Practice Guide: Auditing Culture

Organizational culture drives how business is conducted and strategies are executed. All organizations have a culture, whether intentionally created or not. Likely, there are organizational subcultures within individual departments, especially if multiple locations or campuses exist. This guide offers example audit checklists, three approaches to conducting an audit, and suggests information to gather before embarking on a culture audit. Topics include: Understanding the business significance of culture and conduct risk in an organization’s control environment. Identifying the key components of culture and conduct risk. Understanding key stakeholder concerns and expectations related to culture and conduct risk. Recognizing internal audit’s role in assessing and reporting on organizational culture. Understanding, based on example tools/guidance, approaches to assess and report on an organization’s culture and management of conduct risk.