How to audit for diversity and inclusion

For years organisations have been urged to increase diversity at all levels from the board down – initially by increasing the representation of women and ethnic minorities and, more recently, to broaden the “lived experience” and diversity of thought brought in by people with different backgrounds and visible and invisible differences and to improve the overall inclusivity of the workplace.

The current skills shortages make it even more imperative that organisations tap into talent in groups who may currently be under-represented in their workforce – and then make them feel comfortable and able to express their views. There is little point hiring someone with a different outlook if they then feel pressure to conform to the “norm” in that environment. Overall progress has been patchy and auditing success in such a nebulous and, often, highly personal area is complex.

In the Chartered IIA’s “Cultivating a healthy culture” survey released in March, equality, diversity and inclusion (EDI) is cited by 34 per cent of internal audit respondents as a top three risk that impacts the corporate culture and undermines fairness. The report cited evidence from a 2018 study by consultancy the Centre for Economics and Business Research that the most diverse workplaces are 12 per cent more likely to outperform their industry average financially than the least diverse companies, while firms with the most developed diversity policies are 15 per cent more likely to outperform financially those that focus less on diversity.

Despite this, white men are more likely to be employed, and to be in senior positions, than any other group in most organisations. Some industries are overwhelmingly white: 96 per cent of firefighters are white, as are over 90 per cent of teachers. According to gay rights charity Stonewall, one in five LGBTQ+ people say they are discriminated against in job interviews and recruitment processes, while research by the Trades Union Congress (TUC) released last year suggests a third of ethnic minority workers have been unfairly turned down for a job.

Some organisations believe their success is built on the team they already have in place and are reluctant to change. Others want to recruit more widely, but are unclear about why it is important and are more influenced by “best practice” and a “tick-box” approach than a meaningful desire to change or to recognise long-term opportunities.

So what can internal audit do to help? For a start, internal auditors can encourage managers to understand, and be ambitious about, EDI. and to view lack of diversity as a risk to their business sustainability. They can also suggest ways to collect and monitor reliable data.

Importantly, they should also ensure that their own teams are inclusive, understand the core issues and reflect the diversity in their broader society and of their auditees. Red flags in the business are likely to be more obvious to those who have encountered similar issues personally, or among people they know, in the past. Encouraging people to share their own experiences and express their differences will also help to educate others in the team and open their eyes to things they may not previously have considered.

Set goals

At a basic level, organisations that wish to increase diversity should state specific goals, outline steps to achieve these and then audit and track what happens, says Elaine Wood, vice-president risk, analytics and investigations at consultancy Charles River Associates. Once goals are set, managers must be expected to demonstrate – internally and externally – that they are making progress towards them. “What gets measured, gets done,” she points out.

Patrick Johnson, director of EDI at The University of Law, adds that the more specific these goals are, the easier it will be to measure success. If, for example, the aim is to increase diverse representation in the workforce, managers should consider which groups are under-represented and determine where the under-representation is – in senior management, a department or elsewhere. They should also define success. Is it to have a workforce that mirrors the diversity of the UK population or the diversity of customers?

Collect and interrogate data

Next, organisations need to establish whether they are capturing the correct demographic data (for example on gender identity, ethnicity or disability status). Good quality data about diversity is key to any audit. Benchmarking diversity data will provide a baseline against which internal auditors can identify trends and track progress over time.

HR data, for example, should show who is applying for jobs, who gets appointed or promoted, and who stays. This will help internal auditors to spot potential problems at different stages in recruitment, selection and talent management processes.

Internal auditors should interrogate the data and ask questions to test whether management’s EDI policy will work and add value with suggestions for improvements, says Janet Barberis, managing director at consultancy Protiviti.

Questions could include:

• Is the