May is Internal Audit Awareness month. Over the course of the month, we will be taking a closer look at the internal audit profession from various perspectives, including industry, technology, and the “future auditor”— an embodiment of those skills and capabilities most valuable to the future of the internal audit function. Subscribe to our blog to follow the discussion.
Within the internal auditing profession we’ve become accustomed to talking about “tone at the top,” and the importance of executives setting the right example. Most organizations have embraced the concept of core values — at least on paper. And still, we keep seeing headlines about major companies we respect and admire for their size and success in the marketplace that stumble and stub their toe over cultural issues — anything from sales practices, to the way they treat employees, customers or vendors.
Every organization has its own values or “ethos.” It turns out that that, in itself, is not enough to prevent faux-pas of the kind we have seen lately. When bad things happen to good companies, it is important to ask ourselves, “What happened, and how do we prevent it from happening again?” In the age of viral news, the topic is more relevant than ever; it is also the central theme of Internal Audit Around the World, Volume XIII, the 2017 edition of our popular performer perspectives series, which will be released at The IIA Global Conference in July.
It may seem obvious to everyone that culture is important, and that the risks associated with unhealthy organizational culture can derail operations, damage the brand, drive away customers and put a sizeable dent in the bottom line. Yet for many organizations, culture continues to be a buzzword in the boardroom discussions but has been given short shrift as an operational priority. “Doing the right thing” is a key performance indicator that doesn’t appear as a line item on any balance sheet but contributes considerably to the “goodwill” capital of a company, and its loss or erosion presents a significant risk. Culture assurance then becomes something much more specific and necessary.
The job falls on internal auditors who, by virtue of their “all access” hall pass can provide assurance against cultural lapses. Because we already peer across all departments and business units at all levels of the company, we are uniquely positioned to monitor and report on the various tone and executional elements within an organization. In the most basic sense, a culture audit should determine whether policies and practices encourage and enable employees to do the right thing.
Too often, when bad things happen, executives tend to fall back on whether policies and procedures were followed. A culture audit should test and verify — through interviews and surveys — whether those policies and procedures enable operators to employ common sense in how they treat people, or whether they create duress and pressure for ethical compromise.
Culture audits are an opportunity for auditors to talk to employees, managers, customers and vendors, and measure whether conduct matches words, and report on whether the company is living its values, or whether they are hollow. Empowering people to better themselves is beneficial for the organization in the long run. You don’t want to be the company that becomes a running loop on social media or on the front page of the paper.
