In June 2014, The Chartered Institute of Internal Auditors released a white paper entitled, “Culture and the Role of Internal Audit“. In this article, I would like to highlight a few of the points made by the white paper.
The white paper identified several enablers that must be in place for Internal Audit to be effective in providing assurance related to culture, these include:
- Culture must have been established and communicated throughout the company and the company must have a good level of risk maturity.
- Internal Audit must have clear mandate to assess culture (as documented in the internal audit charter) and the Chief Audit Executive must have the trust of the Audit Committee to communicate “gut feel” where needed.
- Employees must feel safe (e.g., confidential surveys and communications)
The white paper then goes into the challenges of auditing culture and provides some considerations for auditing culture. These include the limitations of surveys, auditor confidence, and the skills and competency gaps that may exist within internal audit groups.
Next, the white paper provides some examples from companies that have implemented culture auditing, including:
- Aberdeen Asset Management
- Mersey Internal Audit Agency
- Old Mutual Group
- TUI Travel plc
- Lloyds of London
- BAE Systems
- 3i plc
They close the white paper with an appendix discussing some sectoral differences. This is particularly interesting if you are engaged in one of the sectors focused on with this survey.
Does your internal audit group audit culture?