Courageous Internal Auditors Don’t Wait For a Choir

This month marks the 20^th anniversary of the internal audit at WorldCom that shined the light on a $3.8 billion financial reporting fraud. My recent article for AuditBoard revisited what I called “arguably the most consequential internal audit ever undertaken.” The audit not only contributed to the demise of WorldCom, but its results contributed in many ways to the swift US Senate passage of the Sarbanes Oxley Act barely three weeks later.

As I observed in my WorldCom article, the audit wasn’t just the work of technically outstanding internal audit professionals (which it certainly was). More importantly, it was the direct product of courageous leadership by WorldCom’s CAE, Cynthia Cooper. Since the publication of my WorldCom article, there has been a lot of conversation on social media and elsewhere on why courage is so important in our profession.

Courage has long been recognized as a necessary trait for internal auditors, and over the decades countless practitioners have put their livelihoods (and sometimes even their lives) on the line to bring wrongdoing to light. Like many others, I have long believed that Cynthia Cooper, was the model of courage in our profession.

In her book, Extraordinary Circumstances: The Journey of a Corporate Whistleblower, Cooper counsels internal auditors to “find your courage.” Courage means many things to many people, so thinking about it and discussing it with others you trust can help you reinforce your moral foundation.  

In my book Trusted Advisors: Key Attributes of Outstanding Internal Auditors, one of the nine key attributes I examine is ethical resilience, and in speeches about the book and a new seminar I have developed for The UAE IIA, I talk about internal auditors needing to be ethical AND courageous. I have known many ethical internal auditors who kept their heads down rather than confront highly contentious risks, issues, or results. But being courageous often requires being the lone voice. It doesn’t take quite as much courage to stand in line to point a finger. Indeed, courage does not wait for a choir.

But courage doesn’t suddenly blossom within an internal auditor simply because there is an expectation or strong case for it. I go back to Cooper’s admonition to “find your courage,” which requires practitioners to examine what courage is and under what circumstances their own internal fortitude may be tested.

A column in Psychology Today titled Six Attributes of Courage offers a useful examination with related inspirational quotes. Each attribute has practical applications to circumstances internal auditors may face in their careers.

Overcoming fear – This is the most fundamental and instinctive attribute of courage. Many have written that courage isn’t the absence of fear, but the ability to act in the face of fear.

Having passion – Passion for the profession drives us to do what’s right, even in extraordinary circumstances.

Persevering in the face of adversity – Cooper and her staff worked many long hours, often at night and in secrecy, to get to the bottom of the WorldCom fraud. Facing adversity day after day when you’re tired and scared builds the internal fortitude that defines courage.

Standing up for what’s right – It is easy to rationalize in the face of adversity, but we must overcome the temptation. Social activist Maggie Kuhn eloquently articulated this attribute when she said, “Speak your mind, even if your voice shakes.”

Expanding your horizons – Courage is also stepping out of your comfort zone. Another great quote, this time from Lord Chesterfield, gives voice to this attribute: “Man cannot discover new oceans unless he has the courage to lose sight of the shore.”

Facing suffering with dignity or faith – Courage often involves suffering. Being able to turn to what gives us strength helps get us through the most trying times.

In addition to understanding what it takes to be courageous, internal auditors should also be attuned to whether their own organizations’ corporate cultures support or discourage speaking out. If organizations foster an environment in which retaliation is unacceptable for those who raise concerns, they tend to be better off in the long run.

I’ve written many times that those aspiring to become CAEs should know what they’re getting into and be prepared emotionally, professionally, and financially to do their talking with their feet if it comes to it. I’ve also written that outstanding internal auditors do not fear difficult or uncomfortable topics. They courageously sail toward the storms to alert management and the board when risks are not being managed and controls are not adequately designed and implemented.

To be clear, I do not take lightly that acting in the face of adversity may pose great professional and personal vulnerabilities. But internal audit’s ability to provide assurance, help organizations overcome risks, and become trusted advisors to our stakeholders depends greatly on our willingness to speak out.

By definition, courage is not easily achieved. It can involve danger and personal sacrifice. But courage is not courage when there’s nothing on the line.

As always, I look forward to your comments.​