Internal Audits role in whistleblowing

By James Rees-Thomas
Institute of Internal Auditors New Zealand Board Member

As we often hear on the sports field – it ends at the final whistle. But when it comes to reporting inappropriate behaviour in an organisational setting, this metaphorical blowing of the whistle actually signals the start of a very important process. The whistle can only be blown effectively if the action occurs from within a well-constructed and supportive framework. This includes a healthy organisational culture and sincere tone from the top, a robust system for escalating concerns of wrongdoing and established people and process elements that work cohesively and collectively to promote ethical and compliant behaviour.

Internal Audit has a part to play in all of this. The recently published State Services Commission (SSC) report into the aftermath of the Ministry of Transport (MOT) fraud is a useful catalyst for action for the profession. The report is valuable because it prompts the reader to reflect on, for the first time in recent memory, the legislative and organisational frameworks that should exist to support the act of whistleblowing.

These include:

• The Protected Disclosures Act, what it covers and its limitations
• As a logical consequence, the difference between organisational wrongdoing, and “serious wrongdoing” as defined by the Act
• The current scope of systems and processes that organisations have in place for dealing with concerns of wrongdoing and potential gaps
• The impact on the person raising the concern and the safeguards necessary to ensure that disclosing a wrongdoing does not result in the whistleblower being disadvantaged.

While the Protected Disclosures Act provides a (albeit limited) basis for protecting the courageous among us, it is fair to say many New Zealanders either don’t understand it or don’t trust its application. Incidents like that which led to the SSC’s investigation of whistleblowing by MOT staff has the unfortunate result of reinforcing such perceptions.

Internal Audit’s professional standards, social obligation and corporate responsibilities coupled with its natural independence makes it the ideal guardian for disclosures of wrongdoing. This means an organisation’s Chief Internal Auditor (CIA) or equivalent is best placed to ensure the following are in place. The table below, previously published in our May and June newsletters, and now expanded in light of the SSC’s findings:

Recommendation