Page 67 - IAT_April_2025_Magazine

Under the Surface

Altho h rtif cts assemble and interpret cultural evi- example might be a campaign focused great audit evidence and can be the
on employee engagement: Maybe
dence collected through audits and
tangible focus of an action plan.
do little to everyday observations. the dress code loosened up, posters Achieving organizational align-
ch e c lt re, the superficial layer: with slogans appeared, free pizza was ment between espoused values
and behavior is complex and diffi-
provided on Fridays, and everyone
the
re e s to rtif cts received a cool new trinket — maybe cult. Leveraging The IIA’s practice
ide tif d c Artifacts are made up of the things a stress ball. The only lasting remnant guide, internal auditors can identify
auditors see and hear daily. They can
of the initiative is likely the addition to
mismatches between documented
Dividi
provide cl es.
under the c lt r l dress code, myths and stories about change culture, they are easy to iden- nizational behaviors or actions,
one’s corporate stress ball collection.
espoused values and significant orga-
include the language people use, the
Although artifacts do little to
such as between core values and
departments and people, the use of
e viro e t i to
technology, and visible traditions like
tify and can provide clues. Contrast
incentive plans.
the annual holiday party. Artifacts are
the culture of a company that has
As changes to espoused values
l ers c reve l
easy to change, but they impact culture
can impact culture, these efforts are
a formal dress code, office sizes
the s rf ce deeper tr ths. in the smallest of ways, if at all. An scaled to people’s rank and title, and worthwhile. However, updates to doc-
umentation don’t always result in
the habitual use of technical acro-
Bryant Richards and
nyms — with a company that has no
changes in behavior. For example, a
Heather Richards
Pintachan dress code, open spaces with movable department may agree to update a
desks, and plain-spoken language pep- procedure, but then, for whatever rea-
pered with occasional profanity. The son, choose not to follow it.
artifacts paint very different pictures
of potential organizational cultures. the hidden core:
derl i ss ptio s
one layer down: Underlying assumptions are diffi-
espo sed v l es cult to find and change. These beliefs
Espoused values are visible if one are the most powerful and impact-
knows where to look. These items ful cultural components. Underlying
include documents where the organiza- assumptions include the collective
tion pledges its values, such as mission perceptions of how to work together,
statements, core values, charters, and behaviors that lead to success and
contracts. Espoused values are change- failure, what makes employees feel
able and can have some impact on cul- safe, and who has power and why. For
ture. Given the documented nature example, what might be the collective
of many of these items, they make for beliefs of a company with a poor track
Under the Surface 53 June 2024
Internal Auditor 51 quick scans of critical indicators, such
June 2024
B ture can bring good budgets are insufficient. Often pressed as unreasonable expectations, incen- Under the Surface
ad organizational cul
participated in the  Pulse say their
to do more with less, nearly two-thirds
tives misaligned with values, and an
companies down It’s a
story that’s played out of audit leaders say they integrate gov- attitude of hubris. As with fraud red record for remediating audit findings? entitlement, a belief that no one is to provide leadership with individual
over and over in the news enough so ernance and culture considerations flags, auditors are encouraged to iden- Is it possible other departments see watching, and a sense that it is safer to insights. Data from exit interviews and
that audit leaders are now well aware throughout their audit plan. Doing this tify and communicate compelling evi- internal audit as an adversary? Maybe be perceived as a perpetrator than to employee engagement surveys may
that culture is a risk can improve the quality of each review dence of significant cultural risks. people feel safer working in a less demonstrate integrity. provide powerful evidence. Results
In thinking about risk at their own by adding more dimension — while However, to increase the value of restrictive control environment where Identifying and communicating from the assessment could lead inter-
organizations, % of internal audit providing greater overall coverage. cultural audits, internal audit must accountability is harder to assign. these assumptions is a familiar chal- nal audit to add more culture-focused
leaders rank governance and culture Another possible reason is that audit go deeper, exploring the foundational Maybe internal audit is not perceived lenge for internal audit. Performing procedures and specific culture audits
risk as moderate, high, or very high, leaders find it challenging to justify characteristics of organizations that as having any authority. reviews of tone at the top and fraud to the audit plan.
