Features
6 May 2015 11:24am

Auditing corporate culture

The regulators are turning their spotlights on corporate culture. But what does that mean and can – or should – it be audited? Caroline Biebuyck finds out

The regulators are busy mopping up the latest round of post-crisis scandals. Tesco’s apparent overstatement of profits by £263m last year caught the attention of the Financial Reporting Council (FRC). The Serious Fraud Office also has Tesco in its line of sight and is currently in talks with HMRC on how to proceed over allegations of tax evasion by customers at HSBC’s Swiss subsidiary – this latter being just the latest in a long, sorry tale of banking scandals on both sides of the Atlantic.

With these problems being blamed on corporate culture the regulators are starting to take an interest, with the FRC considering how the board assesses culture and whether it needs to be reviewed by an independent party.

This is driven by a need to protect investors, who have an interest in understanding a company’s ethos and how that shapes its operations.
“Corporate culture has always been important, particularly to investors in for the long term,” says Jo Iwasaki, ICAEW head of corporate governance. “What has changed is that it’s more widely seen as an important indicator for successful businesses.” A first step for institutional investors in finding out what the company says about its culture is through its annual report.

Your intitial view about culture becomes becomes a filter through which you see the organisation

Jo Iwasaki

Most typically spend time talking to senior managers who have a sense of the organisation’s culture in operation and observing whether the company’s assertions match its deeds.

“It’s not enough for a company to say it’s doing the right thing – it has to do it,” says Frank Curtiss, head of corporate governance at pensions firm RMPI. “This isn’t easy to measure if you are an outsider.” Iwasaki adds: “Your initial view about culture becomes a filter through which you see the organisation. Through this filter you determine how you act, the questions you ask, and how trustworthy you think the company’s numbers, or even the board, are.”

Some companies seem to have high levels of integrity and what they say is taken on trust. But this isn’t the case with all companies or with different sectors; not surprisingly, there is a great deal of scepticism currently about banks. “Frankly, banks are unpopular,” says Curtiss. “They have gone through enormous problems, some of their own making, and public trust in them is low. Antony Jenkins has specifically made the culture of change and values a part of his mandate at Barclays; other banks are trying to do this, with varying degrees of success.”

Auditors have a slightly different take from investors as they need to consider the company’s culture as part of its controls environment in their audit planning and risk assessment. One challenge is that corporate leaders do not always understand what the culture really is, (such as the recent example of the HSBC chairman, who claimed that the group’s complex structure meant it was impossible for board members to know how its different businesses were operating).

This is a common problem in many companies, thinks David Herbinet, global audit leader at Mazars. “There is often a disconnect between what really is happening on the ground and what the board believes is happening on the ground,” he says. “Sometimes there are the best intentions from the top but then you realise that employees’ incentives contradict the message from the leadership.”

Growing interest in this area is driving a great deal of analysis into how to rigorously assess corporate culture with a degree of audit methodology, says Hywel Ball, managing partner for assurance at EY. “This will happen in two ways,” he says. “One is a specific service, in which the external auditors give directors some level of assurance that the culture they believe is in place at board level is actually being promulgated throughout the organisation. Then I think you will see best practice starting to move into how auditors adopt the same sort of thinking into their external audit.”

Henry Irving, head of ICAEW’s Audit and Assurance Faculty, questions whether culture could explicitly be covered by statutory audit. “You would have to have a public statement in place to say what companies report on their culture first,” he says. “The management reporting would have to use robust, neutral and measurable criteria to be measured against, and these would need to be consistently applied. It would be difficult to audit these robust criteria without having a tick-box culture.”

Instead he prefers the approach already being used by some companies in which audit firms undertake private engagements to give some kind of assurance to management over culture. (The Faculty’s publication The journey milestone 2: assurance over risk disclosures gives a guide to this subjective topic.)

Mazars uses an audit methodology to look at tangible aspects of 12 areas of culture, which can be audited in an evidence-based manner: these areas include structures and functions, vision and values, responsibilities and incentives.

“We then say to the board, this is how we have assessed your culture based on what we have observed, not on what you think the situation is,” says Herbinet.

Bavan Nathan, internal audit director at KPMG, says while auditing established metrics is fairly straightforward, because these can be tested against established expectations, the problem comes in looking at the more nebulous aspects of culture, such as sub-cultures within departments, countries or even within a process.

“We try to approach that aspect of culture using terms such as honesty, transparency and collaboration – none of which are definable or measurable in absolute terms,” Nathan says. “So how do you audit these? The challenge from the external audit perspective is that yes, you will get a gut feeling and some insight, but how much rigour can be put into that?”

Nathan thinks it is up to the audit committee and board members to start asking questions around culture, using the insights gained by the internal and external auditors. “Board and audit committee focus on the auditor insights on culture will lead to management increasingly seeking feedback from auditors,” he says. “There will be a ‘permission’ to discuss auditors’ insights on culture.”

This puts the focus on culture firmly where it belongs: with the board. “Training and systems and processes all contribute to having the right culture, but it starts with leadership,” says Irving. “It’s very convenient for business leaders to say: it’s not our fault, the system broke down. Phrases like having a ‘bad apple’ or a ‘team with the wrong culture’ are simply an abrogation of responsibility by business leaders.”

Curtiss agrees. “The board sets the aspirational values and management needs to implement that, so employees have to accept and believe in the tone from the top. We constantly hear executives saying they couldn’t possibly know everything that went on in their organisation, but this doesn’t wholly wash. Better focus on risks, better controls and a good internal audit function will help bring better early warnings to the audit committee and the board.”

Does Curtiss think the external auditors should be looking at culture? “Evaluating culture is quite complex,” he says. “There’s a big behavioural element of looking at the effectiveness of controls that the auditor has to take into account. But I think the broader issue of culture and the public regard for the business is best investigated and evaluated by a different discipline. That’s not to say that audit firms won’t acquire these disciplines, but I don’t think they are there yet.”

Some audit firms are already looking at what they need to do to equip staff with the skillsets to combine assurance with areas such as psychology, sociology and human resources. In time, combining these skills on an audit might be a necessity. “I think we are going to see many developments on what auditors opine on,” says Ball. “The question is whether culture will get wrapped into the external audit opinion to become part of the overall assurance on the annual report. The way regulation is going, I think it will.”

Herbinet agrees that culture will become a more prominent part of the landscape for external auditors. “They will have to come up with views and ideas about this. But I would hope we will not allow the regulators to tell us how this should be done as I’m not sure more standards would help here.”

Caroline Biebuyck

 

Related articles

CEOs should be brave enough to lead on corporate culture

Boards should audit own company culture

What should companies be responsible for?

Back to basics for boards

Topics