Don’t forget to audit controls!
It's best to have management detect issues and for audit to assess whether those detective controls are adequate.
culture
How do you manage culture?
There are many aspects or dimensions to culture, just as there are many dimensions to the behavior you want it to drive. They may include:
Are we doing enough about behavior?
I have written about culture as having many facets. Auditing culture is not just about ethics, or risk-taking. It’s about behavior and what drives it. Are we, as individuals (especially when we are in a position of authority, such as any member of internal audit) doing enough?
