Thank You!

You are attempting to access subscriber-restricted content.

Are You Ready to Experience Everything Internal Auditor (Ia) Has to Offer?

​6 Myths of Business Ethics

Internal auditors should examine several “tacit truths” that often hinder organizational ethics.

Comments Views

Recent corporate scandals at companies such as Nike, Volkswagen, and Wells Fargo have spotlighted the negative impact of poor ethical cultures. Meanwhile, public trust in business and government is low.

Ethics is a key part of corporate governance. The past three decades have seen several moves to improve business governance and ethics: The Committee of Sponsoring Organizations of the Treadway Commission’s Internal Control–Integrated Framework, the U.S. Sentencing Reform Act, and the U.S. Sarbanes-Oxley Act of 2002 and similar legislation in other countries.

Ethics is a cornerstone of internal auditing, as well, both in terms of the ethics of practitioners and the profession’s role in providing assurance of organizations’ ethical practices. The International Standards for the Professional Practice of Internal Auditing Standard 2110: Governance calls on the internal audit function to assess the organization’s ethical climate, and The IIA’s Practice Guide on Evaluating Ethics-related Programs and Activities describes procedures to help auditors review organizational ethics. 

Yet, in addressing ethics, organizations and internal audit often are hindered by several myths. Internal auditors should step back and assess whether these “tacit truths” about ethics are actually helping organizations become more ethical. 

Myth 1: The code of Conduct Supports Ethical Behavior

The first step in planning an audit of ethics is to check whether the organization has a code of ethics or conduct designed to help the organization and its stakeholders behave ethically. In fact, most publicly traded companies around the world are legally required to have a code in place. 

However, the main risk is not whether the code of conduct exists, but how it is used in the organization. There is mixed evidence that conduct codes actually help improve the ethical climate. Implementing a code of conduct could reduce ethical behavior, according to a 2011 study published in Decision Sciences Journal. A 2005 Harvard Business School study shows that the main goal of such codes is not to improve an organization’s ethical climate but to reduce possible legal fines in case of prosecution. Moreover, a 2018 Harvard Business Review study conducted by Hui Chen and Eugene Soltes found that a code of ethics has no impact on ethical decision-making. 

How to address this myth Internal auditors should examine the actual practices of their organization’s code of conduct. Employees annually signing the code, checking for specific compliance policies in place to support and provide additional guidance on key components of the code, and conducting focus groups or surveys to assess the code of conduct are not enough. Based on various behavior experiments, the best practice is to require decision-makers to read and sign a statement that they are complying with the code before making every major decision, according to the book The Honest Truth About Dishonesty by Dan Ariely.

Myth 2: The Compliance Program Helps the Organization Become More Ethical

The average multinational company spends several million dollars a year on compliance, which can be even greater in highly regulated industries such as finance and defense, according to the 2018 Harvard Business Review article by Chen and Soltes. Despite such spending, executives complain that compliance does not offer any tangible ethical benefits. Putting these two trends together, executives are struggling to see how compliance can help improve ethics in the organization. 

Compliance programs are caught in the same dilemma as ethics codes: The primary goal is to satisfy regulatory requirements or reduce penalties, rather than actually help the organization become more ethical. Internal auditors also should keep in mind that compliance issues are not the same as ethical issues — what is legal is not the same as what is ethical and vice versa.

How to address this myth For compliance programs to have a meaningful impact, internal auditors need to test what works and what doesn’t. The compliance program should experiment and innovate. One way is to test assumptions about how people actually behave versus what they say they do. Compliance should test which programs or internal controls work — using hypothesis testing or control and testing groups — to see why people do not follow the rules and how rules should be presented to them. For example, some people respond more to visual information, so for them, rules should be presented in a different form than for those who respond more to audio. 

Myth 3: Whistleblowing Tolls Reduce the Risks of Unethical Behavior

The recent case of Nike, which faces gender discrimination lawsuits despite taking steps to alter its culture, shows that sometimes, even if the tools of enhancing ethics in an organization are enforced and communicated, unethical behavior may persist. EY’s 14th Global Fraud Survey finds that people do not want to report wrongdoing and that reporting comes with significant risk. Challenging the status quo in any organization threatens people’s status and relationships with their supervisors and colleagues. Moreover, whistleblowing can be a self-serving tool when combined with the bystander effect — when a person is in trouble, others who are present often fail to intervene because they assume other people will do so or because they think it’s not their place to act. 

How to address this myth The objective of whistleblowing should be to detect wrongdoing more timely. There are several ways whistleblowing can achieve this goal: 

  • Establish legal protection for whistleblowing at the national, industry, organizational, and labor contract levels.
  • Offer financial benefits to whistleblowers.
  • Test whether the hotline works and is confidential — for example, by using “mystery tester” reports.
  • Conduct a mock performance of unethical behavior, such as deliberately backdating and signing a document in front of employees or staging an act of employee harassment, to test whether anyone reports it.

