Table Of ContentInternal Audit and IT Audit
Series Editor: Dan Swanson
A Guide to the National Initiative Mastering the Five Tiers of
for Cybersecurity Education (NICE) Audit Competency:
Cybersecurity Workforce Framework (2.0) The Essence of Effective Auditing
Dan Shoemaker, Anne Kohnke, and Ken Sigler Ann Butera
ISBN 978-1-4987-3996-2 ISBN 978-1-4987-3849-1
A Practical Guide to Performing Operational Assessment of IT
Fraud Risk Assessments Steve Katzman
Mary Breslin ISBN 978-1-4987-3768-5
ISBN 978-1-4987-4251-1
Operational Auditing:
Corporate Defense and the Value Principles and Techniques
Preservation Imperative: for a Changing World
Bulletproof Your Corporate Hernan Murdock
Defense Program ISBN 978-1-4987-4639-7
Sean Lyons
Securing an IT Organization
ISBN 978-1-4987-4228-3
through Governance,
Data Analytics for Internal Auditors Risk Management, and Audit
Richard E. Cascarino Ken E. Sigler and James L. Rainey, III
ISBN 978-1-4987-3714-2 ISBN 978-1-4987-3731-9
Fighting Corruption in a Security and Auditing of Smart Devices:
Global Marketplace: Managing Proliferation of
How Culture, Geography, Language Confidential Data on Corporate
and Economics Impact Audit and Fraud and BYOD Devices
Investigations around the World Sajay Rai and Philip Chuckwuma
Mary Breslin ISBN 9781498738835
ISBN 978-1-4987-3733-3
Software Quality Assurance:
Investigations and the CAE: Integrating Testing, Security,
The Design and Maintenance and Audit
of an Investigative Function Abu Sayed Mahfuz
within Internal Audit ISBN 978-1-4987-3553-7
Kevin L. Sisemore
The Complete Guide to
ISBN 978-1-4987-4411-9
Cybersecurity Risks and Controls
Internal Audit Practice from A to Z Anne Kohnke, Dan Shoemaker,
Patrick Onwura Nzechukwu and Ken E. Sigler
ISBN 978-1-4987-4205-4 ISBN 978-1-4987-4054-8
Leading the Internal Audit Function Tracking the Digital Footprint of Breaches
Lynn Fountain James Bone
ISBN 978-1-4987-3042-6 ISBN 978-1-4987-4981-7
CRC Press
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742
© 2017 by Taylor & Francis Group, LLC
CRC Press is an imprint of Taylor & Francis Group, an Informa business
No claim to original U.S. Government works
Printed on acid-free paper
Version Date: 20161102
International Standard Book Number-13: 978-1-4987-6780-4 (Paperback)
This book contains information obtained from authentic and highly regarded sources. Reasonable
efforts have been made to publish reliable data and information, but the author and publisher cannot
assume responsibility for the validity of all materials or the consequences of their use. The authors and
publishers have attempted to trace the copyright holders of all material reproduced in this publication
and apologize to copyright holders if permission to publish in this form has not been obtained. If any
copyright material has not been acknowledged please write and let us know so we may rectify in any
future reprint.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced,
transmitted, or utilized in any form by any electronic, mechanical, or other means, now known or
hereafter invented, including photocopying, microfilming, and recording, or in any information stor-
age or retrieval system, without written permission from the publishers.
For permission to photocopy or use material electronically from this work, please access www.copy-
right.com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222
Rosewood Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that pro-
vides licenses and registration for a variety of users. For organizations that have been granted a photo-
copy license by the CCC, a separate system of payment has been arranged.
Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are
used only for identification and explanation without intent to infringe.
Visit the Taylor & Francis Web site at
http://www.taylorandfrancis.com
and the CRC Press Web site at
http://www.crcpress.com
Contents
Preface xv
author xix
chaPter 1 IntroductIon 1
Learning Ethics as a Child 1
Section 1: How Ethical Are You? 2
Drawing the Ethical Line 3
How Ethical Are You? Scenario One 3
How Ethical Are You? Scenario Two 4
How Ethical Are You? Scenario Three 4
How Ethical Are You? Scenario Four 4
How Ethical Are You? Scenario Five 5
Conclusion 5
Section 2: Analysis of High Profile Cases 22
Example 1: Analysis of Adelphia Communications 22
Adelphia - Lessons Learned from a Family Business 22
Adelphia - Lessons Learned from Lack of Oversight 23
Adelphia - Lessons Learned from Lack of Independence 23
Adelphia Summary 23
Example 2: Analysis of Western Resources, David Wittig 24
David Wittig - How Could This Happen? 24
David Wittig - Lessons Learned from Executive
Spending Habits 24
David Wittig - Lessons Learned from Responsibility
for Reporting 25
Example 3: Analysis of Bernie Madoff 26
v
vi Contents
Bernie Madoff - Lessons Learned from Personality 26
Bernie Madoff - Lessons Learned When Things
Appear Too Good to Be True 26
Bernie Madoff - Lessons Learned from Relying on
One Investor 27
Section 3: Why Do Issues Continue to Evolve? 27
Section 4: A Company’s Moral Compass, and Who Is Responsible? 33
Establishing a Strong Moral Compass 34
Can Moral Compass Be Audited? 35
Leadership and Moral Compass 36
Section 5: The International Professional Practices
Framework Standards for Ethics for Internal Auditors 38
Integrity 39
Objectivity 40
Confidentiality 41
Competency 41
Rules of Conduct: Integrity 42
