Focus on people: Behavioral and cultural risks as a compliance hotspot

How auditing and compliance can reveal “soft” risks

The best processes, systems, and control mechanisms are of little use if they are not put into practice. Experience shows that the causes of rule violations or fraudulent acts often lie not in structural weaknesses in the organization, but in behavior, the environment, or corporate culture.

“Compliance is more than just following rules. It is the result of a lived attitude.”– Florian Habel

While technical risks, processes, and documentation requirements are usually easy to identify, the soft side of risks—i.e., values, communication, leadership, and trust—often remain unexamined. Yet it is precisely these factors that make a functioning governance system sustainable.

Recognizing behavioral risks – before they become a problem

Behavioral and cultural risks are not reflected in charts or accounting entries, but in everyday life:

• In the tolerance of grey areas

• In the Supression of critical voices

• In an environment where “it'll work out somehow”

Typical cultural risks:

• Low error or feedback culture

• Unclear ethical orientation of leadership

• Fear of consequences when reporting issues

• Trivialization of rule violations

• Low trust in internal reporting channels

  
  

In my work as an audit manager and special auditor, I have repeatedly seen how behavioral patterns can undermine control systems in the long term, even if they work on paper.

Whistleblowing and reporting systems – lots of potential, little trust

Internal reporting systems are a key tool for identifying behavioral risks. However, even with good technical implementation, their effectiveness remains low if there is a lack of trust – or if reported incidents are swept under the carpet internally.

“A whistleblower system without credible follow-up is like a fire alarm that no one takes seriously.“

Auditing can play a supporting and reviewing role here:

How is the system implemented? Is it being used? And above all: How does the organization respond to feedback? How can corporate culture be made auditable?

Culture cannot be measured directly—but it can be observed in a structured way and integrated into audit processes. Through interviews, cultural indicators, deviation analyses, or special cultural surveys, patterns can be identified that point to soft risks.

Audit approaches from practice:

• Interviews with employees on leadership behavior and decision-making processes

• Evaluation of anonymized reports and their processing

• Comparison of lived and communicated value orientation

• Inclusion of cultural issues in compliance checks

Conclusion: Culture can be audited – if you are willing to look. A broad range of experience on the part of the auditors is essential.

Trust, leadership, and attitude are not secondary issues – they are an essential part of functioning compliance structures. Those who do not put people at the center will never fully understand the risks – no matter how strong the control systems are.

“People are not the risk – but they are the key to a functioning system.”– Florian Habel

Contact us now for advice on assessing cultural risks and further developing your compliance structures.

Contact