Home > Risk > Let’s talk about culture

Let’s talk about culture

December 19, 2015 Leave a comment Go to comments

Organizational culture has been blamed for many recent disasters, including BP Deep Water Horizon (which has been referred to as a “culture of greed” as well as a culture that had defects relating to safety), GM (“…a culture where you get fired if you do talk about quality and safety issues, and you get fired if you don’t talk about them”), Toyo Tire (“Toyo Tire’s problems stem from its corporate culture”) and VW (‘North Korea without labour camps”).

Some interesting articles have been written about culture, including:

In our webinar on December 8th[i], Richard Anderson and I talked about organizational culture. I made the points that:

  • There are many aspects or dimensions of organizational culture, illustrated by people talking about ‘safety culture’, ‘risk culture’, ‘ethical culture’, and so on.
  • There is no single corporate culture. Culture can be quite different between units, departments, locations, or teams within a single organization.
  • Culture reflects people, and since the employee population is changing all the time, we should expect culture and the behavior patterns it influences to similarly change. However, there can be a dominant culture that reflects the influence of leadership (whether of the organization, a unit, team, or so on), and that influence is likely to remain fairly constant until there is a change in leadership

Richard shared the results of some research and study into corporate culture, with an emphasis on risk culture. He talked about the fact that while many are driven by performance, others are driven by a need for ‘control’. A balance needs to be found.

Some are highly collaborative, while others are prone to taking the lead and directing others to follow.

These differences in personality can drive behavior when it comes to risk decisions – how much ‘risk’ to take.

Richard is the author of the IRM’s publication on Risk Culture. (I was one of many reviewers). I believe you will find it an interesting read.

Richard and I have scheduled additional opportunities to discuss risk culture and its effect on the management of risk. Details are at www.riskreimagined.com.

But in the meantime, I have some thoughts I want to share on how to assess whether your organization’s culture is what it should be.

  • Because there are so many aspects or dimensions of organizational culture (safety, ethics, risk, and so on), I would focus on a limited number of dimensions at a time.
  • I would endeavor to define (a) what I want to see in a model culture; (b) how defects in culture would impact corporate success and the achievement of objectives (in other words, I would assess the risk); and, (c) how I might identify red flags that would indicate such defects.
  • Based on the above, I would determine appropriate assessment methods and tools. I personally like surveys and have used them with some success in partnership with the Human Resources department. However, we should not underestimate the fact that all of us (if we are alert) can provide input and insight into the culture of our organization. We typically know, or at least suspect, when there are problems with the corporate culture. I was very much aware of issues at several of my employers, and always (a) considered whether they represented a threat to the organization that merited my attention, (b) took them into consideration when defining my internal audit plan, and (c) discussed serious issues with top management and the board. Of course, I did not rely on my own suspicions; I would use surveys and interviews to provide additional information for confirmation or clarification.

Are you sensitive to the possibility of defects in corporate culture that might represent an unacceptable level of risk – through their impact on decision-making – to the achievement of organizational objectives?

I am interested in your experiences and insights.


[i] I believe that if you register, you can listen to recordings of both webinars

  1. Thomas Day
    December 22, 2015 at 4:26 PM

    This is an important topic, perhaps one of the most important. Culture, to me, represents the “tribal values” that you manifest. Many organizations believe that this is accomplished through mission and vision statements. This is incorrect. Culture and mission/vision often diverge. I’ve worked with so many organizations where the mission and vision “reads well”, but execution is poor. And this is where leadership steps in. Defining your aspirational culture is always important; however, building the organizational dynamics and metrics to evaluate whether you are achieving your “tribal” values and goals is another matter and requires budget. It requires a true financial and organizational commitment. For example: “We maintain a healthy work/life balance.” This is a tribal more, or normative value. In practice, leadership may express this value while manager and directors fail to properly conform to this organizational principle. How do you measure such failures? How do you restore balance? How do employees that are being mistreated through non-stop “utilization” get proper elevation such that the managers and directors that fail to ensure team and individual “balance” are taken to task? An effective culture has such sensors in place and put real teeth to the cultural value. In practice, I don’t see this often enough. The cultural vision is good; the implementation is poor. Google’s culture appears to exhibit good vision and implementation. Perhaps we can take some lessons.

