Thank You!

You are attempting to access subscriber-restricted content.

Are You Ready to Experience Everything Internal Auditor (Ia) Has to Offer?

​​​Into the Light​

#MeToo is shining a light on the harassment women have faced in the workplace for decades and have been afraid to report.​

Comments Views

When the dust settles, disgraced movie mogul Harvey Weinstein may actually end up helping women in the workplace. More than 85 women have come forward with their stories of sexual harassment and sexual assault at the hands of Weinstein, including retaliation in the form of blacklisting them from acting jobs for rejecting his advances. 

The Weinstein scandal has become a social media firestorm that has propelled a movement — #MeToo — thousands of tweets, Instagram posts, and press conference comments, raising the profile of sexual harassment on legislative agendas and in corporate boardrooms. Publicity around the topic is drawing attention to the risks harassment represents and the processes companies implement to manage those risks — areas where internal auditors are key players in their organizations’ harassment prevention and mitigation efforts.

A Shift in Response

​​History of #MeToo

Corporations addressing the risks represented by sexual harassment can thank civil rights activist Tarana Burke for spurring the improvements they’re making. She first used “Me, Too” in 2006 as shorthand for efforts to unify behind changing the harassment paradigm. In 2017, she was among the “Silence Breakers” Time named as “Person of the Year.” Actress Alyssa Milano took a friend’s advice to flood Twitter with the phrase, urging women who’ve been harassed or assaulted to retweet the two words. Her effort generated more than 200,000 responses in 24 hours. It became a top topic on Facebook, and Time’s Up, a defense fund and pressure group, formed to keep the message moving. ​

Is the definition of sexual harassment changing? Betty McPhilimy, retired chief audit executive (CAE) at Northwestern University in Evanston, Ill., says no. Rather, “clarity is setting in.” Personal workplace priorities haven’t changed, either, she adds: “Everyone wants to be treated with respect.” 

Brian Koegle, a partner in the employment and labor law department of the Los Angeles office of Poole & Shaffery LLP, agrees. “Legally speaking, the definition of harassment in the workplace has not changed,” he says. “It does evolve, but there have been no material changes to the definition or to how it’s interpreted under federal or state law for the better part of 15 years.” 

What’s recently changed is the mix. “From the late 1980s until about 10 months ago, the most prevalent legal claims involved harassers creating hostile work environments,” Koegle says. “But now the overt, obscene cases are coming up more frequently, which we hadn’t seen for years until the Weinstein scandal broke.” He attributes this to the empowerment movement the scandal has spawned, where “women are feeling strong enough to come forward and say what’s actually happening after decades of fearing being blackballed.” The change, he adds, is especially evident in Hollywood, where there’s a groundswell of support. “It’s a social norm shift, rather than a legal shift.” 

“Corporate response is changing, with more attention and responsibility focused on harassment issues and policies,” says Bettina Deynes, chief human resources officer at the Society for Human Resource Management, in Alexandria, Va. “The acceptance of primary responsibility for policy and enforcement by management is also increasing.” Human resources, she adds, must “create and publish policies that are clear and effective and that have strict penalties for unacceptable behavior.” It also must be simpler and less intimidating to report incidents of sexual harassment. “It’s a necessity,” she stresses, because “the risks of sexual harassment — lawsuits, internal conflicts, and employee terminations — are increasing.”

Cases Are Climbing

While the U.S. Equal Employment Opportunity Commission (EEOC) has not reported a surge in the number of harassment claims, Koegle says that it’s been exactly the opposite. “We’ve conducted more workplace investigations in the last four months than in the last five years, and we’re seeing more written in journals on harassment,” he says. There may be an explanation for the EEOC’s numbers, according to Robin Shea, an attorney with the Encino, Calif., firm Constangy Brooks Smith & Prophete LLP. In a blog post, Shea says the EEOC reporting period ended Sept. 30, before #MeToo gained prominence. “Brace yourself for 2018,” she says in the blog. “Retaliation was the most common claim in 2017, and pre-litigation monetary relief in harassment charges was at its highest since 2010.”

