Page 21 - Internal Auditor M.E. (English) - June 2018

auditing culture

No Defined Criteria Ideally, management and the board should is, but their perception of the culture is filtered by employees’
define expectations for each part of the business, as well as the unwillingness to tell them there are problems in the culture.
observable behaviors that illustrate consistency with, or variance
from, that expectation. This is rarely done. The lack of clear, The culture exists in the perceptions of employees. If employees
specific criteria to audit against increases the challenge of auditing believe the culture is “win at all costs, do whatever it takes,” that’s
culture. To address this challenge, some internal audit departments the way they behave. If employees believe the culture is “put the
customer first,” that’s the way they behave. That’s why a common
have developed a culture model — usually starting from a model definition of culture is simply “how we do things around here.”
developed by an outside firm. For example, Prudential uses a
model it co-developed with EY (see “Auditing Prudential’s Control Employees are the best source of information about the culture,
Environment: Areas of Focus” at right). Once the board and but getting that information presents several challenges for
executives buy into the model, internal audit can develop audit auditors:
programs and tools to address specific expectations and behaviors
within that framework. • Employees might not be fully candid, especially if they fear
retribution for saying something negative to the auditors.
The Extended Organization Although they are difficult to
identify, cultural inconsistencies in global operations, outsourced • They may have cultural blind spots that make them unable to see
a cultural weakness from within the culture.
functions, vendors, and joint venture partners can be harmful to
the organization. Internal auditors must adapt their approach, • Some employees may be chronic complainers.
audit tools, and judgment to account for differences in country • Surveys, interviews, and workshops by internal auditors might be
cultures. Some organizations require their vendors and third-party
providers to submit a report annually showing how they comply influenced by the same blind spots.
with the organization’s values. Then they meet to discuss the • The response to the results will be influenced by the culture.
report, which can be more meaningful than the report, itself.
Internal auditors must be aware of these challenges and
Culture Is Perception use knowledge of their organization, good judgment, and
interpersonal skills to deal with them as they develop and apply
Before addressing the techniques internal auditors are using to their assessment techniques. There are several keys to auditing
audit culture, a basic principle and its related challenges are worth culture successfully.
discussing. An organization’s culture does not exist in formal
documents such as codes of ethics or value statements, which Success Factors
only reflect what the organization says it wants the culture to be. The Subjectivity of Culture
Nor does it exist in what the board and executives tell auditors
about the culture. They can describe what they think the culture Culture is inherently subjective. So how can internal auditors

JUNE 2018 INTERNAL AUDITOR - MIDDLE EAST 19