The Global Internal Audit Standard calls for auditors to assess whether an organisation’s culture aligns with its ethics and values. It states that internal auditors must recognise and report conduct inconsistent with organisational ethics while promoting an ethics-based culture. Increasingly, stakeholders such as the Board, Audit Committee, and regulators expect Internal Audit to provide cultural assurance. The value that Internal Audit can bring is clear:
1. Providing comfort to the Audit Committee and the Board
2. Understanding of the culture across the organisation and within groups/teams/pockets
3. Knowledge of practices across the organisation gained through ongoing internal audit reviews
4. Ability to understand cultural and behavioural root causes
5. Being independent of the business
Despite this emphasis on culture, a 2016 IIA survey revealed a significant gap: many organisations lacked structured cultural assurance, leading to the critical question:
How is your Board getting assurance over the culture within the organisation?
The survey was sent to around 900 Heads of Internal Audit, with approximately 220 responses. The results were as follows:
To effectively audit culture, organisations can apply the Three Lines Model:
This article is the second from a series of three. The first article gave a generic overview of the auditing corporate culture and ethics, while the upcoming article will look into effective approaches and practical steps for auditing culture.
Reference: Auditing Culture, 2nd Edition, Global Practice Guide
