The standards require it. What does it actually mean in practice?
“Demonstrate integrity and professional courage”
Standard 1.1 of the 2024 Global Internal Audit Standards requires internal auditors to perform their work with honesty and professional courage. The expectation is clear. The definition is not.
The Standards assume we already know what professional courage means. They do not explain how it shows up in the room, under pressure, when the issue is politically awkward and the consequences of challenge are personal rather than procedural.
This is where governance work becomes human.
Where professional courage is tested
Anyone working in second- or third-line roles recognises the moment. The evidence is incomplete. The executive narrative is optimistic. The risk feels real but relational dynamics are delicate. You are the one expected to raise the difficult point.
You are visible. You are accountable. You know that staying quiet would be safer.
Most governance leaders know what needs to be said. The harder question is how to say it well, at the right time, in a way that preserves influence rather than diminishing it, and then how to stand by that judgement when it is challenged.
That challenge is not primarily technical. It is behavioural.
The gap between knowledge and action
Governance functions invest heavily in frameworks, methodologies and technical rigour. Professionals are trained to interpret standards and follow process with care.
What receives less structured attention is the behavioural side of applying judgement under pressure.
Behavioural science research consistently shows that human decisions are shaped by cognitive bias, hierarchy, perceived threat and reputational concern. These forces influence how people speak, challenge and escalate - particularly when the stakes are high. Knowing the right answer and being able to act on it are not the same capability.
Professional courage sits in that gap.
Defining professional courage for governance
There are multiple definitions of courage across psychology, philosophy and organisational research. Some centre fear. Others emphasise moral virtue. Others focus on risk-taking behaviour.
Rather than assume a single universal definition, it is more useful to ask what courage must mean within the specific context of governance.
In oversight roles, the central issue is not dramatic heroism. It is the capacity to exercise independent judgement when doing so creates exposure.
For governance professionals, professional courage can therefore be defined as:
The enactment of independent, values-aligned judgement under conditions of experienced personal or relational exposure.
This definition is deliberate. It recognises that:
Courage in governance is rarely physical; it is reputational and relational.
Exposure is often social rather than procedural.
The potential cost may be to standing, influence or professional relationships.
The actor is aware of that exposure when choosing to act.
Courage, in this context, is not simply about emotion. It is about recognising exposure and exercising sound judgement anyway.
In governance environments, where visibility, accountability and hierarchy are real, that distinction matters.
Why professional courage is harder than it sounds
The leaders I speak with are rarely lacking integrity or commitment. They are navigating genuine complexity:
Incomplete or evolving evidence
Competing organisational priorities
Relationships that must endure beyond the difficult conversation
Sustained executive pushback
Professional courage is most demanding when the risk is relational and reputational rather than technical - when the exposure is social, political or career-impacting rather than procedural.
The hesitation before raising a concern. The pull toward a softer version of the truth. The gradual erosion of confidence under challenge.
These are not failures of knowledge. They are human responses to exposure.
What behavioural science adds
When stakes are high, the brain becomes more sensitive to threat. Cognitive biases can distort risk perception. Social hierarchies can amplify the perceived cost of dissent. The desire to protect credibility or preserve working relationships can quietly compete with the duty to challenge.
In oversight roles, these pressures are intensified. Scrutiny is high. Authority structures are visible. Relationships must continue after the meeting ends.
Professional courage is therefore not merely conviction. It is judgement exercised within a web of psychological and social pressures.
Understanding those pressures does not dilute governance. It strengthens it.
Developing professional courage
If professional courage were purely a personality trait, Standard 1.1 would offer limited practical leverage. But it can be strengthened.
In my work at the intersection of psychology, neuroscience and applied decision science, three areas consistently matter:
Cognitive awareness
Recognising how bias, hierarchy and threat responses influence judgement and communication.
Relational capability
Learning how to challenge constructively - maintaining connection while expressing difficult truths.
Behavioural practice
Rehearsing escalation, executive challenge and difficult conversations so that courageous action becomes deliberate rather than reactive.
Professional courage grows through structured reflection and practice - just as technical governance capability does.
Governance for good is behavioural
Principle 1 assumes integrity and professional courage are present. But these are not checklist items. They are behaviours.
They show up in how executive pushback is handled. In how hesitation is managed. In how independence is balanced with influence.
Governance failures rarely begin with incompetence. They begin with unraised concerns, softened language or delayed escalation.
Professional courage is the capability that interrupts that drift. The Standards assume it.
The question is how deliberately we choose to define it - and build it.