Corporate Culture: Are You Curious Enough?

Corporate Culture Are you Curious Enough

Corporate Culture: Are You Curious Enough?


As a keystone provides integrity to an arch structure, culture infuses the shared values and attitudes that frame how an organization thinks and behaves. In essence, it gives the organization its particular character. Culture is a potent source of strength or weakness for an organization and, good or bad, is almost always at the root of reputation and financial performance outcomes.

In this issue of The Bulletin, we explore the question, “Are organizations curious enough to really understand all aspects of their culture?” We also discuss practical ways to facilitate such an understanding.


Corporate Culture Is an Enigma

Take a guess at a key root cause that applies to all three of the following situations:

  • Three former officials of a major university, including a former president, were sentenced to short jail terms followed by home confinement for their roles in failing to report the child molestation scandal that rocked the institution.[1]
  • A car manufacturer intentionally programmed the turbocharged direct injection diesel engines in about million cars worldwide to activate emissions controls only during laboratory emissions testing, resulting in the vehicles’ nitrogen oxide pollutants output meeting regulatory standards during testing, but emitting up to 40 times more emissions in real-world driving; as a result, the company exposed itself to mega fines and significant investor lawsuits.[2,3]
  • Accusations of sexual misconduct against high-profile and powerful men across multiple industries and in the public sector, resulting in dismissals, resignations and suspensions.

The answer: a dysfunctional culture. An unhealthy, toxic culture enables, if not encourages, unethical, illegal behavior and/or reckless, irresponsible risk-taking. Ultimately, they put the organizations’ leaders in serious jeopardy. Other events that can be attributed, at least in part, to significantly impaired cultures include the 2007-2008 financial crisis, the Enron and Watergate scandals, and the Space Shuttle Challenger disaster.

No doubt, most historians would agree a severely flawed culture that leads to a dangerous downward spiral and ultimately ends in a disastrous outcome is as old as humankind itself. When such events occur, most observers are left shaking their heads, wondering, “What were they thinking?” And business leaders pause to think, “Can that happen here?”

But culture is a two-sided coin. Most observers are quick to note the unique aspects of the culture of organizations they admire for their impressive track record of sustained success. For example, consider the organizations listed as “most admired companies,” “most reputable companies” or “best places to work.” As people seek to understand the underpinnings of these and other successful and highly innovative companies, they tend to look for what makes them “tick.” Most often that includes the distinctive characteristics of the unique cultures they have in place that contribute to sustained superior performance in the marketplace. The point is, culture drives positive outcomes as an enterprise asset just as it can be a root cause of unwanted outcomes.

So everyone agrees culture is important, but not everyone can agree on exactly what culture is, much less how to fix it if improvement is needed. Until a broken culture manifests its ugly head with a reputation-damaging outcome, decision-makers must undertake corrective action based on reports of near misses, close calls, unwelcome surprises, performance gaps, policy violations and audit findings. Often, the data comes in drips before the spigot is turned on in full force. Thus, making the management of culture actionable is a challenge for leaders of all organizations.


A strong, positive and transparent culture contributes significantly to the alignment of employees with the mission, vision and strategy driving the enterprise’s value-creation pursuits.


What Is Corporate Culture?

At its core, culture is essentially the DNA of the organization, meaning it consists of the fundamental and distinctive characteristics or qualities that define a company’s shared values and belief systems. There are many definitions available in the public domain, but for this discussion we define corporate culture as:

The behaviors that people experience when they work for or interact with the enterprise’s management team and other representatives, as manifested through their decision-making, attitudes and actions day to day.

The focus here is not on what leaders and key employees say, but on what they do. Whatever the belief systems are, they are manifested through the enterprise’s actions. (Enron had a world-class code of ethics statement, after all.)

