Internal Auditors – Beware of Your Own Ethical Lapses

Internal auditors are ethical, right? After all, we see ourselves as “beacons of ethical behavior,” shining a light on the misdeeds of others in our organizations. If you can’t trust the internal auditor, who can you trust? Yet, at the end of the day, we are also human. We are subject to the same pressures (culturally, politically, and organizationally) as everyone else in the enterprise. So, maybe we are vulnerable, after all.

But can we so complacent? I think not.

History is littered with instances in which the ethical compass of internal auditors appeared to fail, and rather spectacularly. The recent arrest and conviction of a public sector auditor in Uganda, for example, might be easily dismissed as an isolated transgression in a remote part of the world. But it is far from unique, and it reminds us yet again of the greater risks to our profession’s reputation.

I have long studied and addressed such indiscretions, including high profile cases in the U.S. and Europe. In some instances, the wayward internal auditors were accused of concealing audit results from the audit committee at the behest of senior management. In others, they took it upon themselves to withhold negative audit results to spare their organizations from embarrassment and bad publicity. In the end, each case ended as badly for the internal auditors as it did for management. Why? Because the cover-up is often worse than the crime!

After more than 47 years in the profession, I have personally encountered more than a few professional ethical dilemmas. They typically involved whether to “call it like it was,” despite the potential personal and professional consequences. Fortunately, I was always a little too naïve, foolish, or (maybe even) daring to care. I did what I felt I needed to do, what must be done. But I can easily see how others might take a different path. Unfortunately, when we do stray, we sacrifice not only our own professionalism, but we chip away at the greater reputation of our profession.

When I was the Global President and CEO of IIA Global, I often observed that “I would rather no one know what internal auditors do than to draw conclusions from those who do it poorly.”

A blog post is too short to explore the intricacies of every ethical dilemma we face. However, I’d like to offer several challenges that commonly arise. As I am sure you will agree, these situations can force us to face areas of gray rather than the pure black-and-white world in which we prefer to live. Try to answer each question as if you are facing the ethical dilemma yourself:

• You audit an area for which you were previously responsible and find major control deficiencies related to the period over which you exercised control. You hadn’t known about the deficiencies at the time. Would you report them?
• Your annual risk assessment identifies a key business process related to how the company performs during the winter holiday season. Scheduling the audit for the coming year means that you and your team will have to sacrifice the holidays with your family. Would you schedule it anyway?
• You audit an area in which a family member or close friend has key management responsibilities. You identify major problems. ​What do you do?
• You are in a rotational assignment in internal audit and slated to shift into another business unit in a year. You just audited the business unit in which you most want to work, but have some critical findings. Do you report them or sit on them?
• You are the chief audit executive (CAE) of a Fortune 500 company. Your audit team just identified potential violations of the Foreign Corrupt Practices Act. Disclosure would create havoc and bring disrepute to the company. Do you finalize the report and send it to the audit committee?
• You just completed an audit of the company’s expense reporting processes and found several violations of travel expense policies. However, you know that you do not personally comply with these policies. Do you call out noncompliance anyway?
• You have been accruing company stock in your 401(k) and stock options in your company since you accepted the role of CAE. Your audit team just delivered a draft audit report to you that cites a potentially serious fraud involving the company’s financial reporting. Disclosure would likely devastate the share value – along with your personal worth. What do you do?

My guess is that you are able to easily answer these questions. Of course, you would do the right thing. Yet, too often, I have seen those faced with these very real dilemmas fail to follow their moral compass. Don’t let that happen to you. Your career – and our profession – depend on it.