Internal auditors often talk about the “tone at the top” — the idea that corporate culture begins with the example set by senior management. But while conduct at the top is where it all starts, it does not end there. An increasing number of companies are beginning to realize that if the tone in the middle is not aligned with the tone at the top, there could be serious risks lurking within the organization.
This need for principled leadership and cultural alignment has become critical to corporate success, which is why Protiviti has included it in our 2018 Audit Committee Agenda. Jim DeLoach, host of this blog, recently discussed the need for audit committees to assess their own effectiveness and act within a proper business context. In this post, I examine this cultural imperative.
Setting a Tone
It is important for audit committees to consider whether executive management is sending the right signals to the organization, not just through words but actions. This past year has provided some interesting examples of cultural failures at high-profile organizations that negatively impacted their reputations. We saw senior executives exercising poor judgment, irresponsible business behavior, and in some cases, possible illegal acts.
When I read stories about corporate misconduct I always wonder what insights the board of directors and senior management had into the issues before the situation arose, and what actions senior management failed to take to ensure that the culture was aligned with the company values.
I read recently that in our society there are about 3 to 4 percent of people who are actually psychopaths or sociopaths – individuals entirely devoid of ethics who will always do the wrong thing. Ten percent will always do the right thing. Most people, however, the 80 or so percent in the middle, are morally flexible and can be influenced by people around them. For this reason, it is very important for organizations to create processes that support people doing the right thing all the time, and foster a culture where people in the organization know the tone at the top, ensuring that that tone flows all the way down to middle management and beyond. This is because, in most cases, employees pay more attention to what their direct supervisors are saying or doing, and less to what the CEO has announced.
In our webinar on the 2018 audit committee agenda, we asked our audience, primarily internal auditors, whether they thought creating and maintaining a robust risk culture is important to leaders in their organization. Thirty-eight percent said “yes.” I would venture to say that those respondents are probably the ones that have a culture assessment on their plan for this year. If so, these auditors must ask themselves, “Are we sufficiently engaged with the executive team and the audit committee in a dialogue around culture, along with all the other risks? Is culture on the radar, and if it isn’t, why not?” When risks are prioritized for the organization for the year, culture certainly should be one of the items on that priority list.
In a future post, I plan to focus in more on culture assessments as they are truly relevant in today’s business environment and underpin many of the other risks organizations face. My colleagues and I are actively discussing this, and the rest of the 2018 audit committee agenda, with our clients and internal audit peers. It is always an enlightening conversation for us.
To read the full agenda and our analysis of the issues, download our Bulletin. The recorded webinar is available here.
