Ethics and Internal Audit-the
critical link- “setting the scene
regarding the importance of doing
the right thing”.
Laura Mabunda, CIA, QIAL,CMIIA, EO
CIGFARO – RISK AND AUDIT INDABA, 19 JUNE 2017
What is Ethics
The definition of ethics is that ethics concerns itself
with what is good or right in human interaction it
resolves around three different concepts: good, self
and other. Ethical behavior results when one does
not merely consider what is good for oneself but also
what is good for others
 Ethics is all about behavior, choices and doing what
is right.

Ethical culture

A strong is the foundation of good governance.

An ethical culture is created through a robust ethics program that sets
expectations for acceptable behaviors in conducting business within
the organization and with external parties. It includes effective board
oversight, strong

tone-at-the-top, senior management involvement, organization

wide commitment, a customized code of conduct,
Ethical culture

timely follow-up and investigation of reported incidents,

consistent disciplinary action for offenders, ethics training,

communications, ongoing monitoring systems, and an

anonymous incident reporting system.
IIA’s Code of Ethics for Internal Auditors —
Practice What We Preach

The IIA’s Code of Ethics underlies the conduct of internal audit
work and compliance with the Code is mandatory.

Compliance with the Code of Ethics is mandatory because of
the trust placed by internal and external stakeholders in the
internal audit profession and the activity.

Internal audit must be viewed as a role model and an advocate
of strong ethics
IIA’s Code of Ethics for Internal Auditors —
Practice What We Preach

The IIA’s Code of Ethics is applicable to the internal audit activity
and its staff. Internal auditors must apply the principles to all
aspects of their work and their relationships with the audit
committee, management, employees, and other stakeholders.

Noncompliance can result in disciplinary actions, including
expulsion from The IIA and withdrawal of the Certified Internal
Auditor (CIA) designation.
Code of Ethics
Code of Ethics

The Code of Ethics of the Institute exceeds the definition of internal audit
that includes two basic components:
1. Principles that are relevant to the profession and practice of internal audit;
2. Rules of Conduct that describe behavior norms expected of internal
auditors
1. Integrity
The integrity of internal auditors establishes trust and thus provides the basis for
reliance on their judgment.
Rule of Conduct
1.1. Shall perform their work with honesty, diligence, and responsibility.
1.2. Shall observe the law and make disclosures expected by the law and the
profession.
1.3. Shall not knowingly be a party to any illegal activity, or engage in acts that
are discreditable to the profession of internal auditing or to the organization.
1.4. Shall respect and contribute to the legitimate and ethical objectives of the
organization.
2. Objectivity
Internal auditors exhibit the highest level of professional objectivity in
gathering, evaluating, and communicating information about the activity
or process being examined.
Internal auditors make a balanced assessment of all the relevant
circumstances and are not unduly influenced by their own interests or by
others in forming judgments
2. Objectivity –continues……
Rules of Conduct
2.1. Shall not participate in any activity or relationship that may impair or
be presumed to impair their unbiased assessment. This participation
includes those activities or relationships that may be in conflict with the
interests of the organization.
2.2. Shall not accept anything that may impair or be presumed to impair
their professional judgment.
2.3. Shall disclose all material facts known to them that, if not disclosed,
may distort the reporting of activities under review.
3. Confidentiality
Internal auditors respect the value and ownership of information they
receive and do not disclose information without appropriate authority
unless there is a legal or professional obligation to do so.

Rules of Conduct
3.1. Shall be prudent in the use and protection of information acquired in
the course of their duties.
3.2. Shall not use information for any personal gain or in any manner that
would be contrary to the law or detrimental to the legitimate and ethical
objectives of the organization.
4. Competency
Internal auditors apply the knowledge, skills, and experience needed in the
performance of internal audit services.
Rule of conduct
4.1. Shall engage only in those services for which they have the necessary
knowledge, skills, and experience.
4.2. Shall perform internal audit services in accordance with the
International Standards for the Professional Practice of Internal Auditing.
4.3. Shall continually improve their proficiency and the effectiveness and
quality of their services.
Ethical Dilemma

Chief Audit Executive and Internal Audit Staff have a responsibility to
behave professionally and ethically at all times and will have a particularly
important role to play in creating, promoting and maintaining an ethical
culture within the practice and, possibly, among the clients of the
practice.

Internal Auditors have an Impact on the organizational ethics tone and
may be subject to scrutiny by the staff of the organization.

A high level of professional competence from their Internal Auditors is
expected, and to be a trusted advisor requires the Internal Auditor’s
integrity to be unquestionable.
Ethics intelligence

Internal Auditors are challenged to recognize and evaluate ethical and
unethical situations often encountered in practice and it is important to be
alert to situations that may threaten these fundamental principles.
“What on earth is ethics intelligence? I would define it as the ability to
discern when there are ethical implications in an issue and being able to
respond appropriately from an ethical perspective” by Dr. C von Eck
Ethics intelligence

Speaks to the individuals ability to recognize ethical implications in
decisions and situations and respond appropriately

It also speaks to the ability to recognize ethical dilemma and being able
to find the best means to deal with such a dilemma i.e finding a solution
that would have the least adverse impact.
Ethics intelligence

The ability to identify ethical and unethical behavior is essential in all
professions, internal auditing is no exception!!!

