5.1 Demonstrate Integrity

Why Integrity Is Non-Negotiable

Under Domain II: Ethics and Professionalism of the Global Internal Audit Standards, integrity is the foundation of trust. Stakeholders—boards, senior management, regulators, and the public—rely on internal audit only when they believe auditors tell the truth, refuse improper pressure, and will not participate in illegal or unethical conduct. Technical skill without integrity produces reports that look polished but cannot be trusted.

Integrity is not a soft “nice to have.” It is an exam-tested expectation for Internal Audit Practitioner (IAP) / CIA Part 1 candidates and a day-to-day professional obligation. When integrity fails, the damage spreads: engagement conclusions lose credibility, the chief audit executive (CAE) loses standing with the board, and the organization’s governance system weakens.

---

Honesty in Every Engagement

Honesty means communicating findings, conclusions, and recommendations accurately—without omission, exaggeration, or spin that would mislead a reasonable reader. Honesty shows up in:

• Evidence-based conclusions — Base ratings and opinions on sufficient, reliable evidence, not on what management prefers to hear
• Balanced reporting — Include both favorable and unfavorable facts when both are material; do not bury adverse results in footnotes
• Transparent limitations — Disclose scope limitations, unavailable evidence, or reliance constraints so readers can judge residual risk
• Accurate attribution — Do not claim work was performed, or controls were tested, if they were not

Honesty also applies outside formal reports: hallway conversations, status updates, and board presentations must not contradict the documented record. Informal “softening” of a finding is still an integrity issue if it misleads decision-makers.

---

Professional Courage in Ethical Dilemmas

Professional courage is the willingness to do the right thing when it is uncomfortable—especially when power, career risk, or relationships push toward silence or compromise. Domain II expects internal auditors to demonstrate courage when facing dilemmas such as:

1. Pressure to change ratings — A process owner demands that a “unsatisfactory” opinion become “needs improvement” without new evidence
2. Requests to delay reporting — Management asks to hold a fraud-related finding until after a financing close or board election
3. Scope interference — Leadership tries to remove a high-risk area from the approved plan without board awareness
4. Personal cost — Raising an issue may harm a mentor, friend, or popular leader

Professional courage does not mean being confrontational for its own sake. It means:

• Stating facts and criteria calmly and clearly
• Refusing to alter conclusions without supporting evidence
• Escalating through the charter-defined path (typically CAE → audit committee/board) when pressure persists
• Documenting attempts to influence the engagement so the file shows independence of mind was preserved

A Practical Dilemma Framework

When you face an integrity dilemma, walk through a structured approach:

1. Identify the ethical issue — What principle is at stake (honesty, legality, fairness)?
2. Gather facts — Separate pressure from evidence; confirm what the Standards and organizational policies require
3. Evaluate options — Comply improperly, negotiate a partial compromise, or escalate with documentation
4. Choose the ethical course — Prefer transparency and legal compliance over short-term harmony
5. Document and escalate — Record the dilemma, advice sought, and decisions; notify the CAE when engagement integrity is threatened

---

Legal and Professional Behavior

Integrity includes legal and professional behavior: internal auditors must not engage in, or knowingly support, illegal or improper activity. That duty covers:

• Compliance with applicable laws and regulations — Securities, privacy, anti-bribery, labor, safety, and industry-specific rules relevant to the engagement
• Refusal to assist wrongdoing — Do not help falsify records, conceal assets, or design procedures intended to deceive regulators or auditors
• Professional conduct standards — Follow The IIA Code of Ethics principles and the organization’s code of conduct
• Reporting obligations — When laws or policies require reporting of illegal acts, follow the prescribed channels; do not bury evidence to “protect” the organization

If a member of management asks internal audit to ignore a clear legal violation, the ethical response is to refuse, document, and escalate—not to “work around” the issue quietly. Integrity here protects both the auditor and the organization: covering up illegal activity creates personal and institutional liability.

Professional Behavior vs. Organizational Loyalty

Loyalty to the employer does not override legal and ethical duties. True organizational loyalty supports long-term value and lawful operations. Short-term loyalty that hides violations usually destroys value when the truth surfaces.

---

Integrity Across Assurance and Advisory Work

Integrity applies equally to assurance and advisory services. In advisory work, auditors may be collaborative and solution-oriented, but they still must be honest about risks, limitations, and conflicts. Saying “everything looks fine” to preserve a consulting relationship when serious control gaps exist is an integrity breach—even if no formal opinion is issued.

Likewise, integrity supports quality. Cutting corners on testing to meet a deadline, then implying full coverage, is dishonest. If time is insufficient, renegotiate scope or disclose limitations rather than inventing completeness.

---

Exam Focus: Domain II Alignment

For the IAP / CIA Part 1 exam, connect integrity to Domain II Ethics and Professionalism and the Global Internal Audit Standards expectations that auditors:

• Tell the truth in communications
• Show courage under pressure
• Obey laws and professional norms
• Avoid associating with illegal or improper activity

When a vignette describes a manager pressuring an auditor, ask: What would an honest, courageous, law-abiding auditor do? The correct choice almost always preserves truthful reporting, documents pressure, and escalates rather than quietly complying.