Publications banner
Cpajournallogo

Whistleblowing Intentions for Internal Auditors

By Joan Lee, PhD, CPA, CGMA, Sridhar Ramamoorti and Lucian Zelazny, PhD

User-added image

Financial fraud represents a serious threat to financial markets, and it has long been noted that whistleblowing can be an important deterrent to fraud. Because of their positions within corporations, internal auditors are uniquely positioned to blow the whistle. For whistleblowing to have a maximal beneficial impact, on an organization and society at large, it is critical that internal auditors perceive a high level of “psychological safety” within a company. Potential whistleblowers must therefore believe that they will be heard and not fear retaliation.

Financial accounting fraud in the capital markets represents a grave threat to the public interest. The 2020 Report to the Nations from the Association of Certified Fraud Examiners (ACFE, http://www.acfe.com/report-to-the-nations/2020/) estimates that global losses owing to fraud exceed $4.5 trillion annually. The report also highlights the key role that whistleblowers play in uncovering and reporting fraud with tips and anonymous complaints, followed by internal auditors as the primary sources of fraud detection. When whistleblowers are emboldened, including internal auditors, their actions raise “the perception of detection” and are likely to have a deterrent effect on those perpetrating fraud (J.T. Wells, “Let them know someone’s watching,” Journal of Accountancy, vol. 193, no. 5, p. 106, 2002). On occasion, compliance and audit professionals may even be eligible for a whistleblower award when their internal reporting has fallen on deaf ears, the company failed to take responsive action, and the internal auditor was compelled to go to the SEC (https://www.sec.gov/news/press-release/2014-180). Thus, members of the financial reporting supply chain, as well as executive management and the board of directors, should be keenly aware of the most conducive environments to encourage whistleblowing.

 

Whistleblowing and Fraud

Several reports and empirical studies highlight the importance of whistleblowing in uncovering fraud (J.O. Brown, J. Hays, and M.T. Stuebs Jr., “Modeling accountant whistleblowing intentions: Applying the theory of planned behavior and the fraud triangle,” Accounting and the Public Interest, vol. 16, no. 1, pp. 28-56, 2016; NBES, Inside the Mind of the Whistleblower, https://bit.ly/2VRxsiG, 2011). Recently, based on interviews with more than 200 people, Thomas Mueller, in his book, Crisis of Conscience: Whistleblowing in an Age of Fraud (Riverhead Books, 2019), notes that whistleblowing derives from celebrated American ideals, including “freedom of expression, the right and duty of citizens to warn of public wrongdoing, and the importance of the individual conscience.” In 2020, the number of awards issued to whistleblowers tripled; by April 2021, the SEC had awarded over a quarter of a billion dollars to whistleblowers in the first seven months of this fiscal year alone, per Jane Norberg, chief of the SEC’s Office of the Whistleblower (https://tinyurl.com/d69saue8).

Despite the obvious rationale and potential payout from whistleblowing, the whistleblowing decision can be stymied because of concerns regarding retaliation: after all, employers may fire or be reluctant to hire “troublemakers,” and colleagues and co-workers may blackball or shun them entirely. In this context, the organizational positioning of the internal audit function—and their being independent and objective—give internal auditors an indispensable triage role in whistleblowing arrangements, either as a channel of communication or for carrying out investigations (Chartered Institute of Internal Auditors, UK (CIIA), Position Paper: Internal Audit and Whistleblowing, 2013, https://bit.ly/3lXCpBH). But the internal audit function can only be effective in its role if part of a “trust-based” organizations where there exists a conducive culture that promotes mutual trust and openness, and a healthy psychological climate that supports their activities.

