On the Frontlines: Auditing Without Evidence in Ethics Cases

Regardless of the choice made, the employee reports the series of events he or she has experienced. Because the series of events took place face-to-face and all communication was conducted verbally, there are no written documents or any other evidence to support the reported incident. Internal audit is asked to independently investigate this case and report the results to the management.

In the International Standards for the Professional Practice of Internal Auditing, IIA Standard 2310: Identifying Information states that "Internal auditors must identify sufficient, reliable, relevant, and useful information to achieve the engagement's objectives." Here are some guidelines that may be helpful for building an internal audit approach in such cases:

• Take an independent and objective perspective. When assessing ethical cases, it is critical that internal auditors are objective. Objectivity, in the sense of being free from bias, is particularly challenging in ethics cases since auditors are employees themselves. Auditors frequently interact with other employees, build relationships, hear information from unofficial sources, and are aware of internal relationships and company politics. These issues may affect auditors' perception and understanding of the entire situation. To overcome such an issue, the engagement could be outsourced.
• Assess the tone from the top. It is known that the tone from the top of the organization sends a strong message to employees on what is acceptable behavior and what is not. If this type of situation is seen as something minor, not problematic, acceptable, and part of business-as-usual, it gives auditors a starting point in understanding the context of the issue and root cause.
• Chronologically reconstruct all the relevant events. When it comes to investigating ethical cases, a chronological reconstruction of the series of events that took place is needed for a proper understanding. An analysis of the events can help internal auditors bring all the pieces together.
• Gather and review all the relevant evidence. Even though the person who reported the case has no evidence, this doesn't mean that evidence does not exist. In today's business, everything is recorded via access and phone logs, video recordings, and messages. Exploring such sources can reveal circumstantial and corroborative evidence and new witnesses and employees involved in the incident, but also confirm the series of events that took place.
• Review the existing process workflow and internal regulation. In ethics cases, auditors should review the internal regulation related to signing practices, as well as the relevant signing process workflow, if any. This will help auditors identify any gaps in the process that have potentially led to the circumstances.
• Interview all employees involved with this case, separately. This is another important step. It is highly important not to announce the interviews much in advance, as this could provide an opportunity for collusion among the people involved or give people time to individually make up excuses.
• Ask for an independent assessment of legal implications. To appropriately assess the situation and relevant implications, a legal expert's involvement could be of great benefit. This subject matter expert could help auditors better understand the situation from a legal point of view, as well as the rights and obligations of all parties involved and possible consequences of any wrongdoings.
• Be wise and brave in reporting the results. Internal auditors are magicians when it comes to reporting and presenting the results of an engagement. By using the right words and formulating findings in a smart way, auditors can sell them to management and the entire organization, regardless of how difficult or uncomfortable they are.

A lack of direct, written evidence should not be an obstacle for auditors to adequately perform their work. Fulfilling the goal of adding value to the organization is still possible in ethics-related cases like this.