Internal Auditor’s blogs reflect the personal views and opinions of the authors. These views may differ from policies and official statements of The Institute of Internal Auditors and its committees and from opinions endorsed by the bloggers’ employers or the editors of Internal Auditor.

Culture May Be the Wrong Question​

Comments Views

​As a member of the boards of several professional publications, I get to review and comment on a number of articles.​

One that recently crossed my desk was about the need to recognize that the root cause of pretty much every business failure and incident in at least recent times was a defect in that organization's culture. It advised that internal auditors can help an organization identify such defects and take remedial action.

That sounds good. But is it on or off the mark?

I agree that poisonous cultures (and I've experienced a few) can have a negative influence on individual and group behavior. But, in my opinion, it still comes down to people: their behavior, actions, and decisions.

Consider the culture across much of Europe during World War II. It is fair to say that the Nazis and their leaders created an environment in which it was easy to participate in acts of genocide. But many stood up to those pressures and acted bravely in accordance with their morals and ethics. Arguably, if more people had stood up for what was right, many awful acts might have been prevented.

Defects in culture can increase the likelihood of poor behavior, but it still comes down to people. Even when the culture seems ideal (strong ethical leadership, a shared commitment to organizational and societal values, and so on), some people will always act inappropriately.

But what is an ideal culture anyway? Is it about one or more of these?

  • Ethical and moral behavior, including but not limited to compliance with applicable laws and regulations.
  • Managers and staff taking the desired level of risk.
  • A shared commitment to achieving the goals of the organization, putting them ahead of personal goals.
  • Collaboration and sharing of information.
  • Teamwork.
  • Innovation and agility.
  • A willingness to work long and hard when needed.
  • Treating all others with respect, honoring differences, and so on.
  • Openness and transparency.
  • A commitment to safety.
  • The ability to report undesired behavior without retribution.

Culture is not, in my opinion, something simple. It has multiple dimensions.

In addition, no organization (unless it's a business with a single employee) has a single culture. There are differences between teams, locations, and so on — and the differences change over time.

Should we worry about culture?

Sure. But perhaps it is better to worry about behavior.

First, define the behaviors you want your organization and its people to demonstrate every day.

Now, what are the risks to achieving the objective you just defined?

What actions (i.e., controls) are you taking to provide reasonable assurance of appropriate behavior?

Is there reasonable assurance, or are the risks to behavior outside desired levels?

How are you monitoring both the level of risk and the incidence of undesired behavior? The latter is not easy, as many behaviors (such as lack of teamwork) don't show up in HR reports, loss investigations, and so on. In fact, defects in culture tend to make surveys useless as people won't be honest.

If you focus too much on one dimension of culture, such as compliance or ethics, you may drive the culture away from what is needed to deliver on another dimension, such as performance and agility.

Yes, defects in culture (if we can find them all and — very important — acknowledge their existence) are important to fix. But that is not enough.

We need to worry about behavior and what needs to be done to provide reasonable assurance that people, both individuals and groups, will behave the way we need them to behave.

Why don't you start by taking my list, upgrading it to fit your organization, then assessing each attribute for your team, your department, your location, and the organization as a whole?

Don't use a survey. If you know your company, you can answer these questions about its culture.

I think you will immediately find areas of weakness.

But how do you go about discussing them with senior management and obtaining agreement on the facts, the assessment, and the actions needed? You may feel the need for additional steps, such as surveys, to support your assessment — but very often you will find management in agreement. The issue then becomes what these defects mean, the risks they represent to the operation and success of the organization.

How do you approach senior management with insights about teamwork, the way people are treated, and whether the organization's goals are put ahead of individual or group goals?

That will not be easy.

I would love to hear your stories and I welcome your comments.


Internal Auditor is pleased to provide you an opportunity to share your thoughts about these blog posts. Some comments may be reprinted elsewhere, online or offline.



Comment on this blog post

comments powered by Disqus
  • Idea-September-2020-Blog-1
  • Galvanize-September-2020-Blog-2
  • CIA-September-2020-Blog-3