Through their words and actions, the board and C-suite set the tone and shape the ethical culture that pervades the organization. If the rank and file perceive the CEO as someone who cuts corners or ignores ethical issues, it sends a message that skirting the rules is acceptable, even if the written policies forbid it. If senior management seems to always do the right thing, it creates a model that others are likely to follow and may do more to create an ethical culture than any amount of training and policy writing could ever do.

So how can internal audit assess something that seems so difficult to quantify? In the latest edition of our video series "MISTI on Audit," Joel F. Kramer, vice president of audit curriculum at MIS Training Institute, looks at some of the ways internal audit can get at assessing "tone at the top."

"Without a doubt, it's something you can audit," says Kramer. He says that there are plenty of ways to look at how the actions of senior management are in line with expectations. "It's more than just the paper—although the paper is important because it does establish documented boundaries. But it is the tone. Are they walking the walk?" says Kramer. It starts all the way up at the board of directors, he says "There are self-assessments the board should be doing and charter audits. Making sure that the board is doing what it is supposed to be doing. And that it's documented and available to the organization."

"There are so many objective things that you can look at. For instance, is there an audit committee charter? Can you audit that the audit committee has fulfilled its responsibilities? Do they have expense reports? Have all of their use of corporate assets been documented and in-line with corporate policies and responsibilities? Have they signed off that they are monitoring the hotline?"

Kramer does caution that auditing tone at the top is not for the faint of heart. "Going against the grain is never the easiest thing to do, but sometimes it has to be done," says Kramer. "It has to be done at the very highest level with lots of interaction with the [senior management team], but it can be done. He says many CEOs welcome the evaluation of how well they are setting the tone at the top and want to know how they can do it better.