As an internal auditor, I’ve learned that words matter. Every conversation, every casual remark, and every carefully worded response tells a story that goes beyond its surface meaning.
Over the years, I’ve heard certain phrases from management that seemed harmless at first – but later, they turned out to be red flags before something went wrong (fraud, business disruption, incidents).
Example Sentences To Watch Out For
1. The Resistance to Change
“Why fix it if it’s not broken?” This question seems logical but often masks as a dangerous complacency.
When management uses this phrase, it typically indicates a reactive rather than proactive approach to risk management. Just because something works now doesn’t mean it’s risk-free, issues often grow under the surface, like roots spreading beneath seemingly solid ground.
2. The Small Entity Excuse
“We assume the risk of not having segregation of duties – we’re a small entity.” This rationalization is particularly concerning because it demonstrates a conscious choice to ignore fundamental control principles. Size should never be an excuse for poor controls. In fact, small teams still need controls – perhaps even more so, as the impact of fraud or errors can be proportionally more devastating to smaller organizations.
3. The Avoidance Pattern
“Sorry, I’m in a hurry, can’t talk now.” When this becomes a pattern, it is no longer a busy schedule. Avoiding questions, especially repeatedly, can signal something is being hidden. This behavior often indicates discomfort with transparency and accountability.
4. The Preemptive Defense
“I heard you wanted to talk to me.” (When I never asked to talk to them 🤔) Strange behaviors and defensiveness can mean someone is nervous about scrutiny. This kind of preemptive approach often suggests an underlying anxiety about potential discoveries.
5. The Delayed Audit Tactic
Let’s restructure the acquired company first, then you can audit it. This request for delay should immediately raise concerns. Delaying audits can mean they want to ‘clean up’ first -why the hesitation? Such postponements often indicate attempts to manipulate or adjust situations before proper examination.
6. The Tradition Shield
“That’s how we’ve always done it, and it works fine.” This defense of the status quo is particularly dangerous. Just because something worked in the past doesn’t mean it’s safe or compliant today. Past success can blind us to present risks.
The Attentive Observer
These statements might seem normal, but in my experience, they often signal deeper risks. They serve as early warning systems for internal auditors. These are not mere words but windows into organizational culture, management mindset, and potential vulnerabilities.
The key is to recognize these signals early and investigate their underlying causes before they turn into serious issues. When these red flags appear, they demand an understanding of the context and culture that produced them. After all, in the world of internal audit, prevention is always better than detection.