Building an Audit Trail for Culture and Conduct Risk

Introduction

Internal audit is built to test controls: does the process exist, is it followed, is there evidence it worked. Culture and conduct risk don't fit that model cleanly, because the thing being tested isn't a discrete control, it's a pattern of behaviour across thousands of individual interactions. That doesn't mean it can't be audited. It means the evidence trail has to look different.

Why Culture Audits Usually Fall Short

The typical approach is to audit the process around culture — is there an engagement survey, does it run annually, is there a values framework, is there a whistleblowing policy — rather than the substance of culture itself. That tells you a programme exists. It tells you very little about whether the culture it's meant to monitor is actually healthy, or whether concerns raised through it are being acted on.

The gap shows up clearly after the fact: post-incident reviews routinely find that warning signs existed in employee feedback well before the incident, and that the programme "worked" in the sense that data was collected, but failed in the sense that nobody structured it, read it properly, or escalated what it showed.

What a Defensible Evidence Trail Actually Contains

• Comprehensive coverage, not sampling. Analysis of all open-ended employee feedback, not a manually reviewed subset, since the signal that matters is often in the comments nobody had time to read.
• Structured categorisation. Comments tagged and scored against defined risk categories — safety, conduct, management behaviour — not just sentiment.
• A documented escalation path. A record of what was flagged, to whom, and what happened as a result.
• An external cross-check. Independent monitoring of public signal, so the internal record can be tested against something management didn't curate.
• Time-series consistency. The same analysis run on a consistent cadence, so trends are visible rather than each period being assessed in isolation.

Where Manual Review Breaks Down

Most organisations that try to build this trail manually hit the same wall: a few thousand open-ended survey comments is more than any team can read and categorise consistently, so review becomes selective, and selective review is exactly the gap that gets exposed later. Structured, comprehensive analysis at scale is the difference between a paper trail that exists and one that would actually hold up under scrutiny.

Insight Index was built for that comprehensive layer, and Walk the Floors for the independent external check — together giving internal audit and compliance functions a structured trail across both internal and public signal. More on how this fits a compliance and risk audit programme.

Building This Into an Existing Audit Programme

This doesn't need to be a separate workstream. Most internal audit functions already have a cadence for reviewing people-risk-adjacent areas — culture, conduct, whistleblowing effectiveness. The change is in what evidence that review actually draws on: instead of a summary prepared by the function being audited, the review draws on comprehensive, independently structured analysis of the underlying feedback itself, refreshed on the same cycle as the audit programme.

That distinction — independently structured evidence versus a self-reported summary — is usually the difference auditors are actually looking for when they assess whether a control is real or nominal.

Conclusion

An audit trail for culture and conduct risk isn't a values statement with a review date on it. It's a documented, consistent, comprehensive process that can answer, specifically, what was known, when, and what was done about it. That's a materially higher bar than most organisations currently meet — and it's the bar that gets applied after something goes wrong.

Nicole Vaughan, CEO & Founder of myCandr