Consider the case of Theranos, the multibillion-dollar biotech startup that, under CEO Elizabeth Holmes’ leadership, claimed to be poised to revolutionize the process of medical testing from finger prick blood tests. But for the courage of whistleblower Tyler Schultz, the true story that the “technology simply did not work” would have never been exposed. Wall Street Journal investigative journalist John Carreyrou also worked tirelessly to get to the bottom of the Theranos story (J. Carreyrou, Bad Blood: Secrets and Lies in a Silicon Valley Startup, Knopf, 2018). Theranos’ culture was such that whistleblowers were highly discouraged and summarily fired before they went public with their concerns. The culture and psychological climate were not at all conducive to whistleblowers and whistleblowing.

Given the unique position and responsibilities of internal auditors, it is important to distinguish between internal reporting, internal whistleblowing, and external whistleblowing. Ideally, internal auditors will first report to their immediate supervisor, typically the chief audit executive (CAE). If the CAE does not take appropriate action, the internal auditor should keep reporting up the chain of command (all the way up to the board of directors). Hoffman and Schwartz (W.M. Hoffman and M.S. Schwartz, “The Morality of Whistleblowing: A Commentary on Richard T. De George,” Journal of Business Ethics, vol. 127, no. 4, pp. 771-781, 2015) refer to this as the “internal reporting principle.” Internal reporting is simply professional skepticism exhibited by alert and vigilant internal auditors as part of their job. In comparison, internal whistleblowing occurs when the internal auditor goes outside the normal chain of command or decides to report using an anonymous hotline. External whistleblowing occurs when the internal auditor reports to some external source such as a regulator or the media. Whenever possible, internal reporting should precede either internal or external whistleblowing. There is little doubt that an internal auditor’s “perceived psychological safety” (i.e., perception about the consequences of taking interpersonal risks in work environments) may influence the decision to blow the whistle on misconduct and wrongdoing. In other words, a psychological climate that is seen as safe and reassuring for those wishing to speak up can go a long way in creating a “fraud-resistant” organization (Center for Audit Quality, The Fraud Resistant Organization: Tools, Traits, and Techniques to Deter and Detect Financial Reporting Fraud, Washington, D.C., Nov. 17, 2014, https://www.thecaq.org/fraud-resistant-organization/).

This article describes the concept of psychological safety, refers to the expanding literature on psychological safety, and provides highlights from an ongoing experimental study with graduate students contrasting high and low perceived psychological safety environments.

 

What Is Psychological Safety?

Several reasons may account for the reluctance of whistleblowers to come forward, including a fear of reprisal, a fear of being ignored, and the stigma associated with whistleblowing (S. Dhamija and S. Rai, “Role of Retaliation and Value Orientation in Whistleblowing Intentions,” Asian Journal Business Ethics, vol. 7, pp. 37–52, 2018; S. Ramamoorti, L.M. Zelazny, and J.F. Castellano, “Psychological safety and internal audit effectiveness: An agenda for research,” Internal Auditing, vol. 33, no.2, pp. 25-31, 2018). A recent review of the extant academic literature on whistleblowing behavior revealed five categories:

1) the characteristics of the whistleblower, 2) the characteristics of the report recipient, 3) the characteristics of the wrongdoer, 4) the dependence of the organization on wrongdoing and evidence credibility, and 5) the characteristics of the organization (L. Gao and G. Brink, “Whistleblowing studies in accounting research: A review of experimental studies on the determinants of whistleblowing,” Journal of Accounting Literature, vol. 38, pp. 1-13, 2017). One core concept that would seem to include attributes of several of these identified factors is psychological safety. According to Edmondson (A. Edmondson, “Psychological safety, trust and learning: A group-level lens,” in Trust and Distrust in Organizations: Dilemmas and Approaches, ed. R. Kramer and K. Cook, pp. 239–272, Russell Sage Foundation, 2004, 241): “Psychological safety describes individuals’ perceptions about the consequences of interpersonal risks in their work environment.” Thus, it would seem that an organization’s culture and psychological climate, particularly the perception of psychological safety, would constitute an important factor motivating a potential whistleblower to act on their intentions.

