Culture and Behaviour Audit.
Independent assurance on how risks are really managed, including the cultural conditions that make controls stronger or weaker in practice.
Audit sits in the middle of the system. Risk and Intelligence indicate where culture may be increasing exposure, Audit tests those areas in the field, Intervention responds to structural issues, and the Boardroom decides how this assurance is owned and used.
This section is written for Chief Audit Executives, Internal Audit leaders and the boards and committees who rely on them for independent assurance on culture and conduct.
What makes this Culture Audit?
Here, Audit means independent assurance on how risks are really managed, including the cultural conditions that make controls stronger or weaker in practice. It describes how Internal Audit and related reviews bring an evidence‑based view of behaviour, systems and governance back to the board and its committees, rather than treating culture as background context.
How does culture change what Internal Audit looks at?
The focus is not on adding “culture audits” as a bolt‑on, but on building culture and conduct risk into planning, scoping, fieldwork and reporting for the risks that matter most. Culture Risk Mapping and Early Warning Indicators highlight where assurance is most needed; Audit then turns those insights into plans, scopes and reports the board can rely on.
Culture Due Diligence
How cultural risks are examined around transactions, so boards see where integration is blocked by underlying norms. This covers both work before major deals or changes, and reviews afterwards of how culture actually affects integration, control and value.
View Due DiligenceDiscrete Culture Signals
How external indicators – from people data to customer experience – are read together as potential signals of issues worth auditing. It turns culture indicators into an input for audit planning, so scopes reflect where risk is compounding, not just where controls are formally weak.
View SignalsInternal Resonance Audit
How Audit assesses whether stated values are recognisable in day‑to‑day decisions, attitudes to risk and control use. This is where Internal Audit tests alignment between corporate philosophy, risk appetite and lived behaviour in specific processes and teams.
View Resonance AuditLanguage Audit
How written and spoken language is reviewed for what it reveals about power, blame, risk, accountability and respect. It treats language in policies, minutes and communications as data about culture, not just as documentation.
View Language AuditHow does Audit connect to Risk, Intelligence, Intervention and the Boardroom?
Many signals used in Culture Due Diligence and Discrete Culture Signals come from the Intelligence column; Intelligence gathers and interprets them, Audit tests and corroborates them before they reach the board. Findings often surface architectural issues that feed into Intervention work, while the Boardroom pages set out what boards can reasonably expect from Internal Audit on culture and how culture findings are read, challenged and followed through.
| Domain | The Connection |
|---|---|
| Risk | Culture Risk Mapping and Early Warning Indicators highlight where assurance is most needed; Audit turns those insights into plans, scopes and reports the board can rely on. |
| Intelligence | Many signals used in Culture Due Diligence and Discrete Culture Signals come from the Intelligence column; Intelligence gathers and interprets them, Audit tests and corroborates them before they reach the board. |
| Intervention | Internal Resonance and Language Audits often surface architectural issues; Intervention work then focuses on how management changes structures, incentives and routines in response. |
| Boardroom | Audit and Boardroom together define what the board can reasonably expect from Internal Audit on culture, and how culture findings are read, challenged and followed through. |