As women read more #MeToo stories, some may realize that an incident in their past — that at the time they felt was inappropriate — was, in fact, sexual harassment. Social media is causing the estimated 85 percent to 95 percent of women who don’t report the incident when it happens to reflect and come forward with their own stories. “I look back and I’m dumbfounded that I didn’t leave or tell someone,” says Tori Reid, a West Hollywood, Calif.-based actress, writer, and producer who grew up in a show business family. “I didn’t have kids to raise. I wasn’t desperate to keep the job. I guess I didn’t realize it was harassment. On a certain level, in the back of your mind, it’s the way we’ve known the entertainment workplace to be .” She avoided the worst of it. “Sixty percent of the work was making sure my boss didn’t put his hands on me,” she says. “I was dodging and ducking.” This year, she participated in the #MeToo unity demonstration at ​the Golden Globe Awards.

Harassment victims have testified about “slaps on the butt, repeated comments about breast size, and requests for sex,” a Kaiser Health News report found. And men are victims, too. A 1998 U.S. Supreme Court ruling in Oncale v. Sundowner Offshore Services Inc. said same-sex harassment of both sexes is actionable, and juries have held women responsible for harassing men. 

What's at Risk

More about sexual harassment in the workplace:

Regardless of gender, this behavior has “a cumulative long-term negative impact on performance,” says Ed Lynch, assistant professor in the Department of Accounting at California State University at Fullerton’s Mihaylo College of Business and Economics. According to the Washington, D.C.-based National Women’s Law Center (NWLC), “victims suffer profound economic and emotional harm” — and its physical manifestations. Up to 70 percent of women and 45 percent of men have experienced harassment, University of Maine sociologist Amy Blackstone recently told Many victims feel self-doubt that turns into self-blame, which then turns into depression — and, for some women, post-traumatic stress disorder. Harassment has been tied to a range of stress-like physiological reactions, including sleep disturbances, neck pain, increased risk of cardiovascular disease, and, in extreme cases, increased risk of suicide. 

The primary effects can destroy economic and career well-being. The New York Times examined the damage that fear of harassment allegations can cause to mentor-like relationships young executives develop with senior leaders. “All too often, we wind up prosecuting the victim as much as the alleged harasser,” Koegle points out, “with all the gossip and innuendo that can surround workplace harassment allegations.” One of the most important elements of an investigation, he says, is “making sure victims feel the company is supporting them, that someone’s got their back, and that nothing happens to them that’s retaliatory.”

There should be greater transparency in complaint handling, Lynch says, including how companies develop codes of conduct and related training and how they craft policies for follow up. He argues that transparency “enables the identification of prevention best practices” and outweighs any risk of reputation damage, which actually acts as an incentive for change.

Employers' Risks Rising, Too 

In fact, organizations risk image damage anyway. “The primary risk is reputation,” says Robert Kuling, a partner in Enterprise Risk Services at Deloitte Canada in Calgary. “Getting into the public domain with issues around discrimination and harassment can absolutely destroy a company’s brand and trust.” For example:

  • Weinstein’s studio has filed for bankruptcy, CNN reports, and terminated all confidentiality agreements that have kept more people from coming forward. Lantern Capital Partners agreed to acquire the studio after a separate deal to sell the assets fell apart. 
  • The CBC News website reported that Toronto’s Soulpepper Theatre Co. lost $375,000 in planned federal funding after its artistic director, who resigned, was accused of sexual misconduct and harassment by four actresses. The women are suing for $4.25 million in damages from Soulpepper and $3.6 million from the executive. Canada’s Heritage Minister told CBC News that arts organizations lacking best practices for harassment and bullying also may be blocked from future funding. 
  • After sexual harassment allegations targeted former CEO Steve Wynn, the Boston Herald reported that a casino under construction there would probably not carry Wynn’s name. Wynn stepped down and sold his shares, but the allegations caused Wynn Resorts stocks to plummet. Wynn reportedly settled one harassment suit for $7.5 million; regulators in Nevada and Massachusetts and in Macau, China, are examining the company.

The secondary risk organizations face is civil litigation saying the company didn’t do an appropriate job of providing a safe workplace, Kuling says. The government of Alberta recently amended safe workplace legislation to include mitigating the risk of discrimination and harassment, for example. “Harassment can be treated as a workplace injury,” he explains, creating regulatory risk as organizations prepare for and comply with their obligations under the law. 

The third risk that’s developing, Kuling adds, “is where internal auditors can do a much better job: employee turnover.” People who don’t report harassment may just leave, he explains, and not mention the reason during exit interviews. But when internal audit conducts culture assessments, investigators “might get indicators of harassment and discrimination issues,” he says, adding that “the professional skepticism of internal auditors has to come to the forefront. That data could then inform future audits of turnover statistics.”

