Auditing van Gedrag & Cultuur

We verzorgen in 2023 weer een aantal trainingen gericht op het auditen van gedrag en cultuur in organisaties. Naast de traditionele trainingen Behavioural Auditing en Integrated People Process Auditing hebben we ons palet verder uitgebouwd met trainingen die bedoeld zijn voor auditprofessionals die op zoek zijn naar verdere verdieping.

Behavioural Auditing


Voorjaar 2023: 23 en 30 maart en 6 april 2023
Najaar: 2023: 18 en 25 september en 2 oktober 2023

Integrated People Process Auditing 2.0


Voorjaar 2023: 20 en 27 maart 2023
Najaar 2023: 6 en 13 september 2023

Kwalitatief Interviewen


In overleg.

Effectieve gespreksvoering


In overleg.

Gestructureerde gedragsobservatie


In overleg.

Kwalitatieve data-analyse


In overleg.

Verdiepingstraining Psychologische Veiligheid


Najaar 2023: 5 oktober 2023 en 9 november 2023

Q&A Behavioural Auditing

In July 2023, the International IIA Congress took place in Amsterdam. We were given the opportunity to provide a presentation to introduce the participants to Behavioural Auditing. Following this presentation, the audience had the opportunity to ask questions. We have provided answers to the questions below.

How is a Behavioural Audit different from an organisational culture audit?

It depends on the definition of an organisational culture audit.  What we see is that most culture audits are based on a predefined norm, with a fixed scope, and a regular audit report with  findings and a judgement. Behavioural Auditing in our definition is a very open, inductive approach to study organisational culture, with no pre-defined norms, no judgement (of the auditors) but with the intention to influence the socio-psychological climate and the organisational culture.
With a BA we investigate mental models and drivers. We offer those involved insight into why they do what they do and think what they think. This insight leads to sustainable changes in behaviour and culture.

Most behavioural audits seem to be quantitative and survey driven. Interested to know how you get good substantiation on a qualitative basis.

We discourage measuring culture in a quantitative way, with the use of surveys. These methods are not suitable if you intend reflection and a deeper understanding of the way people think, feel and do. Mental models are mostly implicit until you get them to the surface by talking about them in a reflective conversation. Human drivers are hard to measure in a quantitative way. Furthermore, it is hard to make a reliable survey, that measures what you intend to measure. Surveys often suffer from a lack of validity. A lot of research is done in this field, and the way questions are stated is a better prediction of the outcomes, than the opinion of the respondent.
To get good substance for quality and trustworthiness, we rely on the quality standards of qualitative research. We use strategic sampling, aiming for maximal variation in perspectives, related to the research question and we use advanced interview techniques. Furthermore we make sure we have triangulation of sources per function. We rely on the saturation principle, used in social sciences.

Management may be ok with this work at the start until they start to see unfavourable results. How do you manage challenges by management that this is merely our subjective opinion and not an accurate representation?

It is very important to tell and show how carefully and solid the design of the audit is, on forehand. At the start of a behavioral audit, we provide a detailed explanation of what a behavioral audit entails and what they can expect. We explain in the validation workshop the theory on perspectives, mental models and drivers. We shape the validation workshop in a way that suits the context and the narrative and invite the participants to listen, ask questions, and be curious for perspectives that challenge their owns.
We experience often that the perspectives of other organisation members do not match with management’s perspectives. This sometimes evokes strong emotions, and that is part of the process if you want to see a change in decisions and behaviours.

Do you provide a conclusion in your report?

During the validation workshop, we ask the participants what the narrative means to them. We supervise this process very carefully. If the customer wishes, we will adopt the attribution of meaning by those involved as an audit opinion in our final report.

How do you feel about the stigma “you’re not a cultural fit!”? Is it bad when you act/think differently to management?

It feels like there is a whole world behind this question, but to answer short: We feel (and research on learning, psychological safety and innovation suggests) that deviant voices and diverse opinions are mostly a valuable source for a different way of looking at problems, that shaped room for improvement and innovation (but not in all cases) If we would hear such a statement in a Behavioural Audit, we would try to dig deeper into what the statement means to the one expressing this and why it is important, with non-directive questions.

How do you take into account micro-cultures within the organisation and avoid giving a skewed view that may not accurately depict the organisation’s behaviour?

We try to make sure we include all perspectives relevant to the research questions in the selection of participants (micro-cultures are mostly a bundle of shared opinions, values and mental models)
The sum (and variety \ differences) of all these micro-cultures give the most valuable insights, we make that tangible, bring it to the surface so people can talk about it, give meaning and change their minds.

Do you come up with the findings and the risk level?

We do not directly do this through our judgements and opinions. But as indicated above, it can be part of the provision of the meaning of the participants during the validation workshop.

Looking at the questions from Menzis and Heineken, are Behavioural Audits best fit for situations of change?

We recommend behavioural auditing when you need deep insights and an understanding of a complex matter that involves humans. Behavioural Auditing is the ultimate way of performing root cause analysis. Change is the only constant. In heavily changing environments, human needs, drives and mental models are more visible, challenged, under pressure, and come to the surface easier, but the culture is always present. In some cases, it might be sensible to investigate the culture, before making major changes like implementing a new strategy.

