Auditing Culture and Culture in Audit

Auditing Culture and Culture in Audit

By Hal Garyn

Culture is important. What happens in an organization is more a result of the culture than all its policies and procedures combined. So, it makes sense that, logically, internal auditors should audit culture. Yet, we primarily audit the policies and procedures. I know that this statement ignores the complexities of auditing culture, but when has complexity stopped auditors from doing what we should be doing?

Background

A lot has been said about auditing culture over the last ten or so years, and yet most internal audit groups are not doing much in the way of culture audits. I first heard of the concept of doing a culture audit around 2005, and my first reaction was like many others. “I get the point, but how do you actually do that?” And, after hearing some of the early answers to my question, I concluded, “Sounds good in theory, but I don’t see that actually being embraced in many organizations.”

Despite that, it wasn’t long before I led what I would call a culture assessment at the enterprise level in 2008. It didn’t feel like an audit, so calling it an assessment was a better and more easily embraced concept. Even the most hesitant executives at the organization warmed up to the idea, we learned a lot, and the organization benefitted tremendously from the project. So, fifteen years later, I still encounter the same question, the same hesitation, and the same responses I experienced in 2005 when talking with chief audit executives today. Without getting into the details of doing a culture audit, let’s talk about several ways you can assess culture in your organization. As we do so, you may find that you are doing some of it already, even if you can’t say you’re doing a full-fledged “culture audit.”

You’ll also recognize that your internal audit function has a culture all its own, and we’ll close with some thoughts about that later.

Four ways to audit (or preferably assess) culture

1. A comprehensive, organization-wide assessment

This method goes for the whole enchilada at once; trying to do a culture assessment across the entire enterprise in one comprehensive project. Many internal audit groups struggle with this from two perspectives. Firstly, they’re not confident in how to do it. Secondly, they don’t feel that they can get buy-in from executive leadership. To address the first obstacle here, there are whole articles and books written that provide quite good guidance on the methodologies, some better than others. The interesting dilemma is that you must do an organization-wide, comprehensive culture assessment in a way that is, ironically enough, consistent with the culture.

Providing detailed advice on doing a comprehensive culture assessment is beyond the scope and space limitations of this article. But, to address the second obstacle, I can tell you three things that must be done before the project goes in your audit plan:

• Get complete buy-in from the entire C-suite (and that means everyone, not just the CEO),
• Advise the audit committee as to why this is such a critical project for you to do, and how they will benefit from the insights derived,
• Do not begin without partnering with your company’s head of human resources and other logical internal partners.

If you don’t prioritize these three things, I can tell you that the project will fail, possibly spectacularly.

2. Including an assessment in each audit (as applicable)

This approach is one that some internal audit functions have made a part of the scoping and planning process associated with each audit. Where applicable, including some assessment of the culture within that function, unit, location, or department. Depending on the audit, this may not be a feasible method, especially if it is an audit that covers a function or set of activities that cuts across the organization horizontally. But this is an effective way to build a view of organizational culture “on the ground” over the course of a period of months or years. An important note here is that not only does the organization have a desired overall culture, let’s call that the macro-culture. But each definable area will have its own, possibly unique culture as well. We can call those micro-cultures. The challenge is determining whether the micro-culture that exists in an area being audited is consistent with the desired overall macro-culture of the organization.

You may be wondering how we do this within each audit. Well, it starts with the planning phase of each audit and asking yourself “is this audit conducive to considering culture as part of our evaluation?” If the area is rather self-contained (a function, a department, a branch, etc.), then the answer should be “yes.” If not, then the answer could be a qualified “maybe.” If considering culture applies, then you must determine a set of questions that you are evaluating during the audit that can be as explicit as a survey of employees or, more likely, a series of prompts for the audit staff on the assignment to be cognizant of as they go about their work. At key points during the audit, and certainly at the tail end of the project, the audit team assigned to the project, under the direction of the project team lead, should meet and discuss their observations. Since any conclusions would be subjective, how you handle them should be worked out with the function’s CAE or other logical audit leader. And, ironically, how you handle delivering any insights gleaned from a project-level assessment of culture should be done in a manner consistent with the organization’s macro-culture. With this process, you can begin to build a view, over the course of several audit projects that include a culture assessment, of the overall state of conformance to the expected top-down culture. Results from this should be of great interest to your organization’s C-suite if they are serious about the organization’s culture.

