Many boards and audit committees are turning to internal audit to help them better understand and assess the company’s culture.
By Jose R. Rodriguez and Tracey Keele
As boards and audit committees sharpen their focus on corporate culture, many are turning to internal audit to help them better understand and assess the company’s culture. Recognizing that internal audit’s skills, capabilities, and stature within the organization will vary widely by company, the following questions should be helpful in tackling this critical and timely challenge.
Have the board and management agreed on the behaviors and values that are key to executing the strategy? There is no one “right” culture; rather, there is a spectrum of behaviors companies might encourage depending on their strategy. Behaviors encouraged at a disruptor company will be different than those encouraged at a heavily regulated company, and culture will need to evolve as the strategy evolves. Internal audit can help reinforce the importance of clarity regarding the desired culture and related behavioral expectations, which can then be assessed and monitored over time.
How can the board gain a better line of sight into the culture throughout the organization? One of the biggest challenges boards face in overseeing and assessing culture is visibility. While the tone at the top is often apparent, the culture in the middle and throughout the organization is more difficult for boards to assess. Directors can improve visibility by visiting company facilities and engaging employees, walking the halls of headquarters, and monitoring social media—and they can also turn to internal audit to deepen their understanding of what is really happening and improve their line of sight at all levels of the organization.
Is it time for a culture dashboard? One of the ways internal audit can help give the board better visibility and a more holistic view of culture at all levels is by taking the lead—together with the ethics and compliance and human resources organizations—in developing a culture dashboard. All three organizations have data—survey results, customer satisfaction data, human resources, and employee data, as well as ethics and compliance data—which can feed into a culture dashboard and provide a snapshot of the corporation’s culture. Similar to cyber risk dashboards, culture dashboards will evolve over time. Boards need to hold management accountable for developing an integrated picture of the organization’s culture, and a regularly updated culture dashboard can be a helpful tool and serve as the basis for management’s discussions about culture with the board.
What approach to auditing culture makes sense? In developing a culture audit approach, internal audit has several options to explore with the audit committee. One option is to add culture considerations to existing audits—for example, by performing root cause analyses to determine whether a breakdown in procedures or controls was caused by lack of training, poor communications, or leadership style. Patterns and trends in culture problems can be identified. Another option is to expand the audit universe to include systems that influence culture (e.g., whistle-blower reporting, incentives and performance targets, training, health and safety, etc.). A third option is to perform a stand-alone culture audit, tailored to the organization’s culture maturity and internal audit’s capabilities. It is critical that auditing and measurement be continuous in order to identify trends and gaps, quickly adjust course, and avoid major cultural blind spots and failings.
A few guiding principles may be helpful as the organization sharpens its focus on culture:
This article was originally published in the November/December 2018 issue of NACD Directorship magazine.