Auditing Culture

Dhallu & Co.

Culture should be at the heart of an organisation. A strong culture leads to highly motivated employees which can lead to strong performance. Many of the reported misconducts of financial services firms highlighted in the media recently is often associated with poor culture as a root cause. As a result, audit committees are now more focused on understanding what staff are thinking and feeling.

An audit of culture within an organisation can be a good investment. But how does one audit culture? Culture cannot be confined to a tick box exercise. There is no value in doing an audit that is based on this type of exercise. Culture audits can be conducted in two-fold: culture audit in every audit and specific culture audits. But first a firm must define what its culture is.

Definition of culture

This is usually set by the board. A statement that defines what its principles and values are which link with its overall firm strategy. Where firms have defined this, it is a good starting place for internal audit to start measuring against.

Audit model

Culture can differ within a firm between different departments and individuals. To truly capture the essence within a firm, internal audits should add cultural assessments in each of their audits. Listed below are some examples where culture can be assessed within the audit process:

Observe examples:

During the audit planning, fieldwork and reporting phases, observe examples of individuals’ behaviours, actions and attitudes that may exhibit poor culture e.g. lack of commitment from senior management to attend committees, lack of commitment from staff to correct their mistakes.

Review effectiveness of challenge:

Provide a view on the effectiveness of challenge at the committees and board meetings that management attend. Consider the time spent to discuss and challenge financial and non-financial risks and any proactive challenge by its members.

Carry out root cause analysis:

In all audit findings make use of your ‘culture lens’ to identify the root cause and whether this has arisen due to inadequate behaviour from employees.

Team brainstorm:

At the end of the audit work, teams should form views on areas such as: did people admit to mistakes and seek to resolve issues; were people taking responsibility, and leading by example; were people constructively challenging others; and do people consider their actions on the firm’s strategic direction and objectives.

Specific culture audits

A specific audit on culture can add further value in addition to auditing culture within every audit. The audit scope can include areas such as: reviewing results of culture audit aspects in every audit, as discussed above, to understand and investigate themes; review evidence from other locations; and select a specific case from the past to investigate how management dealt with the issues, root cause analysis and what lessons were learnt.   

Audit committees want real insight from internal audit. For internal audit to provide this it must distance itself from it usual practise of confining audits to a tick box exercise. It must move more towards judgements, instincts and conversations with management. Internal audit must be more empowered to share their findings with the board, as financial services firms are looking more to internal audit to add value to the process.


Dhallu & Co. and the author will not be liable for any reliance you place on the information in this publication. You should seek independent advice.