An internal auditor has contacted you. What do you do next?

Typically, an auditor calls to ask for your help.  Auditors need to gain an understanding of processes and practices and do so by asking questions of managers and staff involved in the process being audited.  The questions may relate to policies or procedures, functions, process history, or obtaining documents.  Being the subject matter expert, you are likely the best person to provide the answers.

There is no need to change, edit, or otherwise modify documents being requested.  The fact that a document does not exist, is incomplete, or could not be located simply means the document “did not exist,” was “incomplete,” or “could not be located.”  Altering existing documents or creating previously non-existent documents may lead to consequences.