have constant, um, constant open communication with them so that if something does come up, they're not taken back by it or it's brought up late in the game, um, it's brought up as the audit's occurring so that they don't feel as it's a gotcha or we're out to get you type situation.

Um, so communicating that upfront when you, you know, first make the introduction of, Hey, this is who we are, we're internal audit, this is, uh, why we're performing this engagement, and we want you to know that we're not here to, to necessarily write up problems and other things like that. We're really here to help understand what's going on, um, and help point out areas that can be improved, not just because it costs money even, um, but because it can make your lives easier. Right?

I don't know how many times I've said in a, in the middle of an audit that we're not the, we're not the police. Oh, yeah. And I feel like I'm just constantly reminding people of that. Totally. And it's unfortunate, but it's a fact of life, unfortunately. Yeah. It's part of it. But you know what, I think I've found that once you engage with them and have show that you have, you're a person, um, and you do, you work for the same company, right?

You're not there to find the problems and make them feel bad

or so on and so forth, like you ultimately do want the the company to do well, um, and you're giving information to leadership so they're able to do that. Do you Have any ideas for auditors that are listening maybe, that are thinking about this is a constant problem that they're, they're often experiencing, you know, how do you position yourself as more of the partner rather than the police or the enforcer in the organization?

Is there, is there anything that they can do on a daily basis to try to make that better internally? Yeah. I, I, you know, it's, it's taken time, right? Just going from different industries, um, to, you know, I'm currently in the airline sector and before that I went into, I started out in public and that has their own perception. And then, you know, go to internal audit for, um, ticketing and entertainment company that has its own set of challenges.

Um, I've found it's really getting to know them. It's really getting to know what makes them tick. Um, some people are very results driven. Some people just want to know, tell me what you need and I'm gonna give it to you, um, because they want you out of your hair.

Um, and some people ask the why, and I have found that when people ask the why behind it, it makes me a better auditor as well because I'm, I'm explaining to them why we're doing what we're doing and what we're attempting to achieve out of it. And you know, I always do this comparison back to when I was a kid, right? My mom always told me when I asked her, why do I need to eat broccoli? And she said, because I said, so that was never a good answer for me.

And so as I've progressed in my career, when you talk to someone, you, you can't just say, the reason you need to do it is because I said, so that doesn't get buy-in from that.

Um, so I'd say, if you are doing that, stop that immediately. I wish that was effective. But to your point, you, I like the broccoli analogy. It doesn't, it does not work if you just say, because I said so. Yeah. I mean, it's the, it's the, uh, the proverbial big stick approach, I think is what we're talking about. And it just can be effective on certain sporadic things, but it's really not the right way to, uh, adopt a, uh, culture of trust and transparency within your organization.

Yeah. Unless you want people to walk away as soon as you walk in the room to get water. So I, you know, I did as an aside, I mean, it's one of the barometers for me is terms of whether in terms of whether a department is functioning well or not, it's a how many requests are management? Are they coming, are they seeking you out or do you have to go find them?

And that also, I think that really does, to your point, dovetail into requests and the 5:00 PM responses and making sure that we have responsiveness. Yeah. Um, as a leader in your department, to me, culture is so important.

Talk to me about how you're instilling that culture in teams and in the company, because I think that downstream trickle impact to any staff that are working on audits and making sure that, you know, they're not just auditing behind a keyboard, for example, and working with management to develop some of those relationships you're talking about is critically important. Yeah. And I mean, if we think about it, the world's changed so much since Covid, right?

It used to be that you have to, you almost have to walk up to someone to have a conversation or engage, but you know, especially as, um, the younger generation enters the workforce, it's, it's not the traditional route of you're always in face-to-face in front of someone. There's a lot of, um, hybrid and remote work styles, and you have to be able to develop that relationship, um, in a different approach.

One thing that we do, uh, that we've done and throughout my career is trying to get the buy-in of stakeholders, um, by showing them that we, that we want to help, right? Um, so approaching them and trying to figure out what are they doing currently, like understanding what they're doing and be able to articulate that back, right? Because I, I received some, again, from another great mentor, received some words of wisdom that internal audit should be a mirror, right?

