As the Institute of Directors notes, an organisation’s culture comprises shared values, beliefs, and assumptions about how employees behave and interact at work (IoD, 2024). According to the IIA, all organisations have a culture, whether intentionally created or not. This includes potential subcultures within an organisation, which are most likely to occur in a geographically widespread organisation. Although Internal Audit generally falls under the third line of defence in most organisations, Internal Auditors are still employees of the organisations and are influenced by the organisation’s culture (IIA, 2024). The question is to what extent the organisation’s culture impacts the effectiveness of an independent Internal Audit.
Purpose of Internal Audit
Internal Audit (IA) has been defined as an independent, objective assurance and advisory service designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic disciplined approach to evaluate and improve the effectiveness of governance, risk management, and control processes (IIA, 2024).
Per the definition, the IA function is to provide value and to improve an organisation’s operations. How the value provided and the improvements recommended are taken on depends on the organisation's culture.
Work Culture
An organisation can have a positive or negative work culture. A negative work culture is colloquially referred to as a toxic work culture. Per the definition, “Culture represents the invisible belief systems, values, norms, and preferences of the individuals that form an organisation. Conduct represents the tangible manifestation of culture through the actions, behaviours, and decisions of these individuals.” (St-Onge et al, 2018)
A positive work culture can be indicative that an organisation has strong core values. Organisations may predefine their core values as part of their mission and vision, outlining the type of organisation they aim to be and what they aim to achieve. Core values may be promoted by senior leadership and driven down through the organisation's governance; however, it is employees who ultimately drive the organisation's core values forward. Core values reflect the values employees bring to the work environment, shaped by their worldviews, beliefs, and experiences. It is then essential that leadership is selective in the employees they hire to ensure a good cultural fit in the organisation. Cultural fit occurs when employees feel connected to the organisation's values and understand the business's needs. Good cultural fit ensures staff retention, employee engagement, performance and productivity, team cohesion, and strong communication (Benstead, 2023). In today’s highly competitive environment, it is clear that employees’ expectations of organisations are closely tied to their values. For organisations that deliver on an employee’s expectations, this results in more loyal and productive employees, ultimately leading to organisational success (Laker, 2021).
A negative work culture is where behaviours such as manipulation and bullying are innate to the culture of the organisation, where low productivity, lack of trust, high stress levels, infighting and discrimination become the norm, resulting in employees feeling psychologically unsafe (Sandhu, 2024). A negative work culture, if left unmanaged, can spread quickly, like a rotten apple in a barrel. A negative work culture has become a significant concern for many organisations, as their culture can sway the organisation's success. Some signs of a toxic work culture include unfair treatment or discrimination, limited growth opportunities, a lack of workplace trust and support among team members, excessive workload and unrealistic expectations, poor communication and lack of transparency, ineffective leadership, and high employee turnover, to name a few (Hastwell, 2023). Although companies may develop a toxic work culture, there are ways to improve and foster a positive one again. For leadership, such steps would include rebuilding trust in the organisation. With organisations taking accountability for past mistakes and current issues, and staying consistent in the right places for employees, a positive work culture can be rebolstered. (Hastwell, 2023)
Impact on Internal Audit
It is sensible to assume that in a positive work culture environment, the value and insights provided by IA to an organisation would be accepted and improvements implemented following observations raised by IA.
However, within a toxic work culture, IA may experience one or more threats to their independence. A toxic work culture hinders and undermines the IA by deterring honest reporting, increasing burnout, fostering cover-ups, and making the IA unwilling to challenge leadership or report real risks due to potential retaliation. This, in turn, may create a culture of silence and check box auditing rather than proper risk management, exposing IA to governance and fraud risks (Flying colour, 2023). As outlined in the IIA's Auditing Culture Global Practice Guide, a toxic organisational culture corrodes the effectiveness of an organisation's controls (IIA, 2024).
An organisation's culture is the responsibility of the board of directors and senior leadership, as is the management of the organisation's risks and controls. Highlighting their role can empower leaders to feel confident in their ability to shape a positive environment. It is therefore the responsibility of the board of directors and senior leadership to set the tone at the top for the implementation of a positive work culture (IIA, 2024).
The board of directors and senior leadership may request that IA provide insight into an organisation's cultural temperature through an assurance or advisory engagement. Emphasising the value of these insights can motivate leaders to seek and trust IA's input on cultural matters actively. Such insights can include identifying the root causes of the development of a toxic work culture, assessing the governance structure related to culture, assessing the modes and means of communication in the organisation, and assessing the organisation's culture-related training, to name a few. (IIA, 2024)
Conclusion
Ultimately, organisational culture plays a pivotal role in determining whether IA can operate effectively and deliver meaningful value. While the responsibility for establishing and maintaining a positive culture rests with the board of directors and senior leadership, IA has a critical role in providing independent insight into cultural strengths and weaknesses. A positive culture enables open challenge, supports auditor independence, and reinforces robust governance and risk management. In opposition, where a toxic culture exists, both the organisation and the IA function are exposed to increased governance, compliance, and fraud risks. By proactively assessing cultural drivers and communicating open observations, IA can support leadership in addressing underlying issues and strengthening the control environment, thereby safeguarding the organisation’s long‑term resilience and integrity.
References:
· Institute of Directors (IoD), 2024, Organisational culture | Factsheets | IoD
· IIA, 2024, Auditing Culture, Global Practice Guide: Auditing Culture, 2nd Edition | The IIA
· IIA, 2024, Global Internal Audit Standards 2024, Complete Global Internal Audit Standards
· St-Onge, Elizabeth, Ege Gürdeniz, and Elena Belov. Measuring Conduct and Culture: A How-To Guide for Executives. New York: Oliver Wyman, 2018. the-relationship-between-organizational-culture-and-turnover-intention-a-literature-review-study.pdf
· Harvard, 2023, Why Workplace Culture Matters - Professional & Executive Development | Harvard DCE
· Benstead, S., 2023, Breathe, What is cultural fit and why is it important? | Breathe Blog
· Laker, B., 2021, Forbes, Culture Is A Company’s Single Most Powerful Advantage. Here’s Why
· Sandhu, P., 2024, The Muse, 9 Signs You’re in a Toxic Work Environment—and What to Do About It | The Muse | The Muse
· Hastwell, C., 2023, Great place to work 8 Signs of Toxic Company Culture That Drive Employee Turnover | Great Place To Work®
· Flying Colour, 2023, Importance of Auditor’s Independence, Threats and Consequences of Compromised Independence - Flying Colour Tax
