Summer 2009

Internal Auditors Help Prevent Inappropriate Activities From Being Swept Away

CORPORATE ETHICS IS A SLIPPERY BEAST, confounding, as it does, internal auditors’ efforts to label it, track it, and participate in managing it. Conceptual issues such as tone at the top, standards of ethical corporate behavior, and assurances that employees act appropriately may now be enshrined in U.S. federal law, courtesy of the U.S. Sarbanes-Oxley Act of 2002, but that doesn’t make them any easier for internal auditors to get their arms around. Indeed, in a recent survey conducted byThe IIA’s Global Audit Information Network, almost 15 percent of internal auditors said they don’t perform ethics audits because they’re “too hard.” Another 39 percent said that ethics audits aren’t part of their mandate or that they’re simply not the internal auditor’s job.

Other internal auditors say they review ethics every time they conduct an audit. “Some believe that in the course of undertaking regular audits, you are also ‘auditing ethics,’” says John Boyd, manager, prevention, with the Crime and Misconduct Commission (CMC), a Brisbane-based arm of the government of Queensland,Australia. “But technically you are getting one indicator of an organization’s ethical standards-but only one, and in an ad hoc way.” Brenda Cowell, senior integrity coordinator at Nexen Inc., in Calgary,Alberta, agrees. “There’s an ethics component to every audit,” she says, “but there are also ‘ethics audits,’ where you review your company’s entire ethics program.” Those programs, Cowell notes,may share little but nomenclature. An ethics program can be as simple as employees’ signing off on the company’s code of conduct or as complex as a comprehensive program that could include policy reviews, signoffs, training, communications, committee involvement, and investigations.

 Internal auditors setting out to perform an ethics audit face both their own concerns about the often uncharted territory of such tasks as well as the concerns of their colleagues and supervisors.Those concerns, experts say, can be allayed once such an audit is fully developed. Seemingly diaphanous notions can, in fact, be quantified and examined, and issues of appropriate versus inappropriate behavior can be addressed successfully.To accomplish that, though, internal auditors need to make sure they have adequate expertise in-house and approach ethics audits with a clear understanding of what they’re trying to accomplish.

LEARN FROM EXPERIENCE

The bottom line is ethics audits should pose no insurmountable challenges to internal auditors, says Greg Hollyman, chief internal auditor at South Africa Post Office Ltd. “An audit is an audit,” points out Hollyman, a member of The IIA’s Ethics Committee and chairman of IIA-South Africa. “An ethics audit uses the exact same processes, interviews, and documents as a standard business audit.”The IIA offers a variety of information tools that internal auditors can use to familiarize themselves with the issues at stake and the kinds of approaches they might take in an ethics audit. One thing is clear: Ethics is a part of an internal auditor’s job.

Continue Reading

> Learn more about the NASBA Center for the Public Trust

Related News