Top Takeaways From the 2023 Organizational Culture and Ethics Report

No organization is immune from culture failure. It is one of the most significant risks any organization faces. A healthy culture is critical to long-term, sustainable organizational success — and toxic cultures often serve as a common thread across organizational failures.

Yet, organizations cannot manage what they do not monitor, and many organizations are still not prioritizing culture assessment or acknowledging culture risks and opportunities. Internal audit can lead the way in helping organizations to understand, assess, and continuously monitor culture’s far-reaching risks, impacts, and opportunities. 

The 2023 Organizational Culture and Ethics Report, coauthored by Richard Chambers and Cynthia Cooper, draws from AuditBoard’s 2023 survey of more than 350 internal audit leaders across industries to look at the current state of culture assessment and identify ways internal audit can rise to the challenge.

Download your copy of the full report, Organizational Culture and Ethics Report: Internal Audit’s Role in Unlocking Culture as Catalyst and 21st-Century Differentiator, and read on for our top three takeaways and to watch a conversation between Richard Chambers and Cynthia Cooper breaking down how they think about culture.

1. Executive Behavior Is Seen as a Major Indicator of Culture Risk

Assessing organizational culture requires identifying key risk indicators — a concept we’re referring to as Key Culture Risk Indicators (KCRIs). KCRIs are specific indicators that can provide early warnings of culture weaknesses or failures. Internal auditors can use KCRIs to create metrics that allow continuous monitoring of changes to key aspects of culture over time. For example, a KCRI to monitor for poor tone at the top or a profit-at-any-cost mentality might be measuring whether management is making financially driven short-term decisions that are not in the organization’s best long-term interests.

When internal audit leaders were asked to select the top five risk indicators for organizational culture, they sent a clear signal that they see executive behavior as critical in influencing organizational behavior. 

• A remarkable 68% of respondents identified “poor tone at the top/executives don’t live values” as the top culture risk indicator. 
• The next three results — “profit at any cost (ends justify the means)” at 51% and both “poor communication” and “unethical/illegal conduct without accountability” at 46% — are related to No. 1. If these risk indicators existed within an organization, they would further support the notion that executives are not demonstrating the values of a healthy culture, and/or suggest that the employees themselves may not be doing so.

The culture assessment toolkit in the appendix of the full report includes more example KCRIs. Most organizations are not yet tracking these types of metrics, but they are critical for maturing internal audit’s approach to assessing culture. 

2. Organizations Readily Identify Employee Behavior as a Key Benefit — but May Be Overlooking Other Strategic Benefits

When internal audit leaders were asked to select the most valuable benefit of a healthy culture, the vast majority (88%) zeroed in on four areas: As the figure below shows, the largest percentage (38%) identified higher levels of employee engagement, satisfaction, and well-being as the top benefit, followed by an increase in organizational value and performance (19%); trust, transparency, and open communication (17%); and ethical values, decisions, and actions (14%).

Interestingly, benefits that receive comparatively scant support include an organization’s competitive advantage (2%), organizational longevity (2%), minimizing fraud and unethical conduct (1%), helping to protect the organization’s assets and reputation (2%), and reducing employee attrition and costs (1%). Each of those tie in directly with strategic business risks. If CAEs and their organizations don’t perceive these as being severely impacted by culture, they are likely to address them minimally or not at all in internal audit plans. A key question CAEs should ask themselves is: Do I see a clear link between culture and strategic business risks?

3. Many Organizations Are Not Prioritizing Culture Assessment

When asked to identify the typical products of culture audits and assessments, a high percentage of internal audit leaders (37%) said they have not formally assessed culture at all. Nearly one in five (19%) indicated that they have not assessed culture and have no future plans to do so. 

Further, when organizations do assess culture, they tend to employ piecemeal, ad hoc approaches and limited, narrowly focused assessment methods (e.g., root-cause analysis, behavioral observation) rather than more comprehensive approaches such as standalone culture audits, culture risk assessments, and culture assessment questionnaires. 

From audit scoping and risk assessments to resource and skill set limitations, the 2023 Organizational Culture and Ethics Survey results help us to more deeply understand why culture remains on the back burner at many organizations. Organizations that don’t assess or audit culture often don’t consider it a key risk or even part of the risk universe. Out of all the respondents surveyed,

• 42% indicated that culture wasn’t scoped in for the audit team.
• 36% said that it wasn’t assessed as a high enough risk.
• 33% cited insufficient resources.
• 19% identified insufficient auditor skill sets. 

The findings of the 2023 **Organizational Culture and Ethics Report: Internal Audit’s Role in Unlocking Culture as Catalyst and 21st-Century Differentiator also suggest that many organizations lack a clear understanding or agreement on what culture is, why it matters, and how it can be measured. For more: insights on culture elements, drivers, benefits, and governance; benchmarking on culture assessment methods, products, and critical actions; as well as a culture assessment toolkit and maturity model, and, download the full 2023 Organizational Culture and Ethics Report.