Auditing Culture

Who will benefit from this course?

This course is suitable for internal auditors, senior auditors/audit management, chief audit executives, compliance officers, risk managers, and professionals responsible for assessing and managing organizational culture and conduct.

Course Objectives

By the end of this course, participants will:

• Understand the key elements of culture and the different foundations to assess this
• Understand the difficulties in any assessment methodology including issues around sub-cultures and behaviours/conduct risk
• Consider the way culture interacts with other GRC processes
• Understand the different ways to approach a culture engagement
• Understand robust ways to think about culture when auditing other matters
• Rethink your approach to accountabilities and root cause analysis
• Understand some of the key regulatory developments around around culture, conduct and behavioural risk.

Unit Topics

Defintions

• Definitions and models of culture – understanding that culture is not “soft”

Where does culture come from?

• The psychology of decision making and how this may be influencing culture
• Sub-cultures – country cultures and behaviours
• Group dynamics and politic
• Taking a systemic approach to understanding organisational levers that influence culture
• Differences between the espoused and real culture – understanding defensive routines

Why is culture hard to measure?

• Biases surrounding staff surveys of culture – question selection, responses and action planning
• The link between risk appetite and risk culture and the problem of finding suitable criteria when looking into cultural issues.

Practical approaches and good practices

• Paying attention to audit behaviours and management attitude towards audits
• Root cause analysis and culture
• Thinking about the culture of the internal audit team and how it inter-relates with organisational culture
• Thinking critically how to deal with external consultants
• Practical first steps

Looking ahead

• Recognising the limits of internal audit in this area – the risk of taking on a management role and of false assurance
• Models of organisational effectiveness that can be used as a way of approaching cultural issues.