Deferred accountability and the quiet transfer of governance exposure to auditors
A dilemma most internal auditors face at some time, is management pressure to soften or omit issues from an audit report on the grounds that, “the regulator has access to these reports and this will create unnecessary problems for the organisation.”
The conversation is almost always polite and rational: “The issue is being addressed.” “This could trigger unnecessary regulatory questions.” “Let us deal with it operationally first.”
I have been in this conversation more times than I can count and in the moment it always sounds reasonable and common sense. That is what makes it dangerous.
This is not an abstract ethics debate, but a recurring challenge, particularly in highly regulated environments like banking, insurance or aviation. It carries a risk that is rarely named. I think of it as Deferred Accountability Risk.
Why this pressure arises and why auditors hesitate
In my experience, management pressure to soften audit reporting usually comes from understandable places.
There is often genuine regulatory anxiety. Senior executives know that audit reports can be accessed by regulators and read without context. Even balanced findings can look stark when lifted out of a broader discussion, so the instinct to manage the written record is not irrational.
There is also reputational concern. Once something is formally escalated to the Audit Committee, it becomes part of the governance record and cannot be unseen or quietly resolved. Softening language is often presented as buying time to fix the issue before it attracts attention or escalates beyond proportion.
There is also the reality of working relationships. Internal audit operates inside the organisation. Escalation can be portrayed as being rigid or disconnected from operational realities, even when the concern itself is valid.
None of this makes management unreasonable. In fact, this is precisely why auditors pause. The request appeals to pragmatism rather than compromise. The problem is that what feels like pragmatism at the time can quietly change where accountability sits.
What Deferred Accountability really looks like in practice
Deferred accountability risk arises when an organisation chooses to delay formal recognition of an issue in order to avoid immediate discomfort or scrutiny. Accountability does not vanish. It waits.
What often goes unspoken in these moments is what management is functionally asking internal audit to do. When management asks audit to soften or omit an issue from a report, they are not just asking for a different turn of phrase. They are asking audit to step slightly outside its assurance role and carry part of management’s accountability for how and when the issue is formally acknowledged.
That shift matters and at that point, the audit report stops being a mirror and starts becoming a shield for management.
While the exposure may not be obvious immediately, it becomes very obvious later, when questions are asked about who knew what, and when.
What history keeps showing us
Large corporate failures are often described as sudden but they rarely are. More often, they follow a slow, familiar pattern where issues are raised, explanations are accepted, discomfort is managed and escalation is delayed.
The sales practices scandal at Wells Fargo is a case I keep returning to. What struck me most when revisiting the timeline was not the scale of the misconduct, but how early the warning signs appeared. Internal concerns existed for years. What failed was not awareness, but escalation with enough clarity and persistence to force governance attention. When accountability finally arrived, it came through regulators, and by then the damage was extensive.
This pattern is not confined to one jurisdiction.
In India, the collapse of Satyam Computer Services showed how comfort can gradually replace verification. Cash balances were accepted rather than aggressively challenged. Each reporting cycle deferred the reckoning. When accountability arrived, it arrived publicly and painfully, with consequences that extended beyond the company itself.
In South Africa, Steinhoff International followed a similar trajectory. Complex structures produced plausible explanations. Concerns were absorbed rather than escalated. Oversight mechanisms existed, but they did not interrupt the pattern. The eventual collapse wiped out billions in value and directly affected pension funds and ordinary investors.
In none of these cases was accountability avoided. It was postponed, and the cost of that postponement compounded over time.
In these cases, early warning signs and governance red flags were present for years before decisive action occurred — whether through internal controls, risk reporting, or escalation to governance bodies — underscoring how accountability was continually deferred until regulators intervened or crises erupted.
Why agreeing to soften can feel like the sensible option
From the auditor’s point of view, agreeing to soften language can feel like a reasonable compromise. The issue is known. Management appears engaged. The relationship is preserved. The auditor retains influence.
The difficulty is that audit reports are not just internal communications. They are governance artefacts. What is included, excluded, or diluted shapes what the Audit Committee knows and when it knows it.
Once something is left out of the formal record, bringing it back later is rarely straightforward. Auditors often underestimate how irreversible these decisions are.
From an Audit Committee perspective, the question after a failure is not whether management felt pressured or whether wording was polite. It is whether the committee had enough information, early enough, to act.
That is where deferred accountability becomes personal.
How I have seen experienced auditors think it through
The most effective auditors I have worked with do not treat this as a binary choice between compliance and confrontation. They ask themselves uncomfortable questions.
· How would this decision read if examined in hindsight? Not by colleagues, but by a regulator or inquiry that does not know the personalities involved.
· Am I, by softening this, making a judgement on timing that properly belongs to the Audit Committee?
· Am I assuming this can be revisited later, when in reality that may be much harder than it sounds?
· Is this an isolated accommodation, or one more small adjustment in what will become a pattern?
These are not checklist questions. They are judgement calls, but they change the nature of the conversation.
Navigating the issue without burning bridges
Independence does not require theatrics. It requires clarity.
In practice, experienced Chief Audit Executives often separate recognition from remediation. They ensure that the issue and its implications are clearly articulated for the Audit Committee, while still acknowledging management’s response and context.
They stay anchored to a simple reality. While day-to-day interactions may be with management, internal audit ultimately exists to support the Audit Committee’s oversight responsibilities. When in doubt, they ensure the committee has enough information to make its own call.
That stance does not always make life easier. It does tend to build long-term credibility.
The cost of getting this wrong
The cost of deferred accountability is rarely borne by those who ask for softening in the moment. It is borne later, often by people who had no part in the original conversation.
Post-incident reviews do not dwell on tone. They focus on whether warning signs were surfaced, whether escalation was timely, and whether governance bodies were adequately informed.
I have yet to see an inquiry conclude that an organisation failed because an audit report was too clear.
A final reflection
Internal audit adds the most value when it surfaces accountability while it is still manageable.
When reporting is diluted to preserve short-term harmony, organisations do not eliminate risk. They merely decide when and how accountability will arrive, often without realising they have made that choice.
Deferred Accountability Risk is not about idealism or confrontation. It is about stewardship. Some of the most consequential audit judgements are not about what we find, but how clearly and when we choose to say it.
Navin Pasricha, a former CAE, CRO and Audit Committee Member, is author of, “Getting Ready to Roar: Chief Auditor’s Guide from Audit Room to Board Room.”
