New IIA-UK Report Takes a Fresh Look at Auditing Culture

The Chartered Institute of Internal Auditors in the United Kingdom and Ireland (IIA-UK) is a pioneer in advocating internal audit’s role in auditing corporate culture. So, it’s no surprise that the body has stepped up again to provide a fresh perspective on the topic in a new report: “Cultivating a healthy culture: Why internal audit and boards must take corporate culture more seriously in a post-Covid world.” The research was undertaken with the support of AuditBoard and the London Business School’s Leadership Institute. I was honored to add my voice, along with IIA-UK CEO John Wood, to the foreword of this important work. It should be priority reading for internal auditors everywhere.

The importance of culture has become increasingly evident in the past decade. As the report notes, “A healthy corporate culture differentiates an organization and impacts customers, financial performance, growth, reputation, recruitment, and retention. An unhealthy or sub-optimal culture impacts all these categories.”

The report conveys both encouraging and troubling news on board oversight and internal audit’s engagement on organizational culture. The report indicates that UK boards are gradually stepping up in the oversight of culture: When more than 100 senior internal audit executives were surveyed, about 70% said the board had “established and articulated what culture it wants for the organization.” Yet, when it came to their own roles, respondents acknowledged that there is still work to do. Only 60% said their plans included any audit coverage of culture (only 5% said they planned to undertake standalone audits of culture).

The report includes several valuable insights on culture. For example, respondents were asked to identify the top three risks that have the most impact on culture:

• About 65% pointed to human resources, talent management, recruitment, and retention.
• 34% identified inclusion, equality, and diversity.
• And roughly 30% believe both corporate governance and ethics are among the top three.

The report correctly observes that:

“Organizations’ cultures differ greatly and come in all different shapes and sizes. They can be shaped by the sector they operate in, for example, the culture of an investment bank, in all likelihood, will differ greatly to that of a healthcare provider. Or a publicly listed company may have a very different culture, to that of a smaller family-run private firm.”

The report also makes a compelling case for internal audit to play an even greater role in auditing culture:

“Organizational culture should matter to internal auditors, because having the right corporate culture, aligned to the organization’s purpose, values, corporate strategy, and vision for the future, is fundamentally important to the effective leadership, sustainability, resilience, and governance of an organization. An organization’s culture can also have a significant impact on the risk management and internal control environment, and touches upon a broad range of other business-critical risks.”

Among the report’s key takeaways for internal auditors are:

• Insights on how the COVID pandemic has impacted corporate culture
• Rising regulatory expectations when it comes to culture
• Insights on the skills and competencies internal auditors need to audit culture
• How to tackle auditing culture (standalone, integrated or continuously), and
• The importance of cross-organizational collaboration

Those who might have thought auditing culture would be a fleeting fad from the 2010’s are in for a surprise when perusing this timely report. As the authors note:

“It is . . . vital that internal auditors champion in collaboration with other business functions to monitor, assess, and provide independent assurance on corporate culture.

I encourage all of you to download your copy today.