A new audit committee member at Halloway Group asks how internal audit understands the term organisational culture and how it connects to the organisation's control environment. Which statement best describes this relationship?
- ACulture is the formal set of written policies and authorisation limits, and it operates apart from the control environment, which is shaped only by the reporting structure.
- BCulture is the shared values, attitudes, and behaviours across the organisation, and it directly shapes the control environment in which the organisation's other controls operate. Correct
- CCulture refers narrowly to the specific control activities that staff perform each day, so it is best assessed by testing individual transactions rather than attitudes.
- DCulture is an intangible factor with no measurable effect on control, so internal audit treats it as immaterial when it evaluates the control environment.
Why A is wrong: It is tempting because policies and authorisation limits are genuine control elements, but this confuses culture with formal documentation and wrongly separates the two, when culture is the values behind the control environment.
Why B is correct: Culture is the shared values, attitudes, and behaviours of people in the organisation, and it forms the control environment, the foundation on which all other controls rest, so the two are tightly linked.
Why C is wrong: This is tempting because control activities are part of internal control, but it confuses culture with control activities; culture is the underlying attitudes and behaviours, not the day-to-day transaction-level procedures.
Why D is wrong: This appeals to the idea that culture is hard to measure, but it is wrong because culture strongly influences control consciousness and is evaluated by internal audit, not dismissed as immaterial.