By Paulina Iiyambo
Peter Drucker’s famous observation that “culture eats strategy for breakfast” has endured because it captures a truth that many organisations learn the hard way: the best strategy in the world means little if the behaviours of employees and leaders do not support it.
A business can have a compelling vision, ambitious growth targets and sophisticated systems, but success ultimately depends on how people make decisions, respond to challenges and work together every day.
For years, organisational culture has been discussed in leadership forums and boardrooms as something important yet difficult to measure. Today, that is changing.
The latest Organizational Behavior Topical Requirement introduced by the Institute of Internal Auditors (IIA) recognises organisational behaviour as a critical business risk that deserves the same attention as financial, operational, technology and compliance risks.
This marks an important shift. Culture is no longer simply a “people issue” or a matter reserved for human resources. It is increasingly recognised as a strategic asset or liability that can directly influence performance, customer outcomes, regulatory compliance and long-term sustainability.
History provides countless examples of organisations that had policies, controls and governance frameworks in place, yet still suffered significant failures. The common thread was often not a lack of processes, but behaviours that undermined them.
Employees may have felt unable to challenge decisions, incentives may have encouraged short-term gains over responsible conduct, or leaders may have sent mixed messages through their actions. In such environments, even well-designed controls can become ineffective.
The IIA’s new requirement acknowledges this reality by placing organisational behaviour firmly within the risk management and assurance agenda.
At its core, the framework asks an important question: do an organisation’s governance, risk management and control processes encourage the behaviours necessary to achieve its strategic objectives?
This is particularly relevant in today’s business environment. Organisations are navigating economic uncertainty, digital transformation, increased regulatory scrutiny and rapidly evolving customer expectations.
In such conditions, culture can either accelerate success or quietly undermine it. Organisations with healthy cultures tend to adapt more effectively, make better decisions and respond more quickly to emerging risks.
Those with unhealthy cultures often find that warning signs go unnoticed until problems become difficult and costly to resolve.
The new framework highlights three critical areas.
First, governance. Boards and executives must clearly define behavioural expectations and create accountability for them.
Culture cannot be delegated or left to chance. Leadership behaviour sets the tone for the entire organisation, and employees are far more likely to follow what leaders do than what policies say.
Second, risk management. Organisations must identify which behaviours are essential for achieving strategic objectives and actively monitor whether those behaviours are being demonstrated in practice.
Understanding behavioural gaps and addressing their root causes can prevent larger issues from emerging later.
Third, controls. This includes everything from performance incentives and recruitment practices to speak-up mechanisms, training programmes and whistleblowing protections.
These are not merely administrative processes. They are powerful tools that either reinforce or weaken the culture an organisation is trying to build.
For business leaders, the message is clear. Values displayed on office walls are not enough.
Organisations must examine whether their reward structures, performance measures and leadership behaviours genuinely support the culture they aspire to create. If employees are rewarded for outcomes that contradict stated values, the incentives will win every time.
For boards, this presents an opportunity. Rather than waiting for regulators, customers or the market to identify cultural weaknesses, organisations can proactively assess whether their culture aligns with their strategy and risk appetite.
Understanding the gap between intended culture and actual behaviour can provide valuable insights into future performance and resilience.
And for internal audit, the role is evolving. Internal audit has traditionally focused on evaluating financial controls, compliance frameworks and operational processes.
Increasingly, it is being called upon to provide assurance over the behavioural factors that influence whether those controls work as intended.
This is not about auditing personalities or judging individuals. It is about assessing whether organisational systems, incentives and governance structures encourage the right behaviours and support sustainable success.
Ultimately, strategy defines where an organisation wants to go. Culture determines whether it gets there.
The most successful organisations of the future will not be those with the most ambitious strategies alone.
They will be those that create cultures where people consistently make decisions and take actions that bring those strategies to life.
Internal audit’s role is to provide independent assurance that the two remain aligned because when culture and strategy move in the same direction, organisations are far better positioned to achieve lasting success.