IA has an obligations to the organizations they serve, their professions and
themselves to exercise sound ethical judgement.
Ethical Treats to Internal Auditor
Independence
Ethical Treats to Internal Auditor
Independence

Familiarity: the threat that, due to a long or close relationship with
someone, you will be too sympathetic to that person’s interests, or too
accepting of their work

Intimidation: the threat that you will be deterred from acting objectively
because of actual or perceived pressures, including attempts to
exercise undue influence over you.
Ethical Treats to Internal Auditor
Independence
Self-interest: the threat that a financial or other interest will inappropriately
influence your judgement or behaviour
Self-review: the threat that you will not properly evaluate the results of a
previous judgement made or service performed by you (or someone else
within your practice) when forming a judgement as part of providing a
current service
Advocacy: the threat that you will promote a position (usually your client’s) to
the point that your objectivity is compromised
Internal Auditors Continue to Face
Ethical Dilemmas
The IIA’s 2015 Global Internal Audit
Common Body of Knowledge Survey.

Ethics and Pressure: Balancing the Internal Audit Profession states that 23
percent of internal auditors worldwide have been asked at least once to
change or suppress an important audit finding, and 11 percent “preferred
not to answer” the question,

The survey of more than 14,500 practitioners in 166 countries also indicates
that 20 percent of staff auditors have been pressured “occasionally or
frequently” to alter audit findings, while 14 percent declined to answer,
which the report suggests could be because of “intimidation.”
What happens when internal auditors don’t want to
go along with unethical requests?
According to the report,

33 percent said they’d be excluded from meetings,

18 percent would lose opportunities,

4 percent saw budget cuts,

1 percent were demoted, another

1 percent had their pay cut, and

13 percent said “other.”
What happens when internal auditors don’t
want to go along with unethical requests?
While each situation is unique, the report states, some of the more
typical “other” responses included:

Reduced communication from executive management.

Discrimination via gossip and second-guessing.

Job elimination.

Audit department outsourcing.
What happens when internal auditors don’t
want to go along with unethical requests?

Hostile working conditions and stress, resulting in health issues.

Pay raises for internal audit staff frozen, while others received pay
increases.

Denied requests for additional internal audit department staff.

Internal auditors can often find themselves side-lined or hindered in
their quest to ascertain whether the governance around such
decisions is adequate. Being asked to reschedule audits, delaying
meetings, documents forgotten to be shared or worse still being
told that certain areas will not be looked at
Are you facing ethical dilemma?

Seek advice from your professional body or obtain
independent legal advice.

Consider whether your actions in response to the
situation and the advice obtained are sufficiently well
documented, either by way of minutes or your own
records.
Auditing ethics – definition
 “Ethics audit is a systematic evaluation of an
organization’s ethics program and performance to
determine whether it is effective.
The audit provides an opportunity to measure conformity to
the organization’s desired ethical standards.
Auditing ethics – CBOK 2015 Global
Practitioner Survey
 Institute
of Internal Auditors' (IIA) Common Body of
Knowledge (CBOK) 2015 Global Practitioner Survey,
Mapping Your Career, Competencies Necessary for
Internal Audit Excellence.
 Internal
auditors throughout the world rate themselves
highly in professional ethics but far lower in technical
skills
Auditing ethics - CBOK 2015 Global
Practitioner Survey
But despite auditors' overall high ranking in professional ethics, the
survey revealed a need for improvement in certain areas. For
example, the survey report notes that 73 percent and 72 percent of
respondents rate themselves as advanced or expert in ethics'
competencies of maintaining confidentiality and objectivity.
 But in incorporating ethics and fraud into audit engagements,
professionals confident in performing advanced and complex tasks
dropped to 64 percent and 60 percent, respectively.
 And slightly more than 10 percent indicated they need supervision
for routine tasks in those two skills.

Auditing ethics – legal requirement
The International Standards for the Professional Practice of
Internal Auditing (The Standards) issued by the Institute of
Internal Auditor (IIA) state that (Standard 2110.A1):
“The internal audit activity must evaluate the design,
implementation, and effectiveness of the organization’s ethicsrelated objectives, programs, and activities.”
Auditing ethics – the role of Internal
Auditors
 Assessing
the state of the organization’s ethical climate
and the effectiveness of its strategies, tactics,
communications, and other processes in achieving the
desired level of legal and ethical compliance
 Evaluating the design, implementation, and effectiveness
of the organization’s ethics-related objectives, programs,
and activities.
 Providing assurance that ethics programs achieve stated
objectives, key risks are effectively managed, and controls
continue to operate effectively
Auditing ethics – the role of Internal
Auditors

Providing consulting services to help the organization establish a
robust ethics program and improve its effectiveness to the
desired performance level.

