Gauging Company Culture Using Internal Audit

More companies are conducting audits of their culture, but questions remain about who should be leading these efforts and how such audits can be done. In its 2016 Regulatory and Examination Priorities, the Financial Industry Regulatory Authority stressed that assessing firm culture would be a major focus. But what does that entail? “What is culture exactly? It’s the visions, beliefs and values that drive the conduct of a firm and its employees,” said Ivan Garces, the risk advisory services practice leader at accounting firm Kaufman Rossin. “How do you audit that?”

Erica Salmon Byrne, executive vice president, governance and compliance, at business ethics advocacy group Ethisphere Institute, said there is a growing trend toward using internal audit to gauge corporate culture, especially when a company doesn’t have or doesn’t want to expend all the necessary resources to conduct a full-blown audit. “What companies in that position are doing are saying, ‘Internal audit is out in the field all the time talking to people, let’s arm them with a handful of questions to take to every field audit they do so we can get a sense of what’s happening from a cultural perspective,” she said. Some companies conduct full audits every couple of years, and use internal audit in the in-between years “as a spot-check” to see what is happening. There are some drawbacks to this approach, including not being sure the auditor will ask the question in the right way–and that means it’s up to the compliance people to train auditors so they understand not only why you are asking the specific questions you are but also so they can better listen to what respondents are saying. “That is what makes this work,” said Ms. Byrne. “If you are only giving them a checklist set of questions, you are not leveraging your resources as effectively as you could be.”

If audit is going to be involved, it’s best to make sure the chief auditor has enough authority to complete the job, said Mr. Garces. That person must also be able to communicate openly and honestly, “as it can be sensitive talking about people’s values and their ways of doing things,” said Mr. Garces. “It’s a tough conversation to have but make sure there is autonomy to be able do it.” Other parts of the audit can involve everything from looking at governance, leadership, compensation and the strength of ethics within the organization, he said. “People think they kind of have a sense but you have to test it. Look at employee surveys, look at HR records, look at turnover, look at training,” he said. “Does the firm invest in its employees? Is the culture transparent? Is it permeating throughout the organization?”