June 2017 37 Internal audItor
statement. …” This is an objective fact.
The auditor then must look for corroborating evidence and investigate the
A well-constructed survey —
provided that employees believe it is
anonymous and action will be taken to
address their concerns —can generate
data that accurately reflects employees’
perceptions of the culture. It is possible, of course, that the results reflect a
misperception. This is why the auditor
must look for corroborating evidence. If
it turns out to be a misperception, that
is valuable information that should be
reported to the local manager, who can
then correct it.
Employee surveys can be used at
two levels: on audit projects or organizationwide. Some internal audit departments have a standard survey they use
on every audit, with a section in the
audit report including corrective action
plans. Others develop a survey for just
one audit when the situation and level
of risk justify the time involved. Some
internal audit departments have developed and administer an organizationwide survey, usually annually.
Many large organizations have an
existing, organizationwide employee
survey. Most of these surveys include
little or nothing on topics such as ethics
or risk that are essential to the culture.
Some internal auditors have reviewed
the content, developed survey statements that address these issues, and
persuaded management to add them
to the survey. They can then use the
survey results as a key risk factor in
developing their periodic audit plan.
When the survey suggests cultural
issues in an auditable entity, the results
also can be used to help plan and scope
that audit. And when process deficien-cies are found, the root cause might be
identified in the survey. Linking the
objectively evidenced deficiency to the
survey results can be very persuasive to
management that a cultural issue exists.
Facilitated workshops were the
first tools used by internal auditors for
evaluating soft controls. In this technique, a group of employees is guided
through a disciplined analysis, often
using the same kind of statements that
are used in surveys, together with confidential voting technology to gather
and tabulate the results. Discussing the
issues that emerge with the employees
who experience them can be powerful. Today, workshops are used more
by risk management departments for
risk assessment, while internal auditors
more frequently use surveys.
In addition to these techniques, internal
audit can leverage metrics that reflect
the culture to develop the periodic audit
plan, plan and scope audit projects, and
support audit results. Hard data can
be persuasive. A monthly dashboard
could give meaningful perspective on
the culture to executives and the board.
The dashboard could present metrics
» Customer survey results.
» Number and trend of customer
» Turnover statistics.
» Sick time statistics.
» Warranty claims.
» Frequency of performance targets being missed.
» Frequency of large projects
» Hotline statistics.
» Environmental impact data.
The best metrics auditors can use
depends on the organization. Several
metrics would be specific to the organization or its industry.
Culture does not lend itself to a pass/
fail type of audit opinion. IIA guidance
addressing sensitive topics often recommends considering a maturity model to
report results. With a maturity model,
executives and the board can decide
how mature they want the organization
to be with each attribute listed. Internal
audit results can then be presented in
terms of the model and help measure
how mature each attribute actually is.
This reporting vehicle assumes that
the organization is working to get better (more mature) with the attributes
important to it and helps measure progress along the way.
Culture might be the most challenging
audit topic the profession has ever faced.
Internal auditors must be realistic about
the constraints they have in their own
organizations. If the constraints are substantial, auditors should do what they
can at present and look for opportunities
to expand over time. It may be impossible to ever give a firm opinion on the
quality of an organization’s culture. But
good auditors using good techniques,
judgment, and communication skills can
present solid evidence about the culture
to executives and the board. Over time,
the picture this evidence paints will
become clearer and more persuasive.
This may be the most valuable information internal audit will ever provide.
James Roth, PhD, CIa, CCsa, is
author of Best Practices: Evaluating the
Corporate Culture and president of Audit-Trends LLC in Hastings, Minn.
Culture might be the most challenging
audit topic the profession has faced.
VIsIt Internalauditor.org to view additional examples
of some of the techniques discussed in this article.