Assessing risk culture

What role does Internal Audit play in assessing risk culture?

Building and embedding desired organisational culture and values has never been so important, with many failures and corporate scandals directly resulting from poor culture and behaviours.

A sound approach to assessing risk culture provides confidence as to the quality of desired behaviours, both for internal and external stakeholders.

40 % believe their executive team are the main drivers for a focus on culture and behaviour

50 % have not developed an approach to assess risk culture within their internal audit function

Three steps to assessing risk culture

Step 1 – Define your risk culture assessment strategy and approach

• Agree in consultation with management, HR, Risk, Exec and Audit Committee the risk cultural dimensions to be assessed.
• Clearly articulate the roles and responsibilities of risk culture assessment across the second and third lines of defence. 
• Define and agree method/s and extent to which risk culture assessments will be incorporated into your IA activities. 
• Communicate

Step 2 – Embed your risk culture assessment approach

• Agree the techniques and approaches to assess risk culture.
• Incorporate your risk culture assessment approach into your Internal Audit methodology and tools.
• Identify and address capability gaps within the team.
• Decide how risk culture insights will be reported and presented per internal audit.

Step 3 – Execute and monitor your risk culture approach

• Deliver and report risk culture assessments via the agreed method. 
• Identify key learnings and reflect in enhancing the assessment approach.
• Theme risk culture insights on an ongoing basis and present to the Audit Committee, Risk and HR as appropriate.  
• Use risk culture insights to inform focus areas on next year’s IA plan.