    • Norman Marks
      December 22, 2015 at 4:39 PM

      Very well said

    • December 23, 2015 at 6:33 AM

      Thomas, very good points! Is it possible to sum up ‘corporate culture’ as ‘respect for the employees’? I worked for most of my life for a large corporation founded over 100 years ago with a very strong respect for employees. I saw it change over my working career to an organization where employees weren’t considered much better than carbon paper (http://dilbert.com/search_results?terms=Valuable+Asset+Employees+Carbon+Paper). I don’t know why the change occurred. The cynic in me thinks that it was at the same time that ‘Personnel’ became ‘Human Resources’ but it probably also coincided with a period when managers no longer worked their way up through the ranks but joined direct into management as ‘graduates’ (I was effectively one of these). Or did the change take place when there was greater emphasis on profitability and larger bonuses?
      Thanks for kicking off the discussion Norman.
      Seasons greetings to all.

  2. Dom Tallerico
    December 23, 2015 at 10:14 AM

    There are those who chose to pursue fields of study that have very little or no practical purposes whatsoever. These fields include sociology, psychology, anthropology, and such. To try to achieve some measure of practicality and try to earn a living, such folks went into business and try to seriously talk about nebulous areas such as “corporate culture,” “soft skills,” and the like. They gravitate toward the Human Resources departments and now seem to be trying to branch out into real value-adding areas such as internal audit functions and similar. To link internal audit functions in any way with the supposed risks of “corporate culture” at best detracts from the Standards for the Professional Practice of Internal Auditing ( as set forth by the Institute of Internal Auditors) and at worst fruitlessly uses up corporate resources from areas that actually matter.

    Norman serves us well by highlighting this dangerous direction some would have internal audit functions grasp. I say once the “social scientists” behind this nonsense can actually use their so-called sciences to actual add predictive value, then we might give them some consideration.

  3. Hal Garyn
    December 23, 2015 at 12:25 PM

    To Dom’s points, I will leave it to the sociologists, psychologist, anthropologists, etc.. to defend themselves, but I will make two observations:

    1. In my view, to Dom’s point about “corporate culture” distracting internal audit from the Standards, I don’t understand. Auditing soft controls a.k.a. auditing tone at the top and now a.k.a. auditing culture is central to what a good internal audit function should be doing in some way. Elevating the dialogue to be about “culture” just brings it to a higher level in my view. Internal audit has an obligation to assess, evaluate and report on whether or not the organization is walking the talk of its culture and values. An organization straying from its desired culture (or having a toxic culture) may be one of the highest strategic risks an organization faces (in my humble opinion, of course).

    2. To Norman’s blog itself, I have always been perplexed by the use of subsets of an organization’s culture, one of the most often used by people refers to a “risk culture”. (I know there has been much written about risk culture, some of which is quite excellent.) However, do we talk about a “controls culture” or a “governance culture”? If we have a “risk culture” do we then have a “risk management culture”? In the end, an organization desires to have a particular overarching culture, by design, happenstance, or something in-between. And then, absent the macro-culture of the organization, there are many micro-cultures throughout the entire organization. Internal audit, in my view, has a role to plan in assessing the macro- and micro-cultures and determining where there may be gaps between what is desired and what is reality. Regardless, we risk (no pun intended) diluting the value of talking about culture if we ascribe descriptors to subsets (e.g., risk culture) of the overall culture (again, in my opinion).

    I expect we will be hearing more about the importance of culture, auditing culture and internal audit’s role in same from many others in the ensuing months and years.

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: