The role of internal audit in creating a corporate risk culture; example of Türkiye

Businesses are faced with various risks due to developing technology, global crises and natural disasters. Anticipating potential risks, taking preventive measures and effectively managing risks have become crucial for the survival of businesses. This reality has forced businesses to develop the concept of corporate risk culture, to manage risks more effectively and even to take advantage of foreseen risks. By contrast, businesses that failed to manage risks often faced closure. Realizing this, some businesses adopted the idea of creating a corporate risk culture and engaged in joint activities with the internal audit unit in this process. However, the transformation of enterprise risk management activities into a corporate culture is relatively rare, and the exact steps for implementing this process remain unclear. Similarly, the role of internal audit in establishing the corporate risk culture has not been fully determined. Therefore, this study aims to determine the role of internal audit in creating an enterprise risk culture. In order to achieve this aim, data were collected from 15 companies traded in BIST 100 through semi-structured interviews. Interviews revealed that the internal audit function plays an important role in the cultural transformation of risk management activities across the organization. The internal audit unit assists risk managers in identifying risks, conducts risk assessments and provides training to increase risk awareness throughout the organization. In this direction, the internal audit unit carries out preparatory work together with risk managers before establishing a corporate risk culture, identifies risks by evaluating market conditions and corporate structure, and provides risk management training to all employees. Periodic trainings should be organized to increase the risk management awareness of the employees. During the actual establishment of the risk culture, internal audit should provide ongoing consulting activities to minimize system errors. Once the transformation process is complete, internal audit should provide assurance services to keep the process running smoothly and implement any necessary fixes. Keywords: Risk, Culture, Internal Audit, Risk Culture, Risk Management, Corporate Risk Culture, Corporate Risk Management, Organizational Culture, Organizational Culture Transformation