The Tone at the Top: What Message Is Your Organization Sending?
Fraud & Investigative Services
Universal Advisor , 2005 Issue No. 1

Make no mistake about it — employees are keenly aware of the practices and rules followed by senior management and owners. Insider or related-party dealings, circumvention of internal controls, and favorable key-employee treatment are just three examples of management looking out for management, often at the expense of the stakeholders and employees of an organization. Business owners and managers affect an organization’s ethical culture by implementing practices, policies, and procedures and, equally importantly, by following them. Properly setting “the tone at the top” of a business can help send a clear message, reinforcing the owners’ and managers’ commitment to integrity and ethical values.

The Reaction to Unethical Behavior
The federal government and the accounting industry have responded to the erosion of public trust in the accuracy of financial reporting results by enacting legislation and standards that specifically address management’s responsibilities. The Sarbanes-Oxley Act of 2002 (SOX) addresses publicly held entities and identifies the CEO and CFO as the primary parties responsible for “setting the tone at the top” of an organization; moreover, it holds them personally accountable for accurate financial reporting and discovering and disclosing fraudulent behavior. Additionally, the AICPA’s Statement on Auditing Standards (SAS) No. 99 tasks auditors with evaluating an organization’s internal control environment and assessing the “tone at the top.” While following these regulations won’t guarantee the complete honesty and integrity of an organization, they do clearly outline the business owners’ and managers’ responsibilities for maintaining an effective internal control environment. Legislative and regulatory bodies agree: Management’s actions dictate the effectiveness of the internal control environment.

Into Action
Establishing (and continually reviewing) a code of conduct, ethics policy, or statement of business principles identifies and documents exactly what behaviors are acceptable within an organization. Implementing human resource policies related to hiring, training, and promoting staff can keep unethical individuals from joining an organization or obtaining a position of trust. Effective HR policies include:

• Pre-employment background checks of education, employment history, and personal references
• Periodic training about the organization’s core values
  • What constitutes unethical behavior
  • The employee’s responsibility to report unethical behavior
  • How to report unethical behavior
• Performance reviews that include discussions of an employee’s contribution toward creating the appropriate workplace environment
• Continuous evaluation of compliance with the organization’s values
• Confirmation
  • An understanding of the organization’s expectations
  • Compliance with the organization’s code of conduct
  • A listing of known violations or statement of no known violation

While these measures are proactive in nature, organizations need to focus on reactive measures to unethical behavior, as well. The expectation that an act will be discovered can serve as a deterrent to unethical behavior. The way an organization responds to incidents or suspected incidents may help to reduce future occurrences. In addition, it’s important to foster an environment where individuals are comfortable voicing their concerns.

To send the right message when something is detected, an organization should:

• Conduct a thorough investigation
• Consistently take action against violators
• Assess related controls and functional areas, and recommend improvements
• Cleary communicate the organization’s values and consequences of violations

Important Considerations
According to the Association of Certified Fraud Examiners’ 2004 Report to the Nation on Occupational Fraud and Abuse, the typical organization loses 6 percent of its annual revenues to occupational fraud. If multiplied by the U.S. Gross Domestic Product, which in 2003 totaled just under $11 trillion, it would translate into $660 billion in annual fraud losses. All organizations, regardless of industry, size, and location, are vulnerable. Companies that set the appropriate tone at the top send a clear message: that they’re committed to integrity and ethical values.