Being the Corporate Conscience: Where are the Boundaries?

Richard Chambers, CIA, CGAP, CCSA, CRMA, shares his personal reflections and insights on the internal audit profession. 


My colleague and fellow InternalAuditorOnline blogger Norman Marks recently wrote that "Internal Auditors Should Be Brave," meaning they should not hesitate to speak up about the things that need to be said, even if they face the prospect of retribution.

It reminded me of a Tone at the Top article in November 2009, the same year I became president and CEO of The IIA. That piece, called “What’s on Your (Corporate) Conscience?” (PDF) examined the role of internal auditors in ensuring an organization is behaving ethically.

I have blogged about the ethical responsibilities of internal auditors in the past. In April 2013, I discussed the “Seven Attributes of the Ethical Internal Audit Leader,” sharing the view that ethical internal audit leaders are “proactive.” I noted that “this may be the hidden trait in ethics; the one few think of. If you act only in a reactive manner, you are fulfilling only part of the ethical contract. While honesty and courage about past acts are important, it is just as important to keep an eye on the future and provide honesty and courage in reporting how situations can be averted. By acting proactively, you are exhibiting the deepest aspects of ethics — working to ensure things go right before they can go wrong.”

Last November, I asked the rhetorical question, “should internal auditors be willing to throw the flag before the play.” I discussed the various roles an internal auditor can play across what I called the “ethics continuum.” The aspirational role that I believe we should all be able to play on this continuum is that of the corporate conscience.

It all sounds pretty straightforward. If someone is or will be doing something wrong, we need to speak up early. But is it really that black and white?

I think we would all agree that we have a moral obligation to report on illegal activities, dangerous flaws, and defects. But what if your organization derives income from a perfectly legal product or service that, when used as intended, poses a known health risk? What is your moral and ethical obligation? What is your obligation as part of the corporate conscience?

What if it’s not your product, but your company’s manufacturing process or working conditions that pose the health risk? Maybe it’s not a problem within your organization, but with a third party with which you contract for goods or services.

At what point do internal auditors have a moral obligation to speak out for what’s right for society and the greater good, even if it flies in the face of pressures for profitability and shareholder value?

I’m not talking about questions that have been asked and answered. It would be foolish, for example, for an internal auditor at a tobacco company to take a stand against tobacco.

I’m talking about cases in which an organization might be considering a new line of business, or may be acquiring a business, or entering a contract with a supplier in a war-torn country. Moral risk must be considered, not only to protect the organization from potential reputational damage, but also because it is the right thing to do.

It is well-established that the best deterrent against fraud, bribery, and ethical compromise is a strong culture and ethical tone at the top.

Norman Marks is right: Internal auditors do have to be brave to stand up for what’s right. It’s also part of our job as internal auditors. As a profession, it is incumbent upon us to advocate for the right to be heard on issues of moral and ethical risks. To be part of the corporate conscience, we need to be guided by our own moral compass.

What do you think? Is it fair to expect internal auditors to be the corporate conscience? How far should we go?

Posted on Mar 3, 2014 by Richard Chambers

Share This Article:    

  1. Richard,

    I believe it is up to Auditors to find the best way to the truth.  Every company's culture is different and requires a different approach.  The Auditors are obligated to be professionally honest, however, there are different ways to "skin the cat".  Looking for win-wins in organizations is the key.  I covered this in my book the "Power of Integrity".  I personnally followed two different paths to establish a pro-active program.  One was easy because the culture was already set for Internal Audit Department to be one of the key leaders in the organization.  The other was trying to establish creditability in the Audit Department so a more educational and careful execution strategy was required to gain trust and creditability.  Finding the right way is "how far" in my opinion.  The Company's culture could make this a short or long journey.  Gary 

  1. Excellent article, Richard.  It's rare to come across a piece which asks us to do something "because it is the right thing to do", not (only) because it'd go towards (that bugbear) 'value addition', better governance, professional creditibility, and a host of such goals.  Coming from a culture which valued individual ethics (or at least used to, in the not so distant past), it sounds like a throwback to more... ummm... moral times (for want of a better word).  I'm all for it, and I guess this is something that has to be ingrained in us from the beginning, at every step, in education, training and orientations of all kind.

    Having said that, I do agree with Gary to the extent that it requires a different approach in every situation, sensitive to the context.  This may look like rationalizing, but sometimes my need to support a family may have a higher ethical ranking than my need to speak out (and thus jeopardise that overarching goal)!  (This may not apply though, to 'wants' - a contentious concept in itself - but only to bare needs.).


  1. Saying Internal Auditors have to be brave and stand up for what is right - is both a truthful statement and an easy out for the rest of management.  The trust is that we should all do that - regardless of our department, but that is easier said than done.  An internal auditor can put the concern on paper in the form of an audit result.  But once that is done, if the company decides not to address the concern - to accept the risk - is the auditor done?  That is, I believe, the key question for auditors.  If we believe information is being diluted before being raised up - what is our obligation to continue to raise the issue - and for how long?  and how high?  It is easy to say we must do it until it is resolved, but as debashis asks - is our need to support our family (and not lose our job) not also an ethical consideration?  I would love to see someone provide some concrete ideas for raising concerns while protecting ourselves from retaliation.

  1.  Many of us have faced situations where nothing could be done to overcome conduct or actions which we have reported and consider irregular, incorrect, unethical or illegal. In such cases we usually have no alternative but to seek employment elsewhere and where possible speak out or disclose quietly to others evidence that may be used eventually to correct the situation. No truly professional internal auditor can be expected to continue to pretend to be independent when his findings and recommendations regarding very serious infractions or irregularities are ignored, covered up or opposed. The great tragedy of these situations involves the support and welfare of the auditor's family. Thus it is imperative that an internal auditor create and maintain an impeccable reputation for professionalism and integrity so that if it becomes necessary to seek other employment, it may be found without problems.

  1. It is irresponsible for authors of articles like these to suggest that in these sour times, where no good deed shall go unpunished, the weakest members of an organization should impale themselves for no great cause. Todays corporate management care little about the truth. Their primary concern is perpetuating the lie of their greatness. They are willing to pay much to those who echo this deception. They will invest noting in that which speaks the truth or results in meaning full transformation. Rant against government intervention if you must, but it may be the only savior in this desperate situation.
  1. I agree with Richard and all the comments. It sounds like I am a fence-sitter, but I have always been a black and white person and I will continue to be, but I did also find out that life is not black and white, and the color in work is even more shades of gray. We all have the responsibility to carefully figure out what is the "bigger goood", and we have to survive to be able to serve the organizations we work for.

  1. It's scary being out on a limb, but sometimes you are negligent as an auditor if you don't go there.  I see my role as advisory, but there have been times that I've had to assert myself and nudge leaders in a particular direction.  It isn't easy, and you have to have good instincts about how far you can push your concerns, lest you fall out of the tree!

    I believe that auditors must pick their battles wisely, earning the respect of others by conducting such battles with the utmost respect and professionalism.  There is no better way to have a long-lasting positive impact on the control environment.

Leave a Reply