During a recent wide-ranging interview with a well-known editor of a global business journal, the issue of CAEs dealing with unethical corporate behavior came up. Part of the discussion included the topic of CAEs having the courage to confront the very people who sign their paychecks.

At one point she asked a simple yet compelling question, “Is the cost of courage unemployment?”

The vast majority of CAEs will successfully navigate their careers without having to deploy extraordinary courage in the face of illegal or unethical behavior by their companies or executives.

However, from Cynthia Cooper at WorldCom to Michael Woodford at Olympus, there are a number of examples of courageous corporate executives who put their careers on the line to speak out against fraud and criminal behavior. These high-profile and celebrated examples of bravery against seemingly overwhelming odds should be praised and celebrated. But in reality most cases of CAEs “doing the right thing” and the fallout they sometimes suffer go largely unnoticed.

Ultimately, all CAEs and those who aspire to the position must ponder what they would do if faced with such ethical challenges. There are some situations where the decision is pretty clear cut, such as discovering that the board and senior management are involved in pervasive criminal activities that could endanger the organization or even lives. Speaking out is ethically and morally imperative, even if it means putting your livelihood on the line. But most ethical dilemmas, while important, aren’t so black and white.

There are a number of factors to consider when confronting ethical or legal quandaries. What do our professional standards mandate? What about work-life concerns? Are there strategies to avoid having to make the ultimate sacrifice of walking away from the job?

The IIA’s Code of Ethics, part of the International Professional Practices Framework, provides guidance on the narrow circumstances when it is appropriate to disclose information outside of the organization. Internal auditors have a duty to protect information given to them in the course of their engagements “unless there is a legal or professional obligation” to disclose it, according to the confidentiality clause of the Code.

The Code also admonishes that internal auditors shall not use information for “any personal gain.” This adds a significant wrinkle with the advent of whistleblower programs that offer financial rewards for those who speak out. Such awards are not without precedent for internal auditors. The U.S. Securities and Exchange Commission (SEC), which established whistleblower rules specific to the profession, made its first award to an internal audit practitioner in 2014.

It is unclear whether the whistleblower in the SEC case met the Code’s burden of “legal or professional obligation” to disclose. Additionally, the financial windfall could be seen as a conflict with the Code.

This raises the issue of work-life implications. CAEs must weigh putting their jobs in jeopardy against making a mortgage payment or paying for a child’s college tuition. As harsh as it may sound, the prospect of unemployment should never outweigh doing the right thing. I often warn those who aspire to the CAE role not accept a position if they don’t believe they can make this hard decision.

But a good CAE can mitigate that risk. One of the fundamentals for good internal audit is to create strong, trusting, and honest communications with the audit committee and management. These kind of relationships can lead to frank and open discussions with management and the board about ethical and moral conflicts.

Cooper addresses making the right choices in the epilogue of her book about the WorldCom scandal, Extraordinary Circumstances. She offers sound advice on establishing and strengthening a personal moral foundation and understanding how it can be weakened through rationalization and fear.

Her guidance includes:

• Know what you believe is right and wrong.
• Guard against being lulled into thinking you’re not capable of making bad decisions.
• What’s legal and what’s ethical are sometimes different.
• Pay attention to your instincts.
• Above being loyal to your superiors, be loyal to your principles.

She also counsels internal auditors to, “find your courage.” Courage means many things to many people, so thinking about it and discussing it with others you trust can help you establish your moral foundation. For me, courage is the willingness to do what’s right despite the personal circumstances. To paraphrase Ambrose Redmoon, “Courage is not the absence of fear. Courage is acting in the face of fear.” As always, I look forward to your comments.