As past research has shown, and many practitioners can likely attest, audit findings that don’t meet clients’ approval can occasionally result in direct pressure to change the audit report. And in some cases, when resisting this pressure, auditors may even experience retaliation. Indeed, sometimes our work consists of much more than just following standards and writing reports. Political factors and unethical behavior create challenges that fall outside the normal realm of professional practice. Nonetheless, in every phase of the audit process — planning, performing, and communicating — auditors must have the courage to perform their work objectively and thoroughly, even in the face of fear and intimidation.
When planning, practitioners try to identify high-risk areas that could have the greatest impact on the organization’s ability to achieve its objectives. But often the most important areas are not immediately visible and consist of information entrusted to gatekeepers — usually management. Internal auditors must demonstrate the courage to examine these areas, even when clients may not want them to. At the same time, practitioners must not confuse courageousness with recklessness. An overly aggressive approach could lead to management and the board pushing back as well as increasing barriers to the information auditors need.
During the performance of audit engagements, practitioners could encounter numerous situations that call for professional courage. For example, in an organization with poor cultural practices, senior management might try to overpower or even bully auditors during information-gathering or attempt to conceal documents. Moreover, performing assessments may involve asking tough questions, which can be intimidating — especially when directed at those in power. These situations require internal auditors to show bravery, challenge the client, and pose questions no one else wants to ask.
Finally, when communicating results, especially to the board, practitioners need to report as objectively as possible. Communications must be measured and accurate to maintain credibility, and auditors need to avoid overstepping their bounds. Moreover, political savvy goes hand in hand with being courageous — as a quote often attributed to Winston Churchill states, “Courage is what it takes to stand up and speak; courage is also what it takes to sit down and listen.” A combination of assertiveness and diplomacy goes a long way toward achieving a successful outcome.
Perhaps Mark Twain said it best when he described courage as the foundation of integrity. For internal auditors, courage should be foundational to professional practice, along with objectivity, due professional care, and competency. We should always be willing to ask stakeholders demanding questions, stand for what is right, avoid falling prey to the pressure of others, and act for the benefit of the organization and society. Courage doesn’t mean you don’t feel afraid; it means you don’t let fear stop you.