Culture often sits at the core of both performance and risk but remains one of the most elusive elements to evaluate.
Unlike traditional controls or compliance metrics, culture can be difficult to pin down. It’s nuanced. Often unspoken. And, at times, deeply inconvenient to confront.
Yet understanding it is vital. That’s why frameworks that support the audit of organizational culture are so crucial, and why Prudential’s structured approach is particularly worth examining.
A Structured Approach to Cultural Risk
Prudential has developed a robust framework to enable internal audit to assess culture as part of its core audit processes.
This method doesn’t reduce culture to vague perceptions or isolated anecdotes, it provides structure, consistency, and clarity.
It blends qualitative and quantitative evidence to offer a multi-dimensional view of culture across different functions and levels.
As highlighted in Auditing Culture – Frameworks and Proven Techniques by James Roth, this approach demonstrates how internal audit can take on the cultural question with rigor and relevance.
Step 1: Identifying Cultural Drivers and Audit Topics
The framework begins by identifying eight key cultural drivers; areas that shape how people behave and how decisions are made across the business.
These are then mapped to 35 specific audit topics (not publicly detailed), which help translate broad cultural themes into tangible areas for inquiry.
The cultural drivers include:
- Core Values
- Roles and Responsibilities
- Risk Management Practices
- Talent Development
- Employee Feedback Mechanisms
- Behavioural Accountability
- Risk Appetite Monitoring
- Performance and Incentive Structures
This mapping allows internal audit to align cultural evaluation with operational relevance, ensuring it isn’t abstract but audit-ready.
Step 2: Evidence Gathering Through a Comprehensive Work Programme
For each topic, Prudential applies a two-tiered approach to evidence collection:
- Hard evidence comes from structured data and documents, including employee surveys, performance metrics, and compensation reports.
- Qualitative evidence is gathered via walk-throughs and structured interviews, not only with business managers but also with key functions like risk, compliance, and HR.
This combination allows auditors to explore not just “what is happening” but “why it’s happening” – an essential distinction when it comes to understanding behavioral risk.
Step 3: A Visual, Actionable Stoplight Rating System
Once the data is analyzed, the framework delivers a clear output: a stoplight rating system applied to each of the eight cultural drivers.
These color-coded ratings are then rolled up into an overall “Control Environment and Culture” assessment for each audit project.
This final output offers leadership an immediate, visual understanding of cultural health, one that highlights not just control weaknesses but the deeper behavioral dynamics behind them.
Making Culture Auditable, Not Intangible
Auditing culture doesn’t mean reducing it to checkboxes. It means building the systems and language to understand it holistically and responsibly.
Frameworks like Prudential’s show that it’s possible to embed cultural assessment into audit in a way that is structured, credible, and actionable.
In today’s risk landscape, where reputational and conduct risks are front and center, this kind of visibility into culture is no longer optional.
It’s essential.