To be sure, culture is complex. It evolves over time and is a function of many things: the company’s mission, vision, pervasive core values and beliefs; its strategy, risk appetite and performance objectives; its organizational structure; the character of the people it hires; the standards, rules, conventions and encouraged behaviors articulated by its policies; and the mechanisms, performance metrics and protocols to reinforce and influence compliance with those policies. A strong, positive and transparent culture contributes significantly to the alignment of employees with the mission, vision and strategy driving the enterprise’s value-creation pursuits.

As noted earlier, culture is a strategic asset, as it lays a foundation for driving the creation of enterprise value. For example, the culture of a highly innovative company must sustain its commitment to reimagining processes and reinventing products and services. The culture of an agile, resilient organization must encourage focus, discipline and processes that lead to timely recognition of market opportunities and emerging risks and prompt action on that knowledge.

It is important to note that corporate culture includes myriad subcultures. For example, innovation culture, as noted above, is a topic that has gained traction as companies pursue their never-ending quest for the “secret sauce” to become more innovative so they adapt rapidly to changing conditions, seize opportunities at the speed of business, improve performance continuously and generate new revenue sources.[4]

Other examples of subcultures include a quality-committed culture, a sales culture, a safety-conscious culture, and a diverse, inclusive culture. Cultures within a corporation may vary at different locations, in different functions and departments and, of course, in different countries and regions. Ask anyone involved in a significant acquisition and there almost always is the issue of addressing distinctively different cultures in the merging entities. Subcultures need to be understood to ensure they are aligned with the enterprise’s mission, vision and core values, because they can create conflict and present a challenge to directors and executives to manage.

A key subset of organizational culture is risk culture. We define it as “the set of encouraged and acceptable behaviors, discussions, decisions, and attitudes toward taking and managing risk within an institution that reflects the shared values, goals, practices and reinforcement mechanisms that embed risk into the institution’s decision-making processes and risk management into its day-to-day operations."[5]

An actionable risk culture helps balance the inevitable tension between (a) creating enterprise value through strategy and driving performance on the one hand and (b) protecting enterprise value through managing risk within an established risk appetite on the other hand. In effect, it keeps the organization performing within acceptable boundaries as it balances the push between value creation and risk appetite and encourages a risk-informed perspective across the entity.

Exercising Intellectual Curiosity: The Unvarnished Truth

Management of an organization’s culture requires intellectual curiosity on the part of executive management. With the board’s encouragement and support, the CEO and executive team must really want to know the unvarnished truth about the company’s culture. Management must inculcate a safe, “speak up” environment in which employees are convinced their feedback can be offered without fear of reprisals and their leaders want not only to listen to that feedback (even when it isn’t what they want to hear) but also understand the underlying facts and root causes and commit to acting on them.

Unless these environmental attributes exist, employees won’t think their participation and input matter. To be sure, creating such an environment isn’t easy. It’s not just about setting up hotlines, although they are certainly a source of data. We’re talking about a proactive commitment to managing culture by fact and earnestly seeking out ways to improve it continuously. “Manage by fact” is a decades-old notion: If a leader wants to improve something, he or she must know the facts at the source. If that knowledge doesn’t exist, the wheels spin and the enterprise is reactive to events. A reactive approach to managing reputation is ineffective in today’s optics.

Part of the challenge in managing culture is the tendency to limit the focus to the tone at the top. During a recent roundtable of active directors, several participants pointed out that most boards neither assess nor understand the tone in the middle because they are focused primarily on the tone at the top.[6] It’s one thing to understand the tone at the top, but completely another to ensure that tone is translated into an effective tone in the middle.

Often, we refer to the “tone of the organization,” a phrase we coined to describe the collective impact of the tone at the top, tone in the middle and tone at the bottom in shaping an entity’s culture. While tone at the top is important and a vital foundation, the real driver of behavior on the front lines is what employees see and hear every day from the managers to whom they report — irrespective of what executive management communicates regarding the organization’s vision, mission and core values. If the behavior of unit and middle managers contradicts the messaging and values conveyed from the top, it won’t take long for lower-level employees to notice.

