Culture Problems Behind Recurrent Findings

Management accepts the report. An action plan is approved, training sessions are scheduled, and the manual is updated. Case closed, right?

Not exactly. In the next audit cycle, the issue returns — often more pronounced than before.

Over time, these situations stop being surprising. They create frustration instead of improvement. The auditor performed the work properly, yet the impact on governance and public value seems limited. Why? Because the root cause often lies outside the procedure itself.

Public sector organizations do not fail repeatedly because they lack manuals, but because of the environment in which those manuals exist. Training alone is insufficient when the culture prioritizes immediacy over compliance and informal habits override formal controls.

To understand recurrent findings, we must observe how work is actually performed.

Culture Reveals Itself Under Pressure

An organization’s true culture becomes visible when time is scarce and results are demanded. Under pressure, the real rules emerge. For example:

• Are decisions properly documented, or postponed?
• Are issues escalated, or quietly avoided?
• Are controls respected, or treated as obstacles?

When the same behaviors appear year after year, recurrent findings are not isolated mistakes. They are patterns shaped by incentives, leadership signals, and time pressure.

This situation can be better understood by using an iceberg metaphor. What auditors see at the surface — missed approvals, incomplete files, after-the-fact documentation — are simply symptoms of what’s actually under the surface. Below the surface of the metaphorical “iceberg” lie behavioral drivers: spending prioritized over compliance, shortcuts under pressure, avoidance of escalation, and a “fix it later” mindset.

Deeper still are leadership signals. When success is measured by spending, when there are few consequences to employees bypassing controls, and when noncompliance is silently tolerated, then behavior adapts. What leadership tolerates becomes standard practice.

Recurrent findings are rarely simple control failures. They reflect how success is defined, urgency is applied, and risk is tolerated.

The Professional Guidance We Needed

For years, auditors identified cultural and behavioral issues through experience. We sensed patterns. We heard repeated explanations. Yet translating those observations into formal, defensible conclusions was not always easy.

The IIA’s Organizational Behavior Topical Requirement, issued in 2025, provides the structure we needed. It does not create a new responsibility for internal audit. Rather, it offers a framework to analyze how governance structures, incentives, leadership signals, and risk tolerance shape behavior.

It allows us to move beyond informal impressions such as “controls are not taken seriously” and instead describe observable drivers that influence outcomes under pressure.

With this lens, recurrent findings can be assessed not only as control breakdowns, but as indicators of deeper, systemic conditions. Behavioral analysis becomes part of risk assessment, control evaluation, and governance review. It strengthens our ability to communicate root causes in a rigorous, evidence-based manner aligned with the Global Internal Audit Standards.

The Year-End Procurement Marathon

Consider another familiar scene. As year-end approaches, tension rises. Procurement volumes surge. Deadlines tighten. The message is clear: the budget must be executed.

In that rush, controls weaken. Files are incomplete. Quotes appear after purchases. Signatures are obtained urgently to legitimize what has already happened.

The following year, the finding reappears.

Traditional explanations seem reasonable: The team was overloaded, deadlines were tight, more training is needed. The response follows the usual script — update the manual, provide refresher sessions, send reminders. Yet the problem returns.

Viewed through a behavioral lens, the situation looks different. In December, the real message is not “comply with the procurement manual.” It is “do not lose the budget.” Underspending may reduce next year’s allocation. Delaying a purchase to verify a control is seen as a threat to management’s success.

Shortcuts become a survival strategy. Staff quickly learn what truly matters. The root cause is not a lack of knowledge of the rules. It is a system that pushes people to bypass them.

Looking Below the Iceberg

Ignoring these root causes has consequences. Skipped controls and after-the-fact documentation erode trust and put public resources at risk.

Internal audit serves the public interest. That responsibility goes beyond compliance. It demands the courage to analyze behavioral drivers, interpret leadership signals, and challenge practices that weaken governance, risk management, and internal control.

Looking below the iceberg allows our reports to move beyond symptoms. They can reveal how the system truly operates and help ensure public resources are managed with integrity and transformed into real value for society.