Auditing Organisational Behaviour & Culture

This day explores the foundations of organisational behaviour and behavioural risk, examining how behaviours influence governance, risk management and control effectiveness. Participants will review behavioural drivers, risk indicators, cultural influences and the role of internal audit in providing behavioural assurance. The topics covered will include:

Understanding Organisational Behaviour

• Moving from organisational culture to observable behaviour
• Understanding how actions, decisions and interactions shape outcomes
• Distinguishing individual incidents from systemic behavioural patterns
• Identifying formal and informal behavioural drivers
• Connecting behaviour with governance, risk and internal control

Understanding Behavioural Risk

• Defining behavioural risk in an organisational context
• Identifying behaviour misaligned with organisational objectives
• Understanding the impact of pressure on decision-making
• Recognising behavioural warning signs and red flags
• Incorporating behavioural risk into the audit universe

Behaviour & the Control Environment

• Understanding why well-designed controls may fail
• Management override and informal workarounds
• Normalisation of control deviations
• Behavioural drivers behind recurring audit findings
• Identifying gaps between documented policies and actual practice

Defining Internal Audit's Role

• Responsibilities of management, HR, risk, compliance and internal audit
• Determining when organisational behaviour should be audited
• Standalone behavioural audits versus integrated behavioural testing
• Establishing engagement objectives and scope
• Maintaining independence and objectivity in sensitive engagements

This day explores how governance arrangements, leadership behaviour, incentive systems and accountability mechanisms shape organisational conduct. Participants will examine oversight responsibilities, leadership influence and behavioural consequences arising from organisational pressures. The topics covered will include:

Governance of Organisational Behaviour

• Board oversight of organisational behaviour and culture
• Senior management accountability
• Roles and responsibilities across the Three Lines
• Connecting organisational values with behavioural expectations
• Escalation and reporting of significant behavioural risks

Tone at the Top & Tone in the Middle

• Evaluating leadership messages and actions
• Testing consistency between stated values and actual behaviour
• Assessing management response to challenge and bad news
• Understanding middle-management influence
• Identifying inconsistencies across management levels

Incentives & Performance Pressures

• Financial and non-financial incentives
• Targets and unintended behavioural consequences
• Reward and recognition systems
• Promotion and career incentives
• Excessive performance pressure and risk-taking behaviour

Ethics, Conduct & Accountability

• Codes of ethics and conduct
• Translating policy into day-to-day behaviour
• Conflicts of interest and ethical decision-making
• Consistency of disciplinary action
• Accountability for behavioural standards

This day explores reporting culture, psychological safety and the behavioural signals that can provide valuable assurance insights. Participants will assess escalation practices, behavioural indicators and measurement approaches used to evaluate behavioural risk across organisations. The topics covered will include:

Speak-Up & Escalation

• Formal and informal reporting channels
  
• Whistleblowing arrangements
• Escalation of risk and control concerns
• Confidentiality and protection against retaliation
• Management response to reported concerns

Psychological Safety & Constructive Challenge

• Employee willingness to challenge decisions
• Confidence in raising concerns
• Fear, silence and avoidance behaviours
• Leadership response to dissent
• Identifying environments where problems may remain hidden

Behavioural Risk Indicators

• Whistleblowing trends
• Employee turnover and absenteeism
• Grievances and disciplinary cases
• Customer complaints and conduct events
• Performance, incentive and compliance data

Behavioural Assurance Dashboards

• Leading and lagging indicators
• Driver, behaviour and outcome measures
• Comparing teams, functions and locations
• Establishing thresholds and escalation triggers
• Avoiding misleading conclusions from individual metrics

This day explores the processes required to prepare, execute and evidence behavioural audit engagements. Participants will examine planning techniques, interview practices, organisational data analysis, evidence evaluation and behavioural root-cause assessment. The topics covered will include:

Planning the Engagement

• Conducting behavioural risk assessment
• Developing engagement objectives
• Establishing appropriate evaluation criteria
• Determining scope and audit populations
• Developing a behavioural audit work plan

Interviews & Focus Groups

• Designing effective behavioural audit questions
• Structured and semi-structured interviews
• Conducting focus groups effectively
• Identifying recurring patterns and contradictions
• Managing confidentiality and sensitive disclosures

Surveys & Organisational Data

• Using employee and culture surveys
• Analysing HR, compliance and conduct information
• Evaluating whistleblowing and incident data
• Comparing information across organisational populations
• Recognising bias, limitations and data-quality issues

Evidence Triangulation

• Combining interviews, surveys and organisational data
• Separating perception from audit evidence
• Corroborating management explanations
• Evaluating evidence sufficiency and reliability
• Documenting professional judgement

Behavioural Root-Cause Analysis

• Moving beyond individual misconduct
• Identifying systemic behavioural drivers
• Connecting leadership, incentives and control design
• Recognising recurring behavioural patterns
• Distinguishing symptoms from underlying causes

This day explores how behavioural audit results can be evaluated, communicated and monitored to support effective assurance and sustainable improvement. Participants will review reporting practices, remediation approaches and board-level behavioural risk assurance. The topics covered will include:

Developing Behavioural Audit Findings

• Distinguishing isolated incidents from systemic issues
• Connecting behavioural findings with organisational risk
• Establishing condition, cause and consequence
• Assessing significance and potential impact
• Developing defensible assurance conclusions

Reporting Sensitive Behavioural Issues

• Using neutral and evidence-based language
• Avoiding subjective or judgemental conclusions
• Presenting qualitative findings credibly
• Managing disagreement with senior management
• Escalating significant behavioural concerns

Board & Audit Committee Assurance

• What boards need to understand about behavioural risk
• Reporting emerging patterns and systemic themes
• Combining behavioural indicators with audit evidence
• Communicating uncertainty appropriately
• Providing assurance over governance and control effectiveness

Remediation & Sustainable Change

• Addressing policies, incentives and governance structures
• Addressing leadership and management behaviour
• Developing measurable corrective actions
• Assigning accountability for improvement
• Coordinating remediation across organisational functions

Follow-Up & Continuous Monitoring

• Developing follow-up indicators
• Testing whether behaviour has changed
• Monitoring recurring behavioural patterns
• Evaluating the sustainability of corrective action
• Determining when further escalation is required