Leaders looking squarely to internal audit for the right risk culture

Executives and senior managers are increasingly looking to internal audit leaders to help their business develop the right risk culture. The trend is providing the internal audit function with a clear opportunity to play a transformative role in responding to the evolving needs of key stakeholders, particularly board members, who want assurance that the organisation is aware of and addressing all types of potential risk.

The global financial crisis a decade ago showed the world that maintaining a strong culture is an imperative for all major businesses – as well as an expectation by their stakeholders. According to Protiviti’s 13th edition of its annual ‘Internal Auditing Around the World’ report series, organisations are, in a bid to ensure they have the right risk culture in place, looking squarely to their internal audit functions to provide assurance on the matter and its effectiveness. 

Leadership is looking to the audit function to assess not only the tone and conduct at the top of the organisation, but also how and if those things are reflected throughout the business. They want to know if the company’s core values and strategic vision are understood and actively practiced by employees. 

“Culture is complex and different within every organisation and remains largely abstract,” said Brian Christensen, an Executive Vice President at Protiviti. “However, even though a company’s culture may be abstract, one thing is clear from an internal audit perspective: developing the right approach for auditing an organisation’s risk culture takes time and careful planning.” He added that fulfilling the mandate requires internal auditors to tread carefully and adhere to a well-structured approach. 

The consulting firm builds its view on proprietary research and dozens of years of experience in the field. Leveraging the findings, Christensen said that Protiviti learned that, across the board, executives agree that evaluating – or even resetting – processes for their audit teams can improve risk culture across the overall business enterprise. 

While executing their plans, internal audit leaders are taking great pains to formalise the auditing of company risk culture by creating and applying well-structured methodologies, frameworks and processes. While some internal audit groups are going for a major transformation approach, others are taking more incremental steps toward formalising an approach to assessing and monitoring  risk culture. A large bank for instance recently modified its quarterly enterprise risk management dashboard to include a specific line for culture.

The report, which profiles detailed culture cases at 15 large organisations, including the likes of Deutsche Bank, T-Mobile, Abu-Dhabi National Oil Company and Aegon, among others, further provides a range of tips about how internal audit leaders can advance their maturity by embedding cultural facets into their operations.

The report, which profiles detailed culture cases at 15 large organisations, including the likes of Deutsche Bank, T-Mobile, Abu-Dhabi National Oil Company and Aegon, among others, further provides a range of tips how internal audit leaders can advance their maturity by embedding cultural facets into their operations.

“As the objective eye of the organisation, the internal audit function is uniquely qualified to bring a systemic, disciplined approach to a potentially subjective process,” concluded Christensen.