"At Citibank, the internal audit was a very tough process, but generally, internal auditors can be more helpful than external. Sometimes they can help you enhance controls, whereas external auditors and regulators won't help you fix things. They'll give you guidance but won't go below a certain level."

An internal audit is also more detailed and usually involves a longer period of engagement, and when preparing for one Kogekar says it is important to go through an engagement process. He advises others to talk to the head of the audit team and set an agenda and create a boundary between the advisory and the checking functions of the audit. He is also careful about who in his team deals with auditors. While the audit is in progress people may be prone to make silly comments and so he likes to have some control about what comments are made.

Margaret Wright agrees that the audit and reporting process needs to be properly managed. Formerly national partner-in-charge of the Computer Audit Group at KPMG and then Information Risk Management, she is now executive director information services division at Macquarie Bank. Wright believes that a lot of IT executives find auditors useful and beneficial at the right times and that the upside of an audit is that it is an opportunity to take a check on where you are at and how well you are going. Similar to Kogekar, though, she thinks there is value in having an open and honest discussion up-front.

"On the first meeting it's very important to understand where the auditors are coming from and what they're really looking for, or what the scope [of the audit] is," she says. "In some organisations it could seem like it's a point scoring exercise, so it's really important to get that right relationship with them, so that it's constructive. I think it's useful to focus on what you've done well, and if you have issues that you want addressed to talk about them."

Wright adds that an external audit is also an opportunity for you to informally benchmark yourself against other organisations through the auditors and for them to tell you how other people, especially in the same industry, are dealing with particular issues you may have. However, Wright urges caution about airing one's dirty linen and be sure to know what outcome you want. And although she advocates being honest and helpful, she also thinks it is the auditor's job to find things out. Likewise, she says an audit can be quite disruptive. So to make it efficient and avoid taking up too much time, her counsel is to ensure that everything is planned and determine just who the auditors need to speak to.

Kogekar thinks the regulatory role of auditors has increased in recent times. Wright has not seen a great deal of change in auditing processes over the years but thinks there is probably more focus on risk now. "Technology is a big spend for a lot of organisations, and not only that, it's probably one of their biggest risks," she says.