CIA-1 - Governance, Risk Management, and Control (30% of the exam) - Section C.2
Recognize the impact of organizational culture on the overall control environment and on individual engagement risks and controls.
Explain how organisational culture, meaning the shared values and behaviours of the organisation, shapes the control environment and therefore the risks and controls present in any given engagement. Recognise that decision-making processes and the behaviour modelled by leadership influence governance, risk management, and control outcomes, so culture is a factor the auditor evaluates rather than ignores.
Organisational cultureControl environmentTone at the top
Practice question for this objective
lock_openFree sampleGovernance, Risk Management, and Controlmedium
A new audit committee member at Halloway Group asks how internal audit understands the term organisational culture and how it connects to the organisation's control environment. Which statement best describes this relationship?
ACulture is the formal set of written policies and authorisation limits, and it operates apart from the control environment, which is shaped only by the reporting structure.
BCulture is the shared values, attitudes, and behaviours across the organisation, and it directly shapes the control environment in which the organisation's other controls operate.check_circle Correct
CCulture refers narrowly to the specific control activities that staff perform each day, so it is best assessed by testing individual transactions rather than attitudes.
DCulture is an intangible factor with no measurable effect on control, so internal audit treats it as immaterial when it evaluates the control environment.
Organisational culture is the shared values and behaviours of an organisation, and it shapes the control environment on which other controls depend. The control environment is the foundation of internal control, and it is set by the organisation's culture. Shared values, attitudes, and behaviours determine how seriously people take controls, so a sound culture underpins every other control.
Why A is wrong: It is tempting because policies and authorisation limits are genuine control elements, but this confuses culture with formal documentation and wrongly separates the two, when culture is the values behind the control environment.
Why B is correct: Culture is the shared values, attitudes, and behaviours of people in the organisation, and it forms the control environment, the foundation on which all other controls rest, so the two are tightly linked.
Why C is wrong: This is tempting because control activities are part of internal control, but it confuses culture with control activities; culture is the underlying attitudes and behaviours, not the day-to-day transaction-level procedures.
Why D is wrong: This appeals to the idea that culture is hard to measure, but it is wrong because culture strongly influences control consciousness and is evaluated by internal audit, not dismissed as immaterial.
Exam traps in Governance, Risk Management, and Control
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-1 bank for this domain.
It is the schedule of authorisation limits that dictates which managers may approve transactions of a given value across the business.
errorWhy it is wrong: Authorisation limits are a real control activity, which makes this tempting, but they are a specific procedural control rather than the overarching example and messaging that leadership sets for the organisation.
Provide the audit committee with a firm guarantee that no unethical or non-compliant behaviour will occur anywhere in the organisation in future periods.
errorWhy it is wrong: Offering a guarantee overstates what assurance can deliver; internal audit evaluates and reports, it cannot promise the absence of all misconduct.
Culture is a matter for human resources alone, so internal audit should exclude it from the scope of every engagement that it performs.
errorWhy it is wrong: Human resources does help shape culture, which makes this tempting, but culture underpins the control environment and is squarely within internal audit's remit, not something to exclude entirely.