Choose evaluation criteria for culture and soft controls
For soft controls such as ethical culture, define observable behaviors and a defensible benchmark before evaluating results. Combine evidence sources so a favorable survey score does not conceal contrary practice. Qualitative subjects need explicit criteria just as transaction controls do.
Make the qualitative subject evaluable
| Decision | How to apply it | Mistake to avoid |
|---|---|---|
| Expected behavior | Employees can raise concerns without retaliation and receive appropriate follow-up. | Using “good culture” as an undefined pass condition. |
| Evidence mix | Compare surveys, interviews, case handling, turnover context, and observed decisions. | Treating one high response score as conclusive. |
| Interpretation | Assess inconsistent evidence and differences between teams or periods. | Assuming fewer reports always indicate fewer problems. |
Expected behavior
Employees can raise concerns without retaliation and receive appropriate follow-up.
Avoid: Using “good culture” as an undefined pass condition.
Evidence mix
Compare surveys, interviews, case handling, turnover context, and observed decisions.
Avoid: Treating one high response score as conclusive.
Interpretation
Assess inconsistent evidence and differences between teams or periods.
Avoid: Assuming fewer reports always indicate fewer problems.
A decision path you can use
- 1Define the expected behavior
- 2Choose corroborating indicators
- 3Investigate contradictions before rating
Understand the method
Work through the reasoning
Translate a broad concept into observable expectations
Soft controls involve matters such as ethical culture, accountability, communication, and leadership behavior. An objective like evaluating a speak-up culture needs more precise expectations before evidence can be interpreted. Consider whether people know reporting channels, concerns receive appropriate attention, and retaliation risks are addressed.
Define the aspect being evaluated instead of attempting to reduce an entire culture to one score. Criteria might concern the accessibility of channels, response responsibilities, and documented handling of concerns. Their suitability depends on the organization, risk, and applicable expectations, not on a universal threshold invented for the audit.
Establish a defensible basis for the benchmark
Look for relevant commitments, policies, governance expectations, and appropriate external requirements or practices. Evaluate whether existing criteria are adequate. Discuss inadequate or missing criteria through the appropriate process with the board or senior management, and document the basis used.
Avoid choosing an arbitrary survey percentage and presenting it as a required standard. A benchmark from another organization may involve a different workforce, question wording, or reporting environment. Explain why a comparison is meaningful and what it cannot establish.
Use several sources to test the same expectation
Surveys can reveal perceptions; interviews can explain them; case records can show how concerns were handled. Training completion shows exposure to a message, not necessarily confidence in speaking up. Compare sources and investigate contradictions rather than allowing one convenient indicator to represent the entire subject.
Assess response bias, population coverage, confidentiality arrangements, and the reliability of records. A low number of reports may indicate few concerns, poor awareness, fear, or weak recording. A high number may reflect problems or greater trust in reporting. Interpret the measure in context.
Write a conclusion that reflects qualitative uncertainty
Describe the specific expectations evaluated, evidence obtained, and significant patterns. Explain how consistent or contradictory sources affect confidence. A conclusion can identify a credible weakness in case handling without claiming that every employee distrusts management.
Recommend actions linked to the evaluated cause and consider how their effects could be monitored. More training may help a knowledge gap but do little for demonstrated retaliation. The response should address the behavior and system that the evidence indicates, while management retains ownership of the action.
Original teaching example
Apply the method to a decision
The scenario
A company reports 95% completion of ethics training. Interviews suggest staff fear reporting concerns, and several complaint cases lack documented follow-up.
The decision
Training completion does not establish an effective speak-up culture.
Completion measures exposure to training, not behavior or trust. Evaluate the reporting process, handling of complaints, and evidence of retaliation concerns against suitable expectations. Do not average contradictory signals into a reassuring score without analysis.
Independent hypothetical case. It is not an official IIA question, an actual investigation, or a scoring prediction.
A second application
High training completion masks weak confidence
The situation
Ninety-eight percent of employees completed ethics training, but interviews and case records indicate that concerns are routinely returned to the manager named in the complaint.
Reason through it
Training completion does not establish a trusted or appropriately designed reporting process. Evaluate routing, confidentiality, independence of handling, and the related expectations using corroborated evidence.
Take the decision
Assess the actual reporting and response process. Do not use participation in training as a proxy for the whole speak-up environment.
Original hypothetical teaching case.
Check your understanding
Choose the best answer, then check the reasoning for each alternative. These short learning checks are not a full exam simulation. Answers are not saved or sent.
Questions about this topic
Can a benchmark from another company be used unchanged?
First assess whether the operations, risks, definitions, and objectives are comparable. An external benchmark can inform criteria, but a convenient number does not become suitable merely because it is published.
Can qualitative controls be audited without a numerical score?
Yes. Clear, observable criteria and corroborated evidence can support an evaluation. A numerical score is useful only when its definition and interpretation are defensible; it is not a substitute for judgment.
Sources and syllabus scope
Prepared by MiloPrep editorial team. Source links checked 2026-10-10. These notes and cases are independent teaching material; the IIA sources do not verify or endorse them.
- IIA expanded syllabus
Establishes the examined topics. Primary domain: Engagement Planning (50% of Part 2). This is a domain allocation, not a separate weight for this lesson.
- Global Internal Audit Standards reference
- Locator: Standards 13.4 and 14.1-14.3. Supports the professional requirements cited here; our scenarios and solution steps are original applications. Current IIA Standards resources.
Part 2: Internal Audit Engagement. Selected learning notes, not complete curriculum coverage. Browse all CIA topics.