Principle 1 - Demonstrate Commitment to Integrity and Ethical Values
Principle 1: Demonstrate Commitment to Integrity and Ethical Values
External Link to US GAO Green Book Principle 1.
Overview
The oversight body and management should demonstrate a commitment to integrity and ethical values.
Tone at the Top
The oversight body and management demonstrate the importance of integrity and ethical values through their directives, attitudes, and behavior.
The oversight body and management lead by an example that demonstrates the organization’s values, philosophy, and operating style. The oversight body and management set the tone at the top and throughout the organization by their example, which is fundamental to an effective internal control system. In larger entities, the various layers of management in the organizational structure may also set the “tone in the middle.” Although it is the oversight body and management’s responsibility to set the tone at the top, other personnel throughout the entity play an important role in supporting the tone that permeates the organizational culture.
The oversight body’s and management’s directives, attitudes, and behaviors reflect the integrity and ethical values expected throughout the entity. The oversight body and management reinforce the commitment to doing what is right, not just maintaining a minimum level of performance necessary to comply with applicable laws and regulations, so that these priorities are understood by all stakeholders, such as regulators, service organizations, employees, and the public.
Tone at the top can be either a driver, as shown in the preceding paragraphs, or a barrier to internal control. Without a strong tone at the top to support an internal control system, the entity’s risk identification may be incomplete, risk responses may be inappropriate, control activities may not be appropriately designed or implemented, information and communication may falter, and results of monitoring may not be understood or acted upon to remediate deficiencies.
Standards of Conduct
Management establishes standards of conduct to communicate expectations concerning integrity and ethical values. The entity uses ethical values to balance the needs and concerns of different stakeholders, such as regulators, service organizations, employees, and the public. The standards of conduct guide the directives, attitudes, and behaviors of the organization in achieving its objectives.
Management, with oversight from the oversight body, defines the organization’s expectations of ethical values in the standards of conduct. Management may consider using policies, operating principles, guidelines, or training to regularly communicate and reinforce the standards of conduct to the organization.
Adherence to Standards of Conduct
Management establishes processes to evaluate performance against the entity’s expected standards of conduct and address any deviations in a timely manner.
Management uses established standards of conduct as the basis for evaluating adherence to integrity and ethical values across the organization. Management evaluates the adherence to standards of conduct across all levels of the entity. To gain assurance that the entity’s standards of conduct are implemented effectively, management evaluates the directives, attitudes, and behaviors of individuals and teams. Evaluations may consist of ongoing monitoring or separate evaluations. Individual personnel can also report issues through reporting lines, such as regular staff meetings, upward feedback processes, a whistleblowing program, or an ethics hotline. The oversight body evaluates management’s adherence to the standards of conduct as well as the overall adherence by the entity.
Management determines tolerance levels for deviations from standards of conduct. For instance, management may determine that the entity will have zero tolerance for deviations from certain expected standards of conduct, while deviations from others may be addressed with warnings to personnel. Management establishes a process for evaluations of individual and team adherence to standards of conduct that escalates and remediates deviations timely and consistently. Management, with oversight from the entity’s oversight body and with consideration of applicable laws and regulations, takes appropriate actions to remediate deviations.
