1. Ethics And Pressure: Balancing the Internal Audit Profession
This PowerPoint is based on the CBOK with the above title. The report refers to other IIA Research Foundation Research, especially the “The Politics of Internal Auditing”
Dr. Larry E. Rittenberg
Ernst & Young Emeritus Professor, University of Wisconsin
Former Chair, COSO

2. CBOK 2015 Practitioner Study
CBOK is the Global Internal Audit Common Body of Knowledge:
The global practitioner survey is the largest ongoing study of internal audit professionals in the world.
CBOK reports about practitioners and the profession are released monthly through 2016.
Download free reports from the CBOK Resource Exchange at The IIA website at any time (
The Commitment to Professional Ethics is one of the Cornerstones of the Internal Audit Profession.
Similarly, the Commitment to Ethical Behavior is one of the 17 Principles of the COSO Internal Control, Integrated Framework.
Extensive research shows that internal auditors often face pressure to change or suppress various audit findings.
How the internal auditor responds to those changes determines the value of that function within that organization.

3. CBOK 2015 Practitioner Survey
Practitioner Survey Results
Survey completed April 1, 2015
14,518 usable survey responses
Participation Levels
100% representation from IIA institutes
Responses from 166 countries
23 languages

4. CBOK 2015 Practitioner Study
Global Regions are based on World Bank Categories. Percentages reflect the percentage of total survey responses from that region compared to all survey responses.
North America: 19%
Latin America & Caribbean: 14%
Middle East & North Africa: 8%
Sub-Saharan Africa: 6%
Europe & Central Asia: 23%
South Asia: 5%
East Asia & Pacific: 25%

5. CBOK 2015 Practitioner Study
The speaker does not necessarily need to say this, but it’s important to remember that each pie chart is based only on those who answered that particular question (in other words, not all 14,518 survey respondents provided an answer to every question). Below are the specific number of responses for each question shown on the slide.
Age was obtained from 12,780 respondents; Organization Type was obtained from 13,032 respondents; Gender was obtained from 14,357 respondents; Staff Level was obtained from 12,716 respondents.
Age was obtained from 12,780 respondents; Organization Type was obtained from 13,032 respondents; Gender was obtained from 14,357 respondents; Staff Level was obtained from 12,716 respondents.

6. Ethics and Internal Audit
The Commitment to Professional Ethics is one of the Cornerstones of the Internal Audit Profession.
Similarly, the Commitment to Ethical Behavior is one of the 17 Principles of the COSO Internal Control, Integrated Framework.
Extensive research shows that internal auditors often face pressure to change or suppress various audit findings.
How the internal auditor responds to those changes determines the value of that function within that organization.

7. Key Findings Ethics are Important to: Build trust and confidence.
Guide internal auditors in dealing with difficult situations.
Establish meaningful audit boundaries.
Ensure objective analysis and communication.
These four points are the pillars of the IIA’s Code of Ethics.
Another important point is that even though an organization may have its own Code of Conduct, it is important for all internal audit professionals to understand the importance of the profession’s Code of Ethics. It is that code that both guides and protects the professional auditor when dealing with organizational pressure, or even in developing an audit approach and audit universe.

8. Key Findings
Ethics and Culture are key elements of an organization’s success, and the auditor must be aware of both.
For many organizations, internal auditors can do their jobs without fear of reprisal.
However:
Pressure does exist to suppress findings or modify reports.
The pressure varies across functions and geographic jurisdictions.
The CBOK Research shows that pressure on the internal audit function exists across virtually all industries and economic regions.
As discussed later, one area of particular concern is governmental units as they often do not have the equivalent of an audit committee to ensure that internal audit has sufficient resources and are supported when needed.

9. Key Findings
Audit Committees are important to preserving strong ethical conduct.
However:
The existence of independent, effective audit committees lags dramatically in the governmental sectors around the world.
The quality of support by audit committees (and similar functions) varies across the world.
Audit committees are important to sustain internal audit independence and is considered a pillar of good governance across the globe.
However, the research shows that:
Audit committees are not used in many governmental organizations (units) and there is considerable pressure placed on internal auditors in those organizations. Simply stated, the internal audit function needs help in governmental institutions.
Not all audit committees are effective “watchdogs” of good governance. In many situations, the research revealed the existence of non-effective audit committees – perhaps where members may be dominated by management.
It is important that audit committees have the skill set and independence to carry out their function.

