Why corporate culture matters

Hello, I'm Richard Chambers, the Senior Advisor for Risk and Audit at Audit Board, and welcome to another in my podcast series, Speaking of Risk and Audit. Today, I'm really excited to be joined by Sandro Boeri. Sandro is the founder of Risk Audit and also currently the president of the Chartered Institute of Internal Auditors in the UK. Sandro and I recently had an opportunity to work together on a very important research project around culture and ethics, and we just released the Audit Board 2025 Culture and Ethics Report.

Sandro, thanks for joining me. It's exciting to talk with you today about culture and all of the implications therein. Richard, it's an absolute pleasure to be here. Thank you very much for introducing me.

I've been reflecting, Richard, whether you or I have been around longer in the profession. I think it's you. What is it, 50 years now almost? It's 50 years this month, actually, but I'm sure you're not too far behind me.

Well, I conducted my first internal audit review in September 1979, believe it or not. That's just before computers were invented. Yes, yes. I had an interesting career working in banking, made my way up through the ranks, junior internal auditor, ticking and bashing.

And then somebody trusted me to start leading teams, worked for the Brits, the French, the Americans, the Japanese, the Dutch, a good multicultural experience. And I thought internal auditing was a relatively straightforward, logical experience. Then I learned something else. What was that?

I think the demise of a lot of banks in 2007-2008 was a real wake-up call for me. First of all, it was a shock to see so many people lose their jobs. Secondly, it was a catastrophe to see what banks did to society. And without getting too political, I think we're still paying the price at the moment.

But what was interesting to me was suddenly realizing that internal auditing, whilst it's a logical game, perhaps needs to revisit the human condition. In other words, it was a realization that human beings do not always do what is expected of them and do not always behave with common sense. And that's where I started my journey on culture, trying to understand why human beings behave the way they behave. And that took me, I would say.

10 years until I ended up at Deutsche Bank as head of staff development for their 900 auditors and also responsible for auditing culture. And then I came to another conclusion, which is perhaps we as internal auditors need to build a bridge into the world of culture, a bridge that mimics the way we perform audits. And that's where I think you and I got together, Richard, and got involved in the project right and you know you know it's it's appropriate i think in so many ways that you are currently the president of the i uk because i have long said that i uk has been the leader of all of the global iia affiliates or institutes that i uk has been the leader on this topic of culture and and the and the role of internal audit when it comes to assurance around culture.

So I think it's a real convergence here of the right person in the right place at the right time. So congratulations on that. Thank you. I was just reflecting, are we really the leaders?

And somebody was asking me this question yesterday or making this statement that the UK is a leader. And I've come to a conclusion we possibly are. Firstly, we've got, I would say, about 10 examples of quite sophisticated, avant-garde behavioural risk teams that are working in large internal audit functions. Secondly, perhaps a little plug for the UK code of internal audit practice that actually requires internal auditors working in the UK and Ireland to audit organisational culture.

That's certainly leading the pack without a doubt. You'd need to talk to my psychiatrist to work out why the internal audit profession in the UK is leading the way. Well, I think it was just some forward-thinking folks. And I think it goes back more than 10 years that IAUK first started talking about this topic and put some thought leadership out there on it.

And I must confess, because I was the global CEO at the IA at the time, I was a little intrigued because we hadn't really talked a lot about culture. We'd often sort of alluded to the tone at the top and how important that is as internal auditors. But I don't think we had, up until that point, really been throwing the term culture around. And since, it's become quite an appropriate topic.

In fact, the first research report we did from Audit Board was in 2023, and I partnered with Cynthia Cooper, the legendary former chief audit executive of WorldCom. She and I partnered with Audit Board, and we put out that first report in 2023. And then this year, we felt like we really ought to revisit it. And that's why when I was fortunate enough to be able to partner with you on it.

And so maybe you want to just share a little bit about what process we undertook and how you feel like that gives this particular project maybe a little bit of a distinction in terms of how these culture reports are put out. First of all, as with any good product in the internal audit world, we based it on fact. In other words, we based it on what people perceive, which to me is fact. In other words, we conducted a research project where we asked leaders in the internal audit, risk and compliance world in the US, in the UK and in Germany, we asked them the answers to a number of questions surrounding their approach to culture, behavior, and behavioral risk.

So there was a solid database of perceptions that was the first input into our thinking. But given the nature of the subject, that then led to, I would say, a lot of fascinating debate between you and I and Pantera and our colleagues at Audit Board, debating, well, what is this data telling us how has the world moved on from 2023. You're also gracious enough to allow me to bring in the Global Institute of Internal Audits as topical requirements on organizational behavior that I, by pure coincidence, was working on at the time.

And I feel that led to a very solid product that certainly identifies a number of challenges and fault lines in terms of the way compliance, risk, and internal audit functions approach this subject. But more importantly, also recommendations. So lots of very good food for thought, I would say. Absolutely.

You know, one of the things about culture, and I've been out there on the trail speaking and talking about it and advocating for an important role for internal audit in culture risk oversight. I've been doing that for more than 10 years, stimulated initially by the work from the IUK. But what I find is everyone kind of has their own definition of culture. You know, there are the academic definitions.

