www.iia.org.uk/culture

McKinsey 7S questions Visit www.iia.org.uk/culture for more information about auditing organisational culture.

Question Observations

Shared values

1 Are the value statements and codes of conduct clear and meaningful?

2 Are values regularly reviewed, evaluated and approved at Board level?

3 Do senior managers proactively (formally and informally) communicate the organisation’s values and codes of conduct?

4 Does senior management behaviour exemplify the values and codes of conduct — do they 'walk the talk?'

5 Do employees understand the values and codes of conduct?

6 Are the values and code of conduct reinforced? – the stories, symbols, rituals etc. that relay success.

7 Are the values built into strategy documents, objectives and decision making?

8 Do employees acknowledge, accept and apply the values and codes of conduct?

9 Are there barriers (real or perceived) to the implementation of values and the code of conduct?

www.iia.org.uk/culture

Question Observations

Style

1 Are the board and audit committee involved sufficiently in evaluating the effectiveness of the 'tone at the top?'

2 Do the board and managers show a desire to address culture issues in an open and transparent way?

3 Do the board receive sufficient and timely information about sensitive issues?

4 Are the board and audit committee members independent of management and willing to ask the tough questions?

5 Do informal and formal processes exist for employees to be able to raise issues about behaviour i.e. grievance, whistleblowing etc.?

6 Where this has arisen are the issues taken seriously?

7 Do employees feel that senior managers listen to their ideas and suggestions?

8 Are exceptions to policy allowed under clearly defined conditions? When they occur are they documented, explained, and reviewed?

9 Compliance with the law and regulations is taken seriously?

10 Are mistakes treated as an opportunity for improvement or used to apportion blame?

11 Do managers foster teamwork and an atmosphere of mutual trust?

www.iia.org.uk/culture

Question Observations

Skills

1 Are the skills, experience and knowledge of people matched to the competencies required for the job?

2 Are training programmes visible and accessible to all?

3 Is training aligned to shared values – e.g. ethical business, customer treatment?

4 Is training aligned with the skills and knowledge necessary for the job?

5 Is training an expression that people in the organisation are valued?

6 Are there multiple training options to fit circumstances and needs?

7 Are training programmes evaluated to ensure they are effective?

8 Are there arrangements in place to ensure sharing of skills and knowledge?

www.iia.org.uk/culture

Question Observations

Staff

1 Do employees have job descriptions that align with the values and codes of conduct?

2 How does the recruitment process emphasis the values/code of conduct and seek to align these expectations with that of candidates?

3 Do employees understand their job descriptions?

4 Do managers and employees regard performance appraisals as frank with constructive discussion of performance issues versus 'going through the motions'?

5 Do performance objectives include how employees are demonstrating the values and codes of conduct in their day to day working?

6 Do employees feel performance targets are SMART? (specific, measurable, achievable, realistic, time-related)

7 Do employees feel that they have an equal chance of promotion based upon merit?

8 Do bonus packages and other performance measures reward the right behaviour?

9 Are employees unduly pressured to meet targets? ‘Whatever it takes’.

10 Is the staff appraisal process applied consistent and fairly?

11 Are there mechanisms in place to capture and evaluate employee ideas on improvements to ways of working?

www.iia.org.uk/culture

Question Observations

Strategy

1 Is strategy and supporting objectives of business units clearly set out and aligned to those of the organisation?

2 Strategy and objectives of business units are periodically re-assessed and re-aligned?

3 Do employees feel that strategic objectives apply to them? ownership?

4 Do employees have job descriptions and performance objectives that align with strategy and objectives?

5 Do managers and employees understand the risks they face?

6 Are employees encouraged to understand risks and be involved in the risk management process?

7 Is the organisation’s risk appetite understood and applied to objectives and decisions by managers and employees?

8 Are plans and actions put in place when there is divergence of actual performance from strategic objectives?

www.iia.org.uk/culture

Question Observations

Structure

1 Does the structure of the business unit facilitate the flow of information upwards, downwards, and across organisational lines?

2 Are reporting relationships appropriate? (2nd and 3rd lines of defence have sufficient independence of the activities they are providing assurance upon)

3 Are accountabilities clearly defined?

4 Are responsibilities and accountabilities clearly communicated and understood?

www.iia.org.uk/culture

Question Observations

Systems

1 Are the values built into and impact decision making processes?

2 Is there a common and clearly understood set of processes set that underpin core business activities?

3 Do employees consider controls and regulations within system are necessary and apply to them?

4 Security of personal data within systems is taken seriously?

5 Does the organisation take customer service complaints seriously?

6 Are customers complaints communicated to the appropriate levels of management and responded to appropriately in an open and effective way?

7 Does the organisation take customer complaints seriously?

8 Is the appointment of suppliers and contractors transparent and equitable?

9 Is the organisation committed to working ethically with business partners?

10 Does the organisation have adequate procedures to prevent bribery and corruption?