Boards and Audit Committees Must Take Culture Risks More Seriously
Culture is a risk — and is fundamental to the success of every organisation.
Organisational culture and the risks arising from an unhealthy or weak culture, are once again rising up the corporate agenda. This is in part being driven by changes and operational disruption brought about by the coronavirus pandemic. With large swaths of the workforce being forced to work remotely for much of the last two years, and the move towards “hybrid” working in the longer-term, many organisations are grappling with the challenge of how to embed and maintain their organisational culture going forwards. At the same time organisations are coming under increased pressure from wider society to ensure that their corporate culture embraces and supports greater levels of equality, diversity, and inclusion.
Whilst much of the debate around organisational culture has focused on the downside risks, the opportunities posed by a healthy, strong, and effective culture, cannot be overstated. Organisations regarded as having healthy cultures tend to be those that thrive, perform better, and are more resilient — but boards and audit committees are not taking culture seriously enough, according to findings from a corporate culture survey conducted by the Chartered Institute of Internal Auditors and AuditBoard.
Read the survey highlights below, and download your free copy of Cultivating a healthy culture: Why internal audit and boards must take corporate culture more seriously in a post-Covid world.
Internal audit has a vital role to play working in collaboration with other business functions in assessing, monitoring, and providing assurance on corporate culture and the associated risks and opportunities. The Chartered Institute of Internal Auditors would like to see the profession stepping up and playing a proactive role within their organisations in the corporate culture space.
Internal audit is one assurance provider that could and should be providing the audit committee with reports and independent insights on corporate culture, including for discussion at board level. Our latest research, based on a survey of over one hundred senior internal audit executives working in all sectors across the UK and Ireland, paints a mixed picture in terms of internal audit’s corporate culture journey and suggests that progress in this area may have plateaued. It is encouraging that 60% of internal audit functions we surveyed said that their internal audit plans included culture within it, and that a further 14% said that while it wasn’t in this year’s plan, they were planning on including it next year. However, that still leaves just over a quarter that aren’t looking at it yet or planning to look at it.
Meanwhile, our survey suggests that nowhere near enough audit committees and boards are taking the risks posed by corporate culture seriously. We were encouraged that just over 70% of respondents to our survey indicated that the board had established and articulated what culture it wants for the organisation, however, almost a quarter (23.2%) said their board had not. This is somewhat concerning, given that the board articulating what culture it wants and setting clear expectations, is fundamental to the effective governance, leadership, and stewardship of an organisation.
Additionally, less than half (47.6%) of senior internal auditors we surveyed said they had been asked by the board or audit committee to provide reports on corporate culture or EDI initiatives, less than half (41.5%) said that in the last twelve months they’d been invited to discuss the risks posed by culture with the audit committee, and only 13.4% said the board. This is quite surprising given that corporate culture-related risk has been impacted because of the coronavirus crisis. Although we appreciate that at the same time, many businesses have been grappling with myriad of other business-critical risks.
Based on these research findings our strong message to internal audit functions is clear: Be pro-active when it comes to corporate culture – don’t wait for the board or the audit committee to come to you before undertaking a culture-related audit engagement. Be prepared to put your head above the parapet if you have concerns regarding your organisation’s culture, use your voice and ask searching questions. In particular, Chief Audit Executives need to be braver and more courageous in having sometimes difficult and challenging conversations about the corporate culture and be willing to speak truth to power.
At the same time boards and audit committees should have greater confidence in seeking independent assurance and harnessing the skills of their internal audit function that the organisation has a healthy corporate culture, that is aligned with its purpose, values, and strategy. Organisations and their internal audit functions must not wait for a major corporate culture related risk event to erupt, a crisis to manifest itself, or the company to topple over before doing something about it. Instead, organisations should get on the front foot and get ahead of the curve.
To learn more about internal audit’s critical role regarding corporate culture, download the full report, Cultivating a healthy culture: Why internal audit and boards must take corporate culture more seriously in a post-Covid world.
