Published by The Institute of Internal Auditors

Issue 50 March 2011

Exclusively for Senior Management, Boards of Directors, and Audit Committees

Soft and Strong: A Best-practice Paradox

H ow often have you heard of organizations referred
to in such terms as:
subculture that sometimes can be contradictive to the tone
set by those at the very top. This magnifies the importance
and complexity of assessing soft controls to determine
ƒƒ Having a per vasively toxic and dysf u nctional whether there might be gaps between stated and actual
atmosphere? corporate values at any level that would signify specific
ƒƒ Depicting a mentality of “do as I say, not as I do?” weaknesses in the corporate culture.
ƒƒ Following a tone at the top that talks the talk,
but does not walk the walk?
ƒƒ Demonstrating an entity wide “cover yourself ”
mindset? The corporate culture is
If you are like many in today’s business environment, the most powerful control
just reading these descriptions will make your shoulders in any organization.
tighten and your stomach churn! But we’re not talking
hypothetically… Countless executive leaders, boards of - Jim Roth, author
directors, and audit committees ignore what has become Best Practices: Evaluating the Corporate Culture
a broken and per vasively negative cult u re in their
organizations — so much so that it’s actually “business
Unlike cut-and-dry, clearly defined controls, soft controls
as usual” in their world.
are extremely subjective and intangible. And auditing them
It’s interesting that internal controls related to these types is neither simple, nor black and white; neither prescriptive,
of settings are labeled “soft.” Actually, there’s nothing soft nor predictable. In other words, one size does NOT fit all.
about either working under, or trying to improve, such Yet, corporate failures of the past and best practices point
circumstances. This is hard stuff — very hard. to the need for assessing the integrity of an organization’s
soft controls. It’s essential to providing management and
Even in companies where executive management models the board assurance that the organization will not join the
the highest ethics, business units may create their own ranks of those that have been brought to their knees by
lagging ethics and a weak corporate culture.

EXAMPLES OF SOFT CONTROLS A Framework for Control

ƒƒ Tone at the top ƒƒ Corporate attitudes Obtaining reliable information about soft controls is one
ƒƒ Morale ƒƒ Openness of the most difficult challenges internal auditors must
ƒƒ Competence ƒƒ Shared values confront, and it can be quite daunting. The Institute of
ƒƒ Ethical climate ƒƒ Leadership Internal Auditors (IIA) Research Foundation recently
ƒƒ Operational ƒƒ Expectations released Best Practices: Evaluating the Corporate Culture,
philosophy ƒƒ Employee by James (Jim) Roth, PhD, CIA, CCSA. This research report
ƒƒ Empowerment motivation delves into creative and innovative practices implemented
ƒƒ Trust ƒƒ Integrity by exemplary organizations to ensure soft controls are
working effectively.
Using the Committee of Sponsoring Organizations of the
Treadway Commission’s Internal Control — Integrated
WORST PRACTICE EXAMPLE
Framework components, the study categorizes soft controls
Enron’s failure in 2001 kicked off a wave of public
under each of the following:
scandals and led to the U.S. Sarbanes-Oxley Act
ƒƒ Control Environment of 2002 and similar regulations in other countries.
ƒƒ Risk Assessment This company’s formal governance structure was
ƒƒ Control Activities seemingly strong, but the informal communications
ƒƒ Information and Communication and behavior of management created a culture
ƒƒ Monitoring that was almost diametrically opposed to its stated
values. An internal audit department that had focused
According to the study, examples of soft controls in the control on evaluating soft controls might very well have
environment that should be assessed include such things as identified the gaps between the stated corporate values
integrity and ethical values, commitment to competence, and and the values that were practiced in reality.
the structure of reporting relationships and information f low.
SOURCE: Best Practices: Evaluating the Corporate Culture by Jim Roth.
Also critical is the extent to which the board of directors or audit
(Available from the IIA Research Foundation at www.theiia.org/bookstore)
committee is involved with and understands the organization;
as is management’s philosophy on leading by example and
fostering an atmosphere of mutual trust.
The participative, risk-based audit approach includes collaboration
between the internal auditor and management to delineate
Guidelines for Evaluating
business objectives, risks, and likelihood and impact of each
the Corporate Culture
risk. It also includes the participation of, and alignment with,
Tools highlighted in the study include surveys conducted during
various levels of the organization. Focusing on the design of
audit projects, participative and risk-based audits, entity-level
the controls and investigating the cause of the findings will
interviews, entitywide surveys, and soft control reports.
uncover weaknesses in the system. Finally, the internal auditors
Surveys should use statements or questions in simple lay should be experienced, have good interpersonal skills, and be
language that asks for a level of agreement or disagreement able to tailor the approach to the style of the manager.
on a scale. They should be field tested to ensure clarity and
When conducting entity-level interviews, the guidelines mirror
optimal value. After assuring confidentiality, participants should
those delineated above for audit project interviews, plus asking
be asked to explain any negative responses, and perceptions
questions that force people to think, reading body language
should be validated for accuracy.
and tone of voice, and asking for concrete examples. The

FIVE PRINCIPLES FOR EVALUATING SOFT CONTROLS

1. Ask “constructively challenging” questions of management and “confirming” questions of employees.
2. Identify and obtain management’s agreement on the criteria for evaluation and what will constitute legitimate
audit evidence.
3. Get “hard” evidence about the results of the soft control when possible.
4. Focus on the underlying management process.
5. Develop and report results in partnership with those accountable. Use appropriate (perhaps informal) means of
reporting.

