Your deal has business sponsorship. Risk committee approved. Procurement signed off.
Then someone mentions internal audit needs to review.
Weeks pass. Questions arrive that seem to revisit issues you thought were settled. Internal audit isn't technically a veto point, but in practice, their concerns can delay or derail deals that seemed done.
Understanding how internal audit thinks and operates reveals how to navigate this often-underestimated stakeholder. Security and control dominate audit psychology, but they manifest differently than in other bank functions.
The Internal Audit Function
Internal audit occupies a unique position in bank governance that shapes their approach to vendor evaluation. Understanding their mandate explains their behavior and reveals how to position effectively.
The independence requirement. Internal audit reports to the board's audit committee, not to management. This independence is structural and jealously guarded. Auditors are supposed to evaluate management decisions without being influenced by management pressure. They take this independence seriously because it's the foundation of their institutional value.
This means management enthusiasm for your solution doesn't translate to audit enthusiasm. If anything, auditors are trained to be skeptical of management excitement. They ask whether the enthusiasm is warranted or whether important risks are being overlooked in the rush to approval.
The review-after-decision role. Internal audit typically reviews decisions after they're made, not before. Their role is to assess whether proper processes were followed and whether risks were appropriately considered. For vendor selection, they evaluate whether the decision was sound, not whether to make the decision.
This creates awkward timing dynamics. The deal feels done to you, but audit is just beginning their work. From your perspective, audit is reopening settled questions. From their perspective, they're doing their job of evaluating whether the decision was properly made.
Understand this timing disconnect to manage your expectations and your champion's.
The documentation focus. Auditors care deeply about documentation because it's their primary evidence source. They need proof that appropriate processes were followed, that risks were considered, that due diligence was performed. The quality of the paper trail often matters as much as the quality of the decision itself.
If you've provided thorough, professional materials throughout the process, audit has what they need. If documentation is thin or disorganized, audit will ask questions to fill the gaps. Those questions can delay or complicate deals that otherwise seemed ready to close.
What Audit Actually Evaluates
Understanding audit's evaluation criteria helps you prepare materials that satisfy their concerns before they become obstacles.
Process compliance assessment. Did the bank follow its own vendor selection procedures? Were required approvals obtained? Were appropriate stakeholders consulted? Audit evaluates compliance with internal policies, not just the merits of the decision itself.
This is largely outside your direct control, but you can help your champion navigate it. Make sure your champion understands their internal procedures thoroughly. Encourage them to document their process carefully as it unfolds rather than reconstructing it later. Offer to help track required approvals and ensure nothing is missed.
Risk assessment adequacy. Were risks properly identified and evaluated? Were mitigating controls considered? Is the risk acceptance appropriate for the potential exposure? Audit reviews whether risk thinking was sufficiently rigorous to support the decision.
Provide materials that support robust risk assessment. Document the risks your solution creates explicitly rather than waiting for audit to identify them. Explain mitigating controls you provide and how they address each risk category. Help your champion build a risk assessment that auditors will find thorough.
Due diligence completeness. Was vendor due diligence appropriately comprehensive? Were financial stability, security capabilities, operational resilience, and reference checks performed and documented? Audit looks for gaps in due diligence that might indicate oversight.
Make due diligence easy by providing complete information packages before they're requested. Respond to questionnaires thoroughly with supporting documentation. Offer references proactively and facilitate those conversations.
The more complete the due diligence record, the easier audit review becomes. When audit requests additional information, respond within 48 hours to demonstrate responsiveness and keep the review moving.
Why Deals Die at Audit
Specific patterns cause deals to fail at the audit stage. Recognizing these patterns helps you prevent them through proactive engagement with your champion.
The late discovery problem. Audit sometimes discovers issues that should have been addressed earlier in the process. A security gap that wasn't discussed in technical evaluation. A financial concern that wasn't covered in vendor risk assessment. A contract term that creates compliance issues.
These late discoveries create audit concern about the entire evaluation process, not just the specific issue.
Prevention requires comprehensive disclosure early in the sales cycle. Don't let audit be the first to discover potential issues. If there are known concerns, address them proactively so audit finds documented solutions rather than surprises.
The process shortcut. When deals are rushed, steps get skipped. Maybe the competitive evaluation was abbreviated. Maybe certain approvals were expedited. Maybe documentation was completed after the fact rather than contemporaneously. Audit sees these shortcuts and questions whether the decision was properly made.
