Fear and Self-Preservation: When Employees Know the Truth but Are Afraid to Tell Internal Audit

“What Happens to Me if I Tell You the Truth?”

Internal auditors often assume that if they ask the right question, they will receive the right answer.

That assumption can be wrong.

Employees may know exactly what is happening inside a process and still decide not to tell the auditor.

Why?

Because telling the truth may create personal risk.

An employee may fear:

• Retaliation

• Embarrassment

• Discipline

• Damage to a career

• Conflict with a supervisor

• Loss of status

• Being labeled disloyal

• Becoming known as “the person who talked to Internal Audit”

"FUD" is one of the biggest issues that auditors encounter: Fear - Uncertainty - Doubt

That makes fear and self-preservation one of the most important human-behavior problems internal auditors must understand.

The issue is especially important during:

• Walkthroughs

• Fraud inquiries

• Investigations

• Control interviews

• Culture audits

• Whistleblower-related work

• Management override reviews

An auditor who asks only yes-or-no compliance questions may receive technically accurate answers while completely missing the real process.

Employees Do Not Experience the Audit the Same Way the Auditor Does

The auditor may think:

“I am here to understand the process.”

The employee may think:

“What happens if my manager finds out what I told you?”

That difference changes everything.

Consider an Accounts Payable employee who knows that managers routinely bypass vendor-verification controls.

The auditor asks:

“Are vendor banking changes independently verified?”

The employee knows the truthful answer is:

“Not always.”

But the employee also knows:

• The manager is in the office next door.

• The manager evaluates performance.

• The manager controls promotions.

• The employee has seen others punished for speaking up.

The employee responds:

“Yes.”

Technically, the policy may require verification.

The answer may even reflect what is supposed to happen.

But it does not describe the real process.

That is why internal auditors need more than good checklists.

They need interviewing tradecraft.

Fear Can Be Completely Rational

Auditors sometimes view employee reluctance as suspicious.

That can be unfair.

Employees may have legitimate reasons to worry.

They may have seen:

• Whistleblowers marginalized

• Employees reassigned after raising concerns

• Managers retaliate subtly

• Poor performance reviews follow disagreement

• Confidential conversations become public

• Senior executives protect favored employees

If that is the organizational history, silence may be a rational act of self-preservation.

The auditor should not automatically think:

“Why won't this employee cooperate?”

A better question may be:

“What has this organization taught employees about the consequences of speaking honestly?”

That is a control-environment question.

Psychological Safety Is an Audit Issue

Psychological safety is often discussed as a leadership concept.

It also matters to Internal Audit.

Employees are more likely to provide useful information when they believe they can speak candidly without unreasonable personal consequences.

That does not mean employees must be protected from legitimate accountability.

It means they should be able to:

• Raise concerns

• Describe workarounds

• Admit mistakes

• Identify pressure

• Challenge unsafe practices

• Report control failures

without automatically becoming the problem.

If employees believe:

“Bad news gets punished,”

auditors should expect bad news to remain hidden.

That weakens:

• Risk reporting

• Fraud detection

• Compliance

• Internal control

• Governance

Yes-or-No Questions Make Fear Easier

Consider this question:

“Do you follow the purchasing policy?”

The safest answer is:

“Yes.”

The employee does not have to volunteer anything uncomfortable.

Compare that with:

“Walk me through the last three purchases you processed.”

Now the employee can describe actual activity.

Then ask:

“What happens when the required approver is unavailable?”

Then:

“How often does that happen?”

Then:

“What do employees normally do in that situation?”

These questions reduce the need for the employee to make an immediate accusation.

The auditor is discovering the process rather than demanding a confession.

Ask About the Process Before Asking About the Person

Employees may resist questions that require them to implicate someone.

Compare:

“Does your supervisor tell you to bypass the control?”

with:

“What happens when the normal control cannot be completed?”

The second question is less threatening.

The auditor can follow the process first.

Then:

“Who makes that decision?”

Then:

“How is the exception documented?”

Then:

“Who knows about the workaround?”

Now the auditor is gradually developing evidence.

This is often more effective than beginning with:

“Who told you to do this?”

Rapport Is Not Manipulation

Some auditors believe rapport-building compromises independence.

It does not.

Rapport means creating a professional environment where the employee is comfortable enough to provide accurate information.

That may involve:

• Explaining the audit purpose

• Listening without interruption

• Asking open-ended questions

• Avoiding unnecessary judgment

• Demonstrating respect for operational expertise

Employees frequently know more about the process than the auditor does.

Treating them as knowledgeable participants rather than suspects can produce far better evidence.

