The culture of an organization is the cornerstone of a sound internal control environment.

This can be defined as the combined beliefs and behaviors of the people within the organization. Whilst business culture is guided and influenced by the ethics of the society within which the organization operates, it is ultimately determined by the people who make up the organization. It is everyone’s responsibility to understand and uphold the shared values of the organization. It is equally important to recognize that leaders have a special responsibility to “set the tone at the top” and to model the appropriate behaviors. Furthermore, and more difficult to achieve, is the code of conduct whereby individual employees are accountable for the “right” behavior that is consistent with the ethos of the organization. For example, an individual may be required to follow procedures
in specific ethical situations such as a conflict of interest or the acceptance of gifts. The organization must have clear procedures in place to determine whether the employee acted within the code. Furthermore, management must act swiftly to deal with any breaches of the code in a fair and transparent manner.
It is possible to forecast the likelihood of internal control failures based on the fundamental culture of the organization. Those organizations that place more emphasis on the importance of values and ethical behavior are much more likely to attract people with strong moral standards and less likely to breach codes of conduct. As such, the organization whose employment practices clearly delineate procedures under their ethical code is better placed to ensure that the desired ethical qualities are evident in new recruits and that those whose standards of behavior are likely to conflict with those of the company are identified and filtered out.

The numerous company failures over the past decade or so show that the number of incidents of large-scale fraud and poor business practices is increasing. Such stories continue to make news headlines on a regular basis, negatively affecting millions of people and undermining public confidence in large organizations. All of this begs the question as to whether or not society’s standards have deteriorated to the point where breaches are not considered problematic and the legislative environment fails
to offer society adequate protection from these undesirable practices.

Bertrand Russell, the 20th century British mathematician and philosopher said that, “Without civic morality communities perish; without personal morality their survival has no value.” This statement can be equally applied to organizations. Now, more than ever before, it is essential that leaders are seen to uphold the highest level of ethics. According to Viv Oates, it is the application of this concept that will ultimately determine the success, or otherwise, of many large organizations.

Values underpin the culture of the organization and establish the foundation for the organization’s morals.

Whilst values define the standards or principles of behavior espoused by the organization, the code of conduct describes accepted behaviour of employees. Organizations that have developed a durable code of conduct and take steps to ensure that employees follow it, are more likely to establish a sound moral identity and will reduce the likelihood of fraud, corruption or other unethical behavior that could undermine the reputation of the business. Boards of directors, executive management teams and other governance committees and structures have an obligation to implement robust business practices that provide reasonable assurance that the objectives of the organization are achieved in a manner that is socially responsible. Nevertheless, the effectiveness of such conduct codes is contingent on strong management support in terms of sanctions and rewards. No system of internal control can be so “complete” that it is able to prevent and/or detect all potential errors or omissions. In addition to management setting an example and monitoring employee behavior, there needs to be substantial reliance, firstly, on the ethical standards of the employees, secondly, on the ethical standards of other stakeholders and, finally, on the ethical standards of the broader society. Where these standards deteriorate, the organization is exposed to substantial risk which could ultimately threaten its survival.

In the past decade, there have been many examples of large scale organizational failure resulting from reputational damage. These examples serve to underline the importance for us, as individuals acting within our families, communities and business environment, to be conscious of the choices we make.

Ethical behavior refers to actions taken that are not only in the best interests of the person involved, but all others who may be affected by it. The behavior of each of us has a definite impact on every sphere of our lives and throughout society. However, a recent survey found that there is still an alarming tolerance for unethical behaviors:

• 47% of respondents thought that one or more types of unethical behavior was acceptable to help a business get through the downturn.

• 25% of respondents thought it was acceptable to make cash payments to win new business.

• 13% of senior managers and board members polled stated that misstating financial performance was justifiable in today’s economic climate.

Senior executives who regularly test the ethical standing of their organization have a much better understanding of the risks the entity is potentially exposed to and can take preventative action. The internal audit function has a significant role to play in this. It is essential to have an appreciation of the ethical standing of the business in order to understand the control environment, as this will inform the nature and extent of testing that may be required to give the appropriate assurance to the board of directors. Regular surveys should be conducted to measure the ethical standing of the organization and to understand changes both within the organization and more broadly, if possible.