SOURCE: Jim Roth’s seminar, “Five Principles for Evaluating Soft Controls.”
participative, risk-based audit project guidelines also apply
to entitywide soft control surveys. These surveys require
proactive support from the top. They will also serve as an
upward or peer evaluation. However, confidentiality must
be balanced with the ability to follow up on the issues, and
the number of issues addressed must be balanced with the
length of the survey. Sometimes an existing survey can be
updated and enhanced to serve as an effective entitywide
survey.

When reporting on soft controls, some audit departments

only provide verbal reports. However, formal reports are
preferable as long as they can be delivered without creating an
adversarial relationship with the managers who are audited. In
order for it to work, the organizational culture must support
the process and buy into the value of formal reporting. In
such environments, the audit process is regarded as a path
to improvement — an opportunity for good managers to
grow into great managers.

Because soft controls are highly subjective, evaluating them

objectively can be quite a challenge. The internal auditors
must provide persuasive evidence indicating soft control
weaknesses. If such evidence cannot be obtained, internal A View of Value from the Top
auditors should express their perception to the responsible The 19 successful organizations cited in this research report
manager, allowing that individual to fix the situation without said that their upper management and audit committees value
involving higher levels of management. And certainly, soft control auditing more than traditional audit work. This
all comments in the audit reports should be phrased very should speak volumes to those at the top of organizations
carefully and should provide a full perspective. everywhere — especially those who might think of “soft”
as being synonymous with “unimportant” or “unnecessary.”
And if they are not convinced of best practices by this study,
perhaps they have already forgotten the lessons the corporate
Meet the Author world and its stakeholders learned from practices exhibited
Jim Roth, the author of the at the opposite end of the spectrum.
research, emphasizes that
those at the top should pay
particular attention to the
culture that exists within
their organizations. “The Please Take our readers survey!
corporate culture is the most We hope you enjoy your complimentary issues of
powerful control in any The IIA’s quarterly newsletter, Tone at the Top.
organization,” says Roth. “The root cause of every Please take a few minutes to let us know what you
major control breakdown — Enron, WorldCom, think of the publication. Just visit the following
Tyco, etc. is a weakness in the culture. More than website link to access our online reader’s survey.
anything else, stakeholders need assurance that the Your input will help us ensure the content is
‘soft controls’ that create and embody the corporate relevant and of value. To take the short survey, visit:
culture are sound.” www.theiia.org/tonetopsurvey.
247 Maitland Ave.
Altamonte Springs, FL 32701-4201 USA

Mission Complimentary Subscriptions Available

To provide executive You, your colleagues, and your audit committee and
management, boards board members are invited to receive complimentary
of directors, and audit subscriptions to Tone at the Top. Visit the online
committees with concise, subscription request form at: www.theiia.org/
leading-edge information on periodicals/newsletters/tone-at-the-top or write to us at:
such issues as ethics, internal The Institute of Internal Auditors
control, governance, and the Corporate Communications
changing role of internal 247 Maitland Ave.
auditing; and guidance Altamonte Springs, FL 32701-4201 USA
relative to their roles in, and Fax: +1-407-937-1101
responsibilities for, the internal audit activity.
E-mail your comments about Tone at the Top to: Tone at the Top is also archived online. To reprint,
PR@theiia.org translate, or post this edition of Tone at the Top, contact
+1-407-937-1247 PR@theiia.org.

(www.theiia.org) is dedicated to the global promotion and

development of internal auditing.

Established in 1941, The IIA is an international professional association with global headquarters in Altamonte
Springs, Fla. The IIA has more than 170,000 members in internal auditing, risk management, governance, internal
control, IT auditing, education, and security.

The IIA is the global voice, recognized authority, chief advocate, principal educator, and acknowledged leader
in certification, research, and technological guidance for the internal audit profession worldwide. The IIA enhances
the professionalism of internal auditors and is internationally recognized as a trustworthy guidance-setting body. It
fosters professional development, certifies qualified audit professionals, provides benchmarking, and through The
IIA Research Foundation, conducts research projects and produces educational products.

2/11166/LK/GS
Printed in the U.S.A. on recycled paper.