Active Listening Matters

Internal auditors are often focused on the next question.

That can cause them to miss important language.

Suppose an employee says:

“Normally we get approval first.”

The word normally matters.

Do not move immediately to the next checklist question.

Ask:

“Tell me about situations where that doesn't happen.”

That single follow-up may uncover the real process.

Listen for phrases such as:

• “Usually”

• “Most of the time”

• “Technically”

• “We're supposed to”

• “Officially”

• “Management prefers”

• “It depends”

• “When we're busy”

• “If the manager is here”

These phrases often signal that the written process and actual process differ.

Silence Is Information Too

An employee hesitates.

Looks toward the door.

Lowers their voice.

Changes the subject.

The auditor should not assume guilt.

But the behavior may indicate discomfort.

A skilled auditor might respond:

“It sounds like there may be more context here. What am I missing?”

That invites rather than accuses.

The objective is to create room for the employee to explain.

Do Not Promise Confidentiality You Cannot Provide

This is critical.

Auditors should not tell an employee:

“Everything you tell me is completely confidential.”

unless that is actually true under the organization's policy, legal requirements, and

Internal Audit procedures.

There may be circumstances where information must be escalated.

A better approach is to explain honestly:

“I will handle your information carefully and limit disclosure as much as our responsibilities allow.”

The auditor should understand:

• Internal Audit policy

• Whistleblower procedures

• Legal requirements

• Investigation protocols

• Escalation requirements

False assurances can destroy trust.

Protect Sources When Possible

Sometimes Internal Audit can communicate the issue without identifying the individual.

Instead of:

“Jane Smith told us her manager instructed her to bypass the control.”

the report may say:

“Multiple employees stated that the control is routinely bypassed when approval deadlines cannot be met.”

If the source's identity is not necessary, do not make it necessary.

This protects employees and can improve future cooperation.

Corroborate What Employees Tell You

Fear can cause employees to understate problems.

It can also create the opposite risk.

An employee may have:

• A personal grievance

• A conflict with management

• Incomplete information

• A mistaken interpretation

That is why inquiry alone should not determine the audit conclusion.

Corroborate with:

• Documents

• System records

• Emails

• Transaction data

• Other interviews

• Observation

• Reperformance

The employee's statement is evidence.

It is not automatically the conclusion.

Use S.P.I.N. Questioning to Reduce Fear

The S.P.I.N. methodology can be useful here as well.

Situation

“Walk me through how this process normally works.”

Problem

“What happens when the normal process cannot be followed?”

Implication

“If that happens, what risk does it create?”

Need-Payoff

“What change would make it easier to follow the control consistently?”

This structure allows the employee to describe the problem without immediately being forced to accuse another person.

Fear Can Reveal Tone at the Top

If employees repeatedly say things like:

“I don't want my name attached to this.”

or

“Please don't tell my manager I said this.”

Internal Audit should pay attention.

One employee may simply be cautious.

A pattern across departments may indicate something bigger.

Possible issues include:

• Retaliation

• Weak speak-up culture

• Management intimidation

• Poor whistleblower protection

• Excessive hierarchy

• Control override

That becomes relevant to the Control Environment.

The issue may no longer be only the specific process being audited.

What People Will Not Say Can Be as Important as What They Do Say

Sometimes the auditor notices:

• Employees answer differently when a manager is present.

• Interviews become more candid after the meeting.

• People send information anonymously.

• Employees contradict the official narrative privately.

Those patterns matter.

A useful audit technique is to compare:

Formal description

with

employee description

with

actual evidence.

If all three differ, Internal Audit may have found something important.

Management Presence Can Distort Walkthroughs

Auditors sometimes conduct walkthroughs with:

• Process owner

• Supervisor

• Department head

• Employee

all sitting together.

That can be efficient.

It can also suppress honesty.

The employee may not contradict the manager publicly.

For sensitive areas, separate interviews may be more effective.

This is especially true when reviewing:

• Fraud risk

• Management override

• Ethics

• Compliance pressure

• Whistleblower concerns

Fraud Inquiries Require Special Care

Fear becomes particularly important during fraud-related work.

Employees may worry that:

• They will be implicated

• They will be blamed for not reporting earlier

• The suspected person will retaliate

• Management will protect the wrongdoer

The auditor or investigator should therefore:

• Plan interviews carefully

• Avoid unnecessary disclosure

• Preserve evidence

• Coordinate with Legal or HR when appropriate

• Document statements accurately

• Avoid premature conclusions

Fraud interviews are not ordinary walkthroughs.

Ask “What Happens if Someone Raises a Concern?”

This can be a powerful audit question.

