The most carefully designed strategies can still fail if the everyday behaviours of leaders and employees do not support them, according to Paulina Iiyambo, Executive Officer: Internal Audit at Standard Bank Namibia.
Reflecting on a long-standing management insight, she noted: “Peter Drucker’s famous observation that ‘culture eats strategy for breakfast’ has endured because it captures a truth that many organisations learn the hard way: the best strategy in the world means little if the behaviours of employees and leaders do not support it.
A business can have a compelling vision, ambitious growth targets and sophisticated systems, but success ultimately depends on how people make decisions, respond to challenges and work together every day.”Iiyambo observed that organisational culture has often been treated as important yet difficult to measure. That is now changing.
“The latest Organizational Behavior Topical Requirement introduced by the Institute of Internal Auditors recognises organisational behaviour as a critical business risk that deserves the same attention as financial, operational, technology and compliance risks,” she said. “This marks an important shift. Culture is no longer simply a ‘people issue’ or a matter reserved for human resources. It is increasingly recognised as a strategic asset or liability that can directly influence performance, customer outcomes, regulatory compliance and long-term sustainability.”
She pointed to repeated corporate failures in which policies and controls existed on paper but were undermined by actual behaviour. “Employees may have felt unable to challenge decisions, incentives may have encouraged short-term gains over responsible conduct, or leaders may have sent mixed messages through their actions,” Iiyambo explained.
“In such environments, even well-designed controls can become ineffective.”The new IIA framework, she added, places organisational behaviour firmly within the risk and assurance agenda by asking whether an organisation’s governance, risk management and control processes encourage the behaviours needed to achieve its strategic objectives.
In an environment of economic uncertainty, digital transformation and rising regulatory scrutiny, she said, culture can either accelerate success or quietly undermine it.The framework highlights three critical areas. On governance, Iiyambo stressed that boards and executives must define behavioural expectations and create accountability for them.
“Culture cannot be delegated or left to chance. Leadership behaviour sets the tone for the entire organisation, and employees are far more likely to follow what leaders do than what policies say.”On risk management, she said organisations must identify the behaviours essential to their strategy and monitor whether those behaviours are demonstrated in practice. On controls, she pointed to performance incentives, recruitment practices, speak-up mechanisms, training and whistleblowing protections as powerful tools that either reinforce or weaken desired culture.“For business leaders, the message is clear.
Values displayed on office walls are not enough,” she said. “If employees are rewarded for outcomes that contradict stated values, the incentives will win every time.” For boards, she added, the opportunity lies in proactively assessing whether culture aligns with strategy and risk appetite rather than waiting for external pressure to reveal weaknesses.
Iiyambo also described an evolving role for internal audit. “Internal audit has traditionally focused on evaluating financial controls, compliance frameworks and operational processes. Increasingly, it is being called upon to provide assurance over the behavioural factors that influence whether those controls work as intended. This is not about auditing personalities or judging individuals. It is about assessing whether organisational systems, incentives and governance structures encourage the right behaviours and support sustainable success.”
She concluded: “Ultimately, strategy defines where an organisation wants to go. Culture determines whether it gets there. The most successful organisations of the future will not be those with the most ambitious strategies alone. They will be those that create cultures where people consistently make decisions and take actions that bring those strategies to life. Internal audit’s role is to provide independent assurance that the two remain aligned, because when culture and strategy move in the same direction, organisations are far better positioned to achieve lasting success.”
