Cultural & Behavioral Risk

Policies and controls are only effective when people understand them, comply with them, and hold one another accountable when necessary. As a result, behavior plays a critical role in whether risks are identified in a timely manner, decisions are made carefully, and warning signals are acted upon effectively.

Regulators and professional bodies are placing increasing emphasis on risk culture, behavior, and effective governance. Organizations are expected not only to demonstrate that controls exist, but also to understand how these controls operate in practice and which behaviors contribute to their effectiveness.

KPMG’s Behavioral Risk team helps organizations identify and understand culture, behavior, and the underlying behavioral risks that influence performance and control effectiveness and translates these insights into practical improvement actions.

Our added value lies in the combination of behavioral science expertise, audit experience, and knowledge of governance, risk management, and internal control. This enables us to directly connect organizational behavior to risk, control effectiveness, and organizational performance.

We can support you in the following areas:

• Culture, behavior, and soft controls assessments;
• Support for Internal Audit, Risk Management, and Compliance functions;
• Development of methodologies and assessment frameworks;
• Training, coaching, and changing interventions;

Our approach is tailored to the maturity, ambitions, and risk profile of the organization. Depending on the objectives of the engagement, we use a combination of document reviews, interviews, observations, group sessions, and surveys. We combine recognized frameworks with the KPMG Soft Controls Model, which has been applied within organizations, and Internal Audit functions for more than twenty years.

We focus not only on what is documented in policies and procedures, but particularly on how decision-making, collaboration, and control operate in practice. This provides insight into behavioral patterns, the risks associated with those patterns, and concrete opportunities for improvement.

The IIA Topical Requirement Organizational Behavior introduces a mandatory framework for assurance engagements where organizational behavior is within the scope of the engagement or emerges as a relevant risk during its execution.

KPMG supports Internal Audit functions in preparing for and applying the Organizational Behavior Topical Requirement, including through:

• Conducting gap assessments;
• Developing and enhancing methodologies;
• Integrating culture and behavior into risk assessments and audits;
• Training and coaching auditors;
• Translating behavioral insights into well-supported findings and recommendations.

In doing so, we help Internal Audit functions comply with emerging standards while increasing their impact and value within the organization.