Traditionally, Internal Audit focused on financial controls and operational risks. Today, its mandate extends to evaluating corporate culture, ensuring governance structures support ethical behaviour, and identifying conduct risks.
The Global Internal Audit Standard calls for auditors to assess whether an organisation’s culture aligns with its ethics and values. It states that internal auditors must recognise and report conduct inconsistent with organisational ethics while promoting an ethics-based culture. Increasingly, stakeholders such as the Board, Audit Committee, and regulators expect Internal Audit to provide cultural assurance. The value that Internal Audit can bring is clear:
1. Providing comfort to the Audit Committee and the Board
2. Understanding of the culture across the organisation and within groups/teams/pockets
3. Knowledge of practices across the organisation gained through ongoing internal audit reviews
4. Ability to understand cultural and behavioural root causes
5. Being independent of the business
Despite this emphasis on culture, a 2016 IIA survey revealed a significant gap: many organisations lacked structured cultural assurance, leading to the critical question:
How is your Board getting assurance over the culture within the organisation?
The survey was sent to around 900 Heads of Internal Audit, with approximately 220 responses. The results were as follows:
A Structured Approach to Auditing Culture
To effectively audit culture, organisations can apply the Three Lines Model:
Culture is a powerful force—either a driver of success or a catalyst for risk. Auditing culture isn’t about box-ticking; it’s about ensuring that an organisation’s values aren’t just words on a page but a lived reality. By proactively assessing cultural risks, Internal Audit can provide the Board and leadership with the insights needed to build a stronger, more ethical, and ultimately, more successful organisation.
This article is the second from a series of three. The first article gave a generic overview of the auditing corporate culture and ethics, while the upcoming article will look into effective approaches and practical steps for auditing culture.
Reference: Auditing Culture, 2nd Edition, Global Practice Guide
Contact us
