Risk and Internal Audit assurance functions have a critical role in understanding and reporting on the human factors that impact on the processes, risks and the overall control environment.
Historically, when things go wrong within an organisation, the response has been to add layers of hard controls such as additional authorisations, reduced delegations, or extra performance metrics to attempt to close the gap. However, we know from experience that increasing layers of hard controls does not necessarily improve organisational performance. People are at the heart of every organisation, and it is the human factors that drive decision-making, organisational performance, and the effectiveness of the internal control system.
Assessing these human factors can be incorporated in several ways, most notably:
- adding cultural considerations to existing internal audits, compliance and risk review
- performing stand-alone cultural deep dives
- expanding the typical risk and audit universe to include areas with cultural salience, or that may indicate red flags (e.g. whistleblower hotlines, incentive programs, employee engagement).
Across these three approaches, Risk and Internal Audit are well placed within organisations to support increased awareness and capability to manage cultural and behavioural considerations, particularly in the following capacities:
- Serving as a culture promoter: Starting and supporting dialogue with boards and executive leadership about the critical connection between culture, strategy and risk; helping the board understand their role in culture and to gain buy-in from top management.
- Understanding the current state: Considering how cultural expectations have been defined, communicated, understood and embedded. To measure the organisational culture, internal auditors may apply root cause analysis, observe behaviours and consider what data is available in the organisation to gain insight into culture (e.g. exit interviews, engagement survey results, hotline reporting). Traditional data inputs can then be complemented by other audit procedures including surveys, facilitated workshops, focus groups and advanced analytical techniques like sentiment analysis.
- Evaluating culture over time: Understanding perceptions about what is happening within the organisation, what is working well, and what are the barriers to achieving organisational goals, including key red flags that may be present.
- Providing insights and promoting collaboration: Sharing what other organisations are doing, and collaborating with different lines of defence to evolve the framework.