Psychological safety, a construct first explored almost 30 years ago, is a “sense of being able to show and employ self without fear of negative consequences to self-image, status, or career” (W. A. Kahn, “Psychological Conditions of Personal Engagement and Disengagement at Work,” Academy of Management Journal, vol. 33, no. 4, pp. 692–724, 1990). In such settings where psychological safety is perceived, there exists a “shared belief that the team is safe for interpersonal risk taking … [suggesting] … a sense of confidence that the team will not embarrass, reject, or punish someone for speaking up” (A. Edmondson, “Psychological Safety and Learning Behavior in Work Teams,” Administrative Science Quarterly, vol. 44, no. 2, pp. 350-383, 1999). Specifically, Edmondson (2004, p. 241) addresses “individuals’ perceptions about the consequences of interpersonal risks in their work environment” (italics added).

Prior research by Edmondson and Lei (A. Edmondson and X. Lei, “Psychological safety: The History, Renaissance, and Future of an Interpersonal Construct,” Annual Review of Organizational Psychology and Organizational Behavior, vol. 1, no. 1, pp. 23-43, 2014) reveals that individual perceptions of psychological safety relate to a variety of individual, team, and organization-level behaviors and outcomes. Psychologically safe settings display supportive, nonthreatening group dynamics and a management leadership style that encourages members to share ideas without fear of criticism or other negative consequences, possibly emboldening them to blow the whistle if the circumstances warrant (Kahn 1990). Indeed, it is in such settings that individuals are motivated to purposefully speak up by intentionally sharing ideas, information, or opinions (L. Van Dyne, S. Ang, and I. C. Botero, “Conceptualizing Employee Silence and Voice as Multidimensional Constructs,” Journal of Management Studies, vol. 40, pp. 1359-1392, 2003). In contrast, when employees fear negative consequences from speaking up (e.g., withdrawal of support from peers or superiors, potential dismissal, or threats to career trajectory), they may adopt “defensive silence,” which is self-protective behavior based on fear whereby an individual withholds ideas, information, and/or opinions (Van Dyne et al. 2003). Thus, it could be argued that employees’ motivation to purposefully express their concerns by sharing information or opinions would include the act of whistleblowing (D.C. Pacheco, A.A. Moniz, and S.N. Caldeira, “Silence in Organizations and Psychological Safety: A Literature Review,” European Scientific Journal (Special Edition), pp. 293-308, 2015).

Ramamoorti, Zelazny, and Castellano (2018) have contended that lacking psychological safety is equivalent to “silencing” the internal audit function, and thus seriously threatens the function’s effectiveness. It is of paramount importance for organizations to create a climate promoting psychological safety and healthy skepticism. Gissel and Johnstone (J.L. Gissel and K.M. Johnstone, “Information Sharing During Auditors’ Fraud Brainstorming: Effects of Psychological Safety and Auditor Knowledge,” Auditing: A Journal of Practice & Theory, vol. 36, no. 2, pp.87-110, 2016) have shown the criticality of encouraging team dynamics that engender psychological safety for less-knowledgeable subordinates. Others (e.g., S. Lightle, J.F. Castellano, and B. Baker, “Why Audit Teams Need the Confidence to Speak Up,” Journal of Accountancy, https://bit.ly/3six0WX, 2017) have argued that audits are most effective when all members of the engagement team feel comfortable bringing their concerns, issues, and questions to the team’s attention.

COVID-19 has caused significant disruption and disorientation globally, inducing the feeling of functioning during “wartime than workday” and most people “really don’t know what to expect and how to behave” (A.W. Kosner, “Amy Edmondson on the Power of Psychological Safety in Distributed Work,” https://bit.ly/2UfCK7r, 2020). Accordingly, it threatens everyone’s sense of psychological safety. Edmondson has also released a new book that may be a useful resource for leaders and managers in cultivating a healthy organizational culture and promoting psychological safety (The Fearless Organization: Creating Psychological Safety in the Workplace for Learning, Innovation, and Growth, Wiley 2019). The sidebar, Cultivating the Proper Tone From the Top to Encourage Psychological Safety, summarizes the actions leaders might take to ramp up the sense of psychological safety within their organizations by adapting a table from Edmonson’s book.

