Cultural Assurance:
Do your colleagues really understand what is expected of them?
Carolyn Clarke and Steven Brown, Founding Partners, Brave Within LLP
If your people are your greatest asset, understanding whether they are acting in line with your intentions is critical. The Internal Audit Standards and Code of Practice make it clear that internal audit functions should be engaged in reviewing the culture of the organisation, ensuring behaviours are aligned with intentions and with the Board’s appetite to risk. Developments in corporate governance are reinforcing this expectation with the need to evidence effective internal controls over all aspects of the organisation.
The third line teams in larger banks and financial services companies have invested heavily in behavioural science capabilities, particularly as their regulators are focused on issues associated with conduct risk to protect customers. However, for many companies resourcing constraints mean this is not possible.
Academic insight into what really changes behaviour
Recent research has shown that the way to influence culture and behaviours is to make the desired actions easy for individuals to adopt. University of Pennsylvania research* indicates that targeting habits and making the right behaviour effortless has greater impact than traditional interventions that focus on motivation, beliefs and values. The authors recommend focussing on interventions that enable individuals to enact desired behaviours and the prevention of circumvention.
This creates a real opportunity. It suggests that we can focus our attention on measurable aspects of social-structural interventions and their efficacy, in the knowledge that these are the activities that have significant impact on cultural outcomes.
The authors state that social-structural interventions include:
- Legal and administrative sanctions;
- Programmes to increase organisational trust worthiness in the minds of the workforce;
- Initiatives targeting injunctive (or social) norms and accepted behaviour patterns;
- Monitors and reminders of expectations;
- Incentives;
- Support provision; and
- Increased access to policies promoting specific behaviour.
Putting this into practice
We have been working with a number of high-profile organisations needing to evidence that behaviours are aligned with expectations to mitigate reputational risks and evidence that they are compliant with regulatory obligations. These organisations have broad based obligations that underpin societal expectations. They are in sectors where there is public perception that they are not delivering on core expectations and standards.
Our experience is that messaging to the workforce too often fails to engage them. People simply struggle to access and digest the requirements in a meaningful way. Take the example of company policies. We write them with multiple intentions in mind:
- To set out expectations for individual employees, freelancers, partners and contractors about what is expected of their personal behaviours and actions.
- To evidence to stakeholders including investors, funders, partners and regulators (sometimes publicly on our website) that the organisation meets minimum legal and regulatory obligations, with procedures and guidance about how we achieve this; and
- To demonstrate to customers (sometimes as attachments to contracts or agreements) that we are trustworthy and have the processes and procedures in place such that we not greenwashing in any respect.
If the clearest way to influence behavioural change is through enabling individuals to do what is expected of them with ease, is it likely that these policies as currently written will achieve this? Many documents we have seen amount to more than 30 pages in complex, legalese language. It’s almost as difficult to digest as the average Annual Report!
Worse, we see organisations “implementing” policies by simply publishing them and cascading an email. Not enough effort goes to fully engaging people in the organisation about what the policy means for them in their role. Not enough into having detailed processes and controls fully aligned with the high-level policy expectations.
Internal audit can make a difference
Where there is a third line capability, internal audit can make a material difference. Through carefully considering policy documents, alongside associated procedures and guidance, and asking the question: would I really be able to digest this and act on it day-to-day? Can I understand it quickly given all the other time constraints I have? Is it proportionate and reflective of the appetite for risk set by the Board? Has it been embedded?
A starting point to bring about improvement is to be clear on the nature of the risk. Some risks must be taken in order to deliver on strategic objectives – these are risks the organisation needs to encourage individuals to take and reward them for doing so. Other risks need to be minimised – and individuals should be penalised if they take risk outside of clear parameters. Internal audit has deep expertise in assessing and analysing risks.
Where there are risks that need to be minimised, are there policies that set out clear and succinctly, in language the workforce can understand, what an individual must and must not do? How easy is it for the individual to behave in the way the company intends?
In most organisations a thorough review of policies and their implementation with the mindset of how behaviours are influenced could significantly move the dial on cultural alignment. Identifying whether the policies meet all three requirements above. If they don’t, then how are behavioural expectations called out for individuals? Is it clear what the organisation expects?
The good news is that it’s possible to deliver this assurance without specialist behavioural skills or expertise. Some level of training and support may be required to ask the right questions about simplification and engagement. A strong understanding of the nature of the risks is essential. These are skills that can be developed.
The right first step?
Of course, this is not the only necessary intervention or indicator of behavioural alignment. A broader dashboard of cultural levers and indicators is required. Internal audit and other assurance providers need to work closely with the HR or People function. We know that hearts and minds are essential to longer term purpose and strategic delivery. However, as a first and very practical step we believe this improvement is meaningful.
*Albarracín, D., Fayaz-Farkhad, B., & Granados Samayoa, J. A. (2024): ‘Determinants of behaviour and their efficacy as targets of behavioural change interventions’.
AUTHOR.
CAROLYN CLARKE
