Culture is a governance issue, not just an HR matter

Reviews of high-profile corporate failures frequently identify cultural factors as important contributors. The collapse of Enron highlighted issues around incentives and behaviour. Volkswagen's emissions scandal raised questions about challenge and oversight. The Theranos case drew attention to transparency and the handling of dissenting views. Carillion's failure prompted scrutiny of governance, risk management and organisational decision-making. 

While each of these examples had different causes, culture featured prominently in subsequent reviews and investigations. It influenced what individuals prioritised, how concerns were raised and addressed, and how decisions were made. 

For many years, internal auditors observed indicators of cultural weakness but often hesitated to report explicitly on culture, concerned that such observations could be viewed as subjective and outside the traditional boundaries of audit assurance. 

This position has evolved significantly in recent years. Updated governance requirements and professional standards increasingly recognise culture as a factor that can influence risk management, internal control and organisational performance. 

Culture as part of the control environment 

Culture influences the environment in which controls operate. It can affect: 

• Whether people raise concerns when issues emerge. 
• How consistently policies and procedures are followed. 
• How decisions are made under pressure. 
• The extent to which challenge and constructive debate are encouraged. 
• Whether informal workarounds become accepted practice. 
• How closely everyday behaviours align with organisational values. 

The UK Corporate Governance Code 2024 increases expectations around internal control, including a requirement for boards to confirm the effectiveness of material internal controls through Provision 29. This reinforces the importance of culture as a governance consideration. If behavioural norms undermine the operation of controls, boards may find it more difficult to obtain assurance over their effectiveness. 

Professional expectations for internal audit have also developed. The 2025 Global Internal Audit Standards and the associated Internal Audit Code of Practice explicitly reference organisational culture and place greater emphasis on understanding the behavioural factors that influence governance, risk management and control. 

Collectively, these developments increase expectations on boards and executive teams to understand and oversee the cultural factors that influence organisational performance and control effectiveness. 

How cultural issues can appear in audit findings 

Internal audit findings often identify patterns of behaviour that may provide insight into organisational culture. Examples include: 

• Poor completion rates for mandatory training: This may indicate weaknesses in accountability, engagement or the prioritisation of compliance activities. 
• Out-of-date policies or significant gaps between policy and practice: This may suggest that informal practices are becoming embedded or that expected processes are not consistently followed. 
• Controls routinely bypassed due to resource or time pressures: This may indicate tension between operational demands and control requirements. 
• Inconsistent application of controls across teams or locations: This can point to differing expectations, practices or subcultures within an organisation. 
• Limited visibility of issues or delays in escalation: This can be associated with low levels of trust, confidence in reporting mechanisms or psychological safety. 
• Repeated findings in the same thematic areas: This may indicate that behavioural or cultural factors are contributing to the persistence of issues. 

These indicators often emerge before significant control failures occur. Monitoring them can provide useful insight into emerging risks and areas requiring management attention. 

Culture can be assessed using existing evidence 

Culture is often viewed as difficult to measure. However, most organisations already hold a range of information that can provide objective indicators of behaviour and cultural trends. Examples include:

Taken individually, these indicators may provide only a partial view. Considered together, however, they can help organisations identify emerging themes, behavioural drivers and systemic issues. 

The Internal Audit Code of Practice encourages internal audit functions to bring together multiple sources of evidence to identify cultural themes and provide insight into how behaviours influence organisational outcomes. As a result, organisations may increasingly expect internal audit reporting to include observations on behavioural drivers alongside traditional assessments of control design and operating effectiveness. 

What should leaders consider? 

Include cultural indicators in management reporting 

Cultural indicators can provide useful context alongside operational, financial and risk metrics. Questions for leaders may include: 

• Are key training modules consistently completed? 
• Are grievance levels increasing? 
• Are workarounds becoming more common? 
• What do recurring control issues suggest about organisational behaviours? 

Bringing these indicators together through a simple dashboard can help identify trends and support discussion. 

Consider the behavioural drivers behind control issues 

When controls fail or operate inconsistently, organisations may benefit from considering not only the immediate issue but also any underlying behavioural factors that contributed to it. 

Remediating a process weakness may address the symptom. Understanding the behaviours, incentives or pressures that contributed to the issue may help reduce the likelihood of recurrence. 

Review audit findings collectively 

Boards and audit committees may gain additional value by reviewing audit findings collectively rather than in isolation. 

Looking across multiple audits can help identify recurring themes, patterns and cultural indicators that may not be apparent from individual reports. This broader perspective can support more informed discussions around governance, risk and organisational effectiveness. 

Culture and organisational resilience 

Culture has long influenced how effectively controls operate in practice. What is changing is the extent to which governance frameworks and professional standards explicitly recognise its significance. 

The UK Corporate Governance Code, Global Internal Audit Standards and Internal Audit Code of Practice all reinforce the importance of understanding the behavioural factors that influence organisational outcomes. 

Cultures that promote accountability, transparency, learning and constructive challenge are more likely to support effective governance and control environments. Conversely, where behaviours discourage challenge or weaken compliance with established processes, organisations may face greater risk. 

Organisations that incorporate cultural considerations into their governance, risk and control frameworks are likely to be better placed to identify emerging risks, support effective decision-making and strengthen organisational resilience.