This is so true — and highly relevant for all executives and managers, including those in internal audit and risk management.
I have questions for you:
- Does your organization have a culture that rewards the performance the board and top management want?
- Is the culture one of taking too much risk and playing down the potential impact?
- Is the culture one of taking too little risk and missing opportunities?
- Is management trusted by the board?
- Is management trusted by employees?
- Does management trust employees?
- Is management trusted by its business partners, regulators, the community, etc.?
- Does the culture enable making decisions quickly, or do managers jump on the train after it leaves the station?
- Does the culture enable the use of new technology, or are you wearing clogs and slowing down the business?
- Is there a culture that rewards dotting the i's and rigorously following policy, or are managers able to get things done?
- Is there a culture of "lean" — focusing on what counts and getting rid of unecessary red tape?
- Does the organization understand the risks of the "wrong" culture?
- What does it do to promote the desired culture?
- When employees are hired, how does management ensure they will add to and not detract from the desired culture?
- Finally, do employees enjoy coming to work?
One more question for internal auditors: have you considered the risks of the "wrong culture" — the impact on performance — and included audits to address the higher risk areas?