Auditing Culture – A New Perspective

Let’s be honest – most readers are probably bored stiff with my constant appeals for internal auditors to focus more on organizational culture. And I get it. It's easy to dismiss as yet another item on an ever-growing list of things we "should" be doing. But here’s the reality: internal audit's role in auditing culture isn’t just a buzzword or my personal crusade. It’s a key expectation of the internal audit profession. The new IIA UK Code of Practice explicitly states that we must engage with organizational culture. So the question isn’t whether we should audit culture—it’s how do we do it effectively?

The Cultural Challenge 

Behavioral scientists have been researching workplace behavior for decades, producing vast amounts of information on what motivates human behavior. We know a great deal about what makes people tick. Yet, when it comes to translating that knowledge into actionable insights for audit functions, most internal auditors struggle to gain traction with the subject.

Some functions have gone so far as to create specialized teams, staffed with behavioral scientists, to help audit culture. Others have chosen to express opinions on the culture of their organizations in their reports. While these are positive steps, the unfortunate reality is that many audit teams have abandoned the idea that thecould look at culture through a risk-based lens. But it’s precisely this risk-based approach that should guide how we audit culture.

Why Do We Struggle? 

There are several reasons why internal audit functions have found auditing culture difficult. First, culture is often seen as intangible, something that cannot be easily measured or audited. Second, there’s often a disconnect between what we know about human behavior from a scientific perspective and how it can be applied in a business context, particularly in an audit.

But there’s a way to bridge that gap and approach auditing culture in a way that fits our risk-based traditions. And that’s by looking at culture through a behavioral risk management lens.

For please please visit auditculture.com