The final version of the Global Internal Audit Standards ("GIAS") became effective on 9 January 2025, following a 12-month transition period from their release in January 2024. One of the most welcomed aspects was the placement of Ethics and Professionalism immediately after the purpose of internal audit and before governance, management, and performance. This positioning appropriately reflects the fundamental importance of ethics in the profession.

An internal auditor who identifies issues but chooses to overlook them for the sake of personal gain does not serve the organisation. In fact, they harm it by providing false assurance. It is clear that no matter how technically competent an auditor may be, their work is meaningless without ethics.

But what exactly is ethics? The GIAS does not define it. Much literature describes ethics as the distinction between what is morally right or wrong. Over my two decades of conducting internal audits, I have yet to meet an internal auditor who openly admits to being unethical. Yet, countless corporate failures could have been prevented had internal auditors performed their roles ethically. What went wrong?

The truth is, most people are ethical most of the time. However, ethics is not about holding onto the right values only when it is convenient or when the stakes are low. Being ethical means doing the right thing, everywhere and every time, whether anyone is looking or when everything is on the line.

Common Ethical Dilemmas in Internal Audit

As internal auditors, we often face challenging scenarios. Have you ever found yourself in any of the following situations?

Integrity

Have you ever intentionally lost a battle to win the war? For example, have you let a small audit issue slide or omitted a fact that would make a key stakeholder, such as the CFO, look bad, in exchange for their approval on all other matters? If the issue was inconsequential, why did you raise it in the first place? If it was significant, why did you drop it? Would you have made the same decision if the key stakeholder had not objected?

Objectivity

While the internal audit charter may state that the internal audit function reports to the Audit Committee or Board, who truly determines the hiring, firing, and compensation of internal auditors within the organisation? If it is senior management or the business owner, how long can you realistically expect to remain an ethical auditor while reporting to the 'real' bosses?

Do you find yourself being more lenient or sympathetic towards those who share similarities with you or who have a compelling story? As humans, we all have cognitive biases and mental shortcuts. Are you aware of your own biases?

Competency

Given the fast-changing risk landscape, does your team collectively have the necessary expertise to audit specialised areas such as cybersecurity, artificial intelligence, ESG, and data analytics? Is attending a one-day course in any of these topics sufficient to enhance your skills for performing internal audits? If you are the sole specialist in these areas, is your supervisor adequately equipped to review your work?

Due Professional Care

Have you ever rushed through audits due to time pressure, taking less care in reviewing samples or leaving some issues unaddressed because earlier findings had met the control objectives? In these instances, is the quality of your work compromised?

Confidentiality

Have you ever discussed audit findings with your spouse or colleagues who should not have access to that information? Do you take adequate steps to protect sensitive data, such as password-protecting files and ensuring emails are securely transmitted? If you check your inbox now, are there audit-related emails from prior years that should have been archived or deleted? Have you ever taken "data souvenirs" from a previous workplace?

Managing Ethical Dilemmas

We have all likely answered negatively to some of the above questions. None of us are perfect; the key is to recognise ethical issues when they arise and address them appropriately or better yet, avoid them altogether.

A simple way to identify ethical dilemmas is by recognising self-rationalisation. This occurs when there is a cognitive dissonance between what you know is the right thing to do and what you prefer to do. In such situations, ask yourself: What is the worst that can happen if I take the ethical path? What is the worst that can happen if I take the easier, unethical path?

In many cases, the worst consequence of choosing the ethical path is losing one’s job. Like most professionals, internal auditors fear unemployment because it affects their livelihood. Consequently, some may feel they have no choice but to turn a blind eye to ethical breaches. This fear is understandable, but there are ways to mitigate it.

To start, keeping up to date with the latest internal audit developments, investing in continuous learning, and expanding your network, including experienced internal auditors, will enhance your employability and reduce the fear of unemployment. Actively participating in IIA Singapore’s courses and events will help you stay competent and relevant while keeping pace with industry and professional developments.

As a service provider, I have faced pressure to take unethical actions to secure contracts or renewals. The key to navigating these situations is reducing customer concentration risk and ensuring that, while walking away may be difficult, it won’t be life-threatening. Ethical conduct should never be compromised for short-term gains.

If you have a trusted team of colleagues, you should also lean on them for advice and support. When you work together, you can overcome personal blind spots and find better solutions to ethical dilemmas.

Quality Assurance Review (QAR) Assessment

Many internal auditors have asked me, as a QAR Assessor, how I assess conformance with Ethics and Professionalism. The guidelines from the latest QAR manual, published in Quarter 4 last year, include the following key points:

• While it may be difficult to provide demonstrative evidence of internal auditors and the chief audit executive conforming with all the requirements, an assessment of conformance with the intents of the related standards and achievement of the intents of the related principles requires professional judgment of the evidence available.
• Although it may be difficult to obtain direct, positive evidence of internal auditors being honest or displaying professional courage, instances of nonconformance may be evidenced, for example, internal auditors making false or misleading statements or concealing or omitting pertinent information.
• While direct, demonstrative evidence of objectivity may be difficult to obtain, the audit charter, methodologies, training plans, annual assertions, and stakeholder interviews and surveys provide relevant evidence.
• While competency development depends greatly on the personal motivation of internal auditors, the chief audit executive plays a key role in ensuring time and effort are dedicated to training and developing the competencies necessary for the internal audit function and internal auditors to continue to be successful.

However, the most definitive guideline states that:

• Concluding on conformance with the Standards and achievement of the principles in Domain II depends largely on reviewing indirect evidence and exercising professional judgment. Accordingly, a conclusion of anything less than Full Conformance or Achievement must be supported by sufficiently persuasive evidence, as nonconformance might impact the credibility of individual internal auditors or the internal audit function.

Ultimately, an internal audit function is considered to comply with ethics and professionalism unless there is clear, compelling evidence of nonconformance. Examples might include unexplained omissions of significant issues or consistent patterns of auditors yielding to undue influence.

Why Ethics Matter in Internal Audit

With Internal Audit Month upon us this May, it is the perfect time to reflect on the significance of ethics and professionalism in our work. Choosing the easier path may seem tempting in the short term, but remember, an internal auditor’s work is lasting, like drawing on a canvas with an immutable pen. There is no undoing or editing. The ethical choices we make today will have long-lasting consequences, and those consequences may resurface in unexpected ways, affecting both our professional standing and the integrity of the organisations we serve.

Always do the right thing, everywhere, every time – no exceptions.

DISCLAIMER: The views and opinions expressed in this article are those of the author who is from the internal audit function. They do not represent the views and opinions of people or organisations that the author may or may not be associated with in professional or personal capacity unless explicitly stated.

This blog post was first published in the May 2025 issue of The Institute of Internal Auditors Singapore's blog: https://iia.org.sg/Resources/IIAS-Blog/May2025