Employee surveys can be a valuable tool for assessing the workplace and spotting potential problems. And while organizations that use them often spend considerable time crafting their survey instrument, internal auditors may find opportunities to improve the content or administration of this key monitoring control. When the survey is tailored appropriately, its results can help auditors develop the periodic audit plan, scope audit projects, and better support audit results.
It is common for organizations to use the employee survey as a "pulse check" on their culture. It is less common for internal auditors to provide assurance on the survey's effectiveness in this capacity, or to use its output to improve their audit work. With the right approach, they can do both.
Tailoring the Survey for Audit Use
The city of Austin, Texas, conducts a citywide employee survey. At one point the city auditors compared its content to the "points of focus" in The Committee of Sponsoring Organizations of the Treadway Commission's Internal Control–Integrated Framework. The auditors found that the survey addressed most of the framework's content, except for ethics. They developed several ethics-related statements and persuaded Human Resources (HR) to add them to the survey. With these modifications in place, the audit team now uses the survey results for audit planning.
Taking a cue from the city auditors' approach, other internal auditors might consider suggesting changes to their own organization's survey. Sources of governance, risk, and control issues that might be addressed include:
-
The risk factors internal audit uses for audit planning. Could additional survey statements provide insight into cultural risks related to these factors?
-
Current professional guidance on culture. A few of the cultural topics found in guidance documents are included in "Suggested Culture Topics" below.
Survey statements used by others. A selection of such statements appears in "Examples of Survey Statements on Cultural Topics." In addition, audit peers may be willing to share culture-related survey statements from their organizations, and internet searches can help identify more.
Getting the survey administrator to add statements to an existing survey may be difficult, especially if the administrator is an external vendor. Internal auditors may want to determine whether the administrator can make changes before taking time to identify or develop additional statements.
Developing meaningful, unambiguous survey statements can be a challenge. Guidelines to keep in mind include:
- Be sure statements are phrased clearly and simply, and provide good instructions (e.g., when referring to "management," specify the level of management).
- Get help. The organization's HR department might have expertise in survey statement development. If not, HR may be able to suggest a good source. Also consider reaching out to peers in the profession for recommendations — and at a minimum, research available guidance online.
Field-test the statements. Ask several people to respond to the statements using internal audit's prewritten response options, then ask them what they think each statement was asking. Start within the audit department, then branch out to other willing employees. This process should identify any ambiguity in the statements.
How to Leverage the Survey
Even if the organization's survey does not include everything internal audit would like, it almost certainly addresses many important aspects of culture. Because cultural problems can be pervasive, negative survey results may suggest increased risk — perhaps even a substantial increase. Internal auditors should, therefore, factor employee survey results into their global risk assessment for planning which assurance and consulting projects to perform.
Survey results for the affected areas can then be used to plan and scope an audit or consulting project. They can also help support audit findings. The root cause of exceptions, for example, might be a cultural issue identified by the survey.
Some organizations might resist giving internal audit access to survey results with enough detail to be useful. Internal auditors must choose their battles, and the importance of culture suggests this might be a battle worth fighting. With support from the top and tactful communication, access will usually be given.
Assessing the Survey Process
If the business leaders rely on an entitywide employee survey to monitor the organization's culture, it is certainly a key control. And it should be subject to audit. Questions to ask about the process include:
If internal audit already knows the survey process well and has full confidence in it, this might constitute sufficient assurance. If not, an audit or advisory review would not take a lot of time and could yield valuable results.
A Valuable Tool
Employee surveys give internal auditors an opportunity to add value to a key monitoring control. They can recommend improvements to the survey content and process. And they can use the results to improve their own global risk assessment, plan and scope audit projects, and enhance and support audit findings.
Suggested Culture Topics
The following are examples of topic areas, gathered from a variety of guidance documents, that might be suggested for inclusion in an entitywide survey. The list is by no means comprehensive. 1. Are the following aligned with the desired cultural values and principles? 2. Is risk management integrated into all decisions and activities, at all levels of the organization?
3. Are appropriate risk behaviors rewarded and inappropriate behaviors identified and sanctioned?
4. Is constructive challenge of risk decisions encouraged?
5. Is risk event reporting and whistleblowing encouraged, without fear of retaliation?
6. Is there clear ownership and accountability for specific risks and risk areas?
7. Are integrity and ethical values discussed regularly? Does management practice what it preaches?
8. Are assurance functions respected and appropriately resourced?
|
Read other articles in this series:
Auditing Culture: History and Principles
Auditing Culture: Bumps in the Road
Auditing Culture: Where to Begin
Auditing Culture: Observation and Data
Auditing Culture: Audit Project Surveys
