Gavin Hayes is head of policy & external affairs at the Chartered Institute of Internal Auditors — the professional association for internal auditors in the UK and Ireland. Here, Gavin discusses the findings of the IIA’s 2022 report on corporate culture and what leading boards and internal audit teams are doing to put culture on everyone’s radar.
The disconnect is indeed huge. The role of internal auditors is to monitor how processes, actions, and tone at the top align with the values, ethics, risk appetite, and policies of an organisation — and culture is part of what they analyse in the course of their job. Yet, only a small minority of boards (13%) and audit committees (42%) discuss culture with their internal audit teams.
There are two reasons for this:
First, many boards don’t fully appreciate the risks and opportunities that stem from corporate culture, and therefore don’t consider it as serious a matter as they should. Some don’t even consider it at all: one shocking finding from our research is that nearly a quarter of boards (23%) do not even articulate the kind of culture they want for their organisations.
“Nearly a quarter of boards (23%) do not even articulate the kind of culture they want for their organisations.”
And second, even amongst those who do take it seriously, there’s a view that culture is more a gut feeling than something concrete that can be measured and reported on, in the way that financials can. And so, over half of boards and audit committees don’t request reports on culture (52%). But that’s a profound misunderstanding. Culture can be monitored — from staff surveys conducted by HR to one-to-one interviews led by organisational psychologists and behavioural risk experts. Many organisations sit on troves of culture-adjacent data that they do not exploit, and they miss out on valuable insight as a result.
One of the board’s key roles is to appoint the chief executive. And choosing the kind of person you want to lead an organisation is, by extension, to choose the kind of culture you reward and will get. So, culture absolutely isn’t an HR or a compliance thing, but rather an integral part of the board’s remit.
“Culture absolutely isn’t an HR or a compliance thing, but rather an integral part of the board’s remit.”
Checking, testing, measuring, reporting on, and nurturing that culture… all that naturally falls onto the executives, with human resources, risk management, compliance, and internal audit playing a crucial part. But to do this well, the tone has to be set at the top — the board’s values and expectations must be accurately defined, and its cultural “blueprints” clearly communicated.
Speaking to boards or committees about “culture” isn’t always easy. Maybe the board members find the topic too vague; maybe the people reporting on it consider themselves unqualified to comment on such a broad subject; or maybe everyone just feels uncomfortable talking about something that has moral connotations, and which they might feel takes them out of their “lane”. And so, pushback isn’t uncommon.
Luckily, what we found is that simply tweaking the language can be sufficient to get past that initial reserve. If you encounter resistance when bringing up “culture”, try switching to “behaviours” or “organisational behaviour” — you’ll be surprised by how much a small change can reframe the entire discussion.
It would be an understatement to say that Covid-19 is heavily impacting corporate cultures — and even more so now that hybrid working is here to stay.
Here, an internal audit team tasked with monitoring culture can be a real asset for a board. As internal auditors typically report to the head of the audit committee — who should be a non-executive — they provide the board with a direct, unfiltered-by-management view of how culture is evolving, and of whether it’s cascading down through the organisation or not. Many internal audit teams make use of live dashboards, too — which can help the board keep a finger on the pulse in real time.
“An internal audit team tasked with monitoring culture can be a real asset for a board.”
Some organisations will decide to integrate culture into their standard audits. Others will opt for a dedicated culture audit. Whatever method is chosen, what really matters is that culture isn’t confined to a report or a team, but that it becomes every department’s problem. And in that regard, the ease or difficulty with which internal audit teams interact with other parts of the organisation on culture-related matters will tell a savvy board member a lot.
This interview was conducted by Megan Pantelides and Maximilien van Gaver.