3. Assessing culture by just walking around

If a full enterprise-wide assessment of culture just won’t work in your organization, and the way you define audit projects in your audit plan does not lend themselves well to including something about assessing culture in each project, don’t despair. There’s likely something you’re doing every day but haven't yet realized has potential value to your audit approach. Culture can also be assessed by simply walking around and observing, or, in the virtual workplace, increasing your awareness of cultural aspects during virtual conference calls.

To do this, you need to lay out parameters to guide what you are looking for as you go about your day-to-day work. Eyes and ears open. On a periodic basis, you’ll need to assemble your audit team and discuss what they are witnessing that is consistent with the organization’s macro-culture, and even more importantly, what is inconsistent with that culture. It will take practice, but as time goes on your team will become more accustomed to doing this. They do it already, but they just haven’t established a formal process for doing it and a way to talk about it. Now, if anything comes up during these observations that is wildly inconsistent with expectations in a way that could be detrimental to the organization, such as employee mistreatment, then your internal audit staff should feel more comfortable raising the issue internally to their audit leadership and be able to determine how much of a concern it may pose. It may even be (likely be?) a root cause underlying some of the audit observations being made during the project.

4. Having internal audit staff meetings about culture in the organization

So, maybe options one, two, and/or three just aren’t going to work in your organization or audit group, depending on a variety of factors. Or you may find that this is a good supplemental choice to instill in addition to some of the more formal methods. You can just make talking about organizational culture part of some periodic staff meetings or audit team leadership meetings. If you designate it as a specifically identifiable agenda item for team meetings from time-to-time, your audit staff will become more familiar with what to look for as they keep their eyes and ears open as it relates to the culture.

And, talking about it within the group in a semi-structured way will create much more awareness among the entire audit staff on what the desired company culture is, what it looks like in practice and behaviors, and when things in an area might not be demonstrating a culture consistent with desired norms. As your staff becomes increasingly acculturated to the desired culture (yes, I used the word “culture” twice in that sentence purposefully), they can even become ambassadors for the desired culture in the organization. This manifests in the way they carry themselves and the way they interact with others, becoming role models for the culture in action and deed. Let’s face it, for some employees of your company, the only “corporate” people they may see are the internal auditors. Why, then, not have them be ambassadors of the desired culture?

Begin at home – What is the culture in the audit department itself?

We auditors are so busy auditing the company, we may not spend time evaluating ourselves. Yes, we have a quality assurance and improvement program (QAIP), and we get our external quality assessment (EQA) done, but none of that considers what the culture is within the internal audit department itself. It seems to me that it would be a bit disingenuous if we were to assess culture, no matter what way we do it, across the organization, if we didn’t first make sure the culture we have within our own department is consistent with the desired enterprise culture.

I am not suggesting that you have an external culture assessment done, although it wouldn’t be a bad idea at all to consider adding this to your next EQA as we can’t necessarily be objective about our own function. But you can still take a step back to think about the culture within internal audit and how it can be improved. We want people to feel as if they can raise any issues they have, and if they are comfortable doing that, internal audit leadership can ask questions of staff in their periodic one-on-one meetings. Incorporating discussions about culture in group staff meetings, and especially team building activities, can be a terrific way to uncover any underlying issues.

We should practice what we preach, right? Starting at home with the culture of the internal function is an impactful way to start leading by example.

Conclusion

So, maybe you are already auditing (yes, I still prefer assessing) culture, but not in a formal way. Depending on what your organization’s culture is and how well the executive team will embrace internal audit assessing culture as a project on your audit plan, maybe you need to fly below the radar and keep things within the audit department. With these methods, you can still assess the culture on an ongoing basis, discuss it among your internal audit team, and determine how to manage any issues that pop up given the facts and circumstances.

All the while, you are better sensitizing your internal audit team members what the company’s desired culture is, how it should (and should not) manifest itself, and what to look for in their daily activities. Perhaps most importantly, your internal audit function can emulate the desired culture because of all the discussions you have about what the culture should look like, and how your own team can demonstrate it.

Paraphrasing Winston Churchill, you have nothing to fear in doing culture assessments, but fear itself!