According to a 2016 U.S. Equal Employment Opportunity Commission (EEOC) report (Chai R. Feldblum and Victoria A. Lipnic, “Select Task Force on the Study of Harassment in the Workplace,” United States Equal Employment Opportunity Commission, https://bit.ly/3jolvaN), surveys of those who experienced sex-based harassment in the workplace tend to respond by avoiding the harasser (survey findings ranged from 33% to 75%); denying or downplaying the gravity of the situation (54%–73%); or attempting to ignore, forget, or endure the behavior (44%–70%). It appears that filing a formal complaint is a last resort.
Harassment is a form of discrimination under Title VII of the Civil Rights Act of 1964, the Age Discrimination in Employment Act of 1967, and the Americans with Disabilities Act of 1990 (EEOC). Harassment can take the form of: sexual, gender identity–based, race or ethnicity, disability, age or national origin or religion, and intersectional. Examples of sexual harassment could include offensive jokes, slurs, name calling, physical assaults or threats, intimidation, ridicule or mockery, insults, offensive objects or pictures, and interference with work performance. According to the EEOC, prevention is the best tool to eliminate harassment in the workplace; this includes establishing an effective complaint or grievance system, providing anti-harassment training to managers and employees, and taking immediate and appropriate action when an employee complains.
Internal Audit Risk Assessment
Regardless of the level of media focus on the issue of sexual harassment, it is important for an internal auditor to maintain a neutral mindset with respect to their involvement with the company harassment system. This is called “applying skepticism,” which the AICPA defines as “an attitude that includes a questioning mind, being alert to conditions that may indicate possible misstatement due to error or fraud (2011).” In this setting, internal auditors should be more concerned with appropriately assessing control risk and allocating resources effectively.
Risk assessment is something internal auditors apply every day. From an internal audit perspective, there are two components of control risk with respect to sexual harassment: 1) the risk that there is noncompliance (either intentional or unintentional), and 2) the risk that the noncompliance is not prevented or is not detected on a timely basis. As a practical consideration, risk may not be absolutely eliminated for numerous reasons (e.g., cost-benefit constraints, circumvention of controls, inappropriate design and implementation of controls, lack of control environment, accountability). One approach to mitigating risk is to develop and maintain a harassment complaint system for high-risk situations.
Internal audit is ideally positioned to play a role in developing and maintaining an effective harassment complaint system. Internal auditors are trained problem solvers possessing unique experience advising on a wide variety of company topics, ranging from the strengths and weaknesses of internal controls to audits of company operations and finances. In addition, the nature of internal auditing typically brings an auditor into contact with staff throughout the company (at all levels, both management and nonmanagement). Therefore, the internal auditor is a familiar face who can provide a trusted independent objective voice in the review and evaluation of company governance, including compliance with laws and regulations.
One critical role of the internal audit department is to regularly monitor high-risk areas in the company.
Four Categories of High-Risk Environmental Factors
One critical role of the internal audit department is to regularly monitor high-risk areas in the company. The EEOC identifies 12 high-risk environmental situations that companies should be aware of with regard to sexual harassment. For internal audit consideration, the 12 environmental factors can be classified into the following four high-risk categories: 1) diversity, 2) organizational dynamics, 3) office layout, and 4) other. Diversity is probably the most obvious high-risk category. This category includes the following four factors: 1) homogeneous workforces, 2) cultural and language differences, 3) young inexperienced workers, and 4) workplaces where some workers do not conform to workplace norms.
The first two environmental factors—homogeneous workforces, and cultural and language differences—may appear somewhat contradictory. When viewed in the extreme, however, it makes sense that a homogeneous workforce or alternately cultural and language differences within the workforce represent potential high risk for sexual harassment. The third factor—young and inexperienced workers—represents potential high risk because they may not be aware of appropriate workplace behavior. The fourth environmental factor relates to workers that do not conform to societal stereotypes held by the workforce; for example, a man might be mocked as being gay by his co-workers who view his actions as inconsistent with their beliefs about “masculine” behavior, or supervisors might believe that men are better suited for a particular job than women.
The second high-risk category is organizational dynamics, which includes the following four environmental factors in workplaces: 1) significant power disparities, 2) high-value employees, 3) reliance on customer service or client satisfaction, and 4) work that is monotonous or requires low-intensity tasks. The first two environmental factors are closely related because they both involve some employees having significantly more power than other employees, or a workplace that has an extreme power imbalance. An example of a significant power disparity would be a setting where executives have total control (e.g., raises, work assignments, performance evaluations) over administrative or other staff (particularly if they are viewed as low-value and easily replaceable). A setting with a high-value employee (who is given wide leeway in how they act) is also potentially high-risk. The next two environmental factors (i.e., workplaces that rely on customer service or satisfaction, and that require monotonous work or low-intensity tasks) are associated with the nature of the work. For example, someone that gets paid based on tips from customers is extremely vulnerable, and may be more likely to experience harassment.
The third high-risk category is office layout. This includes the following two environmental factors: 1) isolated workspaces and 2) decentralized workplaces. Isolated workspaces entail situations where people have little opportunity for interaction with others and few witnesses should inappropriate behavior occur. For example, an accounting analyst working alone at a remote production location where there are few co-workers would therefore be at high risk for harassment from production workers. Decentralized workplaces are similarly high-risk.
The fourth high-risk category is “other,” and it includes the following two factors: 1) coarsened social discourse outside the workplace and 2) workplaces that tolerate or encourage alcohol consumption. The first factor, “coarsened social discourse outside the workplace,” describes situations where events outside of work can result in harassment to employees on the jobsite. For example, after a terrorist attack, people of certain religious or national background may be harassed by co-workers. The second factor is straightforward; alcohol lowers ambitions and therefore can result in increased risk of inappropriate work-place behavior.
Ethically, there are no neutral positions with respect to sexual harassment. You are either part of the solution or part of the problem.
Auditors’ Response
Auditors can respond by incorporating sexual harassment into audit risk assessments and audit planning meetings. Internal auditors can also advocate for more transparency with respect to how sexual harassment complaints are handled. The typical argument against transparency is the potential damage to a company’s reputation and civil penalties. There are two general benefits: First, negative consequences associated with transparency act as an incentive for change. Second, transparency (particularly intercompany transparency) enables management to identify best practices to prevent sexual harassment.
Ideally, internal auditors should be prepared to identify and report suspicious behavior while working on every assignment. The nature of internal auditing brings an auditor into contact with a wide range of employees and their role places them in a unique position to spot the potential for sexual harassment and raise a red flag for human resources and the general counsel to follow up. In addition, every internal auditor should receive training on identifying evidence of sexual harassment (or a failed reporting mechanism)—and every audit report should enable the auditor to comment on compliance with the code of conduct.
Ethically, there are no neutral positions with respect to sexual harassment. You are either part of the solution or part of the problem. Sexual harassment will not stop on its own. Success requires a unified effort from everyone in the workplace. Noninvolvement potentially reinforces a culture of inappropriate behavior. Therefore, one cannot be neutral, or passive, and expect change in workplace culture.
One potentially promising strategic approach to engage the workforce is the “It’s On Us” campaign (https://www.itsonus.org/). This campaign was initially developed to engage students on college and high school campuses in order to change the culture with respect to sexual assault. The campaign was premised on the notion that sexual assault is not just about the victim and the perpetrator—rather, because it is a crime against the entire community, it falls upon everyone to do their part and become part of the solution.