10. Pressures Faced by Internal Audit
In order to fully understand Ethics, it is important to understand the factors that affect internal audit ethical behavior. Outside the rings is pressure that may impact the internal auditor and those pressure can be either positive or negative.
The outside rings are composed of three important elements:
Culture
Personal Needs
Organizational Governance and Control
These three rings are further filtered by an internal auditor and the internal audit function to shape the behavior of internal audit. These filters include:
The IIA Professional Code of Ethics
Personal Values – what the individual brings to the table
Organizational Codes of Ethics
An important point is to understand the differences between the IIA Code of Ethics and the Organizational Code of Ethics. Both are important to an internal auditor. The IIA Code of Ethics is designed to enhance the value of internal audit within an organization by defining a professional code that all internal auditors should be taking.

11. Internal Audit Reporting
The diagram illustrates that most internal auditors report functionally to the audit committee (or equivalent) and administratively to the CEO/President, followed by the audit committee.
The functional reporting is necessary to help ensure the full scope of internal audit and the independence of the audit function.

12. Who Appoints the CAE?
Most Chief Audit Executives are appointed by audit committee, board, or supervisory committee. Unfortunately, the group with the lowest percentage appointed by the audit committee, or equivalent, is the Public Sector. Even privately-held organizations have a higher percentage of their CAE’s appointed by audit committees, or equivalent than does the public sector.
Depending on the audience, the slide can be used to look at other industries, for example the publicly traded (excluding financial institutions).
It is the author’s opinion that governance of public sector organizations needs substantial improvement, and that internal auditing and an independent review function, such as an audit committee is needed.

13. Code of Ethics and Internal Audit Charter
This slide looks at the Codes of Ethics and Internal Audit chapters by geographic locations. Most of the respondents, across all areas, report that they have an internal audit charter. However, South Asia clearly lags on this question (further slides will illustrate this further).
Most organizations reported that a Code of Conduct/Ethics existed. However, the Code of Ethics might be the organization’s code, and not the IIA Professional Code. This can be a problem. An example shown in the report talks about Enron’s Code of Ethics which was basically non-operative.
That said, it is also worth noting that 25% - 40% of locations do not have a Code of Conduct/Ethics. It is worth pointing out that such organizations are challenged to show that they meet the important control environment concepts of the COSO Internal Control Framework.

14. Audits of Ethics
Most internal audit functions are not performing audits of their organization’s ethical environment and implementation of its Codes of Ethics. In looking at this chart, it is important to understand that the question that was being asked related only to whether the internal audit function was either performing a review of ethical conduct or were anticipating a forthcoming audit in that area. For the most part, however, most internal audit departments are not auditing the organization’s commitment to an ethical environment.

15. Pressure to Change Audit Findings
This question was a follow up to the Politics of Internal Auditing [Politics] research project which reported a great deal of pressure on internal audits to change or suppress audit findings. Initially, this slides shows that approximately 23% of the respondents, across all levels of internal auditors responding to the question, and across all geographic areas, indicated they had been pressured, at least once, to change or suppress audit findings. The finding is somewhat less than reported in the Politics research. The differences can partially be explained by responses from a broader audience, e.g. staff in the CBOK Study.
One difference is the “I would prefer not to respond” question. In essence, the response of “I would prefer not to answer” may reflect some pressure. We created a pressure index by adding the “at least once” response and the “prefer not to respond” response. When adding the two together, we find a response rate of 31% to well over 40%. In looking at geographic responses, the following areas were very high on preferring not to respond:
South Asia – 15%
Middle East and North Africa – 15%
East Asia and Pacific – 19%
We explore these more in the subsequent slides.

