Introduction
The culture of an organisation drives the way the organisation conducts business and delivers its strategy. Every organisation has a culture, and sub-cultures in each team, department, function, and region they operate, whether intentionally or unintentionally developed.
In the last decades, various corporate scandals and failures, like the Lehman Brothers, Barclays Bank (UK), Carillion (one of UK's biggest construction companies), and Volkswagen, just to mention some, have been attributed to flaws in their organisational culture.
Therefore organisational culture remains central to regulations (e.g. FCA, ESG) and corporate governance codes, putting more emphasis on the importance of culture as a tool, which, when managed well, helps deliver on the organisation strategy. The C-level and the boards are expected to ensure the right culture is in place and to actively manage it, especially as, in the post-pandemic world, culture and purpose are seen as the main drivers for an organisation's success.
“Culture is unique to each organisation, it defines the organisation, and influences a wide range of decisions made about the areas that include safety, innovation, quality, customer service, integrity, employee behaviour, and decision making. Culture has the powerful ability to affect how people do their jobs, how decisions about quality, compliance, and other critical concerns are made; and how the organisation is perceived both internally and externally.”
(AFC, Assessing corporate culture, March 2020)
In the absence of active culture management, an organisation’s culture will evolve in ways that are not aligned with the aims of the business, and it will be more difficult to correct.
Organisations should conduct regular assessments of the status of their culture, and board members have a duty of care to ensure that the adequate culture is in place enabling decisions to be made in line with the organisation’s values and mission.
Just as there is no one-size-fits-all culture for all organisations, there is also no one culture assessment that would apply to all organisations; each organisation needs to develop its tailored assessment based on its strategy and (desired) culture, to ensure they purposefully manage its culture.
Functions that are independent of operations (e.g. Internal Audit) or 3rd parties are best placed to perform the culture assessments.
Our Internal Audit Services, at Grant Thronton Netherlands, consider assessing culture an integrated part of providing insightful and valuable information about the effectiveness of internal control framework and corporate governance structure.
Internal audit can play a very important role in assessing an organisation's culture, as it fits well with IA’s mission, which is to enhance and protect organizational values by providing risk-based and objective assurance, advice, and insight. (International Professional Practices Framework (IPPF), 2017 Edition)
“One of the internal audit’s key responsibilities is to assess the adequacy and effectiveness of the internal control environment directly impacted by culture and the conduct that arises from employees acting out and exhibiting their interpretation of the values of that culture. This can be difficult to do as employees of the organization themselves, and it is why objectivity is fundamental to this type of audit. Internal audit, as the third line of defense in an organization’s governance framework, is uniquely positioned to assist an organization in evaluating its culture. “
(Institute of Internal Audits (IIA) paper: The Three Lines of Defense in Effective Risk Management and Control, 2013).