Impact of Organization Culture on Internal Controls
The COSO defines Internal Control as “a process, effected by an entity’s board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: effectiveness and efficiency of operations; reliability of financial reporting; and compliance with applicable laws and regulations.” It further defines Control Environment as – “The control environment is an organization’s culture, beliefs, and values. It includes the integrity, ethical beliefs, and competencies of its people, which are visible in management’s operating style, how management assigns authority and responsibility, and how management organizes and develops its employees. Another indication of the control environment is the degree of involvement from its board or directors.”
In other words, Organization Culture is the sum total of the psychology and attitudes which are communicated by the leadership team to the employees and the ethics, values and beliefs which are incorporated for execution of work and obtaining business objectives. Now that connections between internal controls, control environment and organization culture are clear; the next question is what the impact of organization culture on internal controls is?
Let us understand the constituents of organization culture and drive the impact on internal controls.
Leadership: Organization culture is defined by the leadership of the organization. The CEO is the torch-bearer of culture. The mission, vision and strategy communicated by the senior management are the glue which holds the organization together and moves everybody in the same direction. Lack of clear direction, frequent and abrupt changes and arbitrary decisions in mission, vision and strategy contribute to the negativity in the culture. This also results in various departments having different work cultures and working in a counter-productive manner. This directly impacts the efficiency and effectiveness of business operations. Depending on the level and clarity of leadership communication, the organization at a macro level may be in high, medium or low risk.
Ethics: Business ethics show in all aspects of business conduct, from the board room strategies to the front desk personnel. It goes beyond legal requirements, and shows whether business is conducted on values of integrity, honesty and fairness. It shows whether employees at all levels are able to walk the talk. A clearly defined and implemented code of conduct improves the culture. However, an organization which has not implemented a code of conduct may have a negative organization culture. In such a case, decisions are taken arbitrarily; organization lacks transparency and may disregard laws and regulations to achieve profitability. Commitment to follow the business ethics, reflect whether organization has high, medium or low compliance risk. High compliance risk raises questions on reliability and authenticity of financial statements.