During a culture, compliance, or governance review, ask:

“What happens here when someone raises a serious concern?”

Then listen.

The formal answer may be:

“We have an open-door policy.”

The real answer may be:

“People stop getting invited to meetings.”

That difference is significant.

Fear Can Hide Management Override

Management override often survives because employees do not feel safe challenging it.

Suppose a senior executive instructs an employee:

“Process the payment. I'll approve it later.”

The employee knows the procedure prohibits that.

But the executive controls the employee's career.

The employee processes the payment.

Later, Internal Audit asks:

“Why was this payment made without approval?”

The employee says:

“I must have missed it.”

The real issue may not be employee error.

It may be executive pressure.

That distinction matters enormously.

Internal Audit Must Avoid Becoming Part of the Fear

Internal auditors can unintentionally worsen the problem.

For example:

• Publicly confronting employees

• Naming sources unnecessarily

• Using accusatory language

• Sharing interview details too broadly

• Appearing closely aligned with management

Employees observe how Internal Audit behaves.

If the function mishandles sensitive information once, future cooperation may disappear.

Trust is an audit asset.

Protect it.

AI Can Help Prepare Better Interviews

Artificial intelligence can help auditors prepare for sensitive interviews.

Using approved systems and properly protected information, the auditor can ask:

“Develop ten open-ended questions to understand whether employees feel pressure to bypass this control.”

Or:

“Rewrite these questions so they are less accusatory.”

Or:

“Identify follow-up questions that distinguish isolated error from management override.”

This can improve interview design.

AI should not be used to replace the auditor's judgment about credibility or intent.

AI Can Also Help Compare Statements

After interviews, an approved AI tool can help compare:

• Management descriptions

• Employee descriptions

• Policies

• Walkthrough notes

It may identify inconsistencies such as:

“Management says all exceptions require approval, while three employees described situations where approval is bypassed.”

That can help the auditor determine where additional evidence is needed.

But the auditor must validate the source information.

Fear Is Often the Difference Between the Written Process and the Real Process

Organizations may have:

• Policies

• Procedures

• Ethics hotlines

• Codes of conduct

• Approval matrices

The existence of those documents does not prove employees believe they can use them safely.

The real question is:

What happens when someone challenges authority?

That is where culture becomes visible.

When Fear Becomes a Governance Issue

The Chief Audit Executive should consider escalation when fear appears to affect:

• Fraud reporting

• Regulatory compliance

• Internal Audit access

• Management override

• Whistleblower protection

• Significant financial risk

• Cybersecurity reporting

At that point, the issue may belong before the Audit Committee.

Governance needs to know if employees are afraid to report significant risks.

A Practical Method for Internal Auditors

When fear or self-preservation may be affecting an interview:

1. Create a professional, non-accusatory environment.

2. Explain the purpose of the audit.

3. Use open-ended questions.

4. Ask about processes before asking about people.

5. Listen for qualifiers and hesitation.

6. Use follow-up questions.

7. Avoid unnecessary disclosure of sources.

8. Do not promise confidentiality you cannot guarantee.

9. Corroborate statements with independent evidence.

10. Escalate patterns suggesting retaliation or management override.

The Auditor's Objective Is Not to Make Employees Confess

This is important.

Internal Audit is not trying to force employees into admissions.

The auditor is trying to understand the process and the risk.

The better objective is:

Create an environment where truthful information can emerge and then validate it with evidence.

That is much more effective.

The Bottom Line

Employees often know where the real risks are.

They know:

• Which controls are bypassed

• Which reports nobody reviews

• Which managers override procedures

• Which deadlines create unsafe shortcuts

• Which problems everyone avoids discussing

But knowledge does not guarantee disclosure.

Fear can keep important information hidden.

That means the internal auditor needs more than technical competence.

The auditor needs:

• Rapport.

• Active listening.

• Open-ended questioning.

• Psychological awareness.

• Confidentiality discipline.

• Professional skepticism.

• Corroboration.

The crucial question may not be:

“Does this control work?”

It may be:

“Do employees feel safe enough to tell us when it doesn't?”

That is an Internal Audit question worth asking.

The Five Human Behavior Problems Internal Auditors Must Overcome

This is Part Four of our series:

1. Denial — “We don't have a problem.”

2. Rationalization — “There is a good reason we do it this way.”

3. Defensiveness and Ego — “You're criticizing me.”

4. Fear and Self-Preservation — “What happens to me if I tell you the truth?”

5. Resistance to Change — “We've always done it this way.”

The next challenge is Resistance to Change—what happens when management finally agrees with the finding but still does not want to change the process.