How internal audit can assess and support culture

There is growing consensus that weaknesses in corporate culture have been a significant factor in a range of corporate and institutional scandals, so it is not surprising that culture has come under increasing scrutiny. Regulators have treated it as a high priority, and boards are increasingly keen to embed a sound corporate culture in their organisation.

It is clear that the issue poses a significant risk that cannot be ignored simply because it is difficult to measure, said Peter Montagnon, author of a new report on the subject.

Based on interviews with audit committee chairs, heads of internal audit, and heads of ethics and compliance departments, the Institute of Business Ethics briefing looks into what internal audit practitioners can do to evaluate whether an organisation’s culture meets its stated ethical standards and values. The briefing suggests that the function can play a central role in identifying weaknesses of corporate culture and where hidden risks lie.

Given that the department’s work involves observing and reporting on behaviour, internal auditors are also well-placed to join the dots to identify the root cause of any problems. Through its work on assurance, internal audit can help evaluate the health of the company culture and provide a key line of defence against risks.

Recommendations

There was a consensus amongst the practitioners interviewed for the report that there is more mileage to be had in looking at the cultural aspects of what is being audited than in separating out culture itself. “Even if it cannot be measured precisely,” the report said, “it pays to look at the way culture within the firm affects the things that are being measured.”

The report outlines some of the indicators that can be used. The objectives that are set and how they are communicated throughout the business unit are a critical indicator of culture, as is the way people respond to basic frameworks. Indicators of a flawed culture include the failure of employees to complete relevant training, or late or grudging reporting of information.

“Late reporting of a control failure or a hostile response to a critical internal audit report doesn’t say anything immediately obvious about ethics, but it does indicate a state of mind which will readily sweep unpalatable things under the carpet,” Montagnon said at the London launch of the report last month. “And even this is therefore a good indicator of culture for internal auditors and boards, and often a pointer to where hidden risks lie.

“The task for them is not so much to grade the overall culture, but more to identify the particular parts of the organisation where the culture is weak, whether because divisional management is poor or, perhaps, because an acquisition has not been very well-integrated.

“When something goes wrong, most investigations simply lead to the introduction of new bureaucratic processes designed to prevent a recurrence,” Montagnon said. “However, asking about the root causes of a problem may point towards a different solution. This means looking at different things, for example, how targets are set, how incentives are communicated, and how appraisals are conducted.”

Though it is the role of an organisation’s leadership to set the culture, internal auditors can:

• Help boards answer the question “Are we living up to our values?”
• Evaluate whether the corporate culture supports the organisation’s purpose and business model.
• Ask why something has happened, get to the root cause, and seek to correct it, rather than simply identify what has happened.

How boards can support this work

• To enable the internal audit department to carry out this role effectively, a mandate from both senior management and the board is needed, with the latter usually taking the form of a reporting line and a close working relationship with the audit committee chair.
• Audit committee chairs need to be firm in their commitment to using internal audit to examine culture and be willing to listen to the concerns raised, even when these are based more on gut feeling than evidence.
• An environment in which people are encouraged to speak up so that mistakes can be corrected rather than tempted to cover them up out of fear of punishment will also support this work.

The skillset required

Montagnon notes that internal auditors have to strike a balance between being perceived by other employees as policemen and adopting a more consultative role that may compromise their objective investigative status.

Ultimately, the report says, internal auditors can be important agents for positive change. To fulfil this role, “[t]hey need diplomatic skills and the ability to make judgements which command trust at [a] senior level.”

—Samantha White (swhite@aicpa.org) is a CGMA Magazine senior editor.