Behavioral risk is how certain factors influence employee behavior. It is also related to decision making.

The new audits are focusing on what is the cause that generates employees to engage in unethical behavior. Why? A company can have a code of conduct and policies in place, but that is not enough. Those documents could be idealistic, unreal for the company’s reality, or the responsibilities unclear.

Culture is how all employees (including the upper management) act; how they behave. It could be said that impunity is forbidden in a company but if the reality is that Managers are exempted because they run an area, employees hardly will follow the rules. This is just an example to show how a situation (driver) can shape the culture in a company and therefore influence everyone’s behavior. That’s why people can easily do unethical things.

Its link with Internal Audit is precisely that: to understand human behavior so potential risks are minimized. Understand how the company can improve controls so employees are less tempted to do wrong. Because if the culture is right, the behavior will also be.

How can it be assessed? Like any other risk. Upon the company’s circumstances it can be used a combination of qualitative and quantitative techniques. The results should determine if behavioral risk allows the company to execute its strategy and objectives. If it is too high, controls must be improved or added. Monitoring should be done on a regular basis.

If done correctly, Internal Audit can generate value to the company by enabling it to reach its objectives, improve its value and prevent crimes. All these, by minimizing behavioral risk.

By Mónica Ramírez Chimal - International Speaker & Trainer, Writer, Consultant-Partner at Asserto RSC