Auditing corporate culture is an emerging issue in the Internal Audit industry. A strong corporate culture can promote ethical behavior, improve employee loyalty, and cultivate devoted customers. It’s not a surprise that this is something auditors talk about at the virtual events we attend, on auditing message boards, and through business-related social media. But given the slippery nature of corporate culture as a concept, this area can present a real challenge to Internal Auditors.
Today, I want to ask and answer the big questions surrounding auditing corporate culture, empower Internal Auditors everywhere to tackle this immense subject, and provide you with practical advice and helpful tools.
How can Internal Auditors perform a corporate culture audit? Should they? What are the critical audit steps and areas? And finally, can Internal Auditors be independent and objective, as required by the Standards, while examining a corporate culture they themselves are a part of?
Why Audit Corporate Culture?
Many years ago, when I was an undergrad, I worked in retail to pay the bills. Shoppers did not seem very concerned with where their consumer goods came from back in those days. All that has changed. Recently, I was chatting with a new acquaintance who runs a business selling jewelry and accessories made in Third World countries. The more this savvy sales woman educated her customers about the artisans who create the products, and how she was benefiting their lives through commerce, the more she sold!
Consumers are also more environmentally concerned and socially-minded than ever before. This is particularly true of the Millennial, Gen Z, and younger generations. People want to know where goods come from, whether companies they patronize are using environmentally sound practices, and whether the workers they employ make a living wage and are treated fairly.
Beyond the world of retail fashion products, consumers care a lot about the ingredients in foods they ingest, the sustainability of food products, the cleanliness of facilities where their food is prepared, and so on. The world of consumer financial products, which has been my home turf for many years, has been a little late to this party. That said, consumers are becoming more sophisticated about the lending practices and financial products that affect their lives.
I recently had a conversation with a friend who was searching for a new financial institution. She reached out because I am very familiar with many of the companies she was considering. I expected questions about rates and customer service, but many of the questions were not at all what I anticipated. She asked how the financial institutions treat their employees, if they had a diverse Board of Directors, and their level of community involvement. Financial consumers are evolving and want to be well informed about a full spectrum of company practices.
When Corporate Culture is Lacking
Without naming names, if you follow business headlines you know that not all corporate culture stories are positive. A corporate culture that incentivizes employees to oversell to customers, charge predatory fees, to ignore consumer interests in favor of short-term gains, or even defraud innocent people have rightly been investigated, fined, and suffered reputational damage. I believe weak corporate culture is at the root of many white-collar crimes.
As auditors, we are in a unique position when it comes to corporate culture. Good or bad, customer, stakeholder, and even the public perception of your company probably makes a lot of sense to you. You see every day how the staff works, what the challenges are, and how difficult issues and situations are handled. If something is rotten, you are in the unique position to point it out to the people empowered to make positive changes. If something is great and previously unrecognized, you are similarly in the position to inform decision makers and share this good news.
For these reasons, I believe corporate culture should be included in your audit universe this year, and if resources allow, included in your risk-based audit plan.
Let’s say you take my advice, and you are ready to begin planning for your corporate culture audit. Where to start?!
It can be quite overwhelming to take on such a subjective and theoretical area. Auditing corporate culture is quite different from counting a cash drawer or inspecting some inventory in a warehouse. But there are many standard audit steps and practices. The first and most important step is to assign an audit owner. In most cases, the CEO is the logical and only choice. Establishing early on that the CEO will be the authority, primary contact, and the recipient who is most invested in the final report, will set you up for a successful audit.
Another important planning step is to get all of your documentation requests together. While many of the documents you’ll need to examine should be easy to track down, if you don’t already have access, some might be a little more difficult or obscure. At a minimum, you should request and review the following:
- Current Organizational Chart
- Corporate Culture Policy or Similar Governing Documents (for example, a Corporate Code of Ethics, Conflict of Interest Statement, etc.)
- Employee Handbook
- Corporate Mission Statement and Core Values
- Human Resources metrics and reports (for example, industry/peer comparisons, turnover rates, employee engagement surveys, etc.)
- Results of customer surveys completed during the audit period
- Documentation of any employee alerts or whistleblower hotline alerts
- Documentation of any customer complaints, investigations, etc.
Another good exercise you should complete during the planning phase is to consider the best- and worst-case scenarios for this project. You may find that the corporate culture is even better than expected, and present your findings to a happy CEO, Board, and Audit Committee. It is never a bad idea to expect the best. But you may find that not all is well, and that your company needs to ask some tough questions and make some difficult decisions. Take an hour, think of all the ways this could go wrong, and start preparing yourself mentally. Auditors should not neglect projects because of how leadership will receive them, but we would be naïve if we didn’t expect and prepare for some push back when auditing such a difficult topic.