according to the  North American investing more resources into culture make them vulnerable to high-risk Similar to the risk assessment pro-
Pulse of Internal Audit. That number audits. Culture audits may be seen as areas. Such depth requires a framework Res lts fro the ssess e t co ld cess, internal auditors can expect the
is up from ƒ„% in the  Pulse. And more resource-intensive, given the embedded with cultural expertise not le d i ter l dit to dd ore c lt re- culture risk assessment to evolve after
the recognition that culture is highly chronic and long-term impacts of cul- typically found within the profession. foc sed proced res d specific each iteration. Collaboration with
management will help identify addi-
impactful seems to be universal: In a ture issues compared to the acute tional valuable evidence and data col-
 PwC Global Culture Survey of and seemingly more pressing nature an organizational c lt re dits to the dit pl . lection procedures. The first itera-
, leaders and employees, ƒ % of issues like cybersecurity risk and culture odel tion may result in an incomplete, but
said culture is even more important regulatory change. Edgar Schein, a Massachusetts Underlying assumptions are the requires internal auditors to identify directionally useful document. As each
than strategy or operations. An added dimension is that audi- Institute of Technology scholar buried treasure. Sifting through arti- and provide evidence for behavioral iteration builds upon the last, audi-
Despite this sense of urgency and tors are not typically experts in culture. considered by many to be facts and espoused values is how red flags. To enhance the value of cul- a culture risk ssess e t tors can expect the value to increase
risk, Pulse reports also show that inter- While often excellent barometers for the father of organizational to find them. These beliefs are the ture audits, internal audit must con- Organizations seeking robust cul- each year. Once the process is solidi-
nal audit leaders have been allocat- identifying healthy versus toxic orga- culture, provides a frame- switches and levers that shape orga- vincingly communicate underlying tural insights need a more comprehen- fied, audit leaders should envision the
ing a consistent % to % of their audit nizational behaviors, internal auditors work for a deeper evalua- nizational behavior, limiting or sup- assumptions and their impact on the sive approach, like an annual culture potential of this process. A heatmap
plans to governance and culture since receive very little training or practice in tion of culture in his book, porting the overall control environ- cultural goals of the organization. Are risk assessment. This requires a cul- could be generated annually to iden-
 ƒ. This category was the third low- assessing organizational culture. Organizational Culture and ment. At this level, internal audit these beliefs supportive of a resilient ture leader, such as the chief human tify risk areas in need of further explo-
est in the  report for resource allo- The IIA’s updated Practice Guide Leadership. His organiza- is looking for cultural characteris- and high-performing culture, or are resources officer, to identify the organi- ration and remediation. The value to
they detrimental to the organization’s
tics and the degree to which they are
management grows as internal audit
zation’s intended cultural characteris-
cation, ahead of only sustainability/ on Auditing Culture, to be released later tional culture model, often consistently expressed, such as how goals, likely leading to toxic environ- tics and then map them to the organi- updates this document quarterly, pro-
nonfinancial reporting (%) and other this year, will provide the profession referred to as the Iceberg cross-department collaboration is ments and quiet quitting? zation’s mission, goals, and objectives. viding some degree of real-time data
risk categories that didn’t make the an approach tied to the Global Internal Model, divides the cultural important to success or how chal- Like other operational reviews, the Internal audit can apply Schein’s on the organization’s cultural standing.
Pulse risk list ( %). Audit Standards. Even in its current environment into three lay- lenging executives in meetings can process must include alignment with culture model throughout the organi-
What’s the story? One reason for iteration, the guide explains how to effi- ers: artifacts, espoused values, impede advancement. the organization’s objectives and mis- zation. It can establish weightings for a culture model ex ple
the lackluster effort may be a lack ciently incorporate culture audits into and underlying beliefs. These Consider a toxic environment that sion. Unlike other reviews, internal critical processes such as onboarding The “Culture Audit in Practice” (see
of resources, as ƒ% of leaders who other reviews allowing, at a minimum, layers can help internal audit is full of fraud and waste. The col- audit will need to know or infer the and performance appraisals — and page ŠŠ) offers an example of a
lective beliefs may include a sense of organization’s cultural objectives. perform departmental assessments culture audit using an internal audit
INTERNAL AUDIT TODAY (continued on page ŠŒ) 64
Internal Auditor 52 June 2024
Internal Auditor 54 June 2024