So, the lead question is, “Do the CEO and executive team really want to know whether the tone in the middle is aligned with the tone at the top?” One director at the roundtable suggested the use of surveys to gauge how employees perceive the current leadership culture and compare that perception to the culture desired or expected. Gaps almost always provide informative insights into what’s really happening in the business and what people below the senior management team really think, revealing opportunities for leadership development and improving the tone at the top as well as in the middle.[7]


The organization’s directors and executive leadership need to seek out and understand the facts regarding the organization’s culture and whether there are any aspects requiring improvement. And they need help.


Surveys are one way to obtain an understanding of the current corporate culture, particularly if they are conducted on a confidential, anonymous basis. But another way is face-to-face interactions, through focus groups and interviews, with key stakeholders at all levels of the organization. Such interactions can take place in a variety of forums and should utilize open (qualitative) questioning as well as ratings-based questions for comparison of selected factors. Survey results can be used to validate themes from stakeholder interactions to gauge consistency of views regarding the culture throughout the organization.

Relevant data metrics also provide useful evidential matter concerning actual day-to-day conduct. They include risk metrics, conduct-related complaint data, issue escalation and resolution data, human resources (HR) data and reports, whistleblower reports, turnover data, ethics hotline reports, unstructured social media data, and employee demographic data. These and other metrics should be used as supplements to performance measures linked to the strategy to drive the type of organization that management and the board would like stakeholders to experience when they interact with it. These metrics should also supplement insights from surveys and direct interactions with stakeholders.

In summary, the organization’s directors and executive leadership need to seek out and understand the facts regarding the organization’s current culture and whether there are any aspects requiring improvement. And they need help. Surveys, stakeholder interactions and evidential matter offer a forward-looking view of the organization’s ability to foster a sound culture.

Culture Assessments and Audits: Essential Tools of the Trade

Directors and executives can most certainly use “eyes and ears” focused on culture in the organization. Otherwise, how can they know the real and perceived culture at all levels of the entity?

As culture presents another risk, business unit leaders and process managers own it. Therefore, the first line of defense is responsible for assessing culture consistent with its responsibility to nurture and sustain it. The CRO, CCO, CISO, HR, EH&S and other second line functions may help with the assessment. The third line — internal audit — may perform a culture audit taking into account the processes used across the entity by first and second line personnel to assess culture. The point is, everyone has a stake in evaluating the enterprise’s culture.[8]

Internal audit can conduct a stand-alone audit and issue a report on the entity’s culture. Alternatively, internal audit can incorporate culture points of focus into existing audits. By “connecting the dots” through analyzing the data points and results obtained across multiple audits to identify culture-related themes and trends, internal audit can bring useful insights to the C-suite and boardroom — particularly if the adequacy of the assessments of the first and second lines is considered in planning its activities. Furthermore, internal audit can connect the observations of second line functions with its own to offer a more comprehensive view.

The points of focus supporting each area of emphasis enable internal audit (as well as second line functions) to evaluate employee awareness, misconduct reporting channels, pressure points, disciplinary measures, and employee perceptions of the tone at the top, in the middle and at the bottom. In the case of internal audit, culture-related observations can be summarized across multiple audits and a roll-up report issued. The above is one approach; there are others.

The importance of continuous assessments by executive and operating management and second-line-of-defense functions cannot be overemphasized, as an organization’s culture can evolve in subtle ways as the environment changes. Internal audit is uniquely positioned to augment these assessments by evaluating their effectiveness and addressing any gaps in scope.


Leaders should demand more of the first and second line functions as well as of internal audit. Culture assessments and audits can provide useful feedback.


Take performance incentives under the “people management” theme noted above. Do they reinforce the desired culture? Are there conflicting metrics requiring clarification, such as cost and schedule versus safety metrics? In other words, are competing priorities creating confusion as to the appropriate behavior in stressful times or when difficult decisions must be made? Do rank-and-file employees really believe the performance expectations their leaders set for them are realistic? 