Myth 4: More Training in Ethics is Better

The common way to measure ethical training programs is with completion rates, which are normally between 90% and 95%, according to Deloitte and Compliance Week’s 2016 Compliance Trends Survey. The problem is that this metric shows neither the quality of the training nor its effectiveness. Research by Carmel Herington and Scott Weaven shows that more training in ethics is not better and can sometimes reduce the engagement of employees. However, training programs are easy to measure, and managers therefore encourage using them. 

How to address this myth The organization should strive for the quality or customization of training for each employee. Ethical behavior is not something that is the result of policies but is a practice that, as Aristotle says, becomes part of the person when in use. Organizations should tailor ethics programs to the individual’s specific need, moral development, and character. At the very least, customization should be based on functions and corporate hierarchy, followed by measurement of employees’ moral development, with subsequent training sessions grouped based on the results. Ideally, training should be conducted in person rather than online and use real examples from people and organizations — especially ethical dilemmas that do not have an easy fix. 

Myth 5: Individual Unethical Character Can Be Curbed With the Right Internal Controls

One outcome of the 2008 financial crisis is that it provided evidence that the character of executives was a contributing factor to the worldwide crisis. For auditors, it should be clear that personality and character are not the same. The main difference is that personality may change over time, but character remains the same. 

Also, personality is the range of distinctive personal qualities and traits of an individual, but character refers to a set of morals and beliefs that defines how the individual treats others or behaves with others and himself. Changing character is not possible, though organizations are spending millions of dollars on these kinds of programs. 

How to address this myth When an employee is already in the organization, it is fruitless to try to change his or her character to become more ethical. The root cause lies in the hiring process. Human resources practices are normally good at testing or examining the technical competencies of candidates as well as evaluating personal traits. When it comes to testing the ethical character of the candidates, most organizations fall flat. Internal auditors should check whether the organization’s hiring practices examine job candidates’ moral development. One well-established test is the Heinz dilemma, a thought experiment developed by psychologist Lawrence Kohlberg to assess moral reasoning skills, which ranks participants along six stages ranging from obedience to universal ethical principles. 

Myth 6: Goals Related to Ethics or Compliance Help Organizations and Individuals Behave More Ethically

When Enron went bankrupt, both independent investigators and company officials were clear: Enron’s goal-setting practices, which involved setting difficult and specific performance goals for employees, were at the heart of the misconduct. In fact, many of the goals were connected directly to compliance and ethics, such as ethics training completion rates and regulatory fines paid. Moreover, a growing body of academic research demonstrates that giving people specific, challenging performance goals can cause them to cheat on tasks or misrepresent their performance. In addition, pressures that companies face striving for quarterly earnings targets or personal goals in employees’ annual appraisal interviews can contribute to unethical behaviors. 

How to address this myth If goals can lead to unethical behavior, following the organization’s purpose can help build ethical behavior, according to Nine Lies About Work by Marcus Buckingham and Ashley Goodall. When the organization has a purpose beyond maximizing value or profit, employees develop a sense of belonging and behave more ethically no matter the specified goals. Moreover, strides in ethical behavior result from practice and repetition, which should be integral to the organization’s approach. 

Reflective thinking can help with this process. Reflective thinking is the critical-thinking process that refers specifically to analyzing and making judgments about what has happened. Reading clubs that feature books that deal with ethical issues, regular meetings about ethical decision-making, and ethics “hackathons” — exercises that examine the ethical implications of a particular technology — are some methods to foster reflective thinking in the organization.

Being Courageous

In letting go of these well-intentioned but misguided myths about ethics, internal auditors should use critical thinking to challenge principles or practices that seem to be great at first, but actually could only be fads. The foundations of critical thinking are Socratic questioning of evidence, closely examining reasoning and assumptions, analyzing basic concepts, and tracing implications both of what is said and of what is done. Especially where business ethics has challenges and old ways of doing things that do not work anymore, critical thinking becomes essential. 

Courage is another integral part of auditing ethics. To speak up and show where the ethical risks lie sometimes involves going beyond the limits of the organization. Internal auditors should have the courage to go further and not be afraid. 

Ethics is a struggle against human nature. New threats lie everywhere, and sometimes people test the boundaries. It is the auditor’s role to gather his or her courage and say “no” to these temptations, and to believe that sometimes it takes just one individual to change the way people and organizations behave.

Matej Drašček
Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to remove comments.

About the Author



Matej DraŝĉekMatej Draŝĉek<p>Matej Draŝĉek, CIA, CRMA, is the chief audit executive at LON Bank d.d. in Kranj, Slovenia.<br></p>


Comment on this article

comments powered by Disqus
  • AuditBoard-November-2021-Premium-1
  • OnRisk-2022-November-2021-Premium-2
  • 2021-All-Star-Conference-November-2021-Premium-3



Stopwatch Auditing Auditing
Thanks, We Already Know That, We Already Know That
Hidden Goals Goals
Building a Better Auditor: Which Way Should I Go? a Better Auditor: Which Way Should I Go?