20
IIA PAS CONFERENCE 2016 Becoming a leading example Culture Audits @ Arcadis Leonard Boogers Director Internal Audit [email protected]
IIA PAS CONFERENCE 2016Becoming a leading example
Culture Audits @ Arcadis
Leonard Boogers
Director Internal Audit
© Copyright Arcadis 2016
Arcadis
2
• Why culture impacts Way of Working and control environment
• Arcadis’ journey creating a truly global culture
• Role Internal Audit
© Copyright ARCADIS 2016
ARCADIS: DESIGN & CONSULTANCY FOR NATURAL AND BUILT ASSETS
Infrastructure Water Environment Buildings
• Dutch roots date back to 1888
• € 3.4 billion revenues* in 2015
• +/-30,000 active projects
26%1) 13% 25% 36%
Global business lines
1) Gross revenues
Geographies
North America
Emerging Markets*
ContinentalEurope
UK
~26.000 employees in 40 countries
39% 27% 18% 16%
3
Note: Brazil, Middle East, Asia
© Copyright ARCADIS 2016
0
5.000
10.000
15.000
20.000
25.000
0,0
0,5
1,0
1,5
2,0
2,5
3,0
1997 2013
To
tal n
um
ber
of
FT
E
Rev
en
ue in
billio
ns o
f eu
ros
YearsRevenue in billions of euros Total number of FTE
2014
Arcadis journey to growth impacts Culture
2007
1997 – Name changed to
Arcadis
2007 – Takeover RTKL Associates
Inc.
2012 –Takeover EC Harris
2012 –Takeover Langdon
Seah
2014 – Takeover Hyder & Callison
2009 –Takeover Malcom Pirnie
4
© Copyright Arcadis 2016
How to leverage our divers culture to become a truly global service provider for our clients?
Arcadis global footprint
5
© Copyright Arcadis 2016
… or how to prevent ….
6
Unethical behaviour ultimately puts an organization at risk but Forbes magazine
stated in 2015 that culture is the most overlooked element of audits – ‘.. It
sheds light on a company’s core DNA, which guides decision making…’
© Copyright ARCADIS 2016
Core Values
Acquisition (4 ABC)
Capacity (2 ABC)
Market (1 ABC)
Governance & Compliance (12 ABC)
Strategic Risks (11 controls)
Operational Risks (45 controls)
Financing (3 ABC)
Integrity Client Focus Collaboration Sustainability
Arcadis Strategy
PerformanceSustainable Growth Collaboration
Health & Safety (1 ABC)
Client & Project (15 ABC ) Reporting (9 ABC)
Reputation : Impacted by managing strategic and operational risks
IT (4 ABC)
People (3 ABC)
Liquidity (2 ABC)
Arcadis Enterprise Risk ManagementHow is culture embedded in Arcadis Business Control Framework (ABC)?
© Copyright Arcadis 2016
Why Culture should also be in scope
of Internal Audit
8
COSO – Public exposure re Integrated Risk Management Mission, vision & core values → Strategy & Business Objectives → Enhanced
Performance
Some of interrelated components of enterprise risk management:
o Risk Governance & Culture; Board risk oversight, Desired organizational
Behaviours, Commitment to Integrity & Ethics
o Risk, Strategy and Object setting: Defines Risk Appetite
o Risk information, Communication and Reporting: Reports on Risk, Culture
& Performance
Nederlands Corporate Governance Code – Voorstel voor herziening Principe 1.3: Interne audit functie
Principe 1.4: Verantwoording over risicobeheersing
Principe 2.5: Cultuur
Regulators & IIA (Conference 2016) placed culture on the agenda.
© Copyright Arcadis 2016
What is Culture?
9
“ The Way we do things around here”Culture eats strategy for
breakfast, operational
excellence for lunch and
everything else for dinner
(PWC 2016)
© Copyright Arcadis 2016
Approach to auditing culture
10
Corporate values to stimulate desired behaviour
and policies and rules to guide this
Risk is that rules do not address underlying
reasons of behaviour
Potential disconnect between corporate
values and personal behaviours
How to prevent and assess the impact of a
disconnect in Arcadis?
