Most of an audit is conducted on paper: notices, data requests, spreadsheets, draft findings. But the moments that shape it most are often live. A scoping call, a weekly status meeting, a walkthrough of preliminary results. These are the points where tone is set, positions are tested, and things get said that cannot be unsaid.

They are also the points most organisations prepare for least. Someone accepts a calendar invite, whoever is available joins, and the auditor leads. Treated that way, every call is a risk. Treated as a managed event, every call is a chance to keep the response on your terms.

Before the call

Good calls are decided before anyone dials in. We work to a simple rule: nobody joins an auditor call without knowing why they are there.

That starts with an agenda. If the auditor has not sent one, ask for it. If they have, review it with your licensing specialists and decide in advance which items you will discuss, which you will take away, and which sit outside the agreed scope. Agree who leads on your side, and make sure everyone else knows their role is to listen unless asked to contribute.

A short internal prep session, even fifteen minutes, pays for itself many times over. Walk through the likely questions, the open data requests, and anything sensitive. Agree the positions you are holding and the things that should not be volunteered. If a technical expert needs to attend, brief them on what is in scope and what is not. Technical people are naturally helpful, and an auditor's open question is an open invitation to be helpful.

During the call

The most important discipline during a call is one voice. A designated lead answers or redirects, and everyone else defers to them. When a question goes beyond what was prepared, the right answer is almost always a calm "we'll come back to you on that", not an improvised one.

That is not evasion. Auditors expect considered answers, and a reply delivered in writing a few days later, reviewed and accurate, is better for everyone than a guess on a call that becomes part of the record.

Keep your own notes. Do not rely on the auditor's minutes as the only account of what was discussed and agreed. Capture every request, every commitment and every date mentioned, and who said it. If the auditor proposes a deadline, it is perfectly reasonable to say you will confirm it once you have checked with the team.

Watch the scope. Calls are where requests quietly expand: an extra business unit, an additional product, a longer lookback period. Note the request and handle it formally afterwards rather than accepting it in the flow of conversation.

After the call

The hour after a call matters as much as the call itself. Hold a short internal debrief while it is fresh: what was asked, what was promised, what surprised anyone, and whether anything has shifted in the auditor's position or tone.

Then put it in writing. A brief follow-up to the auditor confirming actions and dates as you understood them closes off ambiguity, and if their minutes later differ, you have a contemporaneous record. Internally, new actions go into the plan with owners and dates, and anything that affects exposure or strategy goes straight to your licensing specialists.

Finally, update your stakeholders. If something material came up, the people who need to know should hear it from the response team that day, not discover it weeks later in a draft report.

Why it matters

None of this is complicated. It is simply the discipline of treating a conversation with a counterparty as a controlled event rather than an informal chat. Over a six-month audit there may be twenty or thirty of these calls. Run consistently, they become one of the main ways an organisation keeps control of its own response. Run casually, each one is a small opening for the scope, the timeline, or the narrative to drift.