4 Oct 2018 01:39pm

Auditing culture

As the post-mortem into Carillion’s demise runs on, a joint inquiry by MPs from the Business, Energy and Industrial Strategy Committee and Work and Pensions Committee in May said a rotten corporate culture was both “responsible and culpable” for the construction giant’s catastrophic failure

audit culture 630
Caption: Why having a healthy mindset can be a great source of competitive advantage

In a damning indictment, Work and Pensions Committee chair Frank Field described the board of directors as “too busy stuffing their mouths with gold to show any concern for the welfare of their workforce or their pensioners”.

The significant role that culture plays in business failure is well-documented and by no means new; cast your mind back to the global financial crisis of 2007/08 and the excessive risk-taking ethos that led to Lehman Brothers’ collapse.

A decade on and misselling of financial products including PPI has put the cultural integrity of banks under the spotlight, but this is not a financial services-only phenomenon. From charity Save the Children to retailer Sports Direct and gig economy poster child Uber – they have all made headlines for the wrong reasons after the culture at the organisations was exposed as toxic.

Given the risk that corporate culture presents, and bearing in mind that boards already have a responsibility to establish the culture, values and ethics of the company under the auspices of the UK Corporate Governance Code, it stands to reason that cultural audits should be an established part of the risk management strategy. And yet few organisations have formalised processes for understanding the cultural pitfalls they face and recognising the tell-tale signs of cultural malaise.

The trick is to nip any cultural issues in the bud before they develop into an issue that could destroy the business, advises Mark Stock, a risk assurance partner
at PwC and former group audit director at Vodafone. Stock is also vice chair of ICAEW’s Internal Audit Panel, a working group that has published a paper offering practical advice on auditing culture. “When culture starts eroding gradually, you can discover and repair it, but once it falls off a cliff it can take years to get it back,” he says.

Recognise the benefits of auditing culture

Your espoused values and standards describe how things get done, the feel of your work environment and the way people treat each other in your organisation – from boardroom behaviour to water cooler chat. At a time when trust in business is at an all-time low, having the right culture can be a source of great competitive advantage.

Whether or not you believe that management guru Peter Drucker ever actually said “culture eats strategy for breakfast”, experts maintain culture is critical to long-term business success. A study by Denison Consulting in the US found businesses with high scores on culturally-related criteria such as mission and employee involvement had significantly higher returns on assets and sales growth rates compared with organisations with low scores.

“A strong cohesive culture can help organisations to deliver long-term growth and reduce risk,” says Hywel Ball, EY’s UK head of audit and assurance managing partner. “Where people are aligned around the organisation’s purpose and values, they are more likely to make the right choices when faced with a difficult decision, even if it may not always be the easy thing to do as targets may be missed.”

The culture example set by a board or shareholders needs to support their vision, mission and strategy, warns Anthony Carey, partner and head of board practice at Mazars and a member of the FRC’s Financial Reporting Lab Steering Group. Carey was also project director for the original Turnbull Report dealing with risk management and internal control. “If top management does not buy into reviewing, demonstrating and fostering a corporate culture for longer term success, a review will be nearly impossible,” he says.

Have clear objectives

Culture is open to many different interpretations so it is essential you determine exactly what you are assessing. Are you looking to be a barometer of the organisation’s culture or to provide insights into a specific aspect of the business? This will in turn dictate which approach to auditing culture will be most suitable for your organisation. Either way, a common auditor perspective gives a consistent view, Stock says.

Alison Smith, internal audit director at Barclays, says it is helpful to define the types of behaviours that you expect to see at play within the organisation – how people act towards each other and to customers. “This has the benefit of translating an intangible, amorphous concept such as culture into tangible behaviours and actions that can be observed.”

It’s vital that enterprises understand organisational culture isn’t a goal but an operational side effect that is difficult to change, says John Palmiero, senior vice president of EMEA at governance, risk and compliance specialist MetricStream. “Rather than trying to audit whether a company’s predetermined values have stuck, assessing what kind of culture a business actually has will be infinitely more useful. Doing a culture audit in this way means organisations can find out, irrespective of company taglines, who they really are.”