Serving as a role model and ethics advocate. Internal audit has
a high level of trust, integrity, and competence to advocate
appropriate conduct to comply with the organization’s legal,
ethical, and societal responsibilities and promote
appropriate ethics and values.
Auditing ethics – the role of Internal
Auditors

Serving as a subject matter expert on ethics-related issues and as
a member of the organization’s ethics council (or equivalent).

Acting as a catalyst for change, promoting and recommending
enhancements for the organization’s governance structure and
practices.
Auditing ethics – understanding
organizational culture

Reviewing the organization’s mission, vision, strategic plan, code
of conduct, allegation reporting system, related regulatory and
privacy requirements, etc.

Confirming internal audit’s understanding with management and
employees.

Reflecting on insights from past business issues and audit findings.

Reviewing applicable legislation and guidelines.
Auditing ethics – Key Considerations
Realistic audit objectives need to be set, which are likely
to include such things as whether:
 There
is compliance with laws, regulations and policies.
 The
organization has a documented ethics program
and adequate means of measuring its effectiveness.
 There
has been effective implementation of the ethics
program.
Auditing ethics – Key Considerations

Breaches of the ethics program have been properly investigated
and adequate sanctions imposed on offenders.

Lapses in ethical behavior have an impact on the efficiency,
effectiveness and economy of business operations and, if so,
what is the impact on the organization.

Assets are properly safeguarded from unethical conduct.

Opportunity for fraud and corruption is minimized.
Auditing ethics - Key considerations

The audit committee should identify specific ethics-related
issues on which to focus. In some settings, the committee may
decide to conduct a comprehensive ethics audit. In other
organizations, the committee may focus on specific ethical
issues that are especially important in those settings.

An audit of ethics needs to be risk-based and based on a risk
assessment. The internal auditor must establish the key risks to
the organization’s ethics program which will help to focus the
audit objectives.
Auditing ethics - Scope of the Audit
An audit of ethics should at least cover the following:

Tone at the top – commitment of the board and top
management to ethics.

Ethical principles – how well these are adhered to by all levels
of the organization, including stakeholders and suppliers.

Risk management – recognition of the need for risk
management and effective implementation of risk
management throughout the organization.
Auditing ethics - Scope of the Audit

Information – availability of information relating to ethical
conduct such as a documented ethical program, awareness
activities, and breaches of ethical guidelines.

Sharing – active sharing of information relating to the ethical
program and its results.

Alignment – risk management alignment with the
organization’s ethical culture.
Auditing ethics – Reporting and
monitoring
 Report
the audit results without fear or favor to the
audit committee and senior management.
 Monitor
and follow-up to ensure recommendations are
effectively implemented and meaningful change
occurs in a timely way.
Auditing Ethics – Benefits

To improve ethical performance and to give assurance that the
organizations has an effective ethics program.

The auditing process can highlight trends, improve organizational
learning, and facilitate communication and working relationships.

Improved relationships with stakeholders who desire greater
transparency.
Way forward

Internal auditors should take an active role in support of the
organization’s ethical culture. They should be trusted within
the organization and possess a high level of integrity and the
skills to be effective advocates of ethical conduct.

They should have the competence and capacity to appeal
to the organizations ’s leaders, managers, and other
employees to comply with the legal, ethical, and societal
responsibilities of the organization
Way forward

The IIA’s Code of Ethics helps ensure that internal auditors
“practice what they preach.” The CAE should ensure that all
audit work is performed in full compliance with, and meets
the intent of, the Code.

The CAE may assume proactive roles such as becoming a
nonvoting member of an internal ethics council or
conducting ethics training sessions.
Way forward

The internal audit activity may also play roles that relate to
both promoting and assessing ethics, such as hosting the
organization’s whistleblowing hotline or conducting fraud
investigations.

Before accepting such roles the CAE should consider how
they would affect the perception of internal audit within the
organization.
Maintaining dignity of the profession
and internal auditors



The supervising and governing institution of internal auditing profession to
hold training courses, workshops and conferences on the standards of
Internal auditing and professional work in general including the ethical
principles and rules conduct of auditing in particular.
The Role of the Audit Committees to be strengthened to support of the
independence and neutrality of the internal auditors, as well as verifying
the efficiency and professional level performance.
The development and establishment of an incentive means that contribute
in making the auditors committed to ethics of their profession
Auditing ethics – conclusion


Conducting an ethics audit requires a team effort as well as a clear
definition of ethical behavior. Auditing ethics is not only required by
the IIA’s Standards but it is essential for the overall health of the
organization.
Even though there is no “one size fits all” approach to auditing ethics,
the internal audit department should still take steps to audit the
ethics program. Just because it is a difficult audit to do is no reason
to ignore it especially when the risk of not carrying out an ethics audit
can be severe.
THANK YOU
Thank You!