October 2013

Take Me Out to the Ball Game


After attending the Major League Baseball playoffs, a senior auditor struggles over whether to report what appears to be an ethics violation committed by her company’s chief audit executive.


By Michael Marinaccio

Stacey is a senior auditor for Big Pharma, a US $100 billion provider of prescription medicines, vaccines, and consumer care products, with operations in more than 80 countries. Last year, Big Pharma’s audit committee requested that the company’s chief audit executive (CAE) and controller jointly solicit quotes to determine if its annual external audit is still competitively priced. The CAE has tasked Stacey with reviewing the incoming quotes and recording the proposal terms and conditions, providing an analysis and comparison to assist management with its selection process. The proposals are currently underway, with four accounting firms — including the current audit provider — under consideration.

Big Pharma is located in a major metropolitan area where professional sports teams are very popular and attending games after work with colleagues and friends is an integral part of the local culture. In fact, Stacey and her friends attended several Major League Baseball games this past summer. The home team has had an outstanding season and is now competing in the League playoffs. And while playoff tickets can be extremely difficult to obtain, Stacey’s roommate secured two seats for one of the games and invited Stacey to join her. 

While attending the game, Stacey’s attention was drawn away from the ball field for a moment by the sight of some familiar faces in the crowd. From a distance, she spotted Big Pharma’s CAE and controller, accompanied by the firm’s current external audit engagement partner. The three of them were seated in the front row behind home plate in what appeared to be excellent seats. Initially, Stacey thought she might be mistaken, but when the game ended she got a closer look as the three men exited the ballpark. She was pretty sure they hadn’t seen her.

At home later that evening, Stacey watched a rebroadcast of the game on a local television network. Through the miracle of high definition video, she was able to definitively confirm the CAE, controller, and external auditor’s identity as well as their presence in the front row behind home plate. The whole incident troubled her deeply. She found the trio’s attendance at the game, in premium seats, highly questionable, especially during the external audit proposal process. She flipped open her laptop and accessed Big Pharma’s ethics policy. There she found the following section:

Accepting tickets valued at greater than $250, or tickets to highly sought-after events where the actual value of the ticket is much greater than the printed or face value, is not permissible absent pre-approval of your manager and the chief compliance and ethics officer. Examples of such “big ticket” events where pre-approval is required include the Super Bowl, the World Series, the Stanley Cup Finals, and any playoffs leading up to any of the foregoing events.”

Stacey had no way of knowing whether or not these executives had obtained pre-approval; however, the likelihood that approval would have been granted under the circumstances seemed doubtful. She picked up the telephone and began dialing the company’s 24-hour ethics hotline, but then suddenly hung up. Stacey’s mind raced as she weighed the pros and cons of raising her concerns. If you were Stacey, what would you do? 