We acknowledge that the compensation committee of the board considers these matters and the executive committee discusses them when evaluating performance metrics. But do they really know what’s happening when the rubber hits the road on the front lines? Directors and executives have the opportunity to insist that the audit plan includes further insights for them to consider.

In summary, it’s time to rethink who is responsible for evaluating culture. Leaders should demand more of the first and second line functions as well as of internal audit. Culture assessments and audits can provide useful feedback on the tone in the middle and at the bottom. Leaders can then assess the findings and evaluate opportunities to improve or reshape the culture on a proactive basis.

Impact of Decision-Making Dynamics

Decision-making processes are the ultimate test of corporate culture. When reviewing the reputation-damaging outcomes of flawed decisions, one wonders if a different decision would have been reached had a simple rule been applied:

Conduct the decision-making process as if the company’s stakeholders were observing.

There are two corollaries of this rule:

  1. Make sure the decisions reached are defensible once the organization’s stakeholders know what’s been decided.
  2. Never assume the decision and its attendant consequences won’t ever be displayed for all to see.

In essence, leaders and managers should make decisions as if stakeholders were in the room. If the organization displays its expressed core values with pride, its leaders should model them. Accordingly, if a decision will cause the management team to “stop the show” and engage in damage control once the sunlight shines on it — meaning the public, regulators, investors and legislators learn about it — then someone has to ask, “Why do it?”

For the CEO and the board, the critical test occurs around what their people do in situations when no one is watching, at least for the time being. Corporate decision-making processes should air out the concerns of those being paid serious money to bring rigor and discipline relevant to the process. Do leaders and managers want everyone with a relevant point of view to have a voice in the process? Can they handle contrarian views? Can they process bad news? If not, they have serious issues of their own. They should ensure the process enables all key stakeholders to be heard. And everyone engaged should speak up, because that is why they sit at the table.

In the corporate environment, it’s not unusual for groups to form opinions, embrace biases, or make decisions without having engaged in robust debate or listened to dissenting views. Many argue that diversity of views is of vital importance to the decision-making process. In his letter to CEOs in January 2018, the chair and CEO of BlackRock, Larry Fink, pointed to the importance of a diverse board:

Boards with a diverse mix of genders, ethnicities, career experiences, and ways of thinking have, as a result, a more diverse and aware mindset. They are less likely to succumb to groupthink or miss new threats to a company’s business model. And they are better able to identify opportunities that promote long-term growth.[9]

This sage observation applies to management as well. Our own annual risk survey — which we’ve conducted for the past six years — consistently points to the diverse views on significant risks and opportunities among C-level executives and directors across the globe.[10]That is why efforts should be made to ensure all views are heard from the right sources and carefully considered.

All this is undermined when data is structured to fit a preconceived conclusion, sole reliance is placed on the most dominant people in the room, the past is inappropriately extrapolated into the future, false security is drawn from probabilities, a singular view of the future is imposed upon the dialogue, dissenting viewpoints are suppressed, and bearers of bad news are made to wish they hadn’t spoken up. Leaders should instead:

  • Encourage creative thinking about what the organization doesn’t know
  • Create focus around the customer experience
  • Channel the enterprise’s collective genius toward pursuing innovation opportunities
  • Recognize the limitations of consensus and that the time required to achieve consensus, assuming it’s possible, can slow things down
  • Encourage expression and consideration of alternative views

And if they don’t do all the above, they risk losing touch with business realities in a rapidly changing world.

In summary, does the company’s culture emphasize treating people with respect and support individuals who challenge something they believe is wrong or not safe? Are great ideas for improving or reimagining processes and functions given serious consideration, or are they ignored or suppressed? Being risk-averse in circumstances in which serious mistakes are about to be made, even in the face of significant organizational or peer pressure, should be encouraged and the appropriate decision-makers brought to bear through escalation. Corporate culture can be a powerful force for making a business a better corporate citizen as well as a stronger competitor.

