The issue of auditing culture first came to the attention of internal auditors several years ago. It then took on a life of its own, with first the IIA referring to internal audit, including within its scope the risk and control culture of an organisation in the July 2013 publication Effective Internal Audit in the Financial Services Sector

More recently, the FRC makes reference to the 'embedding of culture and what assurance boards require to confirm that it has happened' in their recent publication Guidance on Risk Management, Internal Control and Related Financial and Business Reporting.

Cultural failure is considered to be the root cause of many of the recent ‘crises’ that have come to the public’s attention, whether in the financial services, NHS, oil industry, and probably the recent Tesco problems. Internal audit need clarity on what they should be doing on this subject, but have been unable to find anything approaching a practical solution.

ACCA UK internal audit network conference

At the ACCA UK internal audit network conference on 15 April 2015, speakers from Protiviti, PwC, the Institute of Business Ethics and Barclays shared their views on how internal auditors should approach the auditing of culture. You can watch three of the presentations and a group Q&A session, simply select which one you want to view:

Philippa Foster Back CBE: Setting the scene
Lindsay Dart: Auditing cultural risk: a proposed approach
Mark Dury: Culture and behaviours
Group Q&A session