Internal auditors are often put in positions where they must make difficult and uncomfortable inquiries. A strong ethical environment can help.

Meanwhile, companies continue to look for ways to emphasize the importance of strong ethics, integrity, and proper conduct and seek strategies to embed processes within their organizational structure. Yet, as we know, incidents of bad behavior still occur. It is an ever-evolving phenomenon. Once we find the answer to address a specific issue, another question or problem arises.

Ethics impacts every professional's job regardless of status, tenure, or selected profession. For internal auditors, ethics can become a very sensitive issue and political dilemma when attempting to execute their responsibilities and fiduciary duties. Internal auditors are often put in positions where they must make difficult and uncomfortable inquiries. It can appear to management as an attack on personal integrity or on personal morals and ethics.

For ethical dilemmas, the answers are never the same. Sometimes people revert to their own personal morals when attempting to resolve a situation. This is what makes the topic so problematic. Each individual may have very different thresholds when it comes to following their own ethical white line, gray line, or black line. The more we learn and understand why individuals do the things they do and how personal beliefs and morals mix into decision-making, the better equipped we will be when faced with issues.

Most major professions establish a code of ethics that is governed and enforced through major professional associations. Organizations may also prescribe their individual code of ethics. Sometimes, reconciling these codes can become a difficult task. The Institute of Internal Auditors code of ethics states the principles and expectations governing the behavior of individuals in the conduct of internal auditing. It describes the minimum requirements for conduct and behavioral expectations rather than prescribing a specific set of activities. The purpose of the IIA's code of ethics is to promote an ethical culture in the profession of internal auditing.

A code of ethics is necessary and appropriate for the profession of internal auditing. It is grounded in the fact that management and stakeholders place a level of trust in the function of internal auditing. However, establishing a code of ethics is often not as simple as it sounds. Let's consider some important attributes of ethics, by using the word as a mnemonic device for the following points:


E – Everyone is responsible
T – Tone at the top is essential
H – Honesty is the best policy
I – Integrity is a must
C – Corporate social responsibility is expected
S – Silence is not acceptable (or silence is a form of acceptance)

Now let's delve a bit deeper into each of these thoughts.

Everyone is responsible
All too often, when the word "ethics" is brought into a business conversation, individuals tend to promulgate that its primary responsibility lies with the leaders of the organization. Although it is critical that ethical behavior must be demonstrated by the organization's leaders, it is an imperative for everyone in the organization to display similar behavior. Each employee from top to bottom must be committed to ethical behavior for a company to be successful. Internal auditors can assist in ensuring everyone in the organization understand their responsibility for ethical behavior. This comes with discussing and educating employees on elements of the organization's control environment.

Tone at the top is essential
Many writers will claim that ethical behavior and conduct must start with “tone at the top.”  Although I agree it is a critical attribute, we must accept that not all individuals will have the same morality and opinion as ours.  Simply addressing “tone” will not ensure the organization appropriately acts when faced with an ethical dilemma. If there is any question as to which path is the most appropriate to take, individuals can find it easier to rationalize alternatives that may not be fully in line with the company’s overall code.  This is why organizations must not only rely on what they deem as tone at the top but ensure that that tone is actually exemplified in day-to-day practices.

Tone at the top must be communicated frequently, openly, honestly and put into practice by every individual within the organization.  Individuals will follow their leaders and learn from their actions.  These actions should be undeniable if questioned. 

Honesty is the best policy
All too often, ethics and corporate responsibility don't necessarily equate to honesty in the workplace. Honesty may mean admission of either wrongdoing, poor judgment, or even an honest mistake. Employees who are conditioned to act with caution when discussing things in the workplace that could have negative implications, may infer some process is not being executed efficiently or an action that may involve leaders. No one wants to be associated with pointing to areas where work is not being done as efficiently or effectively as possible. This can become quite a dilemma when your job is that of an internal auditor. You are put in the spot of calling out those gaps that may have existed for a long time.

Organizations must ensure that all professionals feel that when they identify a potential issue, they can openly discuss the situation with the appropriate management. This doesn't mean everyone's word or opinion is taken at face value, but when employees don't feel they can freely express these thoughts and ideas, the culture may be sending the wrong message. When you are personally faced with an ethical dilemma, you must ask yourself whether you are looking at the situation as honestly and transparently as you can. If questions still arise, it is your obligation to raise those questions to individuals in positions of responsibility.

Integrity can be measured by ethics
If someone had you name the top 3 people in history that you felt displayed unquestionable integrity, would those same individuals measure high on the ethics scale? Most likely they would. Integrity is adherence to a moral code, reflected in honesty and harmony in what one thinks, says, and does. As such, those who we regard with high integrity normally possess a strong set of morale ethics. From a corporate viewpoint, are the members of your leadership team individuals whom the employee population will view as having strong integrity? These are the people employees will look to emulate. It is the mirror into your future organization, and a concept that is closely correlated with having a strong ethical environment.