 

Organization Culture and Internal Auditor Whistleblowing

There is general acknowledgement that there exists a “symbiotic relationship” between internal whistleblowing and organizational culture—they are mutually reinforcing (Chartered Institute of Internal Auditors, UK, Research report: Whistleblowing and Corporate Governance: The Role of Internal Audit in Whistleblowing, https://bit.ly/3m2vo2n, 2019). While previous studies have examined the propensity to blow the whistle among various groups, none have focused exclusively on internal auditors, who may, as a result of their deep understanding of a company and its internal control environment, be more aware than others of fraud-risk indicators within an organization (S. Ramamoorti, “Internal auditing: History, Evolution, and Prospects,” in Research opportunities in internal auditing, edited by A. Bailey, A. Gramling, and S. Ramamoorti (eds.), ch. 1, pp. 1-23, The Institute of Internal Auditors Research Foundation, 2003; Ramamoorti, Zelazny, and Castellano, 2018). Operating from the premise that internal auditing is a key mechanism in ensuring organizational reliability, Carmeli and Zisu collected data from employees in medical clinics of one of the largest healthcare organizations in Israel at two points in time, six months apart (A. Carmeli and M. Zisu, “The Relational Underpinnings of Quality Internal Auditing in Medical Clinics in Israel,” Social Science & Medicine, vol. 68, no. 5, pp. 894-902, 2009). Based on the data, they were able to show empirically that organizational trust, perceived organizational support, and psychological safety enable and increase internal auditing quality. Ramamoorti and Siegfried have also suggested that internal audit could usefully conduct “governance audits” which would presumably involve auditing culture as well [S. Ramamoorti and A.N. Siegfried, Promoting and Supporting Effective Organizational Governance: Internal Audit’s Role, Global Common Body of Knowledge (CBOK) 2015 Study Core Report, Internal Audit Foundation, 2016].

Organizational support for whistleblowing is evidenced through the existence of one or more effective means to blow the whistle, including a culture that promotes and assures psychological safety. Section 301.4 of the Sarbanes-Oxley Act of 2002 (SOX) required public companies, via their audit committees, to put in place an anonymous system for receiving tips and complaints related to financial malfeasance and misfeasance. The 2020 ACFE Report to the Nations reveals that 43% of the “occupational frauds” in their sample were detected through “tips,” and another 15% were detected by internal audit. In addition, where healthy cultures promote the surfacing of fraud suspicions and allegations, there is an expectation that specific measures exist to protect the whistleblower’s identity, and that internal reporting requirements are clearly defined. This is particularly important for internal auditors, especially when they must go outside the organization to report nagging concerns about wrongdoing.

While Cynthia Cooper of WorldCom remains undoubtedly the most famous internal audit whistleblower (C. Cooper, Extraordinary Circumstances: The Journey of a Corporate Whistleblower, Wiley, 2008), internal auditors are known to be on the front lines of detecting and reporting unethical and illegal activities, including corporate fraud and questionable accounting practices. While no company readily embraces such unwelcome news nor wants to acknowledge it may have a serious problem, some companies will respond appropriately by taking the necessary measures to clean up the situation, particularly if internal (audit) reporting is done quickly. All too often, however, internal auditors find themselves pressured to ignore, or actively encouraged to suppress the problems they have discovered, and may not bring them up until it is too late (P. Miller and L.E. Rittenberg, The Politics of Internal Auditing, Internal Audit Research Foundation, 2015). For those morally courageous internal auditors who refuse to give up, it is all too likely that they will become targets of direct or indirect retaliation, become persona non grata, and be ousted through termination and career derailment. In this context, it is critically important that there should exist an established framework that is relevant to whistleblower situations, along with a predefined communication protocol for escalating matters to the appropriate levels within the organization—or, when extreme measures are called for, to go to outside parties. It is important to note that section 21F has been added to the SEC 1934 Act; it incorporates the provisions of the Dodd-Frank Act of 2010 which had considerably expanded SOX’s antiretaliation provisions (see https://www.sec.gov/whistleblower/retaliation).

