Developments in corporate governance are reinforcing this expectation with the need for effective internal controls over all aspects of the organisation.
Larger banks and financial services companies have invested heavily in behavioural science capabilities, particularly as their regulators are focused on issues associated with conduct risk to protect customers. However, for many internal audit functions resourcing constraints mean this is not possible.
Academic insight into what really changes behaviour
Recent research has clearly shown that the way to influence culture and behaviours is to make the desired actions easy for individuals to adopt. University of Pennsylvania research indicates that targeting habits and making the right behaviour effortless has greater impact than traditional interventions that focus on motivation, beliefs and values. The authors recommend focussing on interventions that enable individuals to enact desired behaviours and the prevention of circumvention.
This creates a real opportunity for internal auditors. It suggests that we can focus our attention on measurable aspects of social-structural interventions and their efficacy, in the knowledge that these are the activities that have significant impact on cultural outcomes.
The authors state that social-structural interventions include:
- Legal and administrative sanctions;
- Programmes to increase organisational trust worthiness in the minds of the workforce;
- Initiatives targeting injunctive (or social) norms and accepted behaviour patterns;
- Monitors and reminders of expectations;
- Incentives;
- Support provision; and
- Increased access to policies promoting specific behaviour.
Putting this into practice
We have been working with a number of high profile organisations needing to evidence that behaviours are aligned with expectations to mitigate reputational risks and evidence that they are compliant with critical regulatory obligations. These organisations receive funding from the public and are considered to have broad based obligations that underpin societal expectations. They are in sectors where there is public perception that they are not delivering on core expectations and standards.
Our experience is that messaging to the workforce too often fails to engage them. People simply struggle to access and digest the requirements in a meaningful way. Take the example of corporate policies. We write them with multiple intentions in mind:
- To evidence to stakeholders including investors, funders, partners and regulators (sometimes publicly on our website) that the organisation meets minimum legal and regulatory obligations, with necessary detail about how we achieve this;
- To demonstrate to customers (sometimes as attachments to contracts or agreements) that we are trustworthy and have the processes and procedures in place such that we not greenwashing in any respect; and
- To set out expectations for individual employees, freelancers, partners and contractors about what is expected of their personal behaviours and actions.
If the clearest way to influence behavioural change is through enabling individuals to do what is expected of them with ease, is it likely that these policies as currently written will really achieve this? Many documents we have seen amount to more than 50 pages. Its almost as difficult to digest as it is to read the average Annual Report!
Internal audit can make a difference
We believe internal audit can make a material difference. Through carefully considering policy documents, alongside associated procedures and guidance, and asking the question: would I really be able to digest this and act on it day-to-day? Can I read it and quickly given all the other time constraints I have? Is it proportionate and reflective of the appetite for risk set by the Board?
A starting point to bring about improvement is to be clear on the nature of the risk. Some risks must be taken in order to deliver on strategic objectives – these are risks the individual should be rewarded for taking. Other risks need to be minimised – and the individual should be penalised if they take risk outside of clear parameters. Internal audit has deep expertise in assessing and analysing risks.
Where there are risks that need to be minimised, are there policies that set out clear and succinctly, in language the workforce can understand, what an individual must and must not do? How easy is it for the individual to behave in the way the company intends?
In most organisations a thorough review of policies with the mindset of how behaviours are influenced could significantly move the dial on cultural alignment. Identifying whether the policies meet all three requirements above. If they don’t then how are behavioural expectations called out for individuals? Is it clear what the organisation expects?
For internal audit the good news is that it’s possible to deliver this assurance without specialist behavioural skills or expertise. Some level of training and support may be required to ask the right questions about simplification and engagement. A strong understanding of the nature of the risks is essential. However, these are skills that can be developed.
The right first step?
Of course, this is not the only necessary intervention or indicator of behavioural alignment. A broader dashboard of cultural levers and indicators is required. Internal audit needs to work closely with the HR or People function and we know that hearts and minds are essential to longer term purpose and strategic delivery. However, as a first and very practical step we believe this improvement is meaningful.