Corporate social responsibility
Corporate responsibility is owned by each and every employee. Whether it is a dedication to recycling efforts, contributing to community causes, or providing appropriate feedback to your staff and supervisors on how to make the business better, this is the true intent of corporate responsibility. Organizations must learn to embrace the concept that individuals who work in the organization have valuable day-to-day observations that can improve operations and business processes. The inability to encourage feedback from employees and to provide an outlet to express these thoughts itself is a failure of corporate responsibility.

Silence is not acceptable
Silence can often occur due to the fear of retribution. The only way to advance the elimination of business scandals that have pervaded our everyday life is to erase the concern that silence is golden. Many employees see things in their day to day job that they may question, yet they turn the other eye due to fear of retribution. Internal auditors must look to ensure employees know the appropriate outlet for surfacing concerns or questions. Is there an independent hotline? If so, how many calls does the hotline receive? Do those numbers appear to be realistic given your employee base and business? How well is your hotline publicized? What comprises the issues reported to the hotline? Do vendors know about your hotline and understand that they can register a compliant? How is your hotline managed? And, out of curiosity, have you ever attempted to call the hotline yourself? You may be surprised the level of questions and comments you do or don't receive.

If you are an internal auditor, the concept of silence is golden should not be one that you abide by. You should understand and acknowledge that silence is a form of acceptance. Your job is to help the organization understand issues as they happen and actions are appropriately taken.

Gaining Insight
For internal auditors to be successful in evaluating ethical programs and concepts, they must think outside of the box and identify procedures that are relevant to their organization. This means moving away from a checklist approach or one-on-one interview processes where much of the input is left up to interpretation. In addition, when individuals are interviewed directly, or asked to complete a survey, the auditors lose the ability to immediately ask relevant follow-up questions that may provide them with further insight into the effectiveness of the program.

The concept of ethics stretches much farther than the corporate walls. Individuals and internal auditors would be wise to understand the concepts and psychology behind ethical behavior.  This knowledge will help them when attempting to evaluate the organization's ethical culture and control environment.

---

A Personal Example of the Internal Auditor's Ethical Dilemma

In the early years of SOX, I was a CAE with a large publicly traded company that was going through many issues similar to those experienced by Enron. Due to the magnitude of many of the issues, it was important for internal audit to identify methods to fully evaluate aspects of the control environment and the ethics program. This meant that we needed to employ evaluation methods that went further than the simple checklist approach that had been established by many of the external audit firms.

Our board was interested in knowing that the company's culture was on the right track and that any existence of potential ethical issues was adequately communicated and dealt with. They wanted to ensure the company's overall compliance and ethics process was reinvigorated and well communicated to assure employees that management was diligently addressing issues of the past.

Typically, for our company, issues related to the code of conduct or ethics program had been managed or handled by the legal or human resource area. It was difficult for those groups to accept the need for internal audit to become a part of the evaluation process. However, because we had experienced several incidents that bordered on questions of ethical behavior, the audit committee supported the need for internal audit to be involved.
You might think that having audit committee support would help smooth the way for internal audit to execute on various analysis processes. However, our organization had been in existence for over 45 years, and the political silos made it very difficult for legal and human resources to open up their process to individuals who they considered outsiders.

Our organization had experienced a history of significant flux. In 2001, the company was listed as number 33 on the Fortune 50. Revenues were over $40 billion, and stock traded at an all-time high of over $37.55 per share. By late 2002, our revenues fell to $2 billion. With that change, the stock price plummeted to $4.39 per share. It would be logical to assume that due to these dramatic shifts in our organization's operations, some elements of the code of conduct and compliance program would have also changed. However, during an audit review, it was identified that many aspects had not been reviewed in several years. To have the internal audit group question some of the processes was akin to a subtle act of pointing at the processes and questioning whether individuals had been adequately performing their jobs.

Although the concept of having internal audit asking ethical and tone-at-the-top questions was not popular, we were able to develop an alternative approach to evaluating the soft components of the control environment such as ethical concepts, management philosophy and operating style, and ethical actions. This process involved executing facilitated sessions with senior management using a maturity model approach to evaluate a multitude of ethical and compliance issues. This process resulted in the ability for internal audit to present the outcome and results of the evaluation as a true management product and not just internal audit's opinion. The process proved to be successful, and we continued to utilize the method to improve aspects of the ethical culture through the remainder of the company's existence.

This method also helped to eliminate some of the perceived controversy and negativity around the topic. Individuals felt as though they had a say in how concerns were heard, and management took appropriate actions.