Look closely at the root causes behind major corporate failures, and you’ll often find a common thread: behavioural risk.
Toxic culture, unspoken norms, undue pressure, and decision-making blind spots.
For years, internal audit functions have addressed the technical and operational aspects of risk, but largely ignored the behavioural drivers behind them. That’s starting to change, and not a moment too soon.
Why Behavioural Risk Can No Longer Be Ignored
Audit teams are often great at identifying control breakdowns, gaps in compliance, or process inefficiencies. But when it comes to the underlying behaviors that contribute to those breakdowns, many functions remain unequipped or unsure where to begin.
And yet, it’s behavioural risk – when decisions, attitudes, and conduct drift from an organization’s values or objectives, that often drives the most damaging outcomes.
Ignoring this dimension not only limits the scope of internal audit but also weakens its ability to function as a truly strategic partner to the business.
A Step Forward: The IIA’s New Draft Guidance
In a significant and welcome shift, the Institute of Internal Auditors (IIA) has released a draft for public comment focused on auditing behavioral risk.
This marks a bold step forward in addressing what has long been a grey area in internal auditing.
The document was shaped by a powerful collaboration between internal audit professionals, like Sandro Boeri, and behavioral science experts such as Dr. Wieke Scholten. By blending these perspectives, the IIA is helping formalize a much-needed methodology.
It defines behavioral risk as:
“The risk that behavior is inconsistent with an organization’s strategic objectives.”
It also provides broad principles and recommendations to guide internal audit functions, recognizing that there is no one-size-fits-all solution, but that a starting point is essential.
What This Means for Internal Audit Leaders
This guidance doesn’t demand perfection or prescriptive tools. What it does offer is a minimum viable framework – a baseline for teams to begin embedding behavioral insights into their audit work programs.
From assessing tone at the top to evaluating cultural misalignments to detecting signs of systemic misconduct, the tools are beginning to emerge.
Now the responsibility shifts to us.
It’s time to go beyond metrics and procedures and start auditing the mindsets and behaviors that actually shape business outcomes.
This Is a Strategic Moment. Let’s Not Waste It.
Behavioral risk isn’t an abstract concept, it’s often the root cause behind compliance failures, reputational damage, and lost stakeholder trust.
For internal audit to remain relevant and valuable, it must evolve alongside the complex realities of business.
That evolution starts here.
Let’s use this moment to:
- Educate boards and senior management about the importance of behavioral risk.
- Adopt and adapt the IIA’s framework into our audit plans.
- Position audit functions as not just guardians of compliance but trusted advisors on culture and conduct.
The spark has been lit. Now, it’s up to us to carry it forward.