How to protect myself when asked to omit a finding in an internal audit report?

Question

If your boss ask you to modify an audit report to omit material findings that are critical to the continuity of an organization, how can I protect myself?

Answer 1

I work as an IT auditor. In your case, your should first document what your boss said to you. Important information includes:

1. Date of communication
2. Who sent it
3. Exact wording of the request from your manager (If feasible)
4. Context such as where and when it was said
5. Any 3rd party witnesses that can corroborate your story

Next, depending on the size of your organization, you should check on any policies your organization may have related to conduct. If procedures related to how file a grievance exists, you should follow it and document all communication in writing throughout the process until resolved. If written (highly doubtful), take a screen capture with system date stamp, your login ID, and sender name

What you boss told you to do may not be sanctioned by the company, and if the manager's actions threaten the continuity of the business:

I would expect most reasonable management to take action, as to ignore such actions is an irrational decision that will only hurt the business and in turn, themselves .

In addition, you should be aware that past audit work papers can be referenced and be relied upon for subsequent audits. Hence, the misrepresented work papers can mislead future auditors and cause them to flag your company as a high risk firm to be targeted for future, more probing audits - the opposite of what your management most likely wants.

Ultimately, what your boss told you to do is unethical. Assuming the auditor was reasonable and not vindictive, you may want to think about working at your employer in the long term.

Answer 2

Working as an IT auditor myself, there are a few considerations to take care of. First of all if your auditor is an independent party (e.g. 3rd party auditor). That auditor gave his opinion in a formal report and your management will rely on that auditor's report to take certain decisions. If you modify an auditor's report to intentionally omit findings you can be indicted for intentional forgery. Your management's decisions may be impacted as they do not have a clear vision on the current situation.

Most likely your boss is covering his own ass and scapegoating you if find out. I recommend you, as Anthony mentioned above, to document the request and raise it to your internal audit department, if you do not have such a department, you may raise your concern to your boss their boss.

There are valid reasons you might want to "remove" findings. For instance if there are multiple departments that are covered within a single audit report, you may opt to split up the audit findings and only send findings relevant to each department. However you do not appear to be in such a situation.