Investigating her own call
I realize this wasn't part of the article, but what would happen if Stacey called the ethics hotline, and was then assigned to investigate her own call? If she's a senior auditor at the company, the possibility of this occurring doesn't seem unreasonable. Does she then have to disclose that she was the one who called?
Posted By: Wes
2013-10-03 12:15 PM
Report and leave it to authorities
Stacey should report is anonymously and let the company's process take over from there. SHE SHOULD NOT INVESTIGATE IT HERSELF. Doing so would potentially harm the actual investigation, and potentially expose her to possible retaliation (she may become visible while investigating).
Posted By: Don Mapes
2013-10-03 10:47 AM
Stacey: make the call
Stacey does not know whether an ethics violation has actually occurred, but she knows it is questionable based on the appearance it gives. As an employee (in any department), Stacey has an obligation to report what she saw in the manner prescribed in the company’s ethics policy. As an internal auditor, Stacey has an additional obligation to not be a party to any discreditable acts. In my view, “party” includes “witness.” Further, Stacey should not forget that she is also involved in the selection process (analyzing and comparing quotes to assist management).
Posted By: Jim Waldrop
2013-10-03 10:37 AM
The Ball Game - Report or Not?
I see several different possibilities. First, the three of them may be friends and have purchased the tickets separately and attended together. Second, the Accounting firm did provide the tickets. Third, they all attended the game on their own and discovered the seats empty and moved to them together. Worst case scenario, the CAE and Controller should be disciplined as others would have been in the same situation. Best case, the CAE and Controller should declare their lack of independence and be excluded from the discussions and decision making of a new external auditor. The Audit Committee and Board should be made aware of the potential ethical issue after a complete investigation is performed by an independent party. I would imagine the Compliance Officer has a working relationship with the CAE that would preclude him/her from doing an adequate investigation. Plus the appearance of a working relationship would not assure a clear line of independence. If it were me, I would definitely call the ethics line to report it. At least my concience would be clear. Although I would probably end up watching for other signs of potential problems or ethical issues.
Posted By: Anonymous
2013-10-03 10:23 AM
Stock options
@anon6:56 - why would you see the granting of stock options to a CAE to be a Code of Conduct conflict? These programs are to encourage employee retention. You seem to suggesting that internal auditors work for free. Do you not value yourself?
Posted By: CAE (with options)
2013-10-03 9:19 AM
Take Me Out to the Ball Game
I would report the observation to the ethics hotline, but not report it as a violation because enough facts have not been obtained. The purpose of a hotline is to offer employees the opportunity to report violations or possible violations without fear of reprisal. The two employees may have paid for their own tickets which discounts any concern regarding a violation of the quoted policy. However, during a competitive procurement, the employees should be careful to avoid opportunities that create a perception of favoritism. It is a possibility (although unlikely) that the seats just happened to be next to each other and that they only discovered it when they were at the game. An interview of both employees would help to disclose the facts of the case. I was wondering if the home team won?
Posted By: Walter Sachs
2013-10-03 8:44 AM
being questioned is not the same as being guilty
It is clear from the situation that Stacey is in a position from her observation and role to suggest that questions need to be asked. Asking questions does not mean that a person or persons are believed to be guilty. Even if conducted as a formal investigation, asking questions are used to determine if actions are needed or if parties have violated a rule or law. Innocence must be presumed without evidence; questions are a mean of getting evidence to determine if something wrong did occur. However, as per the IPPF, a conflict of interest has occurred, whether it is in fact or appearance. This certainly was apparent if not factual! In every firm where I have been employed, I would have pursued one of the following options. 1. Reported the observation to the ombudsman noting the potential value at risk and significance of a potential breech by someone at that high of level in the firm over such a large $$ contract. 2. Directly contacted the CAE of my firm to note that a Conflict of Interest had occurred. The CAE should initiate an investigation or inform the Executive of the potential breech so they could take appropriate actions. 3. Directly contacted the head of the Fraud and Ethics Investigation department with my observations after informing my own management of the situation.
Posted By: Robyn Stephens
2013-10-03 8:39 AM
Professional Ethics
Too often, "worker bees" are subject to different interpretations of company rules than the "queen bees". Compliance hotlines aren't designed to judge and punish people - rather they are designed to investigate people. In this case, the auditor has identified what appears to be a clear violation of company policy. By firmly believing this, and not calling the hotline, Stacey is intentionally remaining silent about an issue which the company needs (and wants) to know about. If Stacey's suspicions are correct, the Controller and the CAE should be disciplined like any other employee. There exists a chance that somehow, both the controller and CAE acquired and paid for their own tickets. Some would suggest that the auditor should approach the topic with the CAE directly. Personally, I wouldn't, as we should allow the parties whose task is to investigate alleged incidents such as this do what they are trained to do. Don't forget, investigations only result in punishment if evidence is found supporting the allegations.
Posted By: Chris Liboiron
2013-10-03 8:30 AM
Take Me Out...
Reporting of the incident should occur. Upholding company policy, meant for all, not just for some, must be adhered, especially by the employees responsible for administrating ethics policies. Even if the tickets were under the limits, the very nature that they were able to be seen in premium seats would violate any type of SOD requirements. At the very least if they were just at the $250 level, that would appear excessive and to violate the objectives of the policy. Report the violation to the ethics hotline with specifics, etc. The larger question is what if the company does nothing and allows such highly visible exceptions to policy...even if approval was obtained, appropriateness and example for others in the company wasn't.
Posted By: Ed Siess
2013-10-03 8:12 AM
Comment on Article: Take Me Out of the Ball GAme
If Stacey's company has a whistleblowing process, then she can use this to report anonymously. Assuming the company does not accept anonymous reporting, at least by reporting anonymously, the company can initiate an informal inquiry. Assuming the whistleblowing is part of the CAE's responsibilty, then the CAE will be aware of the anonymous report and if the CAE is not guilty, this will be the CAEs opportunity to clear his name with the company and with his/her subordinates.
Posted By: Paul Alcos
2013-10-03 8:02 AM
Take Me Out to the Ball Game
I would definitely report the matter via the company's 24-hour ethics hotline to ensure that my concern is properly addressed by the company.
Posted By: Thinh Nguyen
2013-10-03 8:00 AM
Professional Ethics
It seems to me that the code of Ethics of big Phrma ( $100Billion) needs to be reconsidered with regard to accepting gifts ( game tickets) valued at more than $250. Game tickets are tickets whether they are for the super ball or for the local high school game. Stacy needs to investigate this case thoroughly first to find out if the ball game tickets were actually provided by the audit firm. Even if so, Stacy needs to consider whether reporting such incident is worth while for all stakeholders.
Posted By: Ameen Bissat
2013-10-03 7:51 AM
What I would do
As a Senior Internal Auditor myself, I can understand the feelings of Stacey. Unfortunately, I think I'd have to call the ethics hotline and report the incident. It would definately be a black eye to IAD at Big Pharma, but other employees finding out that this occurred and that there were no concequences for the CAE and controller would be a death blow to Big Pharma's anti-fraud program and could also put Stacey's career in jeopardy if it became known that she was aware of this violation and did nothing.
Posted By: Chris Shumate
2013-10-03 7:28 AM
Re; take me out to the ballgame...or grant me stock options...
I had a similar experience, only dealing with learning of the Audit Director being granted stock options in excess of $50000. I was angry. I was dumbfounded. I was appalled. But I had tendered my resignation the day before, so I was also leaving the company. I wrestled with the ethics of this granting. I wrestled with the moral compass that appeared to have been tainted with gain. I did not want to burn bridges. I was uncertain of the code violations. And if I started asking questions, I was afraid of some very serious pushback. Sadly, I left the company without every raising the question, "is there an ethical code that prohibits the CAE from accepting stock options?" Seems to me that the very process owners that we, as a team, are testing have just purchased his moral code.
Posted By: anonymous
2013-10-03 6:56 AM
Stacey should report it as a concern.
Stacey's concern is clearly defined as violation of ethics policy, hence it must be reported. However considering her audit background, it will be better if she tries to collect more information about this e.g. Whether permissions were obtained? Whether the CAE had attended any others events in the past? She also needs to consider if CAE has made attempts to push the case of renewing contract for existing auditor.
2013-10-02 12:41 PM


Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online, or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to edit/remove comments.





To make something bold:
<strong>Text to bold</strong>

To make something italic:
<em>Text to italicize</em>

To make a hyperlink:
<a href="URL">Text to link</a>


Subscribe_June 2014 



IIA Seminars_Nov 2013  




facebook IAO