Some behavioural traits have to do with acceptance of change and its consequences. How is this highlighted in the results of the audit?

If that comes out of the conversations, and that is what is going on, it will show in the narrative. In the dialogue during the validation workshop, the new insights that arise in the narrative lead to a reduction of resistance and more understanding of each other's motives and drives.

When do you do interviews with focus groups and when do individual interviews? What are the criteria?

It depends on the context and the research question. In general, we often opt for face-to-face interviews with members of (senior) management. Usually, we invite operational responsible staff for a focus group. An essential advantage of focus groups is that the risk level that participants accept in a focus group is higher than in individual interviews. This effect is less when it comes to (senior) management.

In what instances behavioural audit is required?

We recommend behavioural auditing when you need deep insights and an understanding of a complex matter that involves humans. Behavioural Auditing is the ultimate way of performing root cause analysis. We’ve audited a wide variety of topics, like:  Are we a learning organisation? Are our values lived? Is our culture-change programme effective? How do people view Internal Audit? What are the lessons learned of an IT implementation? Why are incidents not reported? Do we have a culture of psychological safety? Relationship of trust between the board and the work council.

How can we as an internal audit department imbed behavioural audit in our audit practice?

We recommend doing a Behavioural Audit as presented, designed as a single audit and not mixing up Behavioural Auditing with norm-based audits.

When you want to add behavioural aspects to your regular audits, we recommend you use Integrated People and Process Auditing (IPPA). We provide a tool online stacked with behavioural aspects, operationalized with audit variables, interview questions and observation schemes. (  We advise using 2-3 behavioural aspects per regular audit, and selecting the behaviour that is most key in the process under review.

How would you perform a follow-up to a behavioural audit? What consequences can you take if no change really happened?

It depends on context and question. If no changes occurred, it is most interesting to find out why? Most behaviour has a function and people trying to maintain the status quo is perfectly human. The question is: is that status quo servant to the goals the organisation wants to achieve?
In our practice, we almost always see changes in behaviour and culture. After all, the new insights lead to a change in mental models and motives and, therefore, to behavioural change.

How many staff were fired after the exercise in both companies?

We are curious as to why ask this question, as it contains some underlying assumptions. In what we know, no one was fired as a result of these behavioural audits.

Can you provide a copy of a white-labelled final behavioural audit report for reference?

We do provide this as part of our training. Please get in touch if you are interested to follow a training Behavioural Auditing in English ( 8. 15. 22 November 2023, see (

How many weeks do you usually spend on a behavioural audit of an organisation?

Mostly 8-10 weeks, depending on the agendas of the respondents and sponsor of the audit. In most cases, we can do a behavioural audit in 200-220 hours in total.

How do you ensure a consistent interview assessment where different auditors may be undertaking the interviews?

We don’t strive for consistency, we strive for high-quality reflective conversations that give insights in mental models, assumptions and drives of people. We provide training in interviewing skills and feedback after every interview. Furthermore, we record, transcribe and code all interviews and perform peered reviews in coding and selecting the data.

What should be in your view always in scope? How do you measure it? What can be the outcome: when is the organisation healthy

There is no rule of thumb as to scope. It depends on the question, the context and the complexity.
During the validation workshop, the participants give meaning to the narrative. They, therefore, decide whether there is a reason for the change. Our experience is that even the slightest omissions in the narrative for those involved are reason to reject the current situation and the wish to change.

What are key questions to ask when auditing culture and behaviour? Can you please mention the most interesting questions of the interview during an audit?

We use open questions (what can you tell us about…?) and non-directive questions in order to follow the mind trail of the other. Our favourite questions are: Can you tell me more? Why is that important to you? What do you mean exactly? Hmm hmm… and silence. Furthermore, most interesting answers follow after a good hypothetical question or well-timed turbo-questions.

As stated earlier, it concerns reflective, inquisitive conversations. We use various conversation models for this. One of these is the so-called four-face conversation model with the following phasing and questions:
1. Exploring phase.
What exactly happened? Who was present? How did he react? What did you say?
2. Diagnosis phase.
Why did you think this happened?
What brings you to this thought?
3. Evaluation phase.
How important is this for you?
4. Speculation and confrontation phase.
Could it have been otherwise?
Why is that alternative not chosen?

How do you manage the risk of retaliation?

We are not sure how to interpret this question. Retaliation of whom, on whom? We try to underline that perspectives differ, and that is ok. More important, the variance in perspectives gives valuable insights for improvement and innovations.

Are there specific skills a behavioural audit must possess?

Interviewing, in the sense of reflective conversations in a neutral, genuine interested way. Other skills are qualitative data-analysis, storytelling and facilitating dialogues.

In what way do you proceed with the outcomes…are there any models used…or any categorizations?

We use grounded theory (Glaser & Strauss) and code the outcomes in 3 stages, open coding for data reduction, axial coding to form concepts and selective coding to form theory. Than we use the two-column format of Learning History.