So we are not identifying anything that's new or a blemish that doesn't exist. It's just being brought to your attention that it does exist. And I found that it's most effective when you have that dialogue to understand why someone doing something a certain way. Um, maybe it's because they, that's just how they were trained. Maybe it's because they, the risks were different a few years ago. Maybe it's an outdated policy, who knows what it is.

But if you don't start at a state of trying to understand where someone's coming from, they're not gonna want to engage with you and they're not gonna want to hear what you have to say. I think that's critically important.

And to your point, making sure that the teams are engaged in that and that they see the value too. And it's not just, you know, it's a top that it's a truly a top-down approach. I think that does go a long way.

So getting into the more tactical, 'cause I know if I was, if I was listening to this and I was thinking about this, we've talked a lot about the whys behind it and the relational side of it, but tactically, I'm sure you know, and I'd love to hear any examples that you may have had, but I'm sure you've had experiences where these kinds of delays ha have negatively impacted an audit. Do you have any where you've had any really significant impacts to an audit and the whys behind that?

Yeah, we can talk about some of the tactical solutions on the proactive basis. Yeah. So I mean, throughout, you know, I have a few throughout my career. You know, the one that comes to mind quickest is there was a point in an engagement where we were trying to wrap up and there were, you know, random pieces of documentation that were missing. And it's been on the open items list for, you know, weeks at that point.

And we've been trying to get in front of stakeholders for them to understand what we're asking for. It was clearly, um, it was clearly articulated what we needed and they just weren't providing the information and we weren't sure why they were doing that or why they weren't doing it. But, um, we ultimately had to write up the audit report 'cause we were coming up against a deadline and we presented to them what our findings were. We obviously need to confirm, um, what you've identified.

And they said, oh, that's inaccurate because we have X, Y, and Z. And we're sitting there thinking, you know, why we're in our heads, we're like, why didn't we have this conversation earlier? Right? Because we've talked about what we need, um,

and we've tried to be as open and available as possible and you're just not engaging. So, um, definitely learning opportunities with it. And we had conversations after the fact and it came out to be just a resource constraint on there. Um, which we all understand. We, we definitely get that.

Um, but having the conversation earlier upfront about, hey, if you're constrained at these times of the month or with these areas, or you just don't have the background with it or the information, let's talk about that, um, earlier. So we're not, you know, writing up an audit report that's gonna be presented To, to me. And I think that's, that's all very well, very well said and articulated.

Um, to me, if I'm walking away with like two tactical things that I've seen be very effective is, you know, one have the five o'clock thing does tend to happen and it's like, a lot of times it is resource constraints. Sometimes it's a dislike for someone looking over your shoulder from an audit perspective and that perception that exists there.

But sometimes, like in a very tactical sense, if you can't get past that from a relational perspective and you're, you're getting there, you get to the deadline, one of the things I've done is you set up a meeting with them for three o'clock before that five o'clock deadline, somehow magically before that three o'clock meeting, the requests seem to trickle in. So to me that becomes like a really tactical, effective way to do it.

And then the other thing I found is a lot of times where we have this happen and especially it slows things down, it's one of my biggest pet peeves and frustrations is in the reporting cycle. 'cause you're trying to get an audit report out the door, you have to get management's feedback, you have to get buy-in, and it just takes so long, right? To get through reporting that sometimes your reporting phase takes longer than the actual field work itself. And to me, that's hugely frustrating.

So I think that when you look at your reporting cycles, sometimes if I look at root cause of why that's happened, it's 'cause management hadn't seen those observations before. They hadn't seen them in that format before. And it's, and effectively what they're saying by not responding timely is that they were surprised by 'em and they're figuring out how to respond in a way that's meaningful.

So I'd love to hear some of your tactical suggestions there, but I mean, for me, bringing that stuff forward into the field work cycle sometimes does go a long way and help, and that's be, that becomes really important, right? Yeah, no, I totally agree with that.

There's many occasions where unfortunately it doesn't seem to click for the people we're working with until it's actually written down that, hey, this is, this is what we actually found. And because you can't prove otherwise to us, this is what we're gonna have to report. And it's a, oh no, uh, wait a minute, let's give us another week. We're able to find something. And they are, and that's great because we don't wanna report something that's inaccurate, obviously.