Other than that, the planning phase is similar to many other audits. Review policies, procedures, and other documentation. Set up any interviews and meetings you’ll have, review as much documentation up front as possible, and start to immerse yourself in the topic.
While the CEO owns the corporate culture, every single person working at your company contributes to the culture in some way. It makes sense to either send surveys to employees, or to interview a diverse sample of employees face-to-face. You could even do a combination of surveys to the majority of employees and one on one interviews with a small sub-group. Decide how much time you can devote to surveys and interviews, create a survey and/or interview questionnaire, obtain a current list of staff by location and department, and make your judgmental sample selections. Be sure to include employees from different departments, locations, branches, etc. Include employees with a long tenure at the company as well as brand new employees; everyone has valuable perspective here.
When you write the survey, or plan for the interview, ask the employees to describe the culture in their own words, then look for common themes. Ask about any instances of fraud, theft, or lapses of ethics, whether committed or witnessed. Be up front and inquire about potential conflicts of interest, their ideas to improve the corporate culture, and actively listen to what they have to say. Your survey subjects may have good reasons to feel uncomfortable being asked about this topic, so do your best to put them at ease. Explain that you are gathering information, that you want what’s best for the company, and that their honest and complete feedback will help you to make a quality report.
Always give the subject time to address anything on their mind. Ask “Is there anything else you would like me to know about?” and give them either the time or space to answer fully. While surveying or interviewing employees is important, and you should make sure your subjects feel heard, you should never make any promises you can’t keep. The best you can offer them is to relay their concerns to executive leadership.
Focus on Human Resources
If you are lucky, your Human Resources department is on the ball and may have already done some corporate culture self-examination. Set up a meeting with the head of H/R, and ask them open-ended questions about the culture. Try to support their statements with information; for example, turnover rates, results of employee satisfaction or engagement surveys, results of recent exit interviews, the details of current incentive programs, etc.
If the company has any programs in place to promote or improve corporate culture, are they effective? How does the company’s vision for corporate culture align with what the employees told you? Human Resources is one of those departments that can really benefit Internal Audit, in this and many other ways. I hope that going into a project like this, you already have a strong and healthy relationship and rapport with this invaluable team.
Public Perceptions and Social Media
At this point in the audit, you will have developed a good understanding of how insiders view corporate culture. It’s now time to look outward, and consider what your customers and the public at large thinks. Start with a Google search of your company name with other search terms like “culture,” “review,” “complaint,” “reputation,” etc. Check out your comments on the standard platforms; LinkedIn, Twitter, and Facebook.
A lesser-known site that is becoming prominent in the social media universe is Glassdoor, where employees can anonymously post about their employer. It’s worth taking a look to see what is out in the public space about your company, but keep in mind that anonymous posts from potentially disgruntled employees and customers should not be taken as fact. Glassdoor is especially problematic; maybe it goes without saying, but these social media platforms are not verifying any of the information being put out into the world. Anyone can say anything.
So why go there at all? As I see it, there are two potential benefits to going down this rabbit hole of social media. First, good or bad, true or false, fair or unfair, people now have a public platform to speak their minds. Is your company aware of what’s being said, and doing their best to manage your social media reputation? If so, is it effective? If not, why not? Second, there is a chance that you can learn something you didn’t know through this process. It is a small chance, but the potential impact is large. Is there an open secret about your company being discussed online? As an auditor, you should do all you can to find out.
Potential Corporate Culture Audit Issues
Some readers may make the case that a corporate culture audit as a standalone project is unnecessary. If you feel corporate culture is constantly being audited, based on your audit plan and the breadth and depth of your testing procedures, you will not get an argument from me. Certainly, while performing our regular duties as an auditor, we are gaining awareness of corporate culture and analyzing it. If that is your audit approach, and it is working for your company’s needs, by all means keep doing what you are doing. Just consider whether any of the advice in this post could help you become even more in tune with your corporate culture.
Another possible area that can trip up this project is auditor independence. As an employee of the company, and one could argue a contributor to the corporate culture, is it appropriate to also be the auditor? I agree that the line is blurred, but bottom line, I think it is appropriate to audit corporate culture at your company. Just be ready to address this concern from your auditees and Audit Committee, if needed.
Tools that can Help
This may all still seem a bit overwhelming. The good news is, The Audit Library has several tools that can help! Subscribers to The Audit Library can download our Corporate Culture Audit Program (General, Credit Union, or Bank) and Corporate Culture Audit Survey Template (General, Credit Union, or Bank) to complete an in-depth audit. I hope these tools, and this post, will help you get your arms around this enormous project!
Have you performed a corporate culture audit recently? Have a question, observation, or concern? Leave a comment!