Weak organisational cultures in entities across the world’s financial system are widely considered to be one of the primary causes of the global financial crisis a decade ago. Perhaps as a result, maintaining a strong risk culture is an imperative for all major businesses today – as well as an expectation by their stakeholders, regulators and customers. Many of these organisations look squarely to their internal audit functions to provide assurance that their risk cultures are indeed effective.

Fulfilling this mandate requires internal auditors to tread carefully and adhere to a well-structured approach. Auditing risk culture seems to fall neatly under internal audit’s mandate to help the organisation improve the effectiveness of its risk management and governance. The core concern is that, in reviewing and measuring an intangible thing like culture, the internal auditor would be at risk of making a subjective assessment of the state of that culture.

Through our research for Volume XIII of Protiviti’s Internal Auditing Around the World, we learn that the internal audit leaders in many organisations already auditing, or that intend to audit, their risk culture are taking great pains to create methodologies, frameworks and processes that can give structure to the abstract.

Key Findings:

• Culture is complex and different within every organisation.
• Auditing corporate culture is a new frontier. But just like partnering across the organisation and working in a collaborative environment, it is a challenge worth conquering.
• For many of the organisations featured in this publication, risk culture audits are new endeavours that are only at the planning or pilot stage.
• Senior management and boards are looking to internal audit leaders to help the business develop the right approach for, and get the most value from, these types of audits.
• The function has a clear opportunity to play a transformative role in responding to the needs of key stakeholders, particularly boards, who want to assurance that the organisation is aware of and addressing all types of potential risk.