There’s a lot of talk about auditing culture and other significant sources of risk.
I am all for focusing our audit plan on the risks that matter to the enterprise as a whole.
But, let’s not forget that we need to be providing assurance on whether management has the right controls to address those sources of risk and whether they are operating effectively.
A survey or other assessment of the current state, whether of culture or something else, seems to have value.
But it is transitory value. It is an assessment at a point in time. Time marches on and how do we know the conditions…
