More than perhaps any other characteristic, an organization is defined by its culture. Put simply, culture refers to the behavior and norms demonstrated by stakeholders — it shapes not only how the organization conducts itself internally, but also how it behaves and is perceived externally. Especially because businesses typically engage across a multitude of communities and across all levels of stakeholders, organizations must commit to maintaining a positive culture both inside and out. Any cultural practices misaligned with public expectations could well draw the wrath of consumers and suppliers alike — hence the importance of placing culture on the risk radar of internal auditors. In fact, any practitioner who ignores culture does so at the organization's peril.
Although every organization should establish a set of expected cultural norms, these represent only a starting point. Ongoing, active engagement and monitoring are required to ensure cultural practices remain relevant and sensitive to the environment in which the organization operates. Neglecting to do so can have significant consequences. From low employee morale to backlash from customers, the economic impact can be far-reaching — not to mention the possibility of long-term reputational damage. In fact, a recent global survey by PwC found that 80% of respondents agreed that an evolving culture is crucial for organizational growth, success, and talent retention. Clearly, this finding reflects the need to continuously keep cultural practices up to date.
For internal auditors who are not already doing so, it is time to pay attention to culture. Practitioners should begin with assessing the organization's cultural risk. Audit programs should include assessments of staff interactions and behavior, as well as the organization's engagement with stakeholders. Internal audit can examine alignment between incentive rewards and cultural values, assess how employees interact with customers, and use data analytics to highlight culture-related risks.
Auditors also could consult on areas with significant cultural components, such as policymaking, employee misconduct investigations, and corporate communications. Moreover, internal audit's independent perspective could be helpful in reviewing the organization's overall approach to culture and how it factors into the strategic plan. And especially when operating internationally, organizations must be attuned to differing norms and expectations around the world, both within the enterprise and among external stakeholders.
Given the increased level of engagement with stakeholders and customers globally through social media and other channels, organizations cannot discount the likelihood of cultural dissension. At a minimum, a set of expected cultural values should be embedded across all levels of the organization. With internal audit's help, management can ensure these values are sound and consistently adhered to.