Do you recommend any training on interviewing?

Yes, the way we interview Is completely different from what is taught in most audit education, so it requires training, practice and feedback.

Are you called in to perform a behavioural audit when it’s already 5 to 12 or 5 past 12 (too late)?

It is never too late. The culture is there, as the sum of mental models, including their dominance and variance. We see culture as the collective programming of the mind that is characteristic of the members of an organisation. (Inspired by Hofstede).
The collection of relatively uniform and enduring values, beliefs, customs, traditions and practices that are shared by organisation’s members, learned by the new recruits and transmitted from one generation of employees to the next (Schein).

Given your social constructivist approach, how do you utilize stated values/norms through reviewing company policies?

We generally don’t review company policies, we investigate what people think about these policies, in relation to the subject of audit.

Is there a minimum team size to conduct a successful behavioural audit? If yes, why?

We advise to set up a team with at least 2 auditors, one auditor who is familiar with the company and knows the way and someone who knows the method of Behavioural Auditing through and through.

What is the starting point (benchmark culture)? How do the auditors know what is acceptable and what not at all?

We don’t use benchmarks or starting points. We only provide insight in the current state of the culture.

What is the actual validation process? How do you judge what to include in the final audit report?

We gather data in two phases. The results are analysed after phase 1. In phase 2, the provisional results of phase 1 are validated and falsified.
During the validation workshop, the narrative is validated. We ask the participants if they recognise the story and if we have understood the context correctly.

Do you also provide an opinion and recommendations? If not why not? How can management track follow up?

We don’t and we try to keep away from audit follow-up. You can’t measure change in mental models and interaction patterns in a formal way. It mostly takes time to change. Procedural actions can be taken up in the audit follow-up, but those are hardly ever the most important outcomes of the Behavioural Audit.
Often the narrative is discussed a half or a whole year later with the question of whether the content is still valid or changes have occurred.

How would you cater various nationality-linked cultural behaviour into your analysis and results for very international teams?

We work based on the belief that all humans we involve in our studies are precisely that: humans. Humans who want to be heard, seen and valued. Of course, we adapt our way of inviting,  interviewing and approaching people in accordance to local customs. We consider cultural differences on forehand and when shaping the validation workshop.

The title is behavioural auditing, but it sounds more like a thematic survey and not an audit.

If we go by the current standards, it says Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation's operations.
We have a well-designed audit process and data analysis, making the outcomes for 99% reproducible. We rather use the words ‘neutral’ and ‘sound’, as common in social sciences and qualitative research, instead of independent and objective. But the mindset and effect are the same: giving valuable insights by providing neutral and sound research.
In practise, it depends on our client how to label a behavioural audit in terms of IPPF. But several clients passed the IIA quality assessment, including their behavioural audits, under current standards.

Do Behavioural Audits usually are executed on request, or is it also possible to plan them beforehand?

It depends on the context, and both options occur.

New! New! New!

The Behavioural Auditing master class now also in English!

Behavioural Auditing


Autumn 2023: November 8, 15 & 22, 2023

Stacks Image 674
Gaat door!
De najaarseditie van de masterclass BA gaat door! Er zijn nog enkele plaatsen vrij.

Wij dragen onze kennis, methoden en technieken graag over aan auditors, toezichthouders en functionarissen uit de tweede lijn, zoals compliance officers, riskmanagers en controllers.


In onze bibliotheek hebben we al onze publicaties over het onderzoeken van gedrag en cultuur vanaf 2013 een plek gegeven. Als je bent ingelogd krijg je toegang tot de bibliotheek en de publicaties.


Onze ondersteuning bestaat voornamelijk uit het begeleiden van audits naar gedrag en cultuur. Ook tijdens een begeleidings-opdracht dragen we onze kennis graag over in de vorm van 'training-on-the-job'.

In september 2020 heeft het IIA een aantal masterclasses georganiseerd over een aantal 'trendy' thema's waaronder het auditen van cultuur en gedrag. De masterclasses bestaan uit een inleiding, een interview en een netwerkbijeenkomst. Jan Otten werd gedurende twee uur geinterviewd over het auditen van cultuur en gedrag.

Kennismakingsbijeenkomst BA en IPPA

De kennismakingsbijeenkomsten zijn bedoeld om je een beeld te geven van wat behavioural auditing (BA) en integrated people-process auditing (IPPA) inhouden en of deze ook passen in jouw auditpraktijk. We organiseren regelmatig online versies in de vorm van webinars waarvoor iedereen die interesse heeft zich kan aanmelden.

De 'offline' versies zijn bedoeld als incompany variant voor audit-, riskmanagement-, control- en compliance-afdelingen. Als jij en je collega's interesse hebben in een dergelijke incompany workshop kan je contact met ons opnemen via het contactformulier.

Zowel de online als offline kennismakingsbijeenkomsten duren ongeveer 2 uur en zijn gratis.

Als je op de hoogte wil worden gebracht van de datum en tijd van het eerstvolgende webinar vul dan onderstaand formulier in.

Klanten waarvoor we met trots hebben gewerkt

© 2022 Jan Otten