Trust is more important than ever when it’s in short supply

By Arleen McGichen, President of the Chartered IIA

Every day another trust-annihilating headline. Whether it’s the alleged corruption of politicians, business leaders or members of different royal families, the tentacles of the Jeffrey Epstein emails extend into the inboxes of the most wealthy and influential in our society. In the US and the UK, repeated scandals are rocking faith in the police and law enforcement agencies.

This is not new. We’ve been here before. Abuses committed by revered Hollywood moguls sparked the Me Too movement, a UK cash for questions outcry resulted in prison sentences for Parliamentarians, and there are still ongoing questions about fraudulent Covid loans.

We do not need to be told that money and power corrupt. It’s happened since the dawn of civilisation. But we have also developed rules, standards and principles to counter these forces. These are not perfect, but the very fact that corrupt practices do eventually come to light demonstrates that the rule of law exists. And the punishment for misdeeds can be devastating – physically, financially and reputationally.

Shout about integrity

Huge corporate scandals are good for news outlets, but we should also seize the opportunities they create for internal audit. There is no better time to shout loudly about the value of integrity and the risks of failure. We need to be the bastion of protecting what is good and honest across all sectors – and use these topical examples to demonstrate why trust matters and how our work supports it.

Most organisations advertise their mission and their values. Many also talk about behaviour and culture. But how many really understand behavioural risk, what drives it and what we can do about it?

Internal audit can make a real difference here. We should use the examples of people in high places who repeatedly exhibit the same patterns of flawed behaviour to highlight how organisations can identify such risks and how we can nurture a genuinely ethical culture.

Internal audit exists to support better management decisions. Society needs leaders to make good decisions and to know how to behave in difficult situations. The real test of a strong ethical culture is whether people at every level immediately know how they should behave when confronted with a complex dilemma.

They should also know how to challenge poor behaviour when they see it – and believe they will be heard. Internal audit should lead by example by demonstrating ethical conduct and professional courage in audit work, reports and opinions. Auditors can advise on ethical education for staff and management, ensure speak-up lines operate well and that organisational policies are well communicated, understood and followed.

Act on evidence

We also need proportionality and verified facts. Scandals undermine trust. It’s easy to move from knowing that some public figures, have behaved badly to believing that no public figures act with integrity. This lack of trust can be distorted for political ends and weakens the social contract. Other people are more likely to behave badly if they believe that everyone else is.

Internal audit can counter this moral erosion by standing up for the need for facts, evidence and a proportionate, effective response. In an age of fake news and disinformation, we need internal auditors to explain loudly and clearly what their work indicates is really happening. We need a route to improving processes to ensure the same mistakes do not keep on repeating.

Of course, some people will deliberately circumvent the rules and betray trust. We need effective mechanisms that help us to identify these actors faster and deal with their transgressions. Too often they are given multiple opportunities to behave badly again.

This is why it is so disappointing that the UK government has abandoned its promise to introduce an Audit Reform Bill during this Parliament. Three separate reviews have stressed that this is necessary to improve oversight of corporate behaviour and the power of the regulators to respond to failures. If we do not put their recommendations into practice, past mistakes will be repeated – with painful consequences for individuals, the economy and society.

Chartered IIA will continue to push for audit reform and for mandatory requirements for internal audit functions in critical infrastructure organisations. In the meantime, internal audit teams must redouble their efforts to educate and communicate the importance of ethical decision-making and to widen the net to catch bad behaviour before it causes major problems.

AI is a critical tool for this. Even relatively basic AI tools can aggregate data in a way that has been impossible till now. Every internal audit team should be thinking of ways to interrogate data more effectively. Investigating an odd shift in transaction patterns, or spotting an unusual trend, may help you to uncover an underlying behavioural issue that can be addressed before it leads to scandal.

Internal audit can lead with good examples and positive, ethical guidance – but we can also demonstrate how bad behaviour can be identified and stopped. People who trust their organisations to do the right thing will respond with pride and honesty not only because they fear discovery, but because they believe that everyone else does the right thing too.

As President, I will be banging the drum for this in all my conversations with internal auditors, leaders of the profession, as well as audit committee chairs and non-execs. In the past month, I have been in Washington for the launch of The IIA’s Global Audit Committee Center, which is dedicated to providing resources and thought leadership to enhance internal audit oversight. This was a career highlight and a chance to have constructive discussions about enterprise risk management.

I came away with questions and ideas about how internal auditors can get better at spotting micro-signs and connecting them to identify deeper issues. What questions should we be asking and how can we gain different views of existing data?

I have also spoken at two Chartered IIA conferences and had meetings with the ICAEW and Barclays. Mixing insights with advocacy is central to what internal audit does. I shall continue to raise all these themes at every level over the coming months. But this is something we can – and must – all be doing all the time. At a time when trust is under attack, this is where our professional value lies.