 

Ongoing Experimental Study

In ongoing experiment conducted by the authors, 123 graduate accounting students performed a computer-administered experimental task within an internal audit case study to assess the effect of psychological safety on their decisions to blow the whistle. Using a case study scenario featuring internal auditors with prior knowledge of financial fraud, the perception of psychological safety is manipulated.

The results show that more study participants in the higher psychological safety condition choose to report first to the CAE, before moving on to other reporting options. This result is consistent with the internal reporting principle, wherein we desire internal auditors to take their immediate boss (CAE) into their confidence first, before considering other reporting options. Organizations usually prefer to have an opportunity to correct situations internally before “bad news” becomes public knowledge, thus suggesting that creating a climate of higher psychological safety could be beneficial to an organization.

Participants in the experiment were more likely to look for a new job when faced with lower perception of psychological safety. Fully 90% of participants facing lower perception of psychological safety indicated that they would look for a new job. Given the high costs associated with employee turnover—employee turnover costs range from 60% of salary for an entry-level position to over 200% of salary for senior executives (B. Conerly, “Companies need to know the dollar cost of employee turnover,” Forbes, August 12, 2018, https://bit.ly/2UeiNOe)—an added benefit of creating a psychologically safe environment might be that it reduces employee attrition costs.

 

Characteristics of Psychologically Safe Environments

As noted by Ramamoorti and Siegfried (2016), culture imbeds many intangibles, including “soft controls,” but the characteristics of a healthy and positive culture generally include the following:

  • Management and board competence, philosophy, and style
  • Mutual trust and openness
  • Strong leadership and powerful vision
  • High performance and quality expectations
  • Shared values and understandings
  • High ethical standards

Specifically, the factors that are directly pertinent to increasing the effectiveness of internal auditors in reporting internally are:

  • Corporate culture and historical track record in creating a safe psychological climate
  • The internal control environment
  • The company’s integrity and ethical standards, as reflected in the organizational code of ethics and ethical training
  • The compliance risk management program
  • The communication protocols in effect

 

Ramamoorti et al. (2018) have conjectured that, in the absence of a psychological climate that allows for high levels of psychological safety, the entire internal audit function could choose to remain silent and “play along to get along,” thus defeating the very purpose of the function. In conditions of lower psychological safety, internal auditors fearing that their findings and recommendations might be ignored or not acted upon feel demoralized. In the worst cases, where the organization has shown the tendency to “shoot the messenger,” more forthright and outspoken internal auditors may have been let go (e,g., the case of the internal auditor at AIG; L. Pleven and A. Efrati, “Documents Show AIG Knew of Problems with Valuations,” Wall Street Journal, October 11, 2008, https://www.wsj.com/articles/SB122368147261224877). It would not surprise anyone in these contexts to learn that the internal audit function is simply ineffective.

 

Nurturing Safety

The UK Chartered Institute of Internal Auditors (CIIA, 2013) notes that internal whistleblowing “acts as a deterrent to corrupt practices, encourages, openness, promotes transparency, underpins the risk management systems” and generally promotes a healthy culture and protects organizational reputation. Internal auditors are a linchpin in this process given their role, positioning, expertise in internal control systems, and objectivity.

The findings from the authors’ exploratory study suggests that internal auditors are significantly more likely to report wrongdoing to internal sources (especially the CAE) under higher perceived levels of psychological safety. The results also suggest that internal auditors are less likely to seek alternative employment when faced with conditions of higher perceived psychological safety. It is only after repeated attempts to seek redress fall on deaf ears that internal auditors are likely to go outside the organization to regulators, news organizations, and other third parties. All of these outcomes, internal reporting of wrongdoing, initial avoidance of external reporting of wrongdoing, and better retention of internal auditors, are beneficial to the organization. Consequently, organizations should pay attention to nurturing psychological safety as an integral part of a well-established and robust internal control environment with a strong tone at the top (see also Miller and Rittenberg 2015).