An ongoing culture of harassment and discrimination, Kuling argues, even if localized to a department, “is going to be hard to hide.” Lynch agrees and adds that internal audit should be prepared to identify and report suspicious behavior while working every assignment. “Th​e nature of internal audit brings the auditor in contact with a wide range of employees,” Lynch says. “Every internal auditor should receive training on identifying evidence of sexual harassment, or a failed reporting mechanism, and every audit report should provide an opportunity for the auditor to comment on compliance with the code of conduct.” 

​​How Internal Audit Can Help Address Sexual Harassment Risks​

Internal audit has a responsibility to provide assurance that risks around sexual harassment policies, procedures, and reporting are being managed.

  • Follow U.S. Equal Employment Opportunity Commission guidance, Proposed Enforcement Guidance on Unlawful Harassment (January 2017), which sets the expectation that employers are being proactive in eliminating workplace harassment. It also outlines five core principles that have proven effective.
  • Make sure there is a written policy on how to handle harassment, discrimination, or retaliation claims. The absence of a written policy almost automatically triggers liability, Brian Koegle says. Policies need to address everybody in the liability universe — full-time and part-time employees, independent contractors, vendors, and clients who each pose some risk of potential liability. 
  • Make sure company codes of conduct include examples of inappropriate behavior, Ed Lynch advises. Relevant examples are critical, he says, “because they serve as bright lines and consequently need to be continuously updated to reflect the changing work environments within each company.”
  • Human resources should conduct training and communicate to employees about how and where to report sexual harassment. Even with policies in place, not everyone knows the process for reporting.
  • Make sure there is an anti-retaliation policy. Inform personnel that the hotline may not only be used for obtaining information and reporting concerns, but also for reporting issues of retaliation. The code of conduct should plainly state that retaliation against anyone reporting harassment in good faith is a significant, punishable violation.
  • Compliance isn’t enough. Testing the effectiveness of compliance programs is another step and leveraging them to mitigate underlying risk is still another. That’s part of the reason The Committee of Sponsoring Organizations of the Treadway Commission has an internal controls framework and an enterprise risk management framework. 
  • Internal audit or the chief compliance officer should report on the effectiveness of a company’s hotline to the audit committee. “Having lines of communication and, ultimately, an objective, confidential hotline process to lodge concerns to someone from outside that unit who will investigate is a critical control,” Betty McPhilimy says. “You don’t want hotline complaints squelched by a senior manager. They should go up to the board so people feel the hotline is a credible resource.”
  • Don’t reinvent the controls wheel. Risk management around harassment usually requires no new tools. An organization’s performance reviews, open-door policies, escalation procedures, ombudsmen, incentives, disciplinary action procedures, and ethics and compliance hotlines are all designed to accommodate anything that comes up, including sexual harassment. 

Being Proactive 

Organizations need to act, Kuling stresses. “Boards of directors need to have conversations with executive leaders around the culture of their organizations, and then be prepared to invest time and resources to seek assurance that these risks are being managed appropriately.” Deynes adds: “Internal audit can assist human resources in designing processes that confidentially discover existing problems and report them to the appropriate internal or external authorities. Legal can and should provide all necessary avenues for the execution of severe internal penalties and external prosecution for offenders.”

But organizations must ensure they don’t attack harassment with processes that simply separate the sexes. The New York Times reported that “some male investors have declined one-on-one meetings with women or rescheduled them from restaurants to conference rooms” because they worry about comments being misunderstood and becoming career-enders. 

“That’s bad,” says Phyllis Hartman of PGHR Consulting Inc. in Freedom, Pa. “Clearly, we have to work together, and we’ve got to help people communicate respectfully, even when perceptions differ as far as how and when to say ‘lay off’ and end it then and there.” When managers say they’re afraid to talk to female employees, she tells them: “You probably can’t get into trouble talking about work. It’s highly unlikely you’ll be falsely accused.” And if a woman finds herself in a situation where she is “systematically excluded from important meetings and opportunities” or if her supervisor acts “in ways that adversely affect her advancement opportunities, learning opportunities, and so on,” she could legally claim discrimination under the Civil Rights Act of 1964. 

Handling Harassment 

What happens after sexual harassment is reported is critical, and internal audit has an important role in ensuring retaliation isn’t tolerated. Those acts, the NWLC points out, include a reprimand or other discipline, including termination; transfers to less-desirable positions or work schedules; and threats to report people to law enforcement based on immigration status. In some cases, just the threat of being penalized for speaking up constitutes retaliation, because the risk of career damage or being labeled a troublemaker is real. 