What Gets Communicated, Measured and Reinforced Matters

Times are changing. Digital transformation, with its attendant implications to the business model and workforce, is the order of the day. Some companies are experiencing rapid growth, while others are downsizing. Many companies are revisiting their strategies. Merger and acquisition activity remains high. These and other factors can have an important impact on corporate culture.


Make decisions as if stakeholders were in the room. If a decision will cause management to “stop the show” and engage in damage control once the sunlight shines on it, then someone has to ask, “Why do it?”


The consensus of the directors in the aforementioned roundtable was that boards should encourage and, if necessary, push management to consider culture-related measures and come forward with an approach that makes sense. It’s that important. As one director noted, “What gets measured matters.” To that end, they recommended that the board insists on engaging HR proactively in the process so that, when culture issues surface, progress is made toward identifying the root cause and the function isn’t an impediment during the change process.

The CEO, senior management team, unit leaders, chief ethics and compliance officers, and other second line functions should regularly communicate and reinforce the essential aspects of the corporate culture in appropriate forums and with consistent messaging aligned with the tone set at the top. They should consider the cultural implications of significant internal and external events and major adjustments to the strategy, and plan accordingly. Onboarding of new hires should emphasize the importance of the enterprise’s culture and reinforce its attributes. In addition, the board should be engaged to ensure directors are on the same page with management in understanding, measuring and reinforcing the corporate culture and in authorizing others to assess and audit it.

Summary: Is There Enough Curiosity?

Corporate culture is important; everybody gets that. What is not as universally understood — at least, in action — is that the top-down emphasis on responsible business behavior in any organization is only as strong as its weakest link. In the end, the actions and deeds of managers up, down and across the enterprise either reinforce or undermine the tone articulated by executive and line management through policies and other communications.

Every CEO — and his or her board — knows alignment is one of the top executive’s most formidable tasks. Reputation and brand image are not sustainable without steadfast commitment from the entire organization to deliver the underlying promises, expressed or implied.

This alignment is either supported or undermined by the organization’s culture. A strong, positive corporate culture may be one of the enterprise’s most important strategic assets in driving innovation, quality, safety, diversity, disruptive change and other opportunity pursuits. Management consultant, educator and author Peter Drucker summed it up well: Culture eats strategy for breakfast.

Drucker argues that, as an equal player in the game with strategy and performance, the power of a strong culture should be harnessed for competitive advantage. We agree. We also believe that culture does not remain static in a rapidly changing world. Accordingly, directors and executives should embrace a proactive agenda to understand, measure and reinforce the corporate culture with an intent to improve it continuously when circumstances warrant.

So, we end as we began: When it comes to corporate culture, are you curious enough?


[1]Former Penn State President Found Guilty in Sandusky Abuse Case,” by Jess Bidgood and Richard Pérez-Peña, The New York Times, March 24, 2017.
[2]Volkswagen Says 11 Million Cars Worldwide Are Affected in Diesel Deception,” by Jack Ewing, The New York Times, September 22, 2015.
[3]The Volkswagen Scandal Shows that Corporate Culture Matters,” by Robert Armstrong, Financial Times, January 13, 2017.
[4]See Issue 102 of Board Perspectives: Risk Oversight, “Sustaining an Innovation Culture in the Digital Age, “ April 2018 .
[5]This definition was derived from one adopted by the Risk Management Association (RMA) and Protiviti in Risk Culture: From Theory to Evolving Practice, 2013.
[6]Board Oversight of Performance Management,” Board Perspectives: Risk Oversight, Issue 100, Protiviti, February 2018.
[7]Ibid.
[8]We use the term “audit” to differentiate what internal audit does from the ongoing assessments by first and second line personnel. This distinction is important in some sectors, particularly financial services. We acknowledge that some may prefer “assessment” in describing the work of internal audit with regard to culture.
[9]Larry Fink’s Annual Letter to CEOs: A Sense of Purpose,” .
[10]Executive Perspectives on Top Risks for 2018, Protiviti and North Carolina State University’s ERM Initiative, December 2017.

(The Bulletin - Volume 6, Issue 12)

Click here to access all series