16. Pressure to Change + Prefer Not to Answer: Focus on Asia
This is a follow up to the previous slide.
Note particularly, the “prefer to not answer” for China. The rest of South Asia, including India and Thailand have “prefer not to answer” responses of around 15%.
On the other hand, the Pacific region, which includes Australia and New Zeeland are the opposite, with very low “prefer not to answer responses”, while at the same time indicating quite high pressure to suppress or change audit findings.
It is the author’s opinion that the “prefer to not answer” is an indicator of the maturity of the organization’s governance quality, i.e. a higher “prefer not to answer” response indicates a lower quality of governance and a commitment to the elements of a strong control environment.

17. Pressure to Change: By Staff Level
The CBOK question was broader than the Politics study which focused mostly on CAE’s. This slide shows the responses by
Staff
Manager
Director
CAE
We explore these dimensions in the next few slides. Again, the total pressure score is around 35% (pressure + prefer not to answer).
Interestingly, the “prefer not to answer” goes down as the audit level goes up, i.e. the CAE is less likely to indicate “prefer not to answer” than is the staff person.
The interesting question is to understand where the pressure is coming from. We examine that next with a focus on staff.

18. Pressure to Change: By Certification
We first examined the role of certification. While most of the certification of the respondents is the CIA, the question is broader and includes various other certifications that may be applicable to internal auditors.
Overall, the pressure to change or suppress findings is less for those individuals that are certified than are not certified (23% vs. 28%). In addition, those with relevant certification are slightly less inclined to not answer (5% vs. 7%).
There are many potential explanations of these differences. The leader may choose to examine the following type questions:
Does certification show a commitment to internal auditing and the organization to higher quality audit functions?
Does certification somehow indicate a tendency for certified auditors to be both more competent and more independent?
Is the difference large enough to debate? [We did not run statistical tests as the respondents were not randomly selected. The large sample size would indicate that had statistical tests been performed, the differences are statistically significant. However, it is more important that the audience determines whether or not the overall differences are significant to them.]

19. Pressure to Change: Sources
This graph is contains a great deal of data, and is worthy of some time for discussion. As a starter for understanding, consider the first row and the third column of data. Here it shows that Sources of pressure to change or suppress audit findings. For Staff auditors 44% of such pressure came from the internal audit department itself. The remaining pressure for the staff personnel was
15% from CEO level,
21% from Operations Management
11% from the CFO and
14% from other internal source.
For the CAE, most of the pressure comes from the CAE, followed by operations management and the CFO. Interestingly, 12% comes from the Board.
One approach is to focus on the staff and discuss why the most pressure came from the internal audit department. The audience could discuss such things as communication, determining the importance of finding, understanding the business purpose, and so forth.
The CAE level could allow for some discussion of why the Board of Directors is mentioned 12% of the time.

20. Reasons for Pressure: Analyzed by Size of Internal Audit Function
This slides examines the cause of such pressure, and is analyzed by large organizations vs. smaller IA functions.
For both sizes of internal audit staffs, the main cause was operational audits would reflect badly on key management.
Smaller internal audit shops find more problems with executive misuse of travel expenditures while larger IA organizations focused more on Executive misuse of corporate funds (9%). Smaller audit shops had more problems with financial reporting issues (8% vs. 4%).

21. Negative Consequences for Resisting Pressure to Change
The Politics study showed that there were many forms of punishment if the internal auditor did not succumb to corporate pressure. Some fall under the broad area of ostracization within the organization. As shown in the slide, the most cited negative consequences included:
33%, Exclusion from meetings
18%, Loss of opportunities
4%, Budget cuts or other resource constraints
13%, a wide variety of other reasons.

22. Summary The profession’s code of ethics is essential.
Provides boundaries, guidance, and support
Pressure to change audit findings is significant and exists everywhere.
Governmental units could benefit from internal audit and The IIA help to build better governance structures.
The IIA Code of Ethics not only sets Parameters to guide behavior, but also provides support for practicing internal auditors trying to do “the right thing”.
Pressure can exist in any organization, and across a variety of functions and geographic regions. Internal auditors must understand pressures, their sources, and how to mitigate the pressures.
Across developed countries, 35% - 45% of the GDP goes to governmental units. On a world-wide basis, there is a need to improve the governance structure of such organizations. Effective internal auditing, backed by strong governance, is important to progress.

