Internal auditors face an uphill climb when it comes to auditing corporate culture
By Joseph McCafferty
August 20, 2016
The Financial Crisis of 2008 cemented what many risk management experts have known for years: You can have an army of risk managers and all the sophisticated risk-management models and tools you like, but if there is something wrong with the culture of the organization and what we all now call the “tone at the top,” they won’t work. That was clear at Bear Stearns and that was clear at Lehman Brothers.
Since then, risk managers, internal audit leaders, and governance gurus have tried make a stronger connection between culture and tone and risk management. What was once thought to be a squishy art better left to the feel-good folks in the human resources department is slowly becoming a hard science with monitoring, measures and metrics, and an emerging literature and research.