Stakeholders want assurance that their organization will not be the next highly publicized failure. To give them that assurance, we must identify the potential causes of such failures: weaknesses in the corporate culture. This book argues that evaluating the corporate culture is an internal audit best practice and gives practical examples of how this can be done.

Evaluating soft controls tone at the top, the organization s ethical climate, and management s philosophy and operating style and reporting weaknesses to those accountable is perhaps the greatest challenge internal auditors have ever faced. Traditional auditors believe we cannot and should not try to do this because of the subjectivity involved. Best practice audit departments like those featured in this book, however, have found ways to do so effectively. Highlights include:
The nature of soft controls and why internal auditors need to evaluate them.
Using surveys and interviews to evaluate soft controls within a specific area or process.
Using surveys and interviews to evaluate entity-level soft controls. Using a combination of surveys, interviews, and workshops during audit projects and for entity-level reviews.
Guidelines for using each of the techniques.
Proven soft control evaluation tools from 21 organizations.

This research report began as an update to the author s 1997 study, Control Model Implementation: Best Practices. That book was part of the vibrant control self-assessment (CSA) movement of the 1990s, which was fostered in large part by the first Committee of Sponsoring Organizations of the Treadway Commission (COSO) report, Internal Control Integrated Framework.

Best Practices: Evaluating the Corporate Culture aims to give readers who have hesitated to evaluate soft controls because of the tremendous challenge involved what they need to get started. And readers who are experienced in this realm will find something to help them do even better.