Organisational culture: Are Internal Audit really doing enough?

The need for Internal Audit functions to establish their role in assessing organisational culture was recently reinforced within the Chartered Institute of Internal Auditors’ (CIIA) guidance:  Organisational Culture – Evolving approaches to embedding and assurance.

“Boards and senior management need to understand whether the culture they want for their organisation is actually the one that exists in practice.”

Why does this matter?

This latest statement confirms two things:  that the focus on culture is here to stay and, that for Boards and senior management, the pressure is on to take responsibility for defining and embedding the culture they want across their organisation. Done right and in alignment with the strategy, it can maximise the organisation’s competitive advantage.

Boards and senior management are therefore looking for assurance that they have the culture they need and increasingly, they are looking to their Internal Audit functions to provide it. High performing Internal Audit functions see this as an opportunity to take responsibility and establish their role in the assessment of culture. This is not easy, there are challenges but these Internal Audit functions are showing the way and tackling them head on.

What is being done?

In developing the new guidance, the CIIA undertook a survey of Heads of Internal Audit (HIAs) across all sectors to understand the extent to which the profession is involved in auditing culture. The results show that Internal Audit functions are taking responsibility for auditing culture, or have at least taken notice of the expectation for them to do so – of the 220 responses, 55% of Internal Audit functions are attempting to audit culture in one way or another. This demonstrates progress; this was a topic that was previously perceived as ‘too woolly, subjective and intangible’ to audit. This shows that Internal Audit are starting to overcome this perception and prove their relevance and the value they can provide.

The guidance also highlights that the most common approach is to incorporate culture as a component part to standard audits on the audit plan. While broad coverage can be obtained across the audit universe, we believe this ‘light-touch’ approach lacks depth and richness. This can prevent the behavioural root cause from being fully explored, the underlying issue identified, which could lead to providing the Board with a false sense of security. This alone is not enough - to be able to provide comprehensive cultural assurance there needs to be a focus on depth as well as breadth.

What does good look like?

It is important to recognise that there is no ‘one size fits all’ approach to auditing culture – this presents perhaps the biggest challenge to Internal Audit functions in establishing their role. However, we have seen high performing Internal Audit functions in their role as the third line of defence rise to this challenge – they are going further than the light-touch approach and developing a strategic framework to audit culture. This approach uses a combination of component and standalone culture audits which provide both breadth and depth to really get under the surface, to identify the ‘why’, not just the ‘what’ and understand the culture across the organisation.

They are using a variety of qualitative and quantitative techniques to look deeper and see further into the organisational culture. They are becoming comfortable with the use of qualitative methods such as interviews, behavioural observations and focus groups and are exploring the innovative use of data analytics to draw out key themes across numerous data sources and corroborate emerging findings.

Taking the cultural outputs from both these audits, Internal Audit functions are able to take a step back and holistically look at the culture, determine what this means for the organisation and provide the Board with a view of the extent to which the desired culture is embedded and in place across all levels of the organisation.

What more needs to be done?

The profession has moved the conversation forward from whether Internal Audit is best placed to deliver cultural assurance to how can Internal Audit deliver cultural assurance. Internal Audit is now seen, by stakeholders and the profession, as a critical lever for change in this area – representing a huge opportunity for you to make a difference. So what does this mean? It means you need establish how you can do more to meet the rising expectations of stakeholders. For those functions already delivering culture audits, you need to build on what you have done to further provide trusted insight helping the organisation move forward. For those who have not yet begun this journey, you need to act fast to prevent falling behind.

This will not be without its challenges - over the coming months we will be exploring these with Heads of Internal Audit at the ‘Providing Assurance over Organisational Culture and Behaviours’ forums and sharing practical solutions with you through a series of PwC Internal Audit Insights.

Contact us

Jill Emney

UK Internal Audit Services Leader, PwC United Kingdom

Tel: +44 (0)7850 515690

Faye Whitmarsh

Director, Culture & Behaviours, PwC United Kingdom

Tel: +44 (0)770 267 5570

Follow us