With this first in a series of articles planned on auditing culture, I'm excited to share what has been my passion, in one form or another, for the last 26 years. I hope the series will serve as a forum for the creative, courageous internal auditors who are active in auditing culture to share what they're doing, thinking, and concerned about.
I went into business for myself three months after the first Committee of Sponsoring Organizations of the Treadway Commission (COSO) report came out in September 1992. Internal Control–Integrated Framework emphasized the primary importance of the control environment, which focuses on "people — their individual attributes, including integrity, ethical values, and competence" — and includes "management's philosophy and operating style" as one of seven factors that contribute to the control environment's effectives. This emphasis matched that of my first chief audit executive, Roger Carolus, who was a member of the COSO advisory group.
We never had the support to fully realize Roger's vision, but COSO's authoritative guidance sparked interest in the profession on evaluating soft controls. And while there is more to auditing culture, evaluating soft controls was the forerunner to this type of assessment and remains an essential ingredient to this day.
During the 1990s, the profession's main tool of choice for evaluating soft controls was the control self-assessment (CSA) workshop. This technique was powerful, but only a minority of internal audit functions adopted it, and most of them saw diminishing returns after the first few years. Today, workshops seem to be used more by risk managers for risk assessment than by internal auditors.
Based on my own research and discussions with other audit professionals, the emerging tools of choice for evaluating soft controls are employee surveys and structured interviews, where auditors ask questions of a sample of employees and tabulate the results. Of course, auditors' observations are also key to understanding an organization's culture, though they usually need to be corroborated with more objective evidence.
How can internal auditors evaluate an organization's culture? They can look at governance documents like the code of ethics, mission and vision statements, and stated values. But these documents reflect the board and executives' desired culture, not the actual culture.
They can interview executives, who will describe the culture as they see it. But the information those executives receive from direct reports and below, upon which their assessment is based, is usually filtered. No one wants to give his or her boss bad news, so employees present a somewhat idealized picture of the culture — not dishonest, just slightly rosy. As information moves up the organizational ladder, the picture gets increasingly rosier. The "emperor has no clothes" syndrome generally applies.
So where does the real culture exist? Three principles help explain where culture can be found and how it should be audited.
1. Culture Exists in Employee Perceptions Ultimately, culture resides in the perception of employees. If employees believe the culture is x, y, or z, that's what it is, and they will act accordingly. Of course, getting employees to say what they honestly believe about the culture can be challenging. I will discuss some of the challenges in future articles.
2. Cultural Evaluation Must Be Based on Self-assessment This principle flows from the first. If culture exists in the perception of employees, internal auditors have to act more as facilitators than as independent, objective observers. I have seen many dozens of effective soft control evaluation tools, and I have yet to see one that is not somehow based on self-assessment.
Auditors should keep in mind an important caveat to this principle. The term self-assessment sounds like people assessing themselves. For obvious reasons, auditors can't rely on this type of assessment as audit evidence — they need some form of verification. To use employee surveys as an example, phrasing questions so that employees assess their own behavior or managers assess their own area is not reliable. But asking employees to assess aspects of the environment created for them by higher levels can be quite reliable if they feel comfortable answering candidly. In addition to building a certain level of reliability into the survey process, internal auditors usually follow up on survey results by looking for corroborating evidence.
3. The Goal Is to Enrich Understanding of the Culture An organization's culture is amorphous, varied from place to place, and changeable over time. It does not lend itself to evaluation by any one technique alone or to reaching a definitive assessment. Rather, internal auditors should use a variety of techniques — some quantitative, some qualitative — with the goal of continually enriching key stakeholders' understanding of the culture. Moreover, stakeholders need to understand that this is internal audit's goal.
Internal auditors should keep in mind that they are only one source of cultural information. The first and second lines of defense also have a story to tell. Auditors should work cooperatively with the first line and coordinate their work with the second line. But with its independence and objectivity, together with the variety of techniques at its disposal, internal audit can be one of the most reliable sources of cultural knowledge in the organization.
The Root of the Matter
As many observers have noted, a root cause of almost every major scandal or fraud is dysfunction in the organization's culture. To give the kind of assurance required at the level they should give it, internal auditors must generate the best information they can about where the culture stands and what factors are driving it.
If you have techniques or methodologies you are willing to share, or would like advice on something you are developing, please let me know. And, of course, questions and comments are always welcome.
For those who are new to auditing culture, our video, "Culture Audits: Getting Started," provides advice on how to begin and where the challenges may lie.