1. Make the case for auditing culture

A few things to put across:

• Culture is key. The right culture delivers better on business strategy and achieves greater competitive advantage. The wrong culture breeds disaffection and erodes the control environment. Some corporate collapses such as Barings and Enron are attributable to some degree to a "hero culture" that has gone unchallenged.
• Audits can empirically assess culture. Internal audit is uniquely positioned to provide a panoramic and in-depth view, as its level of independence means it is the function likely to be least affected by vested interests.
• You have a clearly defined approach. This means clearly defining an approach in the first place of course; Steps 2 – 5 look more at this.

2. Gain the support of the board and audit committee

Gaining sponsorship from the board and audit committee often means overcoming the scepticism that surrounds culture audits: some boards have questioned whether culture can be audited at all.

In order to achieve this, you’ll need to articulate the value of internal audit and the fact that it is uniquely positioned to provide a panoramic and in-depth view, as its level of independence means it is the function likely to be least affected by vested interests.

3. Pinpoint exactly what you want to assess

Determine whether you seek to be a general barometer or provide insight on a specific area or aspect of the business. Each approach has its advantages and disadvantages.

4. Take a risk-based approach

Culture touches every part of an organisation so it isn’t possible to audit all of it in one go. Focus on areas where there is a greater inherent cultural risk (e.g. high sales commission; locations with higher levels of corruption; a transient workforce), or where there is already evidence of a cultural risk forming (e.g. poor engagement scores; high turnover of leaders).

5. Be strategic about resourcing

Consider which resource model best suits your audit:

• Building specialist teams. Hiring specialists in organisational psychology, people and change, HR and organisational design, where these teams have a dedicated capability to audit culture, values and change programmes. This approach earns credibility quickly, but can be an expensive option if the auditors cannot be redeployed to resource audits across the rest of the plan. This approach is more common with larger teams in larger, more complex groups.
• Establishing competencies in auditing culture. Training existing audit teams to incorporate culture audit objectives into audits they currently undertake. Acquiring skills through training can take time and it may still be appropriate to hire specialist skills in the early audits while knowledge transfer takes place.
• Integrated audits. Using the skills of second-line defence functions (risk management and compliance) and/or guest auditors from specialist disciplinary teams. This can be effective as long as the risk of self-review is managed.
• Co-sourcing. Obtaining the necessary skills on a targeted and temporary basis. This approach can be more economical for smaller functions.

6. Tailor your approach to the organisation

Choose the most appropriate audit method:

• Discrete. Undertaking targeted audits around specific culture risks e.g. a specific business unit, geography, or business objective.
• Component. Incorporating the assessment of cultural objectives into a wide range of audits, providing greater coverage. If organisational readiness to audit culture is less developed, introducing cultural insights (for example in relation to root causes) can be a sensible approach to building the case for a more dedicated approach in future years.
• Consolidated. Examining all audit evidence, be it from specific audits targeted on culture, wider audits or other internal audit activity such as attending programme boards. This results in a single point of view on culture. One of the following techniques, or more likely a combination of them, can be used in forming an audit view on culture:
• Qualitative (interviews, focus groups, behavioural observations).
• Quantitative (KPIs, data, survey).
• Continuous monitoring throughout the year.
• Data analytics, in particular Artificial Intelligence / sentiment analysis.

7. Be flexible

Most internal audit functions that have adopted culture audits have taken two to three years to fully establish an appropriate approach with the right capability and to establish credibility with the business. You may want to start with a pilot scheme.

When reporting on culture, consider:

• Including context and areas working well: not just reporting by exception.
• Supporting culture observations with specific examples as far as possible.
• Varying depth and approaches on recommendations.
• Varying approaches to score (for example verbal vs. provision of score per finding).
• How to drive real organisational change, such as setting out the specific steps or behaviours that would lead to stronger cultural performance assessments.

8. Writing your report

In formulating your conclusions, consider the following questions:

• What were your initial conclusions at the end of planning?
• How did these bear out during fieldwork?
• What was management’s attitude to audit during the fieldwork and to group internal audit observations raised: were the challenges fair or were management using the opportunity to play down issues raised without valid reason?

Your cultural observations should be supported by specific examples as far as possible. Any “gut feel” observations that you have should also be recorded.