Courage is often discussed as a necessary trait for internal auditors, and over the decades countless practitioners have put their livelihoods on the line to bring wrongdoing to light. Like many others, I have long believed that Cynthia Cooper, the former vice president of internal audit at WorldCom, is the model of courage in our profession.

Cooper’s story is well known within internal audit and accounting circles, and she is rightly praised and lauded for having the courage to stand up in the face of enormous pressure and adversity to unearth the $3.8 billion fraud.

In her book, Extraordinary Circumstances: The Journey of a Corporate Whistleblower, Cooper counsels internal auditors to “find your courage.” Courage means many things to many people, so thinking about it and discussing it with others you trust can help you reinforce your moral foundation.  

In Trusted Advisors: Key Attributes of Outstanding Internal Auditors, one of the nine key attributes I examine is ethical resilience, and in speeches about the book, I talk about internal auditors needing to be ethical AND courageous. I have known many ethical internal auditors who kept their heads down rather than confront highly contentious risks, issues, or results. But being courageous often requires being the lone voice. It doesn’t take quite as much courage to stand in line to point a finger. Indeed, courage does not wait for a choir.

But courage doesn’t suddenly blossom within an internal auditor simply because there is an expectation or strong case for it. I go back to Cooper’s admonition to “find your courage,” which requires practitioners to examine what courage is and under what circumstances their own internal fortitude may be tested.

A column in Psychology Today titled Six Attributes of Courage offers a useful examination with related inspirational quotes. Each attribute has practical applications to circumstances internal auditors may face in their careers.

Overcoming fear – This is the most fundamental and instinctive attribute of courage. Many have written that courage isn’t the absence of fear, but the ability to act in the face of fear.

Having passion – Passion for the profession drives us to do what’s right, even in extraordinary circumstances.

Persevering in the face of adversity – Cooper and her staff worked many long hours, often at night and in secrecy, to get to the bottom of the WorldCom fraud. Facing adversity day after day when you’re tired and scared builds the internal fortitude that defines courage.

Standing up for what’s right – It is easy to rationalize in the face of adversity, but we must overcome the temptation. Social activist Maggie Kuhn eloquently articulated this attribute when she said, “Speak your mind, even if your voice shakes.”

Expanding your horizons – Courage is also stepping out of your comfort zone. Another great quote, this time from Lord Chesterfield, gives voice to this attribute: “Man cannot discover new oceans unless he has the courage to lose sight of the shore.”

Facing suffering with dignity or faith – Courage often involves suffering. Being able to turn to what gives us strength helps get us through the most trying times.

In addition to understanding what it takes to be courageous, internal auditors should also be attuned to whether their own organizations’ corporate cultures support or discourage speaking out. If organizations foster an environment in which retaliation is unacceptable for those who raise concerns, they tend to be better off in the long run.

I’ve written many times that those aspiring to become CAEs should know what they’re getting into and be prepared emotionally, professionally, and financially to do their talking with their feet if it comes to it. I’ve also written that great internal auditors do not fear difficult or uncomfortable topics. They courageously sail toward the storms to alert management and the board when risks are not being managed and controls are not adequately designed and implemented.

To be clear, I do not take lightly that acting in the face of adversity may pose great professional and personal vulnerabilities. But internal audit’s ability to provide assurance, help organizations overcome risks, and become trusted advisors to our stakeholders depends greatly on our willingness to speak out.

By definition, courage is not easily achieved. It can involve danger and personal sacrifice. But courage is not courage when there’s nothing on the line.

As always, I look forward to your comments.​