My colleague and fellow InternalAuditorOnline blogger Norman Marks recently wrote that “Internal Auditors Should Be Brave,” meaning they should not hesitate to speak up about the things that need to be said, even if they face the prospect of retribution.

It reminded me of a Tone at the Top article in November 2009, the same year I became president and CEO of The IIA. That piece, called “What’s on Your (Corporate) Conscience?” (PDF) examined the role of internal auditors in ensuring an organization is behaving ethically.

I have blogged about the ethical responsibilities of internal auditors in the past. In April 2013, I discussed the “Seven Attributes of the Ethical Internal Audit Leader,” sharing the view that ethical internal audit leaders are “proactive.” I noted that “this may be the hidden trait in ethics; the one few think of. If you act only in a reactive manner, you are fulfilling only part of the ethical contract. While honesty and courage about past acts are important, it is just as important to keep an eye on the future and provide honesty and courage in reporting how situations can be averted. By acting proactively, you are exhibiting the deepest aspects of ethics — working to ensure things go right before they can go wrong.”

Last November, I asked the rhetorical question, “should internal auditors be willing to throw the flag before the play.” I discussed the various roles an internal auditor can play across what I called the “ethics continuum.” The aspirational role that I believe we should all be able to play on this continuum is that of the corporate conscience.

It all sounds pretty straightforward. If someone is or will be doing something wrong, we need to speak up early. But is it really that black and white?

I think we would all agree that we have a moral obligation to report on illegal activities, dangerous flaws, and defects. But what if your organization derives income from a perfectly legal product or service that, when used as intended, poses a known health risk? What is your moral and ethical obligation? What is your obligation as part of the corporate conscience?

What if it’s not your product, but your company’s manufacturing process or working conditions that pose the health risk? Maybe it’s not a problem within your organization, but with a third party with which you contract for goods or services.

At what point do internal auditors have a moral obligation to speak out for what’s right for society and the greater good, even if it flies in the face of pressures for profitability and shareholder value?

I’m not talking about questions that have been asked and answered. It would be foolish, for example, for an internal auditor at a tobacco company to take a stand against tobacco.

I’m talking about cases in which an organization might be considering a new line of business, or may be acquiring a business, or entering a contract with a supplier in a war-torn country. Moral risk must be considered, not only to protect the organization from potential reputational damage, but also because it is the right thing to do.

It is well-established that the best deterrent against fraud, bribery, and ethical compromise is a strong culture and ethical tone at the top.

Norman Marks is right: Internal auditors do have to be brave to stand up for what’s right. It’s also part of our job as internal auditors. As a profession, it is incumbent upon us to advocate for the right to be heard on issues of moral and ethical risks. To be part of the corporate conscience, we need to be guided by our own moral compass.

What do you think? Is it fair to expect internal auditors to be the corporate conscience? How far should we go?​