Boards and audit and risk committees are increasingly putting internal audit functions under the microscope to better understand and audit their organisations’ culture and conduct.
For many auditors, this simply extends what they have always done. But for some this is unchartered waters.
To date, there are very few factual datapoints for auditors to use. There are engagement surveys, staff turnover, and succession plans, for example, but they don’t give a holistic view of the culture. In some organisations, engagement results are linked to performance reviews, sometimes creating unintended cultural consequences.
In one organisation I am aware of, the phrase “vote 5 to stay alive” was coined. It referred to the coercion most felt about allocating the highest score to ensure they were seen in a positive light. Any division that dared fall below this score got an executive summons to “please explain”. Is this the culture that boards want to inculcate in their organisations? I suspect not.
Other oganisations employ psychologists to tease out issues by using pre-prepared questions. Most do not have the time or financial capacity to interview everyone and, as such, there can be flaws in a process where only individuals with “an axe to grind” participate. Where this process occurs, the findings are often questionable – at best. External experts such as psychologists will find it difficult to determine how individual motivations might affect this type of review. Again, this makes it difficult for the internal audit function to interpret the findings and suggest possible remedies.
Employees often seek out the internal audit unit, given its status and direct reporting line to the board, for advice. Many in this role that I have spoken to say this puts them in a difficult position. Although information provided in confidence may give them fresh insights, ultimately its function is still one of risk management and cannot and should not conceal any issues brought to its attention. Again, this is often not an area where organisations have a policy and, consequently, it can leave individuals feeling compromised.
One way to test the robustness of a culture and a propensity to “speak up” is by assessing the reactions to audit findings. Where management is open to discussion and challenge, this is often a positive sign around the culture that is being built. Where management excludes more junior members of the team from key meetings, or the body language suggests their participation comes with the tacit assumption they will remain silent, these are all early warning signs of a dysfunctional culture.
Audit can also review risk assessment processes that may be part of performance or remuneration vesting arrangements to ensure that systemic conduct breaches are dealt with appropriately. There should also be recognition within these processes that mistakes are made and people should be able to acknowledge these without fear of being penalised. However, if the process demonstrates a mistake reflects systemic behavior, then remedial action will need to be taken.
As organisations are increasingly realising, culture and conduct is not an add-on. It’s integral to their bottom lines. So, the roles of internal audit and people and culture functions in testing, validating and improving the workplace culture has never been more important.
Lindall West | Managing Director
+61 412 728 828