When should an internal auditor blow the whistle?
Developing a culture of speaking-up remains a challenge for many, heard delegates at ACCA's annual Internal Audit Conference.
Employees who voice concerns about perceived irregularities within their organisations can help prevent behaviours that lead to major financial and reputational losses. However, developing a culture of speaking-up remains a challenge, Jo Iwaski, Head of Corporate Governance, ACCA, told delegates to this year’s annual ACCA Internal Audit Conference in London.
Recent research, jointly funded by ACCA and the UK's Economic and Social Research Council (ESRC), examines the challenges, opportunities and best practices associated with various types of speak-up arrangements. The resulting report – Effective speak-up arrangements for whistle-blowers - reveals that, for speak-up arrangements to be effective, it is important to have more than one channel available to employees.
‘People experience a degree of reluctance when they are raising concerns with people who are involved in their day-to-day job function,’ Jo said. ‘We can understand that because they probably feel they’re disclosing something about their colleagues and are concerned about possible misunderstandings. That’s why people who speak-up want to do it as discreetly as possible.’
Externally, the channels often offer more independence, she pointed out. The use of technology, such as voice channels using digital technology, may have benefits for whistle-blowers because they can use an automated service and are not required to have conversations about the concerns they are trying to raise. However, it is still early days to say how effective these channels may be: for example, they can present a challenge when additional information is needed.
The importance of multi-channels
Four case studies on speaking-up arrangements – an NHS trust, an international bank, engineering company and central government in south-east Asia – have further confirmed the importance of multi-channels being available to employees so that they can choose the means which they feel most comfortable with. They also highlight that, over time, employees often start to use open and direct communication if they have gained positive experiences from external and independent channels.
‘When a loss of trust prevails amongst employees, they are unlikely to use internal channels,’ said Jo. ‘In that case alternatives, including independent and external channels, are very important. People need to feel safe if they are to speak out.’
However, ultimately, the aim is for whistle-blowing to become part of the broad structure of an organisation’s risk culture and corporate culture.
A UK-based survey relating to whistle-blowing showed that the number of people who raised concerns only once was about 44%, those who did so twice was about 40%; those for a third time, 14 % and those a fourth time 2.5%.
The important thing to note is that people don't raise concerns only once but many times. ‘That indicates that when people come across something that they have an issue with they want to do the right thing,’ Jo said. ‘And people generally feel that certain things have to be dealt with at a management or even more senior level if necessary.’
The same study shows that most speak-ups start internally with 90% choosing this option at the first attempt against just 8.6% opting for an external channel. A small proportion of people would use a union. And for a second attempt over 70% of people will still use an internal channel. Unsurprisingly, at the third and fourth attempt, a growing percentage of whistle-blowers opt for external channels including their union.
Effective speak-up arrangements rely on trust, and trust is dependent on robust and consistent response systems. In addition to the existence of multiple channels, Jo said that it is important to have a response system set out clearly internally.
‘When information comes in from employees, concerns must be processed following an established protocol. It is essential that, across the organisation – and especially at management level and above – everyone understands how to follow that.’
Another lesson from research is that tendencies for managers at local level to speak directly to the person raising concerns can be counter-productive because, if information is not recorded and passed on, learning within the rest of the organisation doesn’t take place.
‘It is important for organisations to centrally record and track how employee concerns are dealt with. This enables top management and the board to understand the culture around the trustworthiness of the organisation. But patterns emerging from speak-up data can also help them spot real issues underlying unsubstantiated concerns.
While public disclosure about what sort of whistle-blowing arrangements exist or speak-up data is not very common in organisations’ reports, Jo highlighted that researchers in this area say there is great potential for cross-learning to help the development of better practice.
Meanwhile, a major consultation at European level is currently focusing on looking at legislation that will introduce sanctions for breaches of confidentiality and sanctions for retaliation against whistle-blowers, as well as minimum standards for speak-up arrangements.
‘I think we will see improvements in this area in the very near future,’ Jo concluded, before passing over to Simon Webley, research director of the Institute of Business Ethics.
Using the ‘right’ terminology
Simon said that the Institute viewed business ethics as vital in maintaining a culture of integrity in any type of organisation with speaking-up being a really important part of this.
‘Speaking up needs to happen before a situation becomes a crisis, not after,’ he said, highlighting his preference for this terminology over ‘whistle-blowing’, which he said was less user-friendly.
For members of professional bodies there are two channels of raising concerns. The most immediate is by speaking up to a superior, or someone else, in the given organisation. The second, if this does not feel appropriate, is by turning to the ACCA, which will offer support. Statistics show that around 66% of ACCA members have experienced concerns around an issue relating to audit.
‘We know from surveys that around half the issues that are raised by people speaking-up relate to HR issues,’ he revealed. ‘The other areas are legal breaches and increasingly we're hearing that small fraud is becoming an issue that people need to speak up about so that it can be investigated.’
Alongside these are what Simon described as ‘ethical breaches’. The most common of these, seldom reported, is the misuse of gifts and hospitality by either offering or accepting them. The rules in this area, he said, are covered by all organisations but it is an issue that comes up very regularly.
Another is conflict of interest, which is not covered by law but nevertheless can be a real threat to reputation if it isn't done properly.
Looking to the reasons that stop employees from speaking up, Simon said that one reason revealed by surveys is that people feel nothing will be done about the concern raised. The second is ‘it’s none of my business’ and the third one is fear of retaliation.
‘These are the most common reasons and there are some very disturbing statistics about the number of employees who have seen things but not reported them,’ he said. ‘This is around 40 to 50%, which is quite concerning.’
One of the roles that internal audit has been asked to take on in ethics is due diligence. ‘This is not easy to do but there are things called symptomatic indicators which you can use to learn what's going on,’ he concluded. ‘They are very useful in doing that quite difficult type of work.’
Jill Wyatt, business journalist