Is auditing culture just another risk factor in a governance audit, or could it be seen as the basis for the entire audit plan?
The IIA has recently highlighted the need for auditors to assess organizational culture, but there is very little guidance on how to accomplish the task. At first glance, culture may seem like just another risk factor to consider in a governance audit. On the other hand, auditing culture could be seen as the basis for the entire audit plan. Our job is to figure out how to incorporate some element of culture into our work load while not getting so mired in the details, that it would make our audit work suffer. We must also deal with the subjective nature of conducting a culture audit and the unique challenges associated with reporting any uncovered issues.