Culture and the role of internal audit - board briefing

Audit committee briefing

Download the audit committee briefing (pdf)

Read the full report

Key points

Boards and senior management have the prime responsibility for establishing the right organisational culture by promoting their ethics and values and the behaviours these require across their organisations.

The behaviour of employees at the front line, such as sales staff, dealers or care workers, needs to conform to the ethics and culture of their organisation, and boards need to be assured that the whole organisation is pulling in the same direction.

Internal audit can be a key player in giving assurance and confidence to boards as organisations come under increasing pressure to demonstrate their commitment to improving standards of behaviour.

Overview

In financial services auditing culture is a key feature of the IIA Code. But there is a similar need across many other sectors. Internal audit can play an advisory role on processes and controls in cultural change programmes. But the ownership of such programmes must lie with the executive.

Internal audit’s role is to analyse to what extent processes (such as performance management and remuneration), actions (such as decision making) and tone at the top are in line with the values, ethics, risk appetite and policies of the organisation. They can therefore help boards judge whether measures put in place to change culture and thus behaviour are actually working.

Auditing culture and its indicators is complex. Culture is an amorphous concept.

Internal auditors need to understand their own organisation’s culture, including risk culture, before starting to audit the indicators. There are many models that look at the components of organisational culture. But it is dangerous to reduce work on culture and behaviour into one set of indicators based on a particular model.

There is no one-size-fits-all solution to auditing culture as organisations can be very different, even if they are producing the same or similar outputs.

Cultural change does not happen overnight, and providing assurance to boards on change programmes and their effects will be an increasingly important part of internal audit’s work.

It is important that audit committees engage with internal audit on culture from the start, so that policies and processes can be developed that build in the need for assurance.

Enablers and challenges

In order to harness internal audit’s support of boards in relation to culture most effectively, boards need to be aware of the enablers and challenges that internal audit faces. 

Background

Following a series of scandals, fundamental changes in organisational culture are being called for across sectors including media, food, retail, health and financial services. How organisations, and individuals within them, behave has become a matter of public concern.

Poor organisational culture has been identified as the root cause of many scandals, which have resulted in great cost to individuals, organisations and even countries. 

In the IIA’s latest annual Governance and Risk Report, ethics and culture was one of the top three areas where Heads of Internal Audit (HIAs) are planning to increase their resources. This suggests that boards and their HIAs will increasingly be engaging in dialogue on culture and the role of internal audit. 

The IIA report aims to assist that dialogue. The IIA financial services Code highlights the importance of culture in one particular sector. It recommends that internal audit should include within its scope the risk and control culture of the organisation and evaluate whether the organisation is acting with integrity in its dealings with customers and in its interaction with relevant markets. This is an important message relevant to many other sectors, in particular those that are regulated.

Auditing cultural indicators 

The IIA report shows the role internal audit is playing in relation to culture. HIAs are taking two main approaches to auditing cultural indicators:

Approach 1

The first is to incorporate culture into each audit, through techniques like root cause analysis, identifying why issues occur and how they can be the drivers for wrong behaviours, and then to join the dots across individual audits.

This takes them beyond focussing on processes and controls and requires them to combine hard data with gut feel. They also need to have a different type of dialogue with the audit committee chair and/or CEO, using more subjective judgements.

Some say that this is what any good internal audit has been doing all along but only now is it being badged as culture. Others see this as a new departure.

Approach 2

The second approach is auditing cultural indicators across the organisation through auditing personal behaviours as a proxy for culture.

Here the key question is how best to gather evidence to show that culture and values are at the heart of every business decision and are being incorporated at every level in recruitment, training, performance management and reward arrangements. 

This second approach requires internal audit to engage in new ‘soft’ techniques and work more closely with other functions, such as HR. This approach is less common, but, over time, may be adopted more widely in addition to the first approach if deemed helpful to the organisation and its circumstances.

The report contains summaries of concrete examples of the different approaches that organisations are taking as they start on the journey of auditing culture.

We are not endorsing any particular model, as there is no one right way to do it. But the examples point to some options for starting work in this area and show some of the challenges being encountered. The Institute is also providing its member internal auditors with technical guidance to help equip internal audit to play a bigger role in the assessment of organisational culture. It contains full detail on the examples of the different approaches