Strong internal controls are essential for every organization. They protect assets, support regulatory compliance, and ensure reliable financial reporting. However, even the most carefully designed controls can fail if the organizational culture does not support them.

In practice, auditors often observe that culture speaks louder than policies and procedures. While control frameworks may look strong on paper, their effectiveness ultimately depends on how people behave within the organization.

That behaviour begins with leadership, but it must resonate throughout the entire organization.

Tone at the Top: Where It Begins

“Tone at the top” refers to the ethical climate established by an organization’s leadership. Boards and senior executives shape this tone through their attitudes toward integrity, accountability, and transparency.

This concept is a core element of the COSO Internal Control – Integrated Framework, which identifies the control environment as the foundation of effective internal control.

Leadership sets the tone through everyday actions, including:

• How decisions are made during periods of pressure
• Whether transparency is encouraged when challenges arise
• How mistakes or control failures are addressed
• Whether ethical conduct is valued as highly as performance

When leaders demonstrate integrity and accountability, they establish a culture where compliance and ethical behaviour are expected, not optional.

The Echo at the Bottom: Where It’s Experienced

Tone at the top matters only if it echoes throughout the organization.

Employees observe leadership behaviour closely. When leadership actions align with stated values, employees are more likely to adopt those same standards. But when employees see leaders ignoring policies or tolerating unethical behaviour, the message quickly becomes distorted.

In a healthy control culture, employees:

• Feel safe reporting irregularities or concerns
• Understand the purpose behind internal controls
• Believe that ethical behaviour is recognized and valued
• See accountability applied consistently across all levels of the organization

This “echo” is where leadership tone becomes visible in day-to-day organizational behaviour.

Why Culture Determines Control Effectiveness

Internal controls rely on people to operate them. Approval processes, segregation of duties, and monitoring procedures only work when individuals respect and follow them.

Organizations with strong ethical cultures often experience:

• Fewer control breaches
• Faster detection of errors or irregularities
• Greater collaboration between finance, audit, and operational teams

Conversely, organizations with weak or toxic cultures may conceal problems until they escalate into significant financial or reputational damage.

The Auditor’s Perspective

During an audit, professionals do not simply review policies and procedures. They also evaluate the control environment, including leadership behaviour, communication practices, and accountability structures.

Indicators that may signal weaknesses in tone or culture include:

• Excessive management dominance over decisions
• Staff reluctance to share information openly
• Frequent management overrides of established controls
• Resistance to internal or external audit reviews

Such observations influence the auditor’s risk assessment and may lead to expanded audit procedures.

Building a Culture That Supports Controls

Establishing a healthy control culture requires consistent leadership commitment and visible action.

Organizations can strengthen their culture by:

• Leading by example: Leadership must consistently demonstrate integrity and ethical decision-making.
• Encouraging open communication: Employees should feel safe raising concerns or reporting irregularities.
• Applying accountability fairly: Policies must be enforced consistently, regardless of position or authority.
• Integrating ethics into performance evaluation: Reward not only results but also the integrity with which those results are achieved.
• Collaborating with auditors: Internal and external auditors should be viewed as partners in strengthening governance.

Conclusion

Culture is the invisible control that supports every other control within an organization.

While systems and policies define what should happen, culture determines whether it actually does.

At SKM Africa LLP, we believe effective governance begins with the right tone at the top and is reinforced by a culture that echoes integrity and accountability throughout the organization.

Because when leadership sets the right tone, the entire organization responds with trust, responsibility, and stronger control effectiveness.