There's the famous how things are done around here definition. What is Sandro's definition of culture? My definition is, it's quite a wordy definition, but I see culture in the way that I see the weather outside. So the weather outside, it can be sunny, can be windy, can be cloudy, can be cold, can be warm.

There's this climate. As the old song goes, it can be frightful. It can be frightful and it can be delightful at times. Well, I certainly ascribe to the view that culture is the way we do things, but it's also the way we think about things, the way we feel about things.

I hear a lot of people say that culture is what happens when your back is turned. But in my experience, having worked for a few quite aggressive investment banks, it's also the way things are done to you when your back is not turned. It's done to you when you're looking and you're totally conscious. You're absolutely right because some toxic cultures are shameless.

They don't pretend that they're anything else. And it's not a well-kept secret in a number of organizations. And when they finally get in trouble or when something implodes, people look around and go, well, that wasn't surprising because they've been doing this stuff for years, right? Absolutely.

No secrets. And I would argue in those scenarios, the people that are being very assertive and aggressive see that as a plus point in their organization as a positive, value-adding, differentiating factor. So, yeah, that's the worst. So what surprised you the most?

We had a ton of data. I mean, our research partners at Pantera, they're amazing in terms of the kind of data they can generate from the questions that we ask. But what surprised you the most out of all of the data and all of the insights that we got? I have quite a few dark days on my culture journey when I actually think no one is listening.

What surprised me most was the fact that I felt. Every single function wanted to do the right thing in terms of culture. In other words, it's on people's radar screen. That to me was a pleasant, positive wake up call.

Yeah, I felt the same way. I was not surprised that internal audit appreciates the importance of culture. I think maybe the thing that surprised me is that even after 10 or 11 years, when we really, we really peel back and look at it, a lot of internal audit functions just don't feel equipped to look at culture and they don't feel enabled to look at culture. There, there's still, there's still a perception in a lot of organizations that, you know, we need to, we need to stick to the bean counting and leave this kind of stuff to the quote unquote experts, whoever they may be.

And yet, over and over, we've seen some remarkable outcomes from internal audit assessing culture in their organizations. So, did that surprise you that we're still fighting the battle about whether this is even a role for internal audit? It surprises me and it frustrates me. But I guess if I think about it, given what we're talking about, I shouldn't be surprised.

Most of my life i've been fighting a battle in terms of my weight i'm still fighting a battle in terms of my weight do i know what i need to do yes and no most internal auditors i think will acknowledge that culture is important and they probably were acknowledging it from the moment they got into business but what what what do we do about it as a profession continues to be a debate and when you've got an internal audit function that's under delivery pressure it's too easy to play ostrich with something that you know you really do need to deal with otherwise it's going to kill you yeah.

Yeah, you know, I think perhaps the thing that's going to strike people when they really pick up the report to read it is that we've come to the conclusion or that the data has led us to the conclusion that this is, quote unquote, not a one man show, right? That internal audit can't be the culture risk oversight element by itself, that there has to be a partnership here because we have risk managers in the organization. We have compliance professionals in the organization. Management certainly has to be there.

So what we found is that to the extent that all these different groups are working, the so-called three lines, to the extent that the three lines are engaged in culture, they're really not doing so in a collaborative sense, that each of them kind of has their own way of assessing or trying to influence culture in the organization. And that's not helping. I really hope the report acts as a catalyst that supports the internal audit function. Someone's got to convene.

Someone's got to coordinate. To perhaps coordinate assurance providers, risk managers, and quite frankly, everyone that is governing this subject. To try and come up with one definition of culture, one definition of the associated risks, one methodology for measuring, one common language and common approach to this subject. I think as internal auditors, we often talk about the fact that we need to take a risk with our independence to allow us to become strategic value-adding advisors in the business.

This is one subject where I think it's critical that we do take that risk and really silo bust as a profession. No, I couldn't agree more. And, you know, when we get into this topic in the report, we really start to talk about what can internal audit do, how can they interface with risk management, and what's risk management's role, and by the same token, what's compliance role. So I agree with you that internal audit is the only one of these elements, only one of these units that's independent, right?

Because... I have a lot of great friends in the risk management field, but to a large extent, they are still an arm of management. That's where the word comes from, right? Risk management means they're part of management.

And so I think if boards and the C-suite are looking for a truly objective view of culture and how effective the risks are being managed, it would have to include internal audit, don't you think? I think in turn, Lord, it has to be included in the conversation. I actually think we need to be prepared to pay a bit of a driving role in the conversation. But what I think is absolutely critical, that we get to a point where we can sit around a table and talk the same language on a subject which is hurting businesses substantially and we're not really learning that.

So, for example, one of the survey data points is the lack of training, the lack of understanding of this subject. Well, let's be efficient. Let's all go on the same training course together, the auditor, the compliance officer, the risk manager. What I'm finding in my consulting work is that I'm frequently now running training programs where I've got the auditor, the risk manager, the compliance officer, and the HR function in the room at the same time, looking at the same material at the same time, and debating quite openly on their respective roles in relation to this subject.

