As an IT Auditor working within the Security function at my company, I sometimes get the feeling that people are walking on eggshells and not being entirely upfront / open about facts.

During meetings and discussions between our team and other teams, sometimes this results in less than fully productive interactions. This is understandable to some extent, due to the role of the audit function in uncovering weaknesses within the company.

An example: It took multiple follow ups and escalation to have an terminated employees access revoked recently , due to no one wanting to take action.

How can I encourage open communication and early acknowledgement of problems, rather than people being afraid?

  • 4
    I don't understand the connection between your first and third paragraphs. There's a big difference between open communication and effective action. Oct 7, 2016 at 1:21
  • Try to find out what is the discourse that makes them think you are the enemy. Then address that. I can't speculate further without knowing the discourse; you may want to add it to your question.
    – user8036
    Oct 7, 2016 at 13:44

4 Answers 4


I think @RickardU hit the nail on the head. The problem is probably with the perception of your role due to your title. An auditor is generally seen as someone who's job it is to check other peoples work and find their deficiencies and failures. That role is often seen as an adversarial position rather than as a member of the team that adds value to the product.

I would have a talk with your manager/Director/CIO or whomever it is that you report up to and is responsible for your activities being a success. I would try convince them to re-brand your role as IT Security Champion. Take the focus off of the audits and those things seen as adversarial, and focus on integrating your role as an asset in the project design and development process.

In your role as Champion your goals should be to get the team to focus on including you in the early planning and discussions of projects to integrate the security component into the design. Get the teams involved in discussions on how to improve and get their engagement in the process of improving the IT Security at your company.

One part of your role will still be the audits. But those should be done discreetly, and reports should be submitted to management, not to the teams. Focus on trends and persistent issues, rather than individual incidents, unless those incidents actually result in a breach. It is the managers job to handle the incidents, it is your function to make them aware of the the problems that keep popping up, or are inherent in the design.

When you get assigned to lead the charge in solving an issue, involve the teams in finding the solution. Get them to help solve the problem rather than providing a solution for them to implement. This will have a two fold benefit of, getting them engaged in the security process, and getting them to think about these problems proactively going forward.


This is always going to be a problem in your profession. The best way to mitigate it that I have found is to talk to the staff. Don't make friends, but be upfront with them so they know you mean business when you have to. And most importantly you will back them when they are in the right.

Think of them as individuals and analyse how you must come across to them, educate them a bit on what your role is and best practices to avoid issues. This is you helping them, it clarifies things for them and they'll appreciate it.

This gives them the confidence to speak out and explain things more thoroughly, somewhat in any case.

I could give many personal examples, but you need to develop your own style and strategies. But communicating on your side is the best start (outside your role).


People not being open during audits probably has more to do with the situation than your mode of communication.

If pointing out weakness will have negative consequences for employees - such as managerial backlash - they will naturally tend to avoid making any waves.

Not until the auditing unit mitigates these concerns, e.g. by guaranteeing actual anonymity, will those dynamics change.


It comes from a fear due to the perception of your role.

Auditor = Someone is going to get in trouble, in the minds of most people.

If this is a legitimate fear in your case, little can be done. I.E. if people are going to be terminated or disciplined due to your findings. The fears are real and nobody is going to put their own head on the chopping block.

It also depends if security in your company takes a cooperative or adversarial approach. I.E. if your company's approach to security is that everyone is part of security or that everyone is a threat to security.

If the corporate culture of security is cooperative and your role is simply one of process improvement, then that fact needs to be clearly communicated to people. In short, you need to let it be known that you are there to deal with breakdown's in processes, not to discipline people.

If people feel that your role is to improve their lives, rather than complicate them, they will be much more cooperative. the whole ITIL approach is worth studying in this regard.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .