The culture questions every audit committee chair should ask

Recent changes to governance expectations and internal audit standards make it clear that audit committees have a role in asking questions about culture and in understanding how behaviour affects risk and control. This means chairs should be curious about the environment in which controls operate, and confident that they are receiving clear, evidence‑based insight.

The following questions are designed to support audit committees in this role.

1. What evidence do we have about our culture, and is it reliable?

Every organisation collects cultural data, even if it is not labelled that way. Some cultural indicators appear in HR data, others in audit reports and many in everyday operational patterns. The challenge is that this information often sits in different corners of the organisation and is not often brought together to form a cohesive picture.

Useful questions include:

• Which indicators do we currently rely on to form a view of organisational culture?
• Do they give us timely insight, or are they mainly lagging indicators?
• Are we relying on one or two data points, or combining insight from different sources?
• Do we see the same patterns across different teams and locations, or is the experience inconsistent?

Much of the data needed will already be available across existing reporting: staff turnover, training completion, grievance cases, customer complaints, internal audit themes, and so on. The key question for the committee is whether these signals are being brought together and interpreted in a way that supports oversight. If the board isn’t seeing patterns, it becomes harder to judge whether behaviour is aligned with organisational expectations.

When committees see cultural indicators side by side, patterns emerge very quickly. It becomes easier to understand not just what is happening, but why.

2. How well do leaders model the behaviours we expect across the organisation?

Leadership behaviour has a significant influence on how people interpret risk and accountability. When leaders listen, set clear expectations, and escalate issues promptly, teams usually do the same. When leaders are hesitant to surface concerns, others notice that too.

Audit committee chairs can explore this by asking:

• What expectations do we set for leadership behaviour?
• How do we know whether these expectations are experienced consistently across teams?
• Do staff survey results, whistleblowing data or exit interviews echo what leaders say about culture?

This is not about performance management; it is about understanding the influence leaders have on the control environment.

3. What cultural themes are emerging from internal audit’s work?

Internal audit sees the organisation in ways that few others do. Audit teams observe behaviours directly, listen to staff and understand how processes work on the ground. Audit committees can gain valuable insight by asking for patterns, not just point‑in‑time findings.

Helpful questions include:

• What behaviours do we see repeatedly across different audits?
• Are we seeing patterns around workload, escalation, or accountability?
• Are there any repeated themes that deserve more attention?

This should not turn into a request for “a culture audit.” Instead, it is about using existing audit activity to generate insight into behaviour and decision‑making. Seeing the common threads across audits can help committees understand whether weaknesses are isolated or systemic.

The most valuable cultural insight usually comes from connecting small observations across the year. When you look at them together, you can see how behaviours influence outcomes.

4. How well does our culture align with our stated risk appetite?

Most boards set a risk appetite, but not all consider whether the organisation’s behaviours support it. For example, an organisation that states it has a low appetite for compliance breaches may still see staff using workarounds because they feel pressured to meet deadlines. A stated appetite for innovation can be undermined by a fear of blame when things go wrong.

Audit committee chairs can probe this by asking:

• Where do behaviours align well with our stated appetite?
• Where do they diverge and what might be driving that?
• How do leaders reinforce the right behaviours when pressure increases?

These conversations encourage management to look beyond process and consider whether cultural forces are shaping decisions in unintended ways.

5. Does internal audit have the mandate and relationships needed to provide cultural insight?

Internal audit is not responsible for culture, but it can provide useful insight when the right conditions exist. Chairs should understand whether internal audit feels able to raise behavioural concerns and whether they can operate without undue pressure.

Questions that can help include:

• Does internal audit have sufficient access to observe behaviours and speak to staff?
• Are auditors confident that they can raise cultural observations when relevant?
• When internal audit raises behaviour‑related themes, how are they handled?

Strong internal audit insight on culture often depends on encouragement from the committee.

Key take-aways

Cultural oversight does not require audit committees to take on a new mandate or duplicate management’s work. It simply requires thoughtful questions, steady curiosity and a willingness to examine how behaviour influences risk. By focusing on available evidence, leadership behaviours and insight from internal audit, audit committees can strengthen their oversight and be prepared to spot issues early on.