Culture (noun): the set of shared attitudes, values, goals, and practices that characterizes an institution or organization
If you think culture is too “soft” to audit, you’re probably looking in the wrong places. Culture has always been integral to management systems. It is what your auditor instinct notices as you start reviewing system documentation and begin your opening meeting. It’s not tangible and yet it’s there slowly forming an image in your mind’s eye. When you conclude that the organization is committed to quality, safety or whatever standard you may be auditing against.
Culture cannot be found in documented procedures, necessarily. Culture is in how personnel embrace the “What’s in it for me?” and contribute to the overall objective of the system. It’s where the vision is clearly shared and understood. It’s the way work is done.
The undocumented and intangible cause auditors to push back on these topics. They question how it can be audited and perhaps rightly so. After all should an audit not be based on objective evidence without the introduction of feelings and opinions? Yes and not everything in a system is documented. For example the person’s knowledge of their process, of what constitutes a potential risk, and more.
In this article I address how auditors can assess the culture of an organization
Why Culture Matters to Management System Performance
Culture is what people do even when there is no oversight, when no one is looking. Culture shapes decisions long before procedures are referenced. It must be driven by leadership who must ‘walk the talk’. It’s in the silent messaging based on what leadership prioritizes.
The organization may plaster the walls with quality and safety posters, but if the senior managers bypass safety and quality requirements to meet deadlines and commercial pressures then that is what everyone does. When objectives are not aligned with the vision of the organization it does not drive the right actions. Think about if you prioritize product quantity over quality. You may still get both however there may be a cost of added scrap.
Culture drives people to take the right actions. The cornerstone of any good management system is the culture of the organization. The shared attitudes, values, goals, and practices. I said shared! It may be championed by one person but the load must be shared, if not equally then proportionately.
The Mistake Auditors Make When “Auditing Culture”
Just like auditors and organizations think of customer surveys when assessing customer satisfaction, similarly auditors may think of employee surveys or opinions, when it comes to assessing an organization’s culture. However, culture is more than that. While there may be no documented procedure on it, It is in how well the forms have been completed and the procedure been followed.
Perhaps the biggest mistake auditors make when auditing culture is this: they ask people how they feel instead of examining how the system behaves.Culture is not a mood or a slogan. Culture is the pattern of decisions the organization consistently makes, even when under pressure. When vague questions are asked such as “How would you describe the culture here?” or “Do you feel empowered?” you will always get an answer. But is this answer the truth?
If raising issues in the past led to being labeled negative, empowerment will be described cautiously. If reporting risks slowed promotions, communication will be described as “generally good.” If audits have historically led to blame, then even the most open-ended question will be filtered through self-protection.
The real culture however shows up when production is behind, when a shipment is at risk, when a major client is on the phone, when a safety incident threatens reputation. In those moments, priorities become visible. Do not treat culture as separate from the management system. It is the management system that shapes culture.
Culture as a System Output, Not a Personality Trait
We sometimes perceive culture as a reflection of personalities. And maybe they do play a role in it. As a result when morale is low we may draw a conclusion that it must be a difficult manager. Perhaps when accountability is weak, it must be “those people.” But all this does is give us someone to praise or someone to blame. But culture is not a personality trait.
What you experience as “culture” is the predictable result of how the management system is designed, reinforced, and lived. It is shaped by objectives, incentives, consequences, communication pathways, and leadership behavior over time. Systems condition behaviour over time.
If an organization consistently closes corrective actions late, perhaps objectives prioritize output over systemic improvement. Perhaps root cause analysis is seen as administrative work instead of strategic work. Perhaps management review does not meaningfully challenge overdue actions. If employees hesitate to escalate risk, that is not a lack of courage. It may be a system that historically punished disruption. If internal audits surface only minor issues year after year, that may not reflect perfection. It may reflect a system that subtly discourages surfacing uncomfortable truths.
Auditing culture, then, is not about assessing personalities. It is about examining whether the system is producing the behaviors leadership claims to value.In the end, culture is evidence. Not of who people are, but of what the system repeatedly produces.
Observable Evidence That Reflects Culture
Every organization has operational realities: nonconformities, customer complaints, missed targets, near misses. How organizations react to these is culture. When a problem surfaces, is the first question, “Who did this?” or “What allowed this?” That single distinction tells you whether the system leans toward blame or learning.
Look at how objectives cascade from the policy (vision) of the organization. Do KPIs drive short-term output at the expense of long-term system health? Culture leaves fingerprints in escalation pathways, in how quickly risks are reported, in how leaders react when challenged.
Culture is reinforced by incentives, metrics, leadership behavior, and how the management system is actually used. The harmonized ISO structure was designed to drive alignment. Context shapes strategy. Leadership sets direction. Planning addresses risk. Performance evaluation feeds improvement. If those elements are functioning as an integrated system, culture stabilizes around accountability and learning. If they are fragmented, culture drifts toward silos and survival.
Questions Experienced Auditors Ask to Reveal Culture
What reveals culture are questions that trace cause and effect. Questions that explore decisions under pressure. Questions that connect behavior to consequences. Below are a few questions that auditors may consider in assessing culture:
- How do you decide which corrective actions deserve deeper root cause analysis and which are “quick fixes”?
- How are conflicting objectives resolved between production, quality, and safety?
- If I looked at your last five corrective actions, what patterns would I see?
- How are lessons learned from one department shared across others?
- What does “risk-based thinking” look like in day-to-day decisions here?
- If I asked frontline employees what leadership truly cares about, what would they say?
- When production is behind schedule, how do you ensure operational controls are still followed?
- How do you verify that outsourced or externally provided processes meet your requirements?
I hope the above will give you adequate insight into framing your own questions as you set to auditing to the various ISO
Integrating Cultural Findings Into Audit Conclusions
Auditing culture does not require abandoning objectivity. The same discipline you apply to reviewing documented information, sampling records, and verifying implementation can be applied to observing patterns of behavior. Culture becomes visible when you connect what people say to what the system consistently produces. When you trace objectives to outcomes. It is evidence-based.
As auditors, we must resist the temptation to reduce culture to sentiment. Equally, we must resist ignoring it because it feels intangible. Culture links leadership to planning, planning to operations, operations to performance evaluation, and evaluation to improvement. If those links are weak, culture will fragment. If they are aligned, culture will reinforce the very outcomes the standard intends. Your audit conclusion should reflect this, not just the presence or absence of documentation.
In the end, auditing culture is about integrity of the system. Does the organization do what it says it values, especially under pressure? Are behaviors aligned with policy and objectives? When you can answer those questions with observable evidence, you audit culture without turning it into a soft conversation.
