Page 45 - iiA
P. 45
The Role of Internal Audit in Embedding
a Risk-Aware Culture
and a catalyst, providing insight into cultural blind
spots while guiding organizations toward a more
mature risk posture.
This article explores the evolving role of IA in
shaping risk culture, the methodologies employed,
practical challenges, and examples from various
industries to illustrate real-world impact.
FCA Jeet Agarwal What is a Risk-Aware Culture?
Partner | J K S S & Associates A risk-aware culture refers to an organizational
jeet.agarwal@jksco.in environment where every employee, regardless of
role or hierarchy, understands the importance of
managing risks proactively and is encouraged to
Introduction act accordingly. It is characterized by:
In today’s rapidly evolving risk environment, • Transparent communication about risk
organizations are exposed to increasingly • Integration of risk into strategic decision-
interconnected and unpredictable threats, ranging making
from cybersecurity breaches and ESG liabilities • Empowered employees who escalate concerns
to supply chain disruptions and geopolitical without fear
shocks. Traditional compliance-based approaches • Consistent application of risk principles across
to risk management are no longer sufficient. the enterprise
Instead, cultivating a risk-aware culture across all • Alignment between organizational values and
levels of the enterprise has emerged as a critical behavior
differentiator for long-term resilience and success.
As outlined by the European Confederation of
A risk-aware culture enables employees to Institutes of Internal Audit (ECIIA) in its 2024
understand and engage with risk in their report “Auditing Risk Culture”, risk culture
decision-making processes, promoting encompasses the values, beliefs, and behaviors that
accountability, transparency, and agility. It shape how risk is identified, understood, discussed,
empowers organizations to navigate uncertainty, and acted upon.
drive performance, and protect stakeholder value.
As companies face mounting challenges from This culture is not created overnight, it requires
regulatory, technological, environmental, and continuous effort, monitoring, and, crucially, a
reputational risks, embedding risk awareness cultural change agent – Internal Audit. By virtue
into daily operations has become a board-level of its independence and enterprise-wide access,
priority. Internal Audit is uniquely positioned to assess and
influence these cultural elements.
Internal Audit, by virtue of its independent status,
enterprise-wide visibility, and proximity to senior The Expanding Role of Internal Audit
leadership and the board, plays a pivotal role in
fostering this culture. It serves as both a mirror Internal Audit serves as a crucial catalyst in
INTERNAL AUDIT TODAY 42
