Page 22 - Internal Auditor M.E. (English) - June 2018

auditing culture

obtain objective evidence about something into evaluating soft controls while building • Audits of entity-level governance and risk
that is, itself, subjective? The answer the team toward a more robust focus on management structures and activities.
is the evidence obtained in auditing culture. • Audits of processes with significant
culture doesn’t have to be as objective as cultural influence such as ethics training,
the evidence obtained in auditing hard Audit Skills The Chartered Institute incentives, and human resource practices.
controls. The applicable International of Internal Auditors’ 2016 report,
Standards for the Professional Practice Organisational Culture — Evolving • Cross-functional thematic audits such as
of Internal Auditing (1100, 1120, 2310, Approaches to Embedding and Assurance, culture of compliance and management
2320, and 2420) do not require objective details the skills and competencies internal initiatives.
evidence. To summarize what the auditors in the U.K. and Ireland say the • Cultural auditing embedded in every
Standards say, internal auditors must profession needs to audit culture: audit project.
identify the best attainable information • Professional judgment (84 percent).
about the culture through the use of Audit results should include hard evidence
appropriate engagement techniques. This • Use of experienced or senior auditors to where it applies, as well as the results
information must be factual, adequate, and lead the work of interviews and other self-assessment
convincing so that a prudent, informed • (71 percent). techniques. All audit evidence should be
person would reach the same conclusions correlated and analyzed until reasonable
as the auditor. Internal auditors must base • Enhanced communication skills to and persuasive statements about culture
their conclusions and engagement results deliver unpalatable findings (60 percent). emerge. Conclusions should be discussed
on appropriate analyses and evaluations. • Influence and negotiation skills (48 and modified, if appropriate, at all levels
Their reporting of results must be fair, percent). before they are finalized. Internal audit
impartial, and the result of a balanced • Training from specialists on qualitative techniques that have proven effective for
assessment of all relevant facts and methods and survey design (33 percent). auditing culture are root cause analysis,
circumstances. structured interviews, employee surveys,
Just 21 percent of respondents say auditors and self-assessment workshops.
To comply with the Standards, internal already have the skills necessary to assess
auditors typically use a combination of culture and soft controls, the survey notes. Root cause analysis is basic-to-good
objective and subjective evidence, evaluate Organizations could supplement the skills internal auditing. Pushed deeply enough,
it objectively, and “connect the dots” about of the audit team by partnering with other the root cause of an audit issue is often
the culture in a way that is persuasive. assurance providers, such as those in the cultural. It might be a disconnect
They are careful not to conclude more second line of defense. Cosourcing with between the desired overall culture and
firmly than the evidence supports, and outside providers can be another good the subculture created by a manager. Or
option.
they present results as giving perspective it might be pervasive. “Connecting the
into the culture rather than stating audit Audit’s Relationship to the Business dots” from numerous audits can create
opinions or ratings. Support from the top is crucial but not persuasive evidence of an issue in the
sufficient. Internal audit must have earned overall culture.
Executives and board members are at the trust and credibility of managers Structured interviews enable internal
least intuitively aware of the challenges in throughout the organization to deal with auditors to ask a sample of employees the
auditing culture and may be skeptical of sensitive issues appropriately. If this is not same questions. For example, to determine
internal audit’s ability to deal with them. the case, auditors should rely on tools such whether a “culture of compliance” exists in
For the audit to succeed, executives and as anonymous employee surveys initially his company, a CAE personally interviews
board members must be willing to accept and focus on building relationships. 65 of the 1,000 employees. He starts with
less hard evidence than they are used to Extra care should be taken in reporting simple questions to set each employee at
receiving and accept that there are gray audit results in ways that are most likely ease and later gets into sensitive questions
areas (see “The Subjectivity of Culture” at to get corrective action taken without like, “Have you ever been asked to do
anything that you believe violates the code
right). Chief audit executives (CAEs) must unintended negative repercussions. The of business conduct or company policies?”
CAE and audit managers will have to work
persuade them that their internal audit more closely with the audit team to be
team has the skills, judgment, tools, and sure they are using mature judgment and This technique is more objective than
techniques to provide valuable insights communicating appropriately with their unstructured interviews because one set
into the culture. The team, of course, must clients. of questions and one skilled interviewer
bring consistency to the process. It
in fact have these attributes. If it does and does, however, require a high level
the board agrees, it is helpful to establish Scope and Techniques of interviewing skills to detect when
auditing culture as a mandate in the The most comprehensive culture audits someone’s positive answer isn’t what the
internal audit charter. If the team does not combine hard and soft control testing at a person is really thinking and ask the
have the skills, it is best to take baby steps variety of levels. For example: right follow-up questions. It also relies on

20 INTERNAL AUDITOR - MIDDLE EAST JUNE 2018