A Proactive Approach to Deter Misconduct

The Anti-Fraud Collaboration (“AFC”), a collaboration of the Center for Audit Quality (CAQ), Financial Executives International (FEI), The Institute of Internal Auditors (The IIA), and the National Association of Corporate Directors (NACD), published their Report on Assessing Corporate Culture. Greene Forensic Accounting Solutions LLP (“GFAS”) provides Corporate Investigative services which are designed to make your company a safer, more productive, and more profitable work environment. We have experienced that corporate culture plays a significant role in allowing, or disallowing, fraud to occur within the workplace. The AFC states “When a corporate scandal occurs and stakeholders seek reasons and root causes, the trail often leads back to problems with the organization’s culture. A proactive approach to culture can deter various types of misconduct and promote behaviors that can enhance morale and productivity”. A strong culture hedges against all three sides of the fraud triangle, a framework that illustrates the factors that can motivate people to commit fraud: pressure, opportunity, and rationalization.

What is Culture and Why Is It Important?

Former IBM CEO Louis Gerstner called culture “the mindset and instincts” of an organization’s people. Culture is unique to each organization; it defines the organization, influencing a wide range of decisions made about areas that include safety, innovation, quality, customer service, integrity, and employee behavior and decision making. Culture has a powerful ability to affect how people do their jobs; how decisions about quality, compliance, and other critical concerns are made. Further, culture is not just the business and potential customers, but also regulators. This may be enforced through compliance ro regulatory efforts such as the Foreign Corrupt Practice Act (“FCPA”), the Committee of Sponsoring Organizations of the Treadway Commission (COSO), and Sarbanes-Oxley section 404, Corporate Responsibility for Financial Reports.

Culture is extremely important as it is how the organization can be perceived both internally and externally. The business’ culture will reflect the mission of the business. Elements typically found when identifying a business’ culture are;

• Vision – The business’ purpose and mission.
• Values – The guidelines on the behaviors and mindset necessary to achieve the vision.
• Practices – The actions the business takes to implement their visions.
• People – Do the people who work for the business share and embody he values of the business.
• Narrative – How is the vision and values presented both internally and externally.
• Place – Does the business provide the employees the ability to put into action what is described in the Vison.

Ownership of Culture

It’s typically said that everyone ‘owns’ the culture of the company, and everyone must participate and do their part. However, “Ultimate responsibility for oversight of corporate culture lies with the full board, because it is so closely connected with strategy and has significant potential to impact the company’s risk profile— two other critical full-board responsibilities,” according to the NACD. Various Board committees should play a role in oversight and monitoring of corporate culture.

The Board can consider cultural issues in CEO selection and capture a comprehensive range of information on corporate culture and ensure culture are a regularly scheduled board agenda item. The Audit Committee can review compliance and whistleblower reports and examine deep-dive data from employee surveys. The Compensation Committee can ensure that the compensation structure supports desired culture and ethical behavior while considering culture-related elements in executive compensation.

The Board, through the CEO selection, can put in place an effective Management team for the day-to-day activities, oversight and responsibility of the company’s culture. This effectively creates a proper “tone at the top”, which portrayed through effective communications and visibility throughout the organization shows ownership of the Values and Vision of the company.

Tools and Techniques to Assess Culture

There are a multitude of methods a company can assess how the culture works on a day-to-day basis and over time beyond the typical audit findings and compliance reviews. Stakeholders should track, monitor, and act based on how the culture evolves throughout the organization over time and each layer of the business. A robust culture assessment allows for early detection of warning signs, allowing leadership to take active steps to prevent and address problems.

A culture dashboard with a variety of metrics is an excellent way for companies to collect and monitor information related to an organization’s culture holistically. Organizations should mobilize cross-functional teams or committees to determine how best to obtain information for an effective assessment. Just as there is no one-size-fits-all culture for all organizations, a culture assessment solution should be tailored to each organization’s culture and strategy. Organizations should determine which combination of tools or techniques will deliver an effective and thorough assessment. Options can include employee surveys, performance appraisals, whistleblower hotlines, and social media monitoring, among other tools.

The Role of Auditors

Board members should receive reports from internal and external auditors, as well as from teams charged with risk management and compliance. The auditors should be encouraged to report warning signs of disruptions in the culture. How can auditor’s report on culture, when culture is a constantly evolving throughout the organization? Using traditional tools and analysis may be difficult to use since there are not any metrics to be based upon, but how employees behave and interact. Different areas and sector of the business may have different types of cultures. Geographical area is a common cause of differences, where both cultures are “right”, yet different from each other. To allow auditors to overcome these challenges, the IIA provides phases to allow auditors to assess the organization. As with common audit methodologies, examining corporate culture is risk based and cyclical in nature. The steps taken include;

• Information gathering
• Consider culture risks
• Risk assessment
• Plan and perform the engagement
• Reporting
• Monitoring and evaluation.

The inability to adapt and put forth recommendations from auditors risks the organization solely maintain the status quo leading to a lack of ownership of the culture, and the overall tone at the top.

Assessing Board Culture

The Board is not immune to Culture risks that may affect the rest of the organization. Since the board is critical to maintaining and influencing corporate culture, any assessment should include an evaluation of board culture. If the Board is unwilling or shows lack of cooperation to take part in what they expect of the rest of the organization,

The NACD reported that “the wrong culture can turn a group of highly competent and experienced directors into a poorly performing board.” The NACD recommends that boards should assess their own culture through regular formal evaluations and informal reviews— and then use the results in decisions about board composition, leadership succession, and areas in need of improvement. The board’s evaluations of culture should also encompass senior management, especially those responsible for key risk management issues, compliance, and internal controls.

Like corporate culture, the culture of any board is influenced by its members’ attitudes and spoken and unspoken values and assumptions, among other factors. The board should be prepared to evaluate its own culture and effectiveness in being a positive influence and to make changes as needed. The assessment of board culture can help identify new board members whose values align with those of the organization.