This chapter introduces both internal control and organizational culture in order to provide a basic Auditing by Lawrence Dicksee, an English audit specialist. . Accountants (FEE) sets internal control in relation to governance and describes. Abstract: Prior studies evidence the influence of organizational culture on the . in different categories and the significance of its relationship with organizational culture in .. Internal Audit, Internal Control and Organizational Culture (Doctoral . This is especially gratifying considering that auditing culture will place a An organization in which management treats its internal audit function in such and audit committee, and one that is eager to identify risks and control.
Anyone can pay a marketing firm to develop a mission statement for them. A common tale for compliance professionals is that Enron had a fabulous mission statement along with award winning code of conduct.
Auditing Corporate Culture: A New Imperative
When rigorously evaluating corporate culture, auditors will need to make sure that these values as reflected in written procedures are actually demonstrated in how the business operates.
When demonstrating and measuring success, it is often not so much whether a compliance violation happens, as to how the company responds once it does. Employees often have a difficult time sounding off to management. Enter internal audit who have the independence and objectivity to evaluate corporate culture. There are a number of ways internal auditors have already historically looked at aspects of culture within the context of audit engagements.
The evaluation of the control environment is one that should already be leveraged by internal audit to apply to compliance program effectiveness as well to fraud control standards. Auditors can refer to the points of focus in the new framework to enhance their understanding. Keep in mind that that the points of focus under the first principle that, "The organization demonstrates a commitment to integrity and ethical values," aligns with the promotion of ethical conduct under the Federal Sentencing Guidelines.
The updated framework provides four points of focus: Sets the "tone at the top" Establishes standards of conduct Evaluates adherence to standards of conduct Addresses deviations in a timely manner Auditors have used several techniques to evaluate corporate culture as areas of focus of the control environment. Most audit projects should already look at the tone at the top of whatever functional area is in scope of the audit, including communication among senior managers, middle managers, and rank-and-file employees to help gauge that tone.
Some audit departments integrate soft control evaluations into their everyday audit procedures. Others conduct structured, entity-level interviews and may combine those with the use of focus groups.
Employee surveys that allow anonymity, however, are becoming acknowledged as one of the most effective and efficient ways to measure corporate culture.
- Event Search
- Comment on this blog post
- MISTI Newsletters
Compliance and audit professionals more routinely incorporate compliance program questions into broad workplace surveys. Learning how employees perceive the company's values can be eye-opening, with results are categorized by position, functional area, geography, or operating unit without compromising anonymity.
Don't assume that culture is uniform across departments or locations, or that line employees will have the same opinion of the company's values as the executives, the law department, or the human resources group.
Other activities of the compliance program further reveal cultural aspects. Auditors can also look at hotline activity, consistency of discipline, and incentives, likes sales commissions. There are instances where organizations have taken hardline approaches to how they remediate certain compliance violations.
They cannot be expected to view it as important if they model their behavior on that of their managers. Other areas of culture measurement for the internal auditor to consider include: Studies suggest that the highest indicator of workplace misconduct is fear of retaliation and the confidence employees feel when raising issues. Fear of retaliation is not only significant in and of itself, but may be a proxy of other problematic cultural factors such as distrust of management.
Auditing Corporate Culture: A New Imperative
Data on employee willingness to address matters with their immediate supervisor or to use the compliance hotline, as well as their views on what would happen if they reported misconduct, can be meaningful. Even better would be measures on how issues are reported and ultimately addressed.
Recognition, reward, and incentive programs can convey positive cultural messages. It reflects that management understands its role and that of the board and audit committee, and one that is eager to identify risks and control weaknesses and improve on those areas.
Most importantly it sets a tone at the top that signals unequivocally that doing things right are hallmarks of its culture.
Internal Audit's Relationship With Management Can Say a Lot About Organizational Culture
Conversely, a poor relationship between management and internal audit is defined by efforts to undermine internal audit's ability to do its job. This signals leadership that shuns scrutiny and will take steps to obstruct or avoid feedback from an independent internal audit function.
Attitude toward internal audit: Management's response to internal audit's inquiries is to circle the wagons and limit access to information.
Carousel of chief audit executives: Management cycles through a number of CAEs seeking one it can most easily control or manipulate. Pressure to change or hide findings: Management makes clear it doesn't want to hear the truth. Redirecting or misdirecting internal audit: Management manipulates the choice of audits based on an agenda other than one based on the organization's risk. Manipulating internal audit's budget: Management limits resources in staff, access to expertise co-sourcingor travel to limit internal audit's ability to do its job.
Limiting internal audit's access to the board or audit committee: Management wants to control the message from internal audit to the board.
Each of these reflect a tone at the top of avoiding accountability and transparency. This does not mean an organization is operating unethically or illegally, but it does suggest a fundamental disregard or misunderstanding of good governance and the dangers that accompany a disregard for it.
It at least hints at an organization that has work to do on its culture.