Whether they are formally aware of it or not, all companies have a business model which explains not what they do but how they make their money.

For some business leaders this is instinctive—they just know how to be successful and don’t really think about it. For others, developing a business model is a more considered process.

Either way round, however, the business model will reflect the values of those who adopted it. For example, a company’s approach might be to undercut competitors, squeeze them out of the market and then enjoy a monopoly advantage at the expense of its customers.

This reflects values that see no wrong in behaving unfairly towards others and exploiting customers. It is also a model that ultimately won’t work because customers, the broader public, will wise up to what is happening and put a stop to it.

Another company might develop a business model that relies on innovation as a means of bringing real value to its customers, and thereby giving it a competitive advantage. This is much more likely to be sustainable in the long term.

The underlying point is that companies—and the way they and their employees behave—are driven by values, which are themselves a reflection of the values of its top leadership. Values and culture—things like openness, reliability, fairness and honesty—are core to the way a company operates, not a public relations add-on.

Acknowledgment

Boards need to be aware of their values, their impact on their business model and in turn on corporate risk. Once they have acknowledged that this is important to the long-term sustainability of the business, they also need to be sure that the values they want are embedded in the company and that staff at every level are comfortable with them.

This is where internal audit can play an important role. Internal auditors have detailed knowledge of the way the company operates at every level. They can see weaknesses and report back on them to the board and senior management.

There is one difficulty, however. Internal auditors are used to measuring things but culture cannot easily be measured.

The IBE’s Board Briefing, Checking culture: a new role for internal audit, suggests that this should not be an excuse for turning away from the task. Insofar as most corporate disasters can be traced back to a cultural weakness, a flawed culture is clearly a risk factor, and internal audit should pay attention.

This depends on asking the right questions—not just what has happened but also why. It depends on joining the dots: are sales targets so demanding that people are cutting corners? It depends on identifying quantitative indicators, like staff turnover, which may point to weakness across the firm or in a particular division.

Sometimes boards make decisions that have unintended consequences. For example, they may decide the company needs to increase its working capital. Yet if they are not careful, managers down the line may respond by delaying payments to suppliers, causing reputational damage or even threatening the company’s own operations if they drive crucial suppliers into financial difficulty.

Internal audit can help by investigating whether expected payment schedules are being respected and ensuring the board is informed if they are not. That way they will help preserve the values the company has set for itself.

This is not to say that internal auditors can or should be leaders in shaping culture. That is the job of the board and senior management. Nor should internal auditors work alone. Compliance and ethics departments are potentially important allies. But, providing they have the right relationships and the right mandate from the top, they can be important agents for positive change. Boards should encourage them, and use what they have to offer.

Peter Montagnon is associate director at the Institute of Business Ethics.

@IBEUK