There’s a new ‘Good Practice Guide’ from Australia. The Ethics Centre, Governance Institute of Australia, Chartered Accountants Australia New Zealand, and IIA – Australia recently released Managing Culture – A Good Practice Guide.
This is a topic I have been writing about for several years. In addition to covering it in World-Class Risk Management, I have posted about a dozen times on the topic in the last 5 years, here and at iaonline.theiia.org.
In my posts, I make the point that there are many aspects or dimensions to culture, just as there are many dimensions to the behavior you want it to drive.
They may include:
- Acting with integrity
- Working as a team towards shared goals
- Putting the enterprise ahead of personal interests
- Complying with corporate policies
- Sharing and communicating
- Listening and empowering
- Treating all others with respect
- Respect for authority
- Tolerance for dissent
- Considering risk (what might happen) in every decision
- Being willing to try new ideas and think out of the box
- Putting the customer first
- A commitment to the community and the environment
- Focusing on quality
- Putting employee and others’ safety first
- Coming forward to report suspected violations of corporate policies
- Having a strong work ethic
- A desire for the health, welfare, and growth of the employees and their families
I suspect that most organizations would embrace these values.
They will want the culture to encourage related behavior
The Good Practice Guide talks about many but not all of these dimensions.
In a 2014 blog post, Culture is a Business Issue, I suggested questions that might help an organization assess its culture and whether it is what they want it to be.
- Have the executive team and the board defined the culture they want?
- Has it been clearly communicated to employees?
- What measures are in place to measure whether the desired culture is achieved, and what actions are taken when it is not?
- What is the effect on the organization if behaviors are not aligned with the desired corporate culture? Which strategies and objectives are likely to be affected and how? Is this significant? Does it merit action?
- Does the management team reinforce the message about desired behavior when they meet employees and others? Are they credible?
- Does the management team walk the talk, setting the example they want others to follow?
- Do managers (and risk and audit professionals) pay attention to signs that the desired culture is not in place?
- Are indicators of deteriorating culture noticed and action taken (for example, employees failing to attend or arriving late at meetings; a high level of stressed managers and staff; loss of key employees and failures to hire talent when needed; a scarcity of smiles and laughter in the office; and so on)?
- When actions such as reorganizations and compensation decisions made, is the potential impact on culture considered?
- Are compensation and related programs based, at least in part, on whether employees’ behavior is consistent with the desired culture?
Today, I am suggesting a simple methodology.
- Select one or more dimensions of culture and desired behavior – but not all of them. That would not be practical.
- For each, what is the desired state? (That becomes the ‘objective’.)
- What can happen that would lead individuals or groups to diverge from the desired behavior?
- What are we doing to enable the culture we desire?
- What controls are in place that would either prevent inappropriate behavior or detect it so that appropriate and timely action can be taken?
- Do they provide reasonable assurance that the culture is as it should be and that individuals and groups will behave as desired?
What do you think?
I welcome your comments and suggestions.
Norman D. Marks, CPA, CRMA
He retired in early 2013. However,he still blogs, writes, trains, and speaks – and mentors individuals and organizations when he can.
Latest posts by Norman D. Marks, CPA, CRMA (see all)
- How effective are your systems of governance, risk, and control/compliance (GRC)? - October 19, 2021
- Delivering value from IT audit - September 22, 2021
- Selecting software for risk management - August 18, 2021
