What not to say during an audit?

[McLucas]

The core rule during an audit is to provide factual, concise responses strictly within your knowledge and role, avoiding speculation, elaboration, or defensive language. Deviating from this can create inconsistencies, expand the audit scope, and undermine credibility. Auditors rely on precise information to assess compliance; unclear or excessive answers raise red flags and prolong the process.

A common critical error is answering for others or outside your specialty. If asked about another department's process, the correct response is, "That would be better addressed by the [Department] lead." Attempting to answer invites inaccuracies. Industry analysis suggests over 20% of audit findings stem from personnel providing incorrect information outside their direct remit, creating compliance gaps.

Offering unsolicited information is equally problematic. Elaborating beyond the question can unintentionally expose unrelated areas to scrutiny. For instance, if asked to confirm a control exists, simply state "Yes, it is documented in procedure X." Avoid adding, "We sometimes skip step Y when busy," as this introduces a new deficiency. Auditors are trained to follow threads; unnecessary details can expand their examination by an estimated 30-40% beyond the original plan.

Using hedge words like "I think," "usually," or "normally" undermines the reliability of your response. These terms imply inconsistency. Instead, base answers on documented evidence: "According to our records, the procedure requires Z." If unsure of a fact, it is professionally responsible to state, "I don't have that information readily available, but I can follow up with the correct data by [timeframe]." Guessing is a severe misstep; an estimated 15% of minor non-conformities escalate to major findings due to provided guesses later proven false.

Maintain a calm, cooperative tone without appearing defensive. Phrases like "We've always done it this way" or "That's not my job" signal resistance. Focus on the present system: "The current process is defined as..." This demonstrates control and professionalism. Your goal is to convey that operations are managed through documented, evidence-based systems, not informal practices.

Ultimately, audit communication is about precision and boundaries. Prepare by reviewing relevant procedures for your area. Listen carefully to each question, pause to formulate a factual response, and stop speaking once the question is answered. This disciplined approach builds auditor trust and leads to a more efficient, accurate assessment.

[DeLyla]

I learned this the hard way in my first audit. The auditor asked a technical question about our network config. I’m in apps, not infra. I started with, “I think the server team usually…” The auditor’s pen just stopped. He looked up and asked, “So you’re not certain?” That mild doubt colored everything after. Now I have a mantra: “I handle [my specific area]. For that, you’ll need [Name/Team].” It’s not rude; it’s accurate. It saves everyone time and prevents me from putting my foot in my mouth. Stick to your lane, and if you don’t know, just say so. Promise to find out. They respect that far more than a shaky guess.

[VonGianna]

As a department head who’s been through dozens of these, the psychology is key. Auditors aren’t enemies; they’re mapping a process. When you say “I think,” you’re showing them a gap in your documentation or training. When you elaborate unnecessarily, you’re handing them a new path to explore. My team is drilled on this: answer the question asked, full stop. If they ask, “Is this report generated monthly?” The answer is “Yes.” Not “Yes, but sometimes it’s late if Jane is on vacation.” That “but” just created a finding about backup personnel. We prepare by role-playing Q&A. It makes concise, confident answers automatic. The goal is to present a controlled, predictable operation. Rambling makes you look unprepared, even if your actual work is flawless.

[Vanessa]

Think of it like a witness in court. You’re under oath to tell the truth, your truth, about what you directly know.

• Don’t narrate. Answer only what’s asked.
• Don’t guess. “I don’t recall” is better than a wrong answer.
• Don’t speak for others. It’s hearsay.
• Avoid “always/never.” Say “according to the procedure.”
• No filler words (“like,” “um,” “you know”). They dilute your message.

Be a clear, reliable source of facts. Pause before you speak. Keep it simple.

[OXavier]

From the auditor’s side of the table, the most frustrating thing is wading through vague language to find a simple fact. We’re on a schedule. When someone says, “Normally we check that,” my immediate thought is: Show me the record of that check. If it’s not documented, it didn’t happen consistently. The word “normally” means it’s not a formal control.

Similarly, when people get defensive—“Why are you asking that?” or “We’ve never had a problem before”—it doesn’t stop the question. It just tells me the area might be sensitive. We’re required to corroborate information. If you answer for another team, I now have to go verify your statement with them anyway, doubling the work. If you guess and I base a question on that guess, and it’s wrong, the whole thread is wasted time.

The most helpful auditees are those who listen, confirm they understand the question, and answer directly. If they need to check, they say so and commit to a timeline. That builds trust. Our job isn’t to trick you; it’s to verify the system works. Clear, concise, confident answers based on evidence make that process smooth and build your credibility immensely.