This article was first published in the June 2015 UK edition of Accounting and Business magazine.

Since the financial crisis, scrutiny of behaviour within the business world has continued to grow. Regulators have striven to put rules and mechanisms in place to head off corporate and reporting failures. Yet high-profile public and private sector organisations, from the NHS to Tesco and the Co-operative Bank, have still taken hits to their reputation. ‘We are very much still in a world where there is a lack of trust between the corporate world and the public,’ says Ewan Willars, director of public policy at ACCA.

With the Financial Reporting Council’s revisions to the Combined Code, the importance of corporate culture is now firmly under the microscope. ACCA’s own work in this area includes a joint research project with the UK’s Economic and Social Research Council encompassing a CFO survey, literature review and numerous roundtables. One view that echoes across research by ACCA and ESRC, Culture and channelling corporate behaviour, is that when organisations take steps to set, measure and assess their culture and values, they need an approach that works across the organisation – one that doesn’t encumber it unnecessarily. ‘There is an argument that rules are part of the problem,’ says Willars.

This new focus on assessing corporate culture puts internal auditors firmly in the frame. Speaking at a conference in April entitled ‘Auditing culture: Exploring culture outside the Petri dish’ organised and attended by members of ACCA UK’s Internal Audit Network, Philippa Foster Back, director of the Institute of Business Ethics, argued that analysing corporate culture is a natural extension of the work of the internal audit function. ‘Internal audit has the capacity to go into every part of the organisation and to impose a rigour to cultural audit – one that will be beneficial to the organisation,’ she said.

The issue of how companies set about auditing culture has been a particular focus of Barclays Internal Audit in the last two years, says its director of internal audit, Toby Whinnett.

Incoming Barclays CEO Antony Jenkins has put embedding a clear set of values front and centre across the entire company. Barclays has also focused on measuring business and individual performance against those values.

The internal audit function has developed tools to support a value-based performance assessment, Whinnett explains. ‘Historically, we have formed an opinion around how well management mitigates inherent risk.’ To support embedding the right culture, Barclays Internal Audit has begun measuring management’s approach to managing risk. This has proved powerful in providing senior management with a view on risk and control culture across the group.

There is a simple scoring system for assessments of risk and control culture – performance is rated as satisfactory or less than satisfactory. This will evolve as the assessment process matures. However: ‘This really drove matters and got people’s attention,’ says Whinnett.

Agreeing on a definition of culture and an approach for assessing how it interacts with behaviour, risk awareness and performance is a challenge, says Willars.

What is more, any clear-sighted assessment of culture needs to take into account that it may be uneven throughout the organisation. ‘It is more than the tone at the top, middle and bottom,’ says Lindsay Dart, managing director at internal audit and risk assurance company Protiviti. It is more to do with whether cultural values and assertions from the top are communicated and lived up to throughout the organisation. ‘It’s about how you behave in order to survive; how people behave when no one is watching.’

To capture that, Dart advocates using an established methodology for auditing culture, such as the Denison Model. ‘Unless you measure it, you can’t possibly manage it,’ he says.

But if corporate values are to be meaningful and measurable, those values themselves need to be specific and tangible, says Mark Dury, senior manager, culture and risk assurance at PwC. ‘If you are setting corporate values, you will need to be clear what they actually mean for an employee as an individual. Evaluating whether values and behaviours are aligned is more straightforward as a result,’ he says. ‘It is much more tangible than discussing the good or the bad.’