But a lot of times we, we try to go back after the, after the engagement and do a feedback session and understand, was the communication not clear on our end? You know, were we not understanding it correctly? And a lot of times it comes down to a communication standpoint. And I'd say that we, you know, a lot of times when we work with different people in the organization, we try to understand how they best communicate, um, what's their communication style?

Do they like to know upfront, um, at the beginning, this is what we need and not the why behind. Um, and it just, it just takes time. Um, it takes time and takes attention. It's such a finesse to your point, because you don't wanna over communicate to the point where they feel annoyed or bugged about it.

But you have, you sometimes have to get to a point where you've showed them some of these things in advance and that they've got that they're not, they're not surprised to the extent that it takes them weeks to, to Respond. Yeah. And on top of that, I mean, they have their day-to-day job to do, right? We're, we're coming in and we're not attempting to slow it down, but it does because they have to pause what they're executed to do, um, in order to fulfill what we need.

So being aware of that even is helpful. What Are your feelings on escalations with management? Because I've seen that done as well where someone doesn't respond and eventually gets escalated to their supervisor. When is an escalation appropriate? When is it not appropriate? How do you feel about that from a relationship management perspective and things like

That? I mean, it, it kind of puts fire a big flame to a relationship that either you have or you're trying to build because that person, the two people in this relationship, this professional relationship are not doing what they need to do. So you're having to bring it to someone's higher attention in order to encourage them or push them to do it. I don't like to do that

unless it's definitely necessary in, there are times that it certainly is. Um, but it's also understanding again, where are people coming from, right? If they're in the middle of a closed period or something and it's our responsibility or our shortcoming that we didn't request this earlier and we're giving them 48 hours during that timeframe that they're swamped, like that's a little bit on on us.

So before raising it up the flagpole, there needs to, not to use too many audit terms, but there needs to be some type of root cause analysis. Is it they don't understand, is it the resource constraints? Um, is it our communication style? What, what, what is the actual problem? One of the things I've done in that realm, 'cause I agree with you, I, he, I always hesitate about the escalation side because I think if done incorrectly, it can be damaging to the long-term relationship.

And so many times when we're doing an audit and we're trying to get requests, if you get back to the, the why we're doing all this, it's to improve the organization and damaging a relationship. Unless it is a critical high risk showstopper type of observation, it's not always worth it.

One of the things I sometimes have done in the past is if you establish the parameters for how you're reporting status within your audit early on, that you can effectively send a status report to that person's supervisor just as part of the normal course of process and let that person supervisor see that we're delayed and we're behind schedule and the y is right on that document.

So it does go to them and it's still getting escalated, but it's not an escalation because of this person doing something. It's just sort of normal course part of the process. Yeah. So I've seen that as an effective way without being as damaging to the relationship. But to your point, you have to be so careful with how you do escalations so that it is getting to the bigger picture issues that you're trying to get to. Yeah,

Absolutely. Any other thoughts or topics as it relates to how we can improve that process, you know, improve the process or giving our listeners other tactical things that they can do to try to speed up response times from management? I would say it's very much to me, I've found to be a very proactive game as opposed to reactive, really getting to know the people for who they are and what their, what their roles and responsibilities are.

Um, rather than walking in after the fact just because you have a mandate, this is what I need to do, educating your, your organization formally and informally about why you're there. Um, you're not there to just necessarily check a box and come up with a list of names. I mean, no one, no one wants to work with that, and that's not what we want to do either.

Um, so building those relationships and providing and communicating what value we can add and do add and have examples and be humble with, um, feedback. I found that's the best way to get your foot in the door and for people to answer before 4 59 and 5:00 PM I would take a 4 59 response over a 5:00 PM response, if I'm Being honest. Oh, I don't know about that. It's still delaying my night, so That's fair. Fair point. Fair point. Adam, thank you so much for your time today.

It was a pleasure talking to you and looking forward to having you back on the show in the future. Yeah, thank You. Thanks so much. Small internal audit teams boost your efficiency at the 2025 audit sphere. This one day virtual conference on June 17th offers expert strategies and practical tools just for you. Register now@theiia.org. If you like this podcast, please subscribe and rate us. You can subscribe wherever you get your podcasts.

You can also catch other episodes on YouTube or@theiiaa.org. That's T-H-E-I-I a.org.