Both internal and outside auditors have an obligation to independently evaluate the culture and systems of the organizations they audit.
Auditing Standard 314, for example, mandates that an auditor have a sufficient understanding of an entity and its environment to assess the risk of material misstatement of financial statements.
The governance standards of the Institute of Internal Auditors are more direct: They state that the “internal audit activity must evaluate the design, implementation, and effectiveness of the organization’s ethic-related objectives, programs and activities.” Compliance with these standards is important to promote confidence in the ethical operations of an organization and the accuracy of its financial reporting.
In light of these obligations, auditors should know more about a useful tool — the organizational ombudsman — that may help an entity surface and resolve workplace issues that might not otherwise get reported.
Since there are different types of ombudsmen, there is often confusion about what an “ombudsman” is and does. In this case, “organizational” ombudsmen usually function in private companies, universities, and other large organizations and adhere to four key principles articulated by the International Ombudsman’s Association: independence, neutrality, informality, and confidentiality.
Organizational ombudsmen can be either employees or nonemployees, but their role is to function independently of management and to remain neutral. They are knowledgeable about the organization and its culture, and listen to concerns of employees and identify ways to bring them to light. They also can suggest ways to resolve conflict and provide information that an employee may be unwilling to request through formal channels.
What makes this role distinct, however, is the promise of confidentiality. Employees can speak with an organizational ombudsman with the assurance that their communications will not be disclosed except in rare situations (such as an imminent threat of harm). Because ombudsmen are not part of management, they do not conduct formal investigations and communications with them do not constitute notice of claims against the organization. Yet, while not disclosing confidential communications, the ombudsman may be able to provide valuable information to management on trends in areas of concern.
The business case
There are three key reasons why organizations should make this tool available to their employees:
• First, developments in the law over the past 40 years — including criminal law, corporate governance, and employment law — have converged to require organizations to adhere to the law and ethical standards and to take action when they become aware of misconduct. Moreover, the increasingly international reach of organizations has compelled them to have uniform standards across boundaries and in places where the law is far from uniform.
• Second, both society and the workforce are now characterized by unprecedented diversity as well as employee separation (for example, four out of five workers work remotely or work with those who do, and as much as a quarter of all workers have part-time, contingent, or nonstandard work schedules).
• Third, the existing mechanisms to help employees report misconduct and resolve conflict have significant limitations and are not responsive to an employee’s concerns (largely fear of retaliation) over whether to report possible misconduct. Compliance officers and HR are formal channels, but going to them can be seen as going to the authorities — an investigation will be conducted and action taken by the organization. Hotlines allow people to make confidential and/or anonymous reports, but data suggests that they are not widely used by employees and only rarely for compliance purposes. And finally, while there are literally hundreds of whistleblower laws, and every major organization has a policy that prohibits retaliation, data supports the widespread perception that whistleblowers suffer adverse consequences when they do come forward. Although a company may be able to punish retaliators, much of the perceived retaliation either doesn’t meet the legal “adverse employment action” standard or is inflicted by peers, but is nonetheless a deterrent to an employee who has a concern.
Organizational ombudsmen can help overcome this fear of retaliation. They can help an employee understand the reporting process before making a decision on how to proceed. Equally important, the ombudsman can help an employee who does not want to be a whistleblower find ways to surface an issue.
Case in point
An ombudsman can be a valuable supplement to the auditor in surfacing issues. Consider this actual example: Internal audit received a report (via assistance from the ombudsman) that an employee was conducting a personal business from his office computer. Two auditors arrived at his department one morning and announced they were conducting a department audit.
An employee in the department realized that the office of the person with the personal business was at the opposite end from where the auditors began, giving the employee several hours to erase files. He immediately called the ombuds and gave only the office number of the suspected employee, never disclosing who he was or providing any identifying information. The ombuds reached the chief of audit in less than a minute, who immediately informed the field auditors to begin at the other end of the department.
The audit discovered evidence of the employee’s personal business on the company computer.
Charles L. Howard, a business litigation attorney and partner with Shipman & Goodwin LLP, is the author of The Organizational Ombudsman: Origins, Roles and Operations — A Legal Guide. He can be reached at choward@goodwin.com.
