Introduction

Data analytics¹ is becoming increasingly important in the business world. Indeed, data analytics has been especially profitable for early adopters like Amazon, Google, and Spotify, which have used it to predict the preferences of consumers. Data analytics has also been applied in the field of auditing to look for patterns that could indicate fraud or non-compliance with regulations, and provide general insight into an organization’s risks.

In the audit profession, data analytics is most often used to explore financial data, but it can also be applied to other types of information. This article argues that auditors can take advantage of the rich data provided by employee surveys to extend data analytics to audits of organizational culture. The article explains why culture audits are important and shows that while using data analytics in culture audits presents some unique challenges, these challenges can be overcome using a programming language, such as Python, to develop analytic functions that can be applied to employee survey data.

Culture audits and proactive risk management

Many organizations never perform internal culture audits. When external conditions make a major organizational transformation necessary, or when the current culture is obviously damaged to the point of hurting organizational success, a culture audit might be considered. However, so long as reports received by senior management indicate that human resource performance goals are being met, culture is generally considered too low risk to be added as a topic in the internal audit plan.

A counterargument to assigning low priority to auditing culture is the quality perspective. According to this perspective, the aim of good management is not only to optimize performance but also to minimize variability in performance in order to achieve objectives and redefine success in terms of surpassing previous objectives.

From the quality perspective, it can be argued that culture is an organization’s most important “soft control” and that auditing culture enables an organization to proactively manage risk and make timely corrections of control failings. To serve an early warning function, culture audits cannot be relegated to an exercise undertaken when elevated risk has become apparent. Indeed, proactive risk management requires a cultural component to be incorporated into every audit engagement.

The quality perspective requires insight into the deep structure of the values, expectations, and practices that define an organization’s culture. This deep insight is not evident in the analysis usually presented to senior management. However, a thorough understanding of the interlocking soft controls that determine an organization’s culture can be obtained by conducting a root cause analysis. By using techniques such as the “five whys”, auditors can determine whether cultural factors are the root cause of specific organizational issues and help explain why an outcome differs from expectations.

About the Author

Philip Lillies is a retired internal auditor (CIA) who has also pursued a lifelong interest in statistics and mathematics. His combination of business and technical skills has led to a data science hobby that requires an intermediate-level understanding of Python. Currently he is working on enhancing the collaboration between internal auditors and Python developers with a view to introducing internal auditors to the tools that data science has to offer.

He is also active on the Government of Canada’s collaboration site, GCcollab, which is open to the public by invitation.

Contact the author at:

plillies@hotmail.com

How employee surveys can contribute to culture audits

Regular employee surveys can provide critical insight into the culture of an organization. These surveys, which are performed by many large organizations, have several advantages over other sources of information, including the following:

• They are anonymous, which means that employees are likely to be more candid than they would be in an interview.
• They yield quantifiable results, which can guide auditors in executing their audits and provide support for audit findings.
• They are efficient, especially if data can be leveraged from employee surveys that are already ongoing in the workplace.

To learn more about using surveys in your audits see here and here.

It is important to keep in mind that culture applies to groups, not individuals within groups. Depending on how it is managed and how it interacts with other groups, each group will have its own subculture, and it is these subcultures that auditors will be interested in. These subcultures will often have important inconsistencies with the culture that the organization aspires to. A culture audit will not only identify these inconsistencies but also provide an understanding of their root causes.

Hence, access to raw data (the individual responses) is not essential for audits of organizational culture; what is required is aggregate data for each group. Indeed, if raw data is provided, auditors will need to analyze the data and rework it into aggregate response scores that reflect the subcultures of groups within the organization. The advantage here is that if the survey owners have already done this data analysis, the respondents’ privacy and anonymity can be preserved by providing only these aggregate scores to internal auditors.

During the initial planning phase of an audit, summaries of this aggregated data can help auditors reach an understanding of where employees may be perceiving cultural inconsistencies in leadership, talent management, ethics, empowerment, psychological well-being, performance management, or other factors. In addition, during annual audit planning, these summaries may be presented to senior management to convince them of the need for a culture audit. For presentation of data summaries, the Python Matplotlib package can be used to create amazing visualizations, such as heatmaps. Figure 1, for example, shows a heatmap created using the aggregate response scores of survey questions as input. The aggregate score for questions under specific themes is shown for each group of employees and a colour scale allows for easy identification of differences between groups.

However, to get the full value from employee survey data, analytics must be applied. Data analytics takes as input the aggregate response scores of survey questions, but goes beyond straightforward analysis. Data analysis may indicate where the problem areas are, but Python data analytic functions can find associations in survey data that answer the first level of whys in a five-why analysis. Once mutually exclusive employee groups with their distinctive subcultures have been identified, data analytic functions can make use of the differing responses across these various organizational groups to provide auditors with an understanding of the key inconsistencies across subculture groups that affect the organization’s culture. In other words, data analytics can provide an insight into the causality behind the organization’s current state, and this insight can be used to develop the audit criteria and instruments that make up the audit engagement work plan.

For example, by comparison with the scores of other subcultures, data analysis might reveal that the engineers have a low aggregate score for a question relating to senior management decision making, which is a very general result, difficult to take action on. However, Python data analytics functions, by identifying inconsistencies across various subcultures, might reveal that dissatisfaction with senior management decision making is associated with dissatisfaction with change management and talent management. These results from data analytics could then be used to inform audit instruments, such as interview questions.

¹ Data analysis and data analytics both involve the manipulation of data to find patterns. However, while data analysis answers questions about what happened, data analytics finds associations between data in order to answer questions about why things happened, what might happen in the future, and what can be done about it.

Page 1 of 3