Page 23 - Internal Auditor M.E. (English) - June 2018

TO cOMMenT on the article, auditing culture
eMail the author at jamesroth@audittrends.com

the interviewer’s understanding of what organizationwide survey, usually annually. • Warranty claims.
was said and the willingness of upper
management to believe its accuracy. Many large organizations have an existing, • Frequency of performance targets being
organizationwide employee survey. Most missed.
Culture Audit Resources of these surveys include little or nothing • Frequency of large projects failing.
Internal auditors can use these tools as on topics such as ethics or risk that are
they prepare to audit culture in their essential to the culture. Some internal • Hotline statistics.
organization. auditors have reviewed the content, • Environmental impact data.
developed survey statements that address
• University of Minnesota Employee these issues, and persuaded management The best metrics auditors can use depends
Survey to add them to the survey. They can then on the organization. Several metrics
• Corporate Compliance Review use the survey results as a key risk factor would be specific to the organization or its
Questionnaire in developing their periodic audit plan. industry.
When the survey suggests cultural issues
• Compliance Quiz in an auditable entity, the results also can Maturity Model
• Culture Audit Metrics be used to help plan and scope that audit. Culture does not lend itself to a pass/
And when process deficiencies are found, fail type of audit opinion. IIA guidance
Employee surveys have the advantages the root cause might be identified in the addressing sensitive topics often
of gathering evidence from a large sample survey. Linking the objectively evidenced recommends considering a maturity model
of employees and producing objective deficiency to the survey results can be very to report results. With a maturity model,
data. The most common survey technique persuasive to management that a cultural
for internal auditors is asking employees issue exists. executives and the board can decide how
to respond to a series of statements by mature they want the organization to be
indicating whether they strongly agree, Facilitated workshops were the first tools with each attribute listed. Internal audit
agree, disagree, or strongly disagree with used by internal auditors for evaluating results can then be presented in terms of
each statement, with an option like “not soft controls. In this technique, a the model and help measure how mature
applicable” or “don’t know” off to the side group of employees is guided through each attribute actually is. This reporting
and not factored into the results. The audit a disciplined analysis, often using the vehicle assumes that the organization is
report can then state, for example, that “46 same kind of statements that are used in working to get better (more mature) with
percent of responding employees disagreed surveys, together with confidential voting the attributes important to it and helps
or strongly disagreed with the statement. technology to gather and tabulate the measure progress along the way.
…” This is an objective fact. The auditor results. Discussing the issues that emerge Cultural Evidence
then must look for corroborating evidence with the employees who experience
and investigate the root cause. them can be powerful. Today, workshops Culture might be the most challenging
A well-constructed survey — provided are used more by risk management audit topic the profession has ever faced.
Internal auditors must be realistic about
that employees believe it is anonymous departments for risk assessment, while the constraints they have in their own
and action will be taken to address internal auditors more frequently use
their concerns — can generate data that surveys. organizations. If the constraints are
accurately reflects employees’ perceptions substantial, auditors should do what they
of the culture. It is possible, of course, Metrics can at present and look for opportunities
to expand over time. It may be impossible
that the results reflect a misperception. In addition to these techniques, internal to ever give a firm opinion on the quality
This is why the auditor must look for audit can leverage metrics that reflect
corroborating evidence. If it turns out the culture to develop the periodic audit of an organization’s culture. But good
to be a misperception, that is valuable plan, plan and scope audit projects, and auditors using good techniques, judgment,
information that should be reported to the support audit results. Hard data can be and communication skills can present solid
local manager, who can then correct it. persuasive. A monthly dashboard could evidence about the culture to executives
and the board. Over time, the picture this
Employee surveys can be used at two levels: give meaningful perspective on the culture evidence paints will become clearer and
on audit projects or organization wide. to executives and the board. The dashboard more persuasive. This may be the most
Some internal audit departments have a could present metrics such as: valuable information internal audit will
standard survey they use on every audit, • Customer survey results. ever provide.
with a section in the audit report including
corrective action plans. Others develop • Number and trend of customer James Roth, This article was republished
a survey for just one audit when the complaints. and translated with the approval of the insti-
situation and level of risk justify the time • Turnover statistics. tute of internal auditors, it was published in
involved. Some internal audit departments June2017 and is the winner of the Thorsten
have developed and administer an • Sick time statistics. Prize as the best article published during 2017

JUNE 2018 INTERNAL AUDITOR - MIDDLE EAST 21