How auditors can navigate social media pitfalls

The pandemic and lockdowns have helped to reshape how we interact and have blurred the lines between the personal and professional. Digital communication has quickly shifted from necessity to normal and there has been exponential growth in the use of social media, expanding the risk landscape way beyond the likes of Facebook and Twitter. Many firms now routinely collaborate using the ‘social’ functionality in software, such as Slack, iMessage, Microsoft Teams, Telegram, WhatsApp and Zoom, and this trend has heightened the need to raise users’ awareness of the associated risks.

It is not unusual for our enthusiastic adoption of technology to outstrip our understanding of the risks or our preparedness to manage them, and social media is a prime example. The very things that make it attractive and useful can also make it riskier than you might think. Without the appropriate education and guidance, even well-intentioned employees can create unintentional risks.

Breaches of privacy and cyber security, compliance violations, damage to brand and reputation, loss of intellectual property and risks to strategy, process and personnel are among the many areas where use of social media by organisations and individuals may potentially have a negative impact. Factors such as familiarity, immediacy and the ability to engage with large numbers of people mean that social media use can pose significant threats to everything from the confidentiality of clients to the career prospects of individual auditors.

Cause for concern

ICAEW is seeing an increase in complaints about the professional behaviour of its members, particularly in relation to their activities on social media. Sometimes a post or blog may be obviously inappropriate, for example, if it uses aggressive or discriminatory language, or contains misleading information about qualifications or experience. But there are also far more subtle ways in which poor social media skills can lead to problems, such as unintended disclosures.

This is reflected in the narrative of the ICAEW training film Without Question. When Professional Standards held workshops to identify topics that should be included in the film, participants flagged inadvertent breaches of confidentiality on social media as a key business risk.

“This was what was keeping the risk partners at all the major firms awake at night,” explains Duncan Wiggetts, Chief Officer of ICAEW’s Professional Standards Department and writer of Without Question.

Pause for thought

The film shows some of the unintended consequences that follow after an audit manager involved in an initial public offering shares a post with friends on a personal social media account. This includes a photo of colleagues attending a meeting, which allows a journalist to work out that the company the audit manager is working with is about to float. As the drama unfolds, the manager apologises and says she “didn’t realise” and “wasn’t thinking”. She is removed from the audit and disciplinary action is taken by HR.

Watching and discussing this scenario in the training film engages the emotional side of the brain, something that Wiggetts believes will help people to remember the fictional audit manager’s experience and exert a positive influence on how they may behave in a similar situation. “If you’re thinking about doing something, it might make you think twice in future,” he says. “These are the potential consequences, and you don’t want to feel how she did.”

Focusing on users

Some firms have carried out research to identify where the greatest risks from social media users lie. These studies generally divide staff into three distinct social media user groups: the expert or prolific users; those who lack an understanding and are incompetent in exploiting such channels; and those who are somewhere in the middle.

Perhaps surprisingly, the research shows the risk is greatest at the two ends of the scale. While the risk from those at the bottom of the scale might be obvious, the risk from expert or prolific users is equally significant. “That’s where firms are looking for who the riskiest people are when it comes to social media,” says Wiggetts.

This illustrates the twin dangers of familiarity and immediacy. “Someone might be posting something as they walk towards the lift, without thinking through the consequences because it becomes so natural,” Wiggetts explains. “So, you have to inject the risk management part of the brain into that very natural, quick action.”

A question of ethics

ICAEW’s Code of Ethics requires accountants to act with integrity and avoid any conduct that might discredit the profession. And this is where most of the risks from social media lie.

A post can take seconds to create, but once it is out there it may be shared with any number of people, including those it was never intended to reach. Yet, the nature of social media can lead to a false sense of security, as people feel they are talking privately to friends. At the same time, its immediacy means there is less time to reflect or edit feelings or thoughts, so users may post language or opinions they would never share in more conventional, professional arenas.

Failures to comply with the Code, whether inadvertent or not, can lead to professional reprimands, as well as financial penalties such as fines and costs. Recent examples where ICAEW’s Investigation Committee has taken corrective action include offensive comments made in a blog and subsequently shared on Twitter, and breaches of confidentiality on Snapchat.

Golden rules

Given the personal, professional and financial costs of failure, how can firms and individuals mitigate the risks inherent in their social media activities? It can help to bear in mind some core principles or ‘golden rules’.

• Never share anything about work on social media channels, other than formal communications such as a post already put out or approved by your organisation.
• Be cautious about accepting friend requests, think about who you follow and be careful when using tags.
• Consider keeping your professional accounts separate to your personal accounts – and take care not to mix them up.
• If you ever consider posting images of colleagues on your personal accounts, even in a social context, ask their permission first.
• Always keep confidentiality in mind – a picture on Instagram or a location tag could reveal confidential information.
• Think about the image you’re presenting and how it reflects your values, views and your profession – whether you are posting on private or professional accounts.
• Give your social media accounts a regular clean out. You may need or want to un-tag photos, delete old posts, unfriend connections and unfollow pages you’re no longer interested in.
• Understand the privacy settings for each of your accounts; set and check them regularly.
• Google yourself now and then. It’s useful to get an idea of what others can easily find out about you, so that you can take action if necessary.

Above all, always stop and think before posting anything, whether on a business or a personal account. Imagine who might read or share it, how it could be perceived, and how it could reflect on you, your organisation, your clients or the wider accountancy profession. Is it something that you’d be comfortable sharing with your manager or client

One simple but effective trick is to imagine you are posting a comment on the side of a bus. Would you be happy for everyone on the street to read it there and have it travelling around your town or city for months – or even years – to come?

ICAEW resources 

To help members use social media productively while avoiding some of the pitfalls, ICAEW has produced a Technical helpsheet highlighting key considerations for individuals and employers using social media.

ICAEW’s ethics department has produced a guide to help members understand when conduct in their personal life may be of relevance to their professional life. Guidance on boundaries between a member's personal and professional life.

Without Question and other ICAEW training films are designed to provoke discussions and challenge mindsets about how to deal with difficult decisions and topical issues in business situations, with a focus on professional scepticism, ethics and everyday challenges.