A lead auditor comes to work one day and is instructed to do an audit engagement with another auditor. However, the lead auditor is aware that the indicated team member is not independent with regard to the underlying audit subject. The prudent and diligent lead auditor presents this information to the relevant superior and asks that the team member be replaced. Yet, not only is the compromised auditor left on the engagement, but the lead auditor is then instructed not to share this information with anyone and to conduct the audit engagement as initially planned. What should the lead auditor do?
Standard 1100: Independence and Objectivity says internal auditors are expected to be objective and independent in performing their professional duties. However, there isn’t always specific guidance on how they should behave in situations that put ethical pressure on them. The first question is whether the auditor is even able to recognize such a situation. Once that is determined, the next relevant question is who can the auditor escalate the issue to. In such instances, the auditor may be afraid of losing his or her job by speaking up about these kinds of issues.
Several suggestions may help internal auditors deal with challenging ethical situations while protecting their own independence.
Start From the Beginning
Internal auditors are obligated to adhere to The IIA’s Code of Ethics, the principles and expectations that govern the behavior of auditors in conducting their work. The Code of Ethics comprises integrity, objectivity, confidentiality, and competency. Although these principles are general in their nature, each has minimum requirements for conduct and behavioral expectations. Ultimately, they set the tone for the ethical practice of internal auditing. Thus, understanding and keeping in mind the requirements outlined in the Code of Ethics is an excellent starting point for every internal auditor in preserving his or her independence and conducting ethical audit engagements (see The IIA’s implementation guidance on the Code of Ethics released in early 2019).
Presenting the situation realistically, based on facts, and with all the relevant details, can help auditors protect themselves. Internal auditors derive objective conclusions based on facts in their everyday work. By not speaking up, auditors can inadvertently become collaborators and supporters of ethical violations, which can impair their own independence. Regardless of the specific circumstances, auditors should be aware that working on an engagement with another auditor whose independence is impaired weakens the independence of all involved auditors and the entire audit engagement.
Ask for Advice
Some ethical problems may not have an obvious solution. One good option may be to ask colleagues with more experience for advice. Without necessarily presenting the underlying situation with complete details, auditors can get valuable advice on how to protect themselves and create a win-win situation for everyone involved. Additionally, auditors might find it useful for their own professional development to listen to the experiences of their colleagues. Hearing about ethical challenges that others have faced can help auditors recognize the indicators of independence impairment.
Create Ethical Safeguards
There are no rules that can help auditors preserve their independence in every situation they may encounter while doing their jobs. Being unaware of their impaired independence does not excuse auditors from responsibility. On the contrary, it is up to all auditors to recognize the situation they are in and to adequately protect themselves. With the right approach to engagements, auditors can eliminate the possibility of compromising their independence.
Some examples of situations that may adversely affect auditor independence include:
- Intimidation by management that makes the auditor concerned about his or her job.
- Personal relationships outside of the office with the CEO, chief financial officer, senior managers, chief audit executive (CAE), other auditors, or employees in the area being audited.
- Accepting gifts or favors from co-workers who may expect something in return.
- Assigning auditors to assurance engagements in their previous employment area less than one year after transitioning into internal audit.
- Expecting auditors to make business decisions and perform nonaudit-related operational tasks.
- Basing auditor compensation on the number of audit findings during engagements.
Escalate the Issue
One effective way to deal with an ethical dilemma in which there is a threat to an auditor’s independence is to escalate the issue. In the case of the lead auditor letting the audit supervisor know of a compromised team member and the supervisor keeping that auditor on the engagement, the lead auditor should ask the supervisor why he or she wants to move forward with that auditor. If there is good reason, the lead auditor should remind the supervisor that the International Standards for the Professional Practice of Internal Auditing requires that the impairment be disclosed to relevant parties. If escalating the issue to the direct supervisor does not help, the next step should be to escalate it within the audit department. If the CAE then does not address the issue, the lead auditor should consider the harm lack of independence might cause. If it is significant, other escalation possibilities should be considered. Whistleblowing systems and ethics hotlines, which are generally present in organizations today, can help auditors report any questionable situations they are dealing with without direct confrontation.
If an internal auditor is confronted with a situation that impairs his or her independence or that of a team member, and none of the actions taken has resolved the issue, then he or she should consider the long-term implications. As a last resort, an auditor can resign from the job. If an auditor’s independence were found to be compromised and he or she was working unethically, the auditor could not only be fired, but he or she could also lose all professional credibility, which can be difficult to regain.
The Basis of Board Trust
The IIA defines internal auditing as an “independent, objective assurance and consulting activity designed to add value and improve an organization’s operations.” Boards of directors rely on internal audit to provide them with reliable information for effective decision-making. This information is most trusted when it comes from an internal audit function that demonstrates its independence.