So silo-busting in a collaborative, collective manner, I think, is absolutely critical. Yeah, I agree. Couldn't agree more. You know, Sandra, one of my favorite euphemisms to use to describe risk conditions is burning platform.

And we kind of get the image there. When a platform is burning, somebody has to act, right? The problem is a lot of times people don't see the burning platform when it involves culture, but there's probably some smoke there. But they don't react to the fire until perhaps it's engulfing the organization.

How do we get people to start thinking more about watching for culture implications before they become a burning platform? So the report highlights the use of inappropriate metrics in terms of measuring culture and recommends metrics that are much more helpful in terms of providing early warning of poor outcomes that are just around the corner. So let me try and illustrate it with an example. If one of our metrics is a data point that tells us that the platform is burning, it's too late.

If, however, the metrics tell us that there's a risk that that platform might ignite, so examples, metrics that look at the degree of escalation that's going on in the organization and detect that escalation is falling off a cliff, metrics that look at the degree to which different views are heard around board table and committee tables. Metrics that measure the way in which control functions are treated, whether they're listened to or not listened to. Metrics that look at client complaints.

These are all examples of early warning indicators that if we don't react. Then to go to your euphemism, Richard, that platform is going to ignite. And then we've got a firefights on our hands, in which case we're not going to be talking about culture then. Now, I think that's absolutely the message that you and I need to be delivering to our profession in 2025 is don't wait until you see the flames to start providing some assurance around culture and how effective the risk is being managed.

You know, Sandro, you mentioned in your introductory remarks about yourself, that you've just been a part of this working group that II Global put together to hammer out the proposed topical requirement on organizational behavior. Now, I think organizational behavior is an interesting term because it really boils down the essence in some ways of what culture is about, right? Culture often manifests itself in how people behave. So talk to us a little bit about this new topical requirement and what should the profession know about it if someone hasn't picked it up?

And hopefully they do pretty soon because I believe the exposure period on it only runs for a few more weeks. Tell us a little bit about the project and what your role was and what your insights are on it. I mean, first of all, it was an unexpected surprise for me to be let into the working group because I do have a reputation as a bit of a provocateur at times. It was also a.

That was not supported with what I would call mature auditing practices around the planet. That was a surprise. But Global seemed to have taken what to me seems to be a leadership role. So what does this leadership role involve?

So first of all, I was given the opportunity to co-author along with a lady called Vika Scholten, who's a behavioral scientist in Amsterdam, and along with very well supported by global staff. So we wanted to articulate a risk because risk-based auditors think in risk terms. So what's the risk? The risk is behavior which is not aligned with the organization's strategic objectives.

If you've got a risk, theoretically, you've got some controls that help you manage that risk and auditors can relate to controls. So we came up with a series of what we call control pressure points. Hiring, training, communicating, incentivizing, and disincentivizing were the control pressure point arenas. And in the user guide that supports the topical requirement we came up with i would say a menu of things that internal auditors should look for when challenging the design and operating effectiveness of the controls in these control pressure points arena so the the whole topical requirement is asking internal auditors to flex the way they look at these areas but given the mandatory nature of the topical requirement from q1 2027 if you want to be eqa compliant and you are auditing in an arena that is running behavioral risk.

Then you must look at these control pressure points. So it's bringing a degree of compulsion, but it's trying to bridge culture. Into the risk-based audit methodologies that are so loved and understood by our profession. And the hope is this is the beginning of a journey, as that our profession will start to get more and more curious as to what actually drives behavior.

The topical requirement does not go into behavioral drivers in any meaningful shape or form. And the good news is all of this is grounded in behavioral science. You know, I'm pleased to hear you talk about the whole concept of incentives and how incentivized, how behaviors get incentivized. If I look at most of the really iconic cultural debacles, corporate debacles that were culture induced there to me, the common thread that often runs through them.

Is that within the organization, what got measured got done, and it was the ends justified the means. In other words, we're not going to penalize you on how you do it, just get it done. And that's true whether we go all the way back to Enron, WorldCom, Parmalat, all the way up through some of the more recent scandals involving big banks and auto manufacturers and others. It was the idea that the people who were charged with making something happen were getting incentivized by making it happen and not how they made it happen.

Is that fair? That's totally fair. And we've tried to recognize that phenomenon by suggesting in the user guide that if you're, you're challenging design by asking the question, well, where is the how somebody does something built into this incentive? And obviously, we end up down the route of balanced scorecards, where in the balanced scorecard, there's reference to conduct, there's reference to compliance with procedures.

But whilst the what and the quantity is important, the how needs to be recognized. Otherwise, we're saying as auditors, there's an audit finding that you really do need to be raising. Well, Sandro, it's been great catching up and talking about the new culture risk report that you and I partnered with Audit Board on. It's also refreshing to get a firsthand account of what the new topical requirement is going to involve.

I wish you all the best as you continue to be a crusader for this very important topic for our profession. And I thank you again for joining me on my podcast, Speaking of Risk and Audit.