Lost in translation

Cultural issues are symptomatic of a gap between the cultural utopia expressed by the CEO and board and the reality experienced at the coalface. Those at the highest levels may not be aware of cultural discontent bubbling below the surface. Culture is less about the tone from the top and more about the tone in the middle. “Often middle managers converting strategy into objectives translate the values and put a filter on what is important and what isn’t,” Stock says. “The ability to audit these people can be very powerful.”

“It’s about getting a sense of the organisation. You can interview the top team but you also need a broader perspective to capture culture and that takes time to be seen,” adds Nadeem Khan, lecturer in governance, policy and leadership at Henley Business School.

Take a risk-based approach

Culture touches every part of a business but it’s not possible to audit every single aspect of an organisation’s activities in one go. Instead, a risk-based approach that hones in on areas most likely to cause cultural problems should be employed – things like sales commission structures, geography idiosyncrasies, a transient workforce. Focus should also be on areas where KPIs suggest cultural risk seems to be materialising, such as poor engagement scores or high turnover of leaders. Root cause analyses will ensure issues identified relate to a cultural breakdown.

Smith says a multi-faceted approach to assessing culture that brings together both quantitative and qualitative data points that already exist can help give the board and senior management an insight into the culture of the organisation, and will help to build a picture of what is important. “For example, at Barclays, we might measure responses to employee opinion surveys on how comfortable people feel about raising issues and review data on how quickly issues get unearthed, escalated and resolved.”

Have a resource strategy

Whichever way you approach culture audits, there will inevitably be an element of behavioural psychology involved in the process. Training internal audit teams to incorporate culture audit objectives into their everyday activities is time-consuming and it may be appropriate to turn to specialist skills while building up competency.

Another option is hiring specialists in organisational psychology, people and change, HR and organisational design. Specialist teams provide credibility quickly but can be expensive. There’s no right or wrong way, but whatever your approach, be explicit.

Culture audits based on observed behaviours may well take internal auditors out of the comfort zone of financial and operational audits and detailed testing of controls, “however, that does not mean we shouldn’t express our opinion and have an open discussion with management about what we’ve observed”, Smith says.

“Start with something people are more comfortable with such as looking at the risk culture,” suggests Liz Sandwith, chief professional practice adviser at the Chartered Institute of Internal Auditors (CIIA).

Adapt reports, internal and external, to encompass culture

Reporting on culture requires an element of judgement and understanding of the dynamics of an organisation. Therefore some thought needs to go into the way that you bring these points out in internal audit reports.

“You have to seek to take the emotion out of the assessment,” Stock says. Depersonalise culture reports by talking more in terms of ‘observations’ than ‘findings’.

“If you can distil culture audits to a tick-box approach it probably won’t capture what the culture is,” warns Fiona Czerniawska, a director of Source Global Research.

Shareholders, regulators and investors are hungry for new and greater insights on a much wider range of non-financial matters, including a company’s culture, yet these are largely absent from most corporate reporting.

“Companies that seek to close this expectation gap are likely to be at an advantage when it comes to attracting investment. And since shareholders and investors may be seeking proxy information on organisations’ cultures from other sources, they also likely to regain some control over how their company is perceived,” says EY’s Ball.

Ensure culture audits don’t become shelfware

There is little point in going through the motions of a culture audit unless any problems unearthed are acted upon, fed up to the leadership team and result in change on the ground. “The challenge for Internal Audit is that too often the attitude is that the job is done when the report is published,” Stock says.

If the findings of a culture audit are not acted upon, staff engagement will suffer and there will be a lack of buy-in for future audits. The board, audit committees and other stakeholders must be prepared to accept the findings and to change the culture if need be, Sandwith says.

This isn’t about doing a one-off audit, warns Susy Roberts, founder of organisational change consultancy Hunter Roberts. “It has to be a living process with the senior leadership team reviewing what’s changed and where the culture barometer has moved positively.”

A culture audit and review will not be able to eliminate risk completely for much the same reasons that it is difficult to prevent individuals from committing fraud in companies, Carey warns.

But if it helps companies identify and prevent cultural trends that could morph into the next Carillion, that can only be a good thing.

An ICAEW guide offering practical advice on how to audit culture is available at icaew.com/auditculture