A Lapse of Ethics
Whistleblower complaints prompt an audit committee chair to seek guidance from the organization’s chief audit executive.
Lisa is the hard-working chief audit executive (CAE) for Joyce Musical Instruments (JMI), a privately owned manufacturer and distributor of fine musical instruments and accessories. The firm is headquartered in the Midwestern United States, with additional facilities in Ireland, Hungary, Japan, Korea, the Philippines, and China. JMI employs nearly 1,800 people, and its annual revenues are approaching US $300 million.
Lisa heads the company’s four-person internal audit shop and oversees the annual audit plan. Her plan is based on The Committee of Sponsoring Organizations of the Treadway Commission’s (COSO’s) Internal Control–Integrated Framework and includes operational, financial, and compliance audits and reviews.
Following a recent audit committee meeting, Lisa received a telephone call from Cyndi Winters, JMI’s audit committee chair. Cyndi is troubled by findings from a quarterly review of concluded whistleblower investigations discussed at the meeting. Specifically, her concerns center around one case that involved a series of ethical lapses at one of the firm’s overseas facilities. The case involved allegations of unfair treatment of employees, personal use of company resources, and conflicts of interest, reportedly resulting in the turnover of skilled craftsmen who were unwilling to further tolerate management’s inattention to unethical practices.
Because of Lisa’s extensive company knowledge and trustworthiness, Cyndi wants to obtain her counsel before approaching Mike, the CEO, about expected next steps. She is looking for some viable options for preventing future ethical lapses, particularly in light of the sensitive nature of this situation. What should Lisa consider before responding to Cyndi’s request? What alternative solutions might she propose, including modifications to her annual audit plan and risk assessment?
Paulette Keller, CIA, CPA
Director of Audit Data Analytics
Before she responds to Cyndi, Lisa should gather additional information about the activities at the overseas facility in question. Both the audit committee and the ceo will want to know the extent of the problem in this facility and whether it is isolated to one particular business unit or more widespread. Lisa should obtain some preliminary quantitative data about the facility’s turnover rates, history of complaints, and expense trends; she may also want to examine the results of any employee surveys, if they occur on a regular basis. If the facility conducts employee exit interviews, this qualitative information may also provide some insight on ethical issues. The data could be benchmarked against other facilities or against other divisions in the facility to identify any adverse trends. Lisa will also want to review the outcome of the whistleblower investigation thoroughly for clues concerning the magnitude of the problem.
Ultimately, Lisa will need to provide her opinion on the ethics risks at this facility. Is there evidence to indicate that, at a systemic level, the company’s ethics checks and balances are not effective either across the entire facility or in particular facility divisions? To obtain a clearer picture of potential risks, Lisa could schedule an immediate ethics audit. She will first have to determine, however, whether her staff has the time and expertise to perform this type of audit. If staff members do not possess the necessary expertise, she may want to consider co-sourcing or outsourcing the assignment. Alternatively, Lisa could conduct focus group interviews or full employee surveys at the facility to obtain more information about the ethical climate. She should also consider conducting a companywide ethics audit to provide management and the board assurance on which elements of jmi’s ethics program work effectively and determine where opportunities for improvement may exist across the organization.
J. Graham Joscelyne, CIA, CA(SA)
Joscelyne + Associates Inc.
Audit Committee Chair, World Food Programme
Cyndi’s concern is justified — her company faces a significant reputational risk. In fact, the firm’s CEO, Mike, seems remiss in failing to raise the issue with the audit committee and offer a proposed remedy.
If management applies COSO as internal auditing does, issues such as tone at the top should have emerged at the overseas facility in question well before the whistle was blown. In fact, whistleblowing might not have been needed at all. Why did the unethical pattern of behavior fester for so long before coming to light? Perhaps the issue was brought forward, but headquarters management failed to take it seriously enough. If so, why did this occur? Moreover, if Mike was slow to act, what caused him to drop the ball? Beginning with these questions, Lisa should be able to assess whether tone at the top issues are local or more extensive. Knowing where the problem started will allow her to best focus her efforts.
Lisa should consider examining the relationships between headquarters and country-operation executives. Is headquarters management tolerating a star performer despite known lapses in ethical behavior? Lisa should determine how seriously ethical standards are taken across the company. For example, does jmi provide mandatory annual ethics training for all employees? Are management’s ethical standards at least equal to those of staff? If the company provides ethics training, is the course material relevant to jmi’s industry type and cross-cultural operations?
Once these bigger issues have been addressed, Lisa should know whether she needs to mount a rapid special audit at the overseas facility or broaden its scope to include headquarters. The audit’s results should influence her audit plan. Most importantly, she should review management’s remedial action in the near term and subsequently to gain assurance that it has the desired effect. Finally, because it has multiple facets, she should consider reviewing the ethics program itself and comparing it to international benchmarks. This relatively simple review will identify the areas where JMI’s ethics program is not fully developed and help Mike and Cyndi determine the appropriate next steps.
John Parsons, CIPFA
Global Fund to Fight AIDS, TB, and Malaria
If the allegations from the concluded whistleblower investigation are true, Lisa should advise Cyndi that the individuals responsible for the “ethical lapses” must be held accountable and that reimbursement must be sought for company resources subjected to personal use. Sanctions should be imposed on the individuals involved. For example, Lisa would need Cyndi’s support to refer the case to the human resources department so that JMI’s disciplinary procedures can be brought into play. The ultimate sanction internally would be dismissal, and Cyndi should advise the CEO not to flinch from taking that course. Demonstrating that jmi has zero tolerance for unethical conduct would send a strong message to employees throughout the organization.
If criminal conduct was established, Cyndi should tell Mike that the case must be referred to local law enforcement agencies promptly. The CEO may hesitate to follow this course, due to the possibility of media coverage. However, Cyndi should explain to him that involving law enforcement actually places the organization in a positive light by showing it will not tolerate criminal behavior.
Lisa should also advise Cyndi to recommend that the CEO report any imposed sanctions in the company’s internal newsletter. The companywide exposure would send a strong deterrent message to other employees.
Finally, Lisa’s audit department should review the overseas facility to determine what control shortcomings allowed the ethical lapses to occur. The results from this review may prompt her to propose a full audit of the facility.