Even when shortcuts are justified by genuine business urgency, they create audit risk. If you know the process has been abbreviated, help your champion document the rationale explicitly. "We accelerated timeline because of regulatory deadline, and these alternative safeguards addressed the usual process requirements" is better than unexplained gaps that audit will interpret unfavorably.
The comparable concern. Audit compares this decision to similar decisions. If comparable vendor relationships required more due diligence, audit asks why this one required less. If the risk acceptance seems out of line with other decisions, audit questions consistency.
Understand the context of prior vendor decisions at the institution. If your champion knows that similar deals required certain documentation or approvals, make sure those requirements are met even if nobody is specifically asking for them. Consistency with past practice protects against audit concern.
Navigating Audit Questions
When audit asks questions, how you respond affects how the review proceeds. Strategic response accelerates approval. Defensive response extends and complicates the process.
The question behind the question. Audit questions often have underlying concerns not explicitly stated. "Can you explain your disaster recovery approach?" might really mean "We're concerned about operational dependency and want to understand what happens if you fail."
The surface question is about disaster recovery. The underlying concern is about concentration risk.
Try to understand the underlying concern rather than just answering the literal question. Ask clarifying questions if needed. A response that addresses the surface question but misses the underlying concern will generate follow-up questions and extend the review.
The documentation opportunity. Audit questions are opportunities to strengthen the record. Each response you provide becomes documentation that supports the decision. Treat questions as chances to add evidence to the file, not as challenges to overcome.
Provide written responses even when verbal responses would suffice. Create documentation that auditors can reference in their work papers. The more thorough your responses, the easier their job, and the faster they'll complete their review.
The escalation judgment. Sometimes audit raises concerns that feel like deal blockers. Before escalating, assess whether the concern represents audit overreach or legitimate issue. Escalation works when audit is operating outside their mandate. It backfires spectacularly when audit has identified genuine concerns that management should have addressed earlier.
If escalation is appropriate, your champion should handle it because this is internal bank politics. But be cautious about encouraging escalation. Auditors remember vendors who went around them, and that memory affects future reviews. Damaging trust with audit creates problems that extend far beyond the current deal.
Building Audit Relationships
Unlike most bank relationships, audit relationships rarely involve direct sales engagement. But there are ways to build credibility that serves you in current and future deals.
The indirect reputation effect. Auditors develop opinions about vendors based on the quality of materials they review. Vendors who provide thorough, organized, professional documentation build positive reputation even without direct interaction. Vendors whose materials are incomplete or disorganized develop negative reputation that follows them across reviews and institutions.
Treat every document you provide as an audit document. Even materials intended for business audiences may end up in audit files. Quality and professionalism in all materials builds audit credibility that accumulates over time.
The post-audit relationship. After deals close, internal audit often reviews ongoing vendor relationships. They assess whether the vendor is performing as represented, whether risk mitigations are working, whether concerns have emerged. These reviews happen whether or not you're aware of them.
Support ongoing audit needs proactively. When the bank requests information for audit purposes, respond quickly and completely. When audit issues arise, address them seriously and document your response. Building positive ongoing experience supports future expansion opportunities and creates reference value for other institutions.
The reference impact. Audit teams at different banks communicate with each other. When prospects conduct due diligence, their audit function may contact audit counterparts at reference institutions. Your audit reputation travels beyond any single institution.
This cross-institutional communication means audit relationship investment has broader value than you might expect. A bank where audit review went smoothly becomes a reference asset for audit concerns at other banks. Conversely, an audit relationship that went poorly creates negative reputation that affects deals at institutions that talk to each other.
Audit as Validation Opportunity
Internal audit isn't technically a decision-maker, but their review can significantly impact deal timing and outcomes. They operate with independence from management, focus on process and documentation, and evaluate whether decisions were properly made rather than whether to make decisions.
Vendors who succeed with audit treat them as legitimate stakeholders with valuable perspectives rather than obstacles to overcome. They provide thorough documentation that supports audit work. They respond to questions thoughtfully with awareness of underlying concerns. They build reputation through the quality of their materials rather than through direct relationship management.
Structure your documentation to serve audit needs from the beginning, not as an afterthought when audit review begins.
Create paper trails that demonstrate process compliance, risk assessment adequacy, and due diligence completeness. The best audit outcome is a review that finds nothing concerning, which happens when the decision was properly made and well documented from the start.
Your job is to support that outcome by providing information that demonstrates the vendor selection was sound. When you do that, audit becomes validation of the deal rather than obstacle to it.
The same documentation discipline that satisfies audit also supports regulatory examination and creates institutional confidence that extends far beyond the initial purchase.