23. Summary Ethics are important. Culture is equally as important.
Codes of Ethics must be more than just words—they must lead to positive action.
There is always opportunity for better governance, starting with culture and supplemented with policies, procedures, and oversight.
Internal auditors need to understand the distinction between Ethics and Culture. Culture is more pervasive and creates examples of boundaries depicting acceptable and unacceptable behavior. Organizations with strong Codes of Ethics can fail when the culture allows activities outside of what is acceptable within the Code of Ethics.
Action is more important than words.
The CBOK shows that significant progress has been made on a global basis, but there are opportunities for greater improvement.

24. CBOK 2015 Releases Jul. 2015 Aug. 2015 Sept. 2015 Oct. 2015 Nov. 2015
IIA International Conference
Governance, Risk, and Control Conference
South Africa Conference
IIA Financial Services Exchange
ECIIA Conference
All Star Conference
Southern Regional Conference
ACIIA Conference
IIA Midyear Committee Meetings
Jul. 2015
Aug. 2015
Sept. 2015
Oct. 2015
Nov. 2015
Dec. 2015
Driving Success in a Changing World: 10 Imperatives for Internal Audit
Navigating Technology’s Top 10 Risks: Internal Audit’s Role
Staying a Step Ahead: Internal Audit’s Use of Technology
A Global View of Financial Services Audits:
Challenges, Opportunities, and the Future
Who Owns Risk?
A Look at Internal Audit’s Changing Role
Combined Assurance: One Language, One
Voice, One View
Responding to Fraud: Exploring Where Internal Auditing Stands
Auditing the Public Sector: Managing Expectations, Delivering Results
Delivering on the Promise: Measuring Internal Audit Value and Performance
Mapping Your Career: Competencies Necessary for Internal Audit Excellence
Please share information about the publication of upcoming CBOK reports and where to go for the free download.

25. CBOK 2016 Releases GAM Conference SoPac Conference
Leadership Conference
IIA International Conference
Jan. 2016
Feb. 2016
Mar. 2016
Apr. 2016
May 2016
Jun. 2016
Engaging Third Parties for Internal Audit Activities: Strategies for Successful
Relationships
Interacting with Audit Committees: The Way Forward for Internal Audit
CAE Career Paths: Characteristics and Competencies of Today’s Internal Audit Leaders
GREAT Ways to Motivate Your Staff
Maturity Levels for Internal Audit Departments Around the World
Regional Reflections: Africa
The Top 7 Skills CAEs Want: Building the Right Mix of Talent for Your Organization
Lifelong Learning for Internal Auditors: Certification and Training Levels Worldwide
IIA Standards: Conformance and Trends
Internal Audit Quality Assurance and Improvement: A Call to Action
Promoting and Supporting Effective Organizational Governance
Women in IA: Perspectives from Around the World
Ethical Pressures Faced by Internal Auditors
Additional reports that will be available for free download..

26. Your Donation Dollars at Work
CBOK reports are FREE thanks to generous contributions from individuals, organizations, IIA chapters, and IIA institutes around the world.
Download your FREE copy today at the
CBOK Resource Exchange.
The IIARF encourages those who are presenting this slideshow to download the full report from The IIA Research Foundation and make it available to their audience.

27. About The IIA Research Foundation
CBOK is administered through The IIA Research Foundation (IIARF), which has provided groundbreaking research for the internal audit profession for nearly four decades. Through initiatives that explore current issues, emerging trends, and future needs, The IIARF has been a driving force behind the evolution and advancement of the profession.
For more information, visit:

28. Copyright and Disclaimer
The IIARF publishes this document for information and educational purposes only. IIARF does not provide legal or accounting advice and makes no warranty as to any legal or accounting results through its publication of this document. When legal or accounting issues arise, professional assistance should be sought and retained.
Copyright © 2016 by the Internal Audit Foundation, formerly The Institute of Internal Auditors Research Foundation (IIARF). All rights reserved. For permission to reproduce or quote, please contact