Enforcement varies by jurisdiction. In Europe, member states are bound by the European Commission’s Directive 2006/54/EC, which defines sexual harassment as conduct intended to “violate the dignity of a person by creating an intimidating, hostile, degrading, humiliating, or offensive environment,” and Directive 2012/29/EU, which requires “assessments to determine if victims are at risk of retaliation” — and calls on employers to “offer appropriate measures to protect them.” In the U.S., claims of workplace harassment and retaliation are handled differently by state. California, for example, is particularly aggressive, maintaining “an affirmative legal obligation to protect victims from retaliation,” Koegle says. “This includes requiring employee handbooks to address with specificity what you do to investigate, remediate, and prevent acts of retaliation.” 

A recent Harris Poll/CARE survey found that sexual harassment in the workplace isn’t illegal in nearly one-third of the world. One-third of respondents in India said it’s acceptable to whistle at colleagues, about the same as the portion of U.K. respondents from 25 to 35 who think touching a co-worker’s buttocks is fine.

Addressing the Future

Rehabilitation also is an important process concern, Hartman points out. In most cases, victims don’t want accusers fired, they just want it to stop — but returning an accused executive to meaningful leadership “takes a lot of work,” she says. “You have to help both parties deal with this, making sure perpetrators understand what they did wrong.” For victims, counseling is a good place to start, according to research published in Psychotherapy: Theory, Research, Practice, Training, the journal of the American Psychological Association. But the specifics, says Kuling, are best left to each to determine. “The complainants are the best source of what constitutes adequate resolution,” he says. 

Counseling often helps the alleged perpetrators, too. Hartman has coached executives accused of inappropriate behavior whose companies felt they could be rehabbed, often as a condition of returning to their former posts, and she stresses that success is situational, depending on what happened, how the two parties work together, and what the workplace is like. 

Staying Focused

It may trace its roots to a little hashtag and just five letters, but the media movement behind workplace sexual harassment has “helped organizations pay attention and give it serious thought,” McPhilimy says — and that implicates internal audit. “Part of internal audit’s role is looking for risks in human resources and employment,” she explains. “We have a big role to play in ensuring controls are in effect in hiring, managing, and evaluating personnel and ensuring effective interactions.” Essentially, making sure that there are training programs and policies and procedures that are documented, current, and effective. That’s a role internal audit always plays, of course. “It’s just that in the past, internal audit wasn’t so focused there,” she adds. “Maybe senior management didn’t think of internal audit as an effective tool for determining if there are problems in such areas. Particularly as it becomes a higher profile risk, though, that’s something internal audit should address with senior management.” 

Harassment Doesn't Discriminate

Most types of workplaces have faced harassment challenges, including universities, hospitals, and government. 

  • Higher education has taken more than one hit in cases that go far beyond harassment. Michigan State University (MSU) fac​​es recurring headlines related to assault complaints against disgraced former staff and Olympic gymnastics team physician Larry Nassar and other school officials. Johns Hopkins University paid almost $200 million to about 8,000 former patients of deceased gynecologist Nikita Levy to settle 2014 charges involving his use of a concealed camera to photograph them during exams. And at Pennsylvania State University, the conviction of former president Graham Spanier and a new movie about former head coach Joe Paterno have kept alive the sexual misconduct case against former assistant coach Jerry Sandusky.
  • A 2016 Research Letter published in the Journal of the American Medical Association, “Sexual Harassment and Discrimination Experiences of Academic Medical Faculty,” reports that 30 percent of women on medical faculties experience sexual harassment. Its author says, “harassment is more common in fields where there are strong power differentials.” 
  • In 2017, women working for U.S. Congress were “making fresh allegations of sexual harassment against unnamed members,” according to CNN. The Office of Compliance, which handles harassment complaints against members of Congress, paid victims more than $17 million, in 268 settlements, from 1997 to 2017 — including claims for racial, religious, or disability-related discrimination. 
  • recently reported that “state legislatures across the country have reeled in recent months under allegations that legislators harassed or assaulted staff, lobbyists, and even colleagues.” The website noted that more than a dozen have resigned, and some have been expelled. ​

Russell A. Jackson
Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to remove comments.

About the Author



Russell A. JacksonRussell A. Jackson<p>Russell A. Jackson is a freelance writer based in West Hollywood, Calif.​</p>


Comment on this article

comments powered by Disqus
  • Galvanize-September-2020-Premium-1
  • FSE-September-2020-Premium-2
  • Auditboard-September-2020-Premium-3