Role of Internal Audit in a Company

"I make sure people know my face," said Simon Lorne, vice chairman and chief legal officer of Millennium Management LLC, in detailing the steps he takes to make the internal audit function of the hedge fund management company an integral part of its ethical culture.

Lorne addressed the Center's Business and Organizational Ethics Partnership, offering practical strategies for promoting ethical behavior and moving toward a more ethical culture:

• Issue a short and long form ethics code. Understand that the average employee is not going to read and pay attention to a policy manual, so be sure that the principle values of the company are concise and clear, and fit on a single page.
• Demonstrate the high regard in which top management holds the internal control system. Lorne himself is a vice chairman of the company and his office is next to the president's. He goes out of his way to involve line management in the ethical dilemmas that arise. This allows employees to observe first-hand the importance that the C-level executives place on the ethical reputation of their firm.
• Reinforce the importance of the internal audit function in company communications. As an example, Lorne pointed to a college campus recruiting brochure for Millennium in which two of 18 pages were focused on internal audit. Although few if any of the new recruits will actually work for Lorne, who hires mostly seasoned professionals, the brochure highlights the company's commitment to ethics and, hopefully, discourages applicants who are bent on cheating.
• Pay attention to the messages the company sends through its actions or inactions. What ethical lapses will the company accept and from whom? Is a star performer treated more leniently? Make sure to publicize the results of ethics investigations so that employees know unethical behavior can (and does) result in termination.
• Make it as easy as possible for people to report problems. In Lorne's experience, employees rarely used anonymous hotlines, but they would talk to compliance officers who had taken the time to understand their challenges and built effective working relationships.
• Make use of personal affirmations, where employees certify (in writing) that they have conducted business in compliance with the law and company policies.
• Finally, exercise eternal vigilance. Ethics is a job that doesn't end.

Before coming to Millennium, Lorne was a partner with Munger Tolles & Olson, LLP. He served as a managing director, with responsibility for Legal Compliance and Internal Audit for Citigroup/Salomon Brothers and as general counsel for the Securities and Exchange Commission.

Miriam Schulman, former communications director of the Markkula Center for Applied Ethics.