Internal audit's role is definitely 'up there' in terms of influence, authority and opportunity; its unique placement / positioning within the organisation means it possesses an incredible opportunity. However, when it comes to discussions about race and equality, like many, internal audit may shy away from the conversation, may feel inappropriately skilled to handle let alone contribute to what might seem and is a sensitive discussion.
I am confident that there are a (small) number of internal auditors who have taken up an active role within their organisation - this was clear in the CIIA's magazine and I also see this in my network. You know who you are and I salute you.
It is time for all internal auditors to get in on the discussion. If you truly want to help your organisation achieve their objectives, to enhance and protect organisational value by providing risk-based and objective assurance, advice and insight, then you need to start talking about black lives matter, diversity, race equality in the workplace, creating inclusive cultures.
Here are a few things to think about:
To address racism in your organisation, first, there needs to be consensus that there is a problem. When people believe that racism does not exist, diversity initiatives become the problem - as they are seen as favouring one group over an other. Do you recognise this? Do you recall conversations or discussions about why there is no place for positive discrimination in your workplace? Perhaps you witnessed the conversations about how everyone progresses on merit?
Many people view racism as a deliberate act of discrimination, motivated by ill-feeling, against a person of colour; this racism we understand, we recognise it, we can even call it out. Covert racism, on the other hand, is harder to identify; the microaggressions experienced by people of colour on a daily basis are normalised, they are not voiced out loud by those who experience it. The reality is that racism can occur without intent, it can cause people to be silenced - this is harder to digest, perhaps for some it is hard to understand. How well is this phenomena understood within your organisation? Are there safe spaces created to enable discussions? Are there explanations of the look and feel of microaggressions and the impact this has on people of colour? Are there safe spaces enabled to allow all voices to be heard, safely?
When we believe racism does not exist, it undermines the organisation's efforts to address inequality by weakening the very policies designed to create inclusive environments. This is a prevalent challenge and can be used as an excuse not to introduce anti-racist or create inclusive programmes within corporate environments. However, what is the evidence to say that policies work? Where is the data that supports progression and opportunity for people who are Black, Asian or another minority ethnic?
You might hear arguments, "we have policies and values around inclusion, diversity and belonging", "our company has held unconscious bias training", "we held a series of unconscious bias training", "we have asked people to be aware of their own personal bias", "we have asked people to share their experiences". But, without being fully aware of the extent to which the problem exists in the first place can render these approaches ineffective. Without understanding if the organisation has embodied psychological safety it is difficult to know whether people can safely speak up. There are many studies that confirm that racial discrimination exists within workplaces starting with recruitment practices. Yet in internal audit when we audit recruitment we fail to audit the number of people who are rejected. Can you honestly say your organisation is not guilty of structured racism? How do you know? Where's your data?
Encourage your leadership to become aware of the problem of racism within the organisation, by first gaining consensus. Consensus means having a dialogue. In order to have a dialogue you have to create an open and trusting psychologically safe space where people can speak up, share their stories, cultivate empathy, share a common language. I believe this is within internal audit's remit to explore and bring awareness to that which might be hidden.
What does this mean for risk management and control? Consider:
people who don't speak up in their organisation with ideas around innovation and improvement, will rarely speak up about racism, microaggressions and whether they feel included. This is not about self-confidence, it is about 'self-safety'.
when people don't speak up, then what does this mean for speaking about emergent/ emerging risks and control failures and deficiencies?
So take the leap. Start a conversation with your Leadership, Audit Committee and HR department.