It is everyone’s responsibility to understand, uphold and behave in accordance with the shared values of the organization.

Table 1. Oates recommends that an annual survey of employees which includes the following types of questions and scoring is extremely useful:

No.	Question	Strongly agree	Agree	Neither agree nor disagree	Disagree	Strongly disagree
1	My organization has a clear set of values and ethical standards that are well communicated and understood by all employees
2	The leaders of my organization demonstrate sound ethical standards and lead by example
3	My direct management set a good example of ethical behavior
4	I understand the values and code of conduct and comply with the highest standards of ethical behavior
5	People within the organization generally comply with the highest standards of ethical behavior
6	I am aware of people within the organization that have breached the values and code of conduct
7	There is an anonymous mechanism to report breaches
8	Management take appropriate action against employees who breach the code of conduct
9	External people to the organization believe that the organization has a strong ethical culture
10	There is a need for significant improvement in the ethical behavior of employees

On the basis of a simple scoring of 1 to 5 for the responses from “Strongly disagree” to “Disagree” to “Neither agree nor disagree” to  “Agree” to “Strongly agree” it is possible (although improbable) to achieve a maximum score of 50 and a minimum score of 10.

Scores above 40

Your organization demonstrates a high moral standing. It is important to continue doing what you are doing to maintain such a high level of ethical compliance. However, complacency is not an option, as the situation can change very rapidly.

Scores between 30 and 40

The organization is finely balanced on a “tipping point”. There are areas that require improvement, and unless there is a continued and focused effort to lift the
overall moral standing of the organization, deterioration could occur rapidly.

Scores below 30

The organization’s code of conduct is dangerously low and there is a likelihood that fraud, corruption or other highly undesirable behavior occurs. Immediate focused and intensive remedial action is required to change the situation. Substantial and deliberate intervention is required over time to ensure that the situation changes.

A score below 20 will require a material intervention that may include a full scale restructuring.
The “tone at the top” is established by a continuous and deliberate effort and cannot be taken for granted. Senior executives should be measured on the extent to which they implement programs to influence moral behavior, communicate acceptable standards, live by example, and take action against breaches of ethical business practices. The benefits of a successful program justify the investment made and will boost the organization’s reputation, contribute to a happier workforce, increased trust from internal and external stakeholders and, ultimately, a better financial performance.

The internal audit function can play an active role in the improvement of the ethical standards of the organization by supporting special programs.

The internal audit function can directly influence the appropriate business practices. Boards of directors and executive management teams should ensure that the internal audit function reports regularly on any activities that may either positively or negatively impact on the reputation.

The following key questions can be posed to determine whether or not sufficient emphasis is being placed on this critical aspect:

1. Does the organization have a clear set of values that is well communicated, understood and upheld?

2. Does the organization have a Code of Conduct which sets out the essence of acceptable business practices?

3. Does the organization have an integrated program, including a culture charter, for updating, communicating, re-enforcing, training and measuring progress in relation to ethical standards?

4. Are there regular training programs (including induction training) using appropriate examples and case studies on the examination of ethical questions?

5. Does the subject of ethical behavior form a central part of performance appraisals?

6. Are people held accountable for unacceptable behavior and appropriately, consistently and transparently disciplined for breaches?
7. Does the organization have a well publicized “Hot Line” where breaches can be anonymously reported and tracked?

8. Are regular climate surveys conducted to establish the level of moral standing of the organization?

9. Are enhancements made to existing programs and improvements introduced to drive the organization further up the maturity curve?

10. Does the internal audit function play a significant role in investigating breaches, conducting climate surveys, reporting results and monitoring activities that have an impact on the reputation of the organization?

By regularly challenging the organizational culture and reviewing and measuring the programs to improve the ethical standing of the organization, the board of directors and executive managers establish the right “Tone at the top”, which is essential to strengthening the overall control environment and ultimately the sustainable performance of the business.

Without civic morality communities perish; without personal morality their survival has no value.