Culture audit approach

Organisational culture put simplistically can be defined as “the way things get done around here” (A. Kennedy, 1982), as the soul of the organisation, its beliefs, and values, based on which decisions are made.

According to the Institute of Internal Audits, “culture represents the invisible belief systems, values, norms and preferences of individuals that form an organisation. Conduct represents the tangible manifestation of culture through the actions, behaviours, and decisions of these individuals.” (Auditing Culture, IIA, 2019).

The appendix of this whitepaper presents some of the best-known culture models. However it is important to highlight that no model is complete or best, and that the concept of culture is complex, and to be able to assess/audit it, it needs to be broken down into various aspects which all together form the culture.

The picture to the right summarises the complexity of an organisation’s cultural aspects and how soft and hard cultural aspects can impact each other.

An organisation's vision and purpose will be the core of its values, which determine the behaviours employees have. You can imagine this as the layers of an onion, the core being vision & purpose, followed by values and behaviours. While the Vision, Purpose, and Values can be defined and written down by an organisation leadership team, their real manifestation is in the behaviours the employees show on a day-to-day basis.

These behaviours are also shaped additionally by internal and external factors. Through the internal factors, we can mention: defined processes, organisational structure, and governance, business model, the technology used, and defined policies and procedures (like a code of ethics).

Some of the external factors are political climate, regulatory requirements, and the regional or country's wider cultural aspects.

The questions often asked by the boards and the management is: how can an organisation’s culture be assessed? Where to start?

To make auditing culture easier, our Grant Thornton's Internal Audit approach is to classify the cultural aspects into two categories: hard and soft cultural aspects.

We consider hard aspects, all those elements of culture that are tangible and have a physical representation and can be factual based; while considering the soft aspects of culture all those elements that are intangible, and based on perceptions.

Enlarge

Hard aspects of organisational culture:

  • Purpose and Vision
  • Exposed values and slogans
  • Strategy
  • Governance structure
  • Processes: in particular decision making, performance, and rewards,
  • Business model
  • Code of conduct/ethics
  • Regulation and compliance
  • Risk appetite

Soft aspects of an organisation’s culture:

  • Values perception
  • Behaviours
  • Heroes
  • Stories
  • Leadership style/tone at the top
  • Commitment & engagement
  • Interaction and collaboration within and across teams
  • Level of Trust within the organisation and its leadership
  • Comfortability with Conflict

As auditors, we might feel comfortable with auditing the hard aspects and less comfortable with auditing and giving an opinion on the soft aspects, but it is very important to assess the soft aspects as well, as the unwritten rules of an organisation will have a critical impact on people’s behaviours and the way results are achieved.

The hard aspects of an organisation's culture can be audited in dedicated audits which might include one or more hard topics to focus on (e.g. corporate governance review, code of conduct and risk management, employee performance and reward process); while the soft aspects of the culture could be integrated into all audits, based on interviews or a questionnaire which could measure these aspects.

It is important to pay particular attention to the ways these assessments are conducted, and that the internal auditors involved in culture assessments need to have an adequate understanding of the sensitivity of the topic. Often it is more appropriate for the interviews and the questionnaires on soft aspects of the culture to be conducted by more senior auditors, who developed the right skills for this approach.

15 Questions to consider when developing your tailor culture audit/assessment:

  1. Is the organisation’s purpose and vision clear to its employees (integrated audit - interviews)
  2. Are the organisation’s values and artifacts aligned- see Schein culture model (integrated audit – observations in offices and interviews)
  3. Does the organisation have a clear strategy, which is aligned with its purpose and vision? (could be a stand-alone audit)
  4. What is the tone at the top? Does the C-level and Board walk the talk? (integrated audit – interviews)
  5. What communication styles are practiced by the organisation? (integrated audit /dedicated audit on communication and marketing)
  6. What stories and heroes do the employees talk about? (integrated audit)
  7. What are the risk behaviours daily, is it aligned with the risk appetite/tolerance? (integrated and stand-alone audit)
  8. What is the level of engagement and commitment from the employees (integrated audit - observation during various audits & review of employees surveys)
  9. Do people feel they are held accountable? (integrated audit – this is a trend that can be seen from various audits over the year)
  10. What’s the level of trust in leadership (integrated audits and employee surveys)
  11. Do employees feel comfortable with disagreeing with others and a constructive level of conflict, without fearing personal consequences? (integrated audits & possibly employee surveys)
  12. How effective is the decision-making process, and who makes decisions? Are all decisions made at the top? (integrated audit and review of decision process)
  13. Does the organisation embrace diversity of all types? (integrated audit- observation and interviews, and also reviews of specific aspects, like hiring process, payroll & reward)
  14. What is the company structure and governance in place? (dedicated audit)
  15. How are employees rewarded, motivated, and incentivized? (dedicated audit)

Sign up for our Newsletter

Sign up for our newsletter and receive new insights on finance, business operations and strategy.

IA mandate to auditing culture and reporting

The CIA (Chief Internal Auditor) needs to ensure that IA has a mandate from the board to perform these types of audits and that the internal auditors involved in auditing culture have the rights skills and level of experience to understand some of the most sensitive aspects of culture.

The outcome of an organisation’s culture assessment can give the management a level of comfort about decisions being made in line with the organisation’s values and mission and an idea of the gap between the lived culture and the desired one, and if needed a maturity culture scale can be used: 1) emerging or developing 2) embedded 3) leading.

All results of culture assessments need to be presented to the board and the C-suite level. Given the more sensitive aspects of culture, the way the results are presented does not always need to be in a formal report, but the CIA needs to ensure they can have open and transparent conversations about the organisation’s culture and required changes. If behaviours and cultural aspects are assessed as part of other audits (integrated audits), the results, and cultural trends should be formally presented to the board twice a year (according to our experience).

Some of the trends which can be identified during organisational culture assessments:

  • People & behaviours (possible issues: (lack of) trust and collaboration, fear of conflict, etc.)
  • Governance & processes (possible issues: accountability, clarity of roles & responsibility, compliance issues, risk appetite, etc.)
  • Purpose & strategy (possible issues: unclear direction, misalignments between strategy and value, long vs short-term decisions, etc.)
  • Leadership & communication (possible issues: tone at the top, lack of communication and engagement, etc.)

The trends above do not intend to be an exhaustive list, but only an example and the advice is for each organisation to identify its trends and potential red flags.

Organisational culture red flags

The IIA, in the Auditing culture paper (2019) listed several cultural red flags, which should be a sign of cultural risk factors in an organisation:

  • Unreasonable expectations including deadlines, profitability, or levels of efficiency.
  • Incentives not aligned with values.
  • Employees (including internal auditors) lack knowledge of key risk management activities and potential risk impacts.
  • An inflexible hierarchy impeding the flow of information up, down, and across the organization.
  • A pervasive environment of mistrust toward auditors and regulators including a lack of understanding of the role of controls in achieving business objectives.

  • An attitude of hubris (e.g., “That will not happen here.” or “That has never happened to us before.”)
  • Lack of accountability, especially at senior levels of the organization.
  • Failure to enforce codes of conduct and related policies and procedures.
  • Management (and, in some cases, the board) refusing to acknowledge information contrary to their opinions.
  • Disregard of laws and regulations if they are not conducive to the organization achieving its objectives.

When as internal auditors we observe the presence of one or more culture reg flags, it is within our scope of work to bring this to the management's attention.