‘Can we tone this observation down a little?’ If you have worked in internal audit long enough, you have probably heard that sentence, or something remarkably close to it. Not because the evidence was wrong or the testing flawed, but because the implications of the finding had suddenly become very real.
That is where auditor independence is often truly tested. When evidence becomes a finding, the finding becomes a discussion, and that discussion becomes uncomfortable.
Rotation of auditors is often seen as a safeguard for independence. A fresh auditor or team can bring new perspectives and reduce the familiarity that naturally develops over time. It is a sound principle.
Changing the auditor cannot by itself change the control environment
But after years in internal audit, I have come to believe that rotation answers only part of the question. Can fresh eyes really make a difference if the organisation is not prepared to see what they find?
Familiar problems
One reality of internal audit is experiencing how often different auditors identify the same types of weaknesses: poor documentation, informal approvals, management override, or controls that are described as operating but cannot be evidenced.
During walkthroughs, processes can sound perfectly controlled. Yet when supporting documents are requested, approvals cannot be traced, reconciliations remain unsigned, or important decisions exist only in emails, phone calls or messaging apps.
‘We have always done it this way’ is a common response to explain a process. This does not evidence a control. Internal auditors do not audit intentions – we audit evidence.
Changing the auditor may bring a different approach and different questions, but it cannot by itself change the control environment.
Focus shift
Organisations often begin an audit with a genuine invitation: ‘Challenge us. Tell us where we can improve.’ The real test comes later.
I have been in meetings where the evidence was reviewed, the control weakness acknowledged and everyone appeared aligned. Then, as the discussion progressed, the focus shifted. Could the rating be reduced? Did the observation really need to be included?
An effective audit committee does not blindly agree with the auditor
No new evidence had emerged. The risk had not changed. Only the implications of reporting it had become clearer.
Management are measured against operational performance and strategic targets. Significant findings can create understandable tension when they affect those outcomes.
Audit functions and professional firms face pressures, too. Longstanding relationships build trust and institutional knowledge, but they can also make difficult conversations harder. Client relationships and continuity matter, but neither should influence what the evidence requires an auditor to report.
This is where audit leadership becomes critical. The auditor conducting the fieldwork must know that a well-supported conclusion will remain supported when the conversation becomes uncomfortable.
Committee is crucial
The audit committee can make the difference between independence existing on paper and independence working in practice.
I have presented similar types of findings to different audit committees and seen completely different responses. One immediately asked management: ‘What is the action plan, and by when will this be resolved?’ Another spent most of the discussion debating whether the finding should really be rated ‘high’ rather than ‘medium’. The issue was similar. The difference was governance.
If the audit committee cannot challenge management objectively, rotating the auditor will solve very little
An effective audit committee does not blindly agree with the auditor. Challenge is healthy and necessary. But the discussion should test the evidence, the risk and the proposed response, not simply seek a more comfortable version of the message.
The independence of audit is closely connected to the independence of those overseeing it. If the audit committee cannot challenge management objectively, rotating the auditor will solve very little.
Five key questions
Before rotating your auditor, ask five questions:
- Are we changing the auditor or avoiding the message?
- Have we addressed previous findings or simply accepted them?
- Will our audit committee support difficult conversations?
- Do we welcome challenge or resist it?
- If the next auditor reports the same issues, what will change?
One of the privileges of working in internal audit is seeing organisations at their most honest. We see what works, what does not, and what happens when uncomfortable truths surface.
Those experiences have convinced me that independence is not created by rotation or policy alone. It is reinforced by audit leaders who stand behind evidence, audit committees that protect constructive challenges, and management teams willing to hear what they may not want to hear.
Auditor rotation may bring fresh eyes. But only strong governance ensures that those eyes are free to see and be heard.