 

User-added image

 

In the new era of corporate governance and accountability, whistleblowing must take center stage because of its immense public policy and public interest ramifications. Regulators must take steps to reward whistleblowers and protect them from possible retaliation (e.g., SEC Office of the Whistleblower, https://www.sec.gov/whistleblower). Organizations should encourage healthy psychological climates that promote psychological safety, mutual trust, openness, and transparency; regulators should reward whistleblowers for stepping forward, and protect them from retaliation; and the societal stigma associated with whistleblowing must be reduced. Only with such a concerted and collective response from different parties—viz., organizations, regulators, and society at large—will there exist the appropriate psychological climate and psychological safety that enables potential whistleblowers to speak up.

Other factors that impact the intention to blow the whistle might also be addressed. For example, Tangirala and Ramanujam (S. Tangirala, and R. Ramanujam, “Employee Silence on Critical Work Issues: The Cross Level Effects of Procedural Justice Climate,” Personnel Psychology, vol. 61, no. 1, pp. 37-68, 2008) address different forms of employee silence, including the “MUM effect”—that is, silence motivated by futility or silence motivated by fear of sanctions—which could impact the intention to blow the whistle. The impact of cognitive factors (K. Kolbe, The Conative Connection, Addison-Wesley, 1990) or differences of temperament or personality type (e.g., W. Huitt, “Problem Solving and Decision Making: Consideration of Individual Differences Using the Myers-Briggs Type Indicator,” Journal of Psychological Type, vol. 24, pp. 33-44, 1992; D. Keirsey, Please understand me II: Temperament, character, intelligence, Prometheus Books, 1998) on the intention to blow the whistle also could be topics for further examination. Finally, given the recent interest in generational effects in the workplace, especially with respect to the ethical propensities of Millennials (F. Elikai, S.D. Hermanson, and R. T. Burrus Jr., “Is the Next Generation of Accountants Ethical? Implications for Internal Auditors,” Internal Auditing, September/October 2018, pp. 20-36), it might be useful to examine the impact of generational identity on the intention to blow the whistle.

 

Joan Lee, PhD, CPA, CGMA, is a professor of accounting at Fairfield University, Fairfield, Conn.

Sridhar Ramamoorti, PhD, ACA, CPA, CGMA, CFE, CIA, CGFM, is an associate professor of accounting at the University of Dayton, Dayton, Ohio, and a member of The CPA Journal Editorial Advisory Board.

Lucian Zelazny, PhD, is an assistant professor of accounting at Appalachian State University, Boone, N.C.

Company The CPA Journal
Category FREE CONTENT;ARTICLE / WHITEPAPER
Intended Audience CPA - small firm
CPA - medium firm
CPA - large firm
Published Date 12/07/2021

User-added image


Cpajournallogo

The CPA Journal
www.cpajournal.com

The CPA Journal is known as the “Voice of the Profession,” and is The New York State Society of CPA’s monthly flagship publication and top member resource. An award-winning magazine and finalist for excellence in journalism (2018, 2017 FOLIO magazine awards), The Journal has over 95% nationally focused content written by thought leaders in the accounting and finance industry.

For more than 85 years, The CPA Journal has been earning its reputation as an objective, critical source of information on issues of interest to CPAs. The Journal provides analysis, perspective, and debate on the issues that affect the CPA profession. Major topics include accounting and auditing, taxation, personal financial planning, finance, technology, and professional ethics. The CPA Journal is issued monthly in print, and offers daily insight and analysis digitally here on cpajournal.com. Published by the New York State Society of CPAs, The Journal’s active editorial and review process ensures thorough technical quality and material relevant to CPAs in public practice, industry, government and education.