Thank You!

You are attempting to access subscriber-restricted content.

Are You Ready to Experience Everything Internal Auditor (Ia) Has to Offer?

​​Care and Feeding of the Company’s Culture

​Two experts discuss internal audit’s role in ensuring a healthy organizational culture.

Jason Pett, U.S. Internal Audit Solutions Leader, PricewaterhouseCoopers
Sandy Pundmann, U.S. Managing Partner, Internal Audit, Deloitte & Touche

Comments Views

Why audit organizational culture?

PETT It wasn’t only through missing or weak controls and processes that the recent credit crisis and the Forex and LIBOR scandals crystallized. They were partially attributable to poor decision-making, a lack of integrity and ethical behavior, and a failure to diagnose and correct poor behavior and culture. In addition to more traditional auditing, there is a need to audit culture to establish the root cause of poor behavior and stop it quickly. Internal audit, through its work and focus on audit results and cultural themes, can provide the board and executives some assurance and a point of view on the state of organizational culture and the responsiveness of the organization to acknowledge and address cultural issues.

PUNDMANN The tie that binds in many corporate funerals is an unhealthy organizational culture. While we may attribute organizational failures to things like fraud, poor leadership decisions, and other such symptoms, culture is really at the crux. Auditing culture can reveal if there’s a gap between perceived culture and what employees and others report as reality. When you’re relying on internal and external third parties to act in a consistent, ethical manner on your behalf, it’s worth examining.

What are the characteristics of a healthy culture?

PUNDMANN Healthy organizations have guidance on norms and expectations. Tone at the top in healthy cultures is communicated and espoused firmwide for the long term. Healthy cultures enable broad thinking and appropriate risk taking, without focusing myopically on the next quarter’s results. It sounds simple enough, but it’s actually quite rare.

The hallmark of an unhealthy culture is the “no bad news” approach. If people face retribution for raising issues that might be contrary to expected outcomes, why raise a hand? Unhealthy organizations also are the most resistant to culture audits.

PETT A healthy culture starts with clarity and transparency at the top. When leadership clearly sets the organization’s vision and values, and reinforces them with both consistent communication and a complementary measurement system, expectations around culture are clearly established. These messages should promote professional skepticism and encourage staff to speak up with autonomy and confidence, without concern about impact on personal reputation and perception. A healthy culture means the board and management hold a well-balanced short- and long-term view on an organization’s strategy and bottom line. Collectively, these characteristics will contribute to an organization’s long-term success.


How should auditors go about auditing culture?

PETT Culture is the DNA of an organization. Additionally, there are multiple subcultures that exist across an organization. The key is to determine where the real hot spots are, such as the teams, divisions, management lines, and activities that potentially present high-impact culture risk. It is therefore important to carry out a culture risk assessment. Auditors should draw on their knowledge and experience gathered through their work and use key business and operational data points that can provide behavioral indicators. Once key culture risk areas are identified, auditors must adopt a methodical approach to consider these areas during all of their audit activities and assess and test the root cause of issues identified during audit activity to determine if cultural concerns are at or near the core of the issue. They should look beyond the control or process concerns and ask the question, “Is the root cause behavioral or cultural?” This is one strategy to embed cultural auditing into the day-to-day audit activities of the department. 

PUNDMANN While some may use the words testing and monitoring interchangeably, they should be separate and applied to any audit of culture. Start with a risk assessment to see what an organization is already doing to understand, communicate, and shape its corporate culture. To test whether existing efforts are effective, talk to senior management, the audit committee, and other leaders to get their take. Then, compare the assessment from leadership with feedback you receive from middle management and employees to identify gaps between leadership understanding and day-to-day practice. Consider starting small, perhaps by auditing the culture of a business unit seen as healthy. Then analyze the gap between the healthy business unit with those that aren’t seen as positively. Of course after various cultural gaps are identified, be sure to monitor efforts to close them. Software solutions can help auditors identify cultural strengths and gaps, and later monitor progress of efforts to enact change.

Why don’t more organizations audit culture?

PUNDMANN Unlike so many things we audit where we know what the control is and whether things varied from it, auditing culture is not so clear-cut. It’s very subjective and hard to evaluate. Within some organizations, culture can differ by business unit, subsidiary, or just one team. But having the ability to honestly communicate with the board, the audit committee, and corporate leaders about corporate culture can be a true strategic enabler. 

PETT Culture and behavior to many people are often nebulous concepts that are viewed as difficult to audit credibly using traditional methods. This combined with historically theoretical culture debates and points of view presented by industry, organizations, and regulators — that have not pointed to culture as a material root cause of failing companies — have resulted in organizations not auditing culture in a meaningful way. It would seem there is a change occurring, with culture audits beginning to appear in audit plans.

What skills do internal auditors need to audit culture?

PETT Internal auditors need not only to be controls and business experts, but they also need to have heightened levels of self-awareness and be more sensitive to the emotional drivers of teams, management, and the organizations. They need to understand how poor behavior can adversely impact day-to-day activities within an organization and ultimately its strategic direction. A good balance between left brain thinking — logical, analytical, technical — and right brain thinking — creative, feelings, holistic — is needed. That said, auditors do not need to be psychologists. Instead, more honed soft skills combined with effective communication capabilities will help them engage in credible culture discussions and educate stakeholders on the importance of culture and behavior.

PUNDMANN Culture audits require tenacity, an analytic mind, healthy skepticism, and the willingness to ask for help. In some cases, internal auditors need to persuade leaders when a culture audit is needed — often reaching out of our groups to build consensus. Once the audit is underway, we need to correlate observations of our own with perspectives from various sources, being mindful of information sources and myriad variables that stand to sway discussions. After initial culture audit results are in, internal audit often contributes to efforts driven by talent, compliance, and other groups to help improve challenged areas.

How can a toxic culture change?

PUNDMANN To truly change a culture, you have to take action. Identifying gaps between leadership perceptions and employee realities in corporate culture is one thing. But changing behavior takes time, consistency, and investments from across an organization to improve.

PETT A toxic culture can only be changed if leadership can diagnose it, is willing to act on and remediate the root cause, and can hold accountable those individuals who are causing the toxicity to occur. Boards, executives, and management need to review their measurement systems to ensure they are not running contrary to their desired values, and must showcase that they take poor culture and behavior seriously, continually reinforcing this to ensure they can influence the change they seek. Methods exist in organizations to deal with poor behavior such as private warnings, performance plans, or termination. However, the key is to make the action taken public and link it as a consequence of poor culture and behavior.

Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to remove comments.



Comment on this article

comments powered by Disqus
  • Your-Voices-Recruitment-January-2022-Blog-1
    • IT-General-Controls-Certificate-January-2022-Blog-3