Rules of Conduct: Objectivity 43
Rules of Conduct: Confidentiality 44
Rules of Conduct: Competency 45
The Realities of How Internal Auditors Can Work with
Ethical Concepts 46
Summary 48
chaPter 2 PrIncIPles that ImPact ethIcal BelIefs
and ethIcal culture 49
Section 1: Psychology of Ethics and Impact on Work Culture 49
Section 2: Theories behind Ethics and Ethical Principles 51
Introduction 51
Ethical Principles and Ethical Theories 52
Philosophy 101: Introduction to Ethics 53
Ethical Theories 53
Meta-Ethics 54
Normative Ethics 55
Business (Virtue Ethics) 57
Business (Deontology Ethics) 59
Business Consequentialist Theories 60
Applied Ethics 66
Everyday Moral/Ethical Judgments 66
Summary 67
Section 3: University Organizational Theory and Behavior
Curriculum 68
Tricks of the Trade Scenario 70
Section 4: Understanding the Internal Auditors Code of
Ethics and Related Principles 72
Introduction 72
Contents vii
Internal Auditors Code of Ethics 72
Objectivity, Independence, and Assurance 73
Partial Definition of Internal Auditing 73
Professional Skepticism Scenario 74
Internal Audit Definition 76
Partial Definition of Internal Audit 76
Code of Ethics: Principles 76
Integrity 76
Objectivity 77
Confidentiality 77
Competency 77
Integrity Scenario 77
Objectivity Scenario 79
Confidentiality Scenario 80
Competency Scenario 81
Section 5: Understanding the Internal Auditors Code of
Ethics and Rules of Conduct 82
Rules of Conduct: Integrity 83
Rules of Conduct Illegal Actions 86
Rules of Conduct Legitimate and Ethical Objectives 86
Rules of Conduct: Objectivity 86
Accepting Gifts 87
Rules of Conduct: Confidentiality 89
Rules of Conduct: Competency 89
Section 6: Corporate Ethics in the Future—Could There Be
an App for That? 90
Introduction 90
Steps for Application 91
Section 7: Global, Diverse, and Expanding Workforce 92
Introduction 92
Diverse Workforce Scenario One 92
Diverse Workforce Scenario Two 94
Summary 98
Section 8: Internal Auditors Working with Diverse
Cultures and Beliefs 99
Introduction 99
Respect Scenario 100
Summary 102
chaPter 3 estaBlIshIng an ethIcal culture and the
connectIon to coso 2013 103
Section 1: Committee of Sponsoring Organizations
(COSO) 2013 Control Environment Principles and
Corporate Ethical Culture 103
Introduction 103
The Updated COSO Framework 105
viii Contents
Section 2: COSO Principles One and Two: Demonstrates
Commitment to Integrity and Ethical Values and Ensures
the Board Exercises Oversight Authority 107
Introduction 107
Scenario One: Board Composition 109
Scenario Two: Internal Audit Oversight 109
Scenario Three: Audit Committee Communication 109
Scenario Four: CAE Selection 110
Scenario Analysis 111
Section 3: COSO Principle Three—The Organization
Establishes Structures, Reporting Lines, Authorities, and
Responsibilities 113
Introduction 113
Downsizing Scenario 114
Section 4: COSO Principle Four—Commitment to
Competence 114
Introduction 114
Executing Commitment to Competence 115
Section 5: COSO Principle Five—Individuals Are Held
Accountable for Their Internal Control Responsibilities 116
Introduction 116
Scenario One: Internal Control 117
Scenario Two: The New CFO and CAE 119
Scenario Three: ABC Consulting Company 121
Summary 123
Section 6: Organizational Requirements to Align with the
New COSO Framework and Ethical Principles 123
Introduction 123
Principle Mapping Process 124
Considerations When Examining COSO Alignment 125
Section 7: Nontransition to COSO 2013 and Implications
to the Ethical Culture 126
Introduction 126
Challenges in Evaluating Ethical Culture 127
Section 8: Internal Audit’s Role in the Evolution of Ethics
in the Corporate Culture 128
Introduction 128
Internal Audit’s Role in Ethics 128
Scenario One: Internal Audit and Evolution of Ethics 129
Section 9: Dissecting Ethics 132
Introduction 132
Everyone Is Responsible 132
Tone at the Top 133
Honesty 133
Integrity 134
Corporate Social Responsibility 135
Contents ix
Silence Is Not Acceptable 136
Summary 136
chaPter 4 methods for IdentIfyIng and measurIng
ethIcal BehavIor 137
Introduction 137
Section 1: Moving Past Surveys, Questionnaires, and
Interviews 139
Introduction 139
Critique with Etiquette 139
Use Your Words 142
Be Specific 142
Avoid Personal References 142
Consider What Information Is Important to Improve
the Process 143
Provide Respondents with Instructions 143
Consider Gathering Demographic Information 144
Carefully Consider Questions for the Survey 144
Provide Guidance for Comments 144
Section 2: Assessing Effectiveness of a Survey or Interview 145
Introduction 145
Utilizing Questionnaires to Evaluate Ethical Culture 146
The Company Has a Code of Conduct 146
The Company’s Code of Conduct is Effective 147
Interviewing 147
Section 3: Effective Survey Techniques 148
Introduction 148
Developing Surveys 148
Step One: Developing Surveys Clarify the Objectives of
the Survey 148
Step Two: Communicate Survey Purpose 150
Step Three: Gather Logistical Information 150
Step Four: Determine Requirement for Anonymity 150
Step Five: Survey Distribution 151
Online Surveys 151
One-on-One Surveys 152
Step Six: Test the Survey 152
Step Seven: Analyze Results 152
Section 4: Effective Interview Techniques 153
Introduction 153
Interview Techniques 153
Step One: Effectively Plan the Interview 154
Step Two: Building Rapport 154
Step Three: Control the Interview 154
Step Four: Don’t Overanalyze 155
Step Five: Listen 155