© Copyright Arcadis 2016 11
Perspectives and InsightsAuditing Culture – A Hard Look at the Soft Stuff (www.IIA.org 2015)*Many considerations can be taken into account when auditing culture and tailor to its environment
1. Satisfaction / Opinion Considerations: Employee surveys, 360 feedback,
employee and customer complaints
2. Training: Induction programs, frequency, attendance, assessing effectiveness
3. Compliance: Complaints procedures (presence, compliance, protection whistle
blower, management response), root cause losses & legal issues, analysis self-
assessment vs. reported control weaknesses by Internal Audit, effectiveness and
monitoring of corrective actions
4. HR practices, Incentives and Enforcement: Employee turnover, exit
interviews, negative media coverage
5. Evidence of Soft Controls: Trust & openness, leadership leading by example,
ethical standards, balancing ambition with ability
Note: Culture and the Role of Internal Audit: Looking below the Surface, IIA UK 2014
© Copyright Arcadis 2016
‘Influencing Behaviour’ - H&S Culture
12
How to create a global H&S culture ensuring
everyone comes home to their loved ones unhurt
Role Internal Audit
• Assess effectiveness 2nd line global function Health & Safety
• Own on-site observations
• Integrate H&S experts in audit team
• Engage in conversations / H&S conferences
Global H&S system impacts culture and pays off
• H&S moment per meeting
• Certification: ISO 9001,
ISO 14001, OHSAS
18001
• Monthly Executive Board
reporting
© Copyright Arcadis 2016
‘Influencing Behaviour’ – Business Principles
13
• Arcadis General Business Principles
(AGBP) and Specific Anti-Corruption
Standards
• Embedding in induction program
• Bi-annual & mandatory training
• Reporting
Role Internal Audit
• Challenge of Arcadis Leadership Council
• OpCo audits
o AGBP reports could be part of audit planning process
o Interview HR regarding results, interpretation and follow up
o Assess effectiveness induction program
• Follow up with Chief Compliance & Privacy Officer
.. all employees of
…we are responsible
.. in accordance with
all laws and in a
moral and honest
manner
© Copyright Arcadis 2016
‘Measuring Behaviour’ – Employee surveys
14
• ‘Your Voice’ being a global electronic
survey, runs every 2 years
• It covers behaviour related topics
• Report discussed at Executive Board,
region, OpCo, and functional level
Region
TopicA B C
My Job
Collaboration
My manager
Values
Etc.
1.00-2.61Very Poor
2.62-2.79Poor
2.80-3.16Moderate
3.17-3.34Good
3.35-4.00Very Good
Role Internal Audit
• Challenge of Arcadis Leadership Council
• OpCo score is part of audit planning process
• Follow up with HR global / region / OpCo re management progress
© Copyright Arcadis 2016
‘Measuring Behaviour’ – Soft Control surveys11 OpCo surveys, 8,000 invites (33% coverage) and 4,800 responses (=60 % response rate), with
external support
15
RESPONSE
Comfort to report
misconduct: The degree
to which employees call
each other to account
about unethical behavior
within the organization.
Enforcement: The
degree to which employees
are punished for
irresponsible conduct and
rewarded for responsible
behavior.
PREVENTION
Clarity of standards: The
degree to which the rules and
procedures are accurate, concrete
and complete, so employees
understand what is expected with
regard to ethical conduct within the
organization.
Role modeling: The degree to
which management sets a good
example for the organization and
their employees.
Enabling environment: The
degree to which the organization’s
targets correspond to
predetermined values and norms.
Support of employees for
integrity: The degree to which
employees endorse the proper use
of corporate assets and the active
realization of the interests of the
organization and their
stakeholders.
DETECTION
Transparency: The degree to which employee conduct and the effects thereof are visible within the
organization.
Openness to discuss dilemmas: The degree to which employees can discuss ethical dilemmas
within the organization.
BEHAVIOR
© Arcadis 2016
Soft controls 0%–xx% xx%–xx% xx%–xx% xx%–xx% xx%–xx% xx%–100%
Clarity of standards
Role modelling
Enabling environment
Support of employees
for integrity
Transparency
Openness to discuss
dilemmas
Comfort to report
misconduct
Enforcement
Soft Control survey reporting: Internal / external benchmark opportunities
Measuring Behavior – Soft Control surveys (cont.)
16Arcadis OpCoExternal references
© Arcadis 2016
• In 2014 - 2015, 80 Risk Workshops in all regions with in total
1,000 participants, mainly project managers
• Topics covered are Finance, Operations and Legal related to
projects
• Facilitation by SendSteps and open dialogues
• Main insights in:
o Bottom-up risk perception and awareness
o Management behaviour and target setting
o Level of transparency
o Level of acceptance / culture to accept challenging discussions
‘Assessing Behaviour’ - Risk Workshops
17
Follow up on Soft Control surveys and Risk Workshops positively impact client and employee satisfaction and thereby culture
© Arcadis 2016
Internal Audit reporting
Reporting Structure per audit
1. Input for Business Consideration
The following observations have no direct relationship with key controls embedded in the Arcadis
Business Control framework but are shared for consideration by the business.
18
Observations
1. …. Various interviewees cited that … a culture of potentially …. news, … personalities and
……impacting the …
Recommendations
1. [….].
High Risk or Medium Risk
Observations
1. Xx % of the joiners between Jan – June 2016 did not complete the on-line AGBP training ….
No monitoring was present regarding non-completion or non-successful completion
Recommendation
1. […]
Management response
1. [….]
Owner
1. [….]
Target date
1. [….]
2. High & Medium rated observations
Unstructured reportingOne-on-one meetings with members of Executive Board, and senior leadership in regions and global
functions
Quarterly reporting to Executive Board and Audit & Risk Committee
© Copyright Arcadis 2016
Lesssons Learned
19
1. Bring Culture to the Executive Board
2. Arrange Executive Board and senior management support
3. Change is difficult, require endurance but is not impossible
4. Level resources
5. Tools should fit the organization
6. Invest in ‘emphatic interviewing’ techniques
7. Do not shy away in making subjective judgements
8. Leverage your peer network
9. Do not ignore the power of data analytics
© Arcadis 2016
Arcadis.Improving quality of life.
