GUEST BLOG POST:
Internal audit talks a lot about risk assessment quality, coverage, methodology, data sources, and scoring, but far less about the human conditions that shape what risks even show up on the table. One of those conditions is psychological safety: whether people feel safe enough to say, “Something here doesn’t feel right,” without worrying about embarrassment or retribution.
Inside many organizations, both internal auditors and auditees are “working scared.” Auditors worry about being labeled difficult or “not a team player.” Clients worry that naming uncomfortable risks will invite scrutiny or damage their reputation. The result is the same: critical information is edited out before the risk assessment ever starts.
The Hidden Risk: Fear of Speaking Up
Formal risk assessment processes assume that people will name the risks they see. In reality, fear quietly undermines the list. A team member may know that a revenue recognition practice is fragile, or that a culture of heroics is driving unsafe shortcuts. Still, if they believe speaking up will backfire, those risks become invisible.
Work by Google’s Project Aristotle on team effectiveness found that psychological safety, the belief that it is safe to take interpersonal risks, is the single most important driver of team performance. Bring that focus into internal audit, and a simple question emerges: if your risk assessment relies on people’s candor, what happens when they don’t feel safe enough to be candid?
Two Paths of “Working Scared” in Internal Audits
There are two parallel paths where “working scared” undermines internal audit’s view of risk.
- On the audit team side, staff may downplay emerging risks to avoid conflict with senior stakeholders or to protect their own standing with leadership. Complex, politically sensitive topics get softened, reframed, or parked for later.
- On the client side, auditees may sanitize their narrative, choosing safer examples, glossing over near misses, and providing documentation that shows what should happen, not what actually does.
Each path on its own can distort the risk picture. Together, they create a false sense of assurance: a risk assessment that looks robust on paper but is built on partial truths and constrained voices.
Making Psychological Safety a Deliberate Input to Risk Assessment
The good news is that psychological safety is not an abstract ideal; it can be built into the mechanics of how risk assessments are run. For internal audit leaders, that means treating “working scared” as an explicit risk factor, not just a cultural aspiration.
Before and during risk assessment activities, ask:
- Where are we likely to see silence or self-censorship from our own team and from stakeholders?
- What design choices can we make to lower the cost of candor?
Those questions move psychological safety from theory into practice.
Concrete Practices Internal Auditors Can Use
Several concrete practices can help internal auditors surface risks that fear would otherwise hide.
1. Redesign risk assessment meetings for voice equity
Structure the meeting so that everyone speaks early and often: use round-robin prompts, ask each participant to bring one “nagging concern,” and explicitly invite dissenting views before aligning on priorities.
2. Blend anonymous input with facilitated discussion.
Start with anonymous surveys or digital prompts to collect risks people might hesitate to say out loud, then use the aggregate themes as a neutral starting point for group discussion. This lowers the personal risk of naming sensitive issues while still allowing follow-up questions and clarification.
3. Name “working scared” as an audit risk in scoping.
When planning culture, ethics, or psychosocial risk work, include “fear of speaking up” in your risk universe and indicators. Look at turnover, near-miss reporting, and employee survey comments as potential evidence of suppressed risk information.
4. Model candor inside the audit team first
If staff doesn’t feel safe challenging assumptions in internal meetings, they are unlikely to push on uncomfortable truths with clients. Use your own planning sessions to demonstrate that naming inconvenient risks and uncertainties is expected, not punished.
From Better Conversations to Better Coverage
Ultimately, psychological safety is not a soft add-on to the “real” risk assessment work; it is part of the engine that determines whether your risk assessment is built on full information or partial stories. When auditors and auditees are working scared, the most important risks can remain invisible. When psychological safety is deliberately designed into the process, more of those risks make it onto the page, where they can be assessed, prioritized, and addressed.
For internal audit leaders, the challenge is simple to state and hard to ignore: if your risk assessment assumes people are speaking freely, how will you know when they are not, and what will you do to change that? 
Bill Englehaupt has spent 35+ years improving performance for organizations like Accenture, PwC, and KPMG, impacting thousands of audits and auditors worldwide. He also served in United Nations peacekeeping operations, where he learned to streamline complex systems and lead teams in demanding environments. Today, through Auditology™, Bill helps audit teams run faster, cleaner, and more profitable audits using a proven system built from Lean Six Sigma and field-tested experience.