Thank You!

You are attempting to access subscriber-restricted content.

Are You Ready to Experience Everything Internal Auditor (Ia) Has to Offer?

​Auditing Culture: Employee Surveys

Auditors can provide assurance on the survey's ability to assess culture, and leverage results to help improve their audit work. 

Comments Views

Employee surveys can be a valuable tool for assessing the workplace and spotting potential problems. And while organizations that use them often spend considerable time crafting their survey instrument, internal auditors may find opportunities to improve the content or administration of this key monitoring control. When the survey is tailored appropriately, its results can help auditors develop the periodic audit plan, scope audit projects, and better support audit results. 

It is common for organizations to use the employee survey as a "pulse check" on their culture. It is less common for internal auditors to provide assurance on the survey's effectiveness in this capacity, or to use its output to improve their audit work. With the right approach, they can do both. 

Tailoring the Survey for Audit Use

The city of Austin, Texas, conducts a citywide employee survey. At one point the city auditors compared its content to the "points of focus" in The Committee of Sponsoring Organizations of the Treadway Commission's Internal Control–Integrated Framework. The auditors found that the survey addressed most of the framework's content, except for ethics. They developed several ethics-related statements and persuaded Human Resources (HR) to add them to the survey. With these modifications in place, the audit team now uses the survey results for audit planning.

Taking a cue from the city auditors' approach, other internal auditors might consider suggesting changes to their own organization's survey. Sources of governance, risk, and control issues that might be addressed include: 

  • The risk factors internal audit uses for audit planning. Could additional survey statements provide insight into cultural risks related to these factors?
  • Current professional guidance on culture. A few of the cultural topics found in guidance documents are included in "Suggested Culture Topics" below.
  • Survey statements used by others. A selection of such statements appears in "Examples of Survey Statements on Cultural Topics." In addition, audit peers may be willing to share culture-related survey statements from their organizations, and internet searches can help identify more. 

Getting the survey administrator to add statements to an existing survey may be difficult, especially if the administrator is an external vendor. Internal auditors may want to determine whether the administrator can make changes before taking time to identify or develop additional statements.

Developing meaningful, unambiguous survey statements can be a challenge. Guidelines to keep in mind include: 

  • Be sure statements are phrased clearly and simply, and provide good instructions (e.g., when referring to "management," specify the level of management). 
  • Get help. The organization's HR department might have expertise in survey statement development. If not, HR may be able to suggest a good source. Also consider reaching out to peers in the profession for recommendations — and at a minimum, research available guidance online.
  • Field-test the statements. Ask several people to respond to the statements using internal audit's prewritten response options, then ask them what they think each statement was asking. Start within the audit department, then branch out to other willing employees. This process should identify any ambiguity in the statements.

How to Leverage the Survey

Even if the organization's survey does not include everything internal audit would like, it almost certainly addresses many important aspects of culture. Because cultural problems can be pervasive, negative survey results may suggest increased risk — perhaps even a substantial increase. Internal auditors should, therefore, factor employee survey results into their global risk assessment for planning which assurance and consulting projects to perform. 

Survey results for the affected areas can then be used to plan and scope an audit or consulting project. They can also help support audit findings. The root cause of exceptions, for example, might be a cultural issue identified by the survey.

Some organizations might resist giving internal audit access to survey results with enough detail to be useful. Internal auditors must choose their battles, and the importance of culture suggests this might be a battle worth fighting. With support from the top and tactful communication, access will usually be given.

Assessing the Survey Process

If the business leaders rely on an entitywide employee survey to monitor the organization's culture, it is certainly a key control. And it should be subject to audit. Questions to ask about the process include:

  • Is the survey truly anonymous and do employees believe that it is? 
  • If the survey is not anonymous, is the level of confidentiality sufficient for employees to feel safe being honest?
  • Does the survey ask for comments at an appropriate frequency? By the time employees complete the survey, they may not remember issues raised that they want to comment on. Asking for comments several times can generate meaningful, specific information. If the survey is structured into sections, each addressing a broad topic, a comment request at the end of each section is advisable. Comments, of course, are voluntary and must be kept confidential.
  • Are the results publicized, with action plans to address issues and explanations when issues can't be addressed?
  • Are action plans completed effectively and on time?
  • What do employees think of the survey? Do they believe management takes it seriously and that it adds real value?
  • Is the response rate high? If not, why?

If internal audit already knows the survey process well and has full confidence in it, this might constitute sufficient assurance. If not, an audit or advisory review would not take a lot of time and could yield valuable results.

A Valuable Tool

Employee surveys give internal auditors an opportunity to add value to a key monitoring control. They can recommend improvements to the survey content and process. And they can use the results to improve their own global risk assessment, plan and scope audit projects, and enhance and support audit findings. 

Suggested Culture Topics 

The following are examples of topic areas, gathered from a variety of guidance documents, that might be suggested for inclusion in an entitywide survey. The list is by no means comprehensive.

1. Are the following aligned with the desired cultural values and principles?

  • The business strategy.
  • The risk appetite.
  • The recruitment process.
  • The onboarding process and training programs.
  • The performance management system.
  • The incentive structures.
  • How employees, customers, and suppliers are treated.
  • Tone at the top and in the middle.
  • Behavior of frontline employees.

2. Is risk management integrated into all decisions and activities, at all levels of the organization?

3. Are appropriate risk behaviors rewarded and inappropriate behaviors identified and sanctioned?

4. Is constructive challenge of risk decisions encouraged?

5. Is risk event reporting and whistleblowing encouraged, without fear of retaliation?

6. Is there clear ownership and accountability for specific risks and risk areas?

7. Are integrity and ethical values discussed regularly? Does management practice what it preaches?

8. Are assurance functions respected and appropriately resourced?

Read other articles in this series:

Auditing Culture: History and Principles

Auditing Culture: Bumps in the Road

Auditing Culture: Where to Begin

Auditing Culture: Observation and Data

Auditing Culture: Audit Project Surveys

James Roth
Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to remove comments.

About the Author



James RothJames Roth<p>​James Roth, PhD, CIA, CCSA, CRMA, is president of AuditTrends LLC in Hastings, Minn., and author of <em>Best Practices: Evaluating the Corporate Culture</em>. He received <em>Internal Auditor</em>’s John B. Thurston award for the article, “How to Audit Culture” and conducts the seminar, Auditing Culture: Challenges and Proven Techniques for The IIA. </p>


Comment on this article

comments powered by Disqus
  • AuditBoard-January-2022-Premium-1
  • CIA-January-2022-Premium-2
  • 2022-GAM-January-2022-Premium-3



Stopwatch Auditing Auditing
Thanks, We Already Know That, We Already Know That
Remember the 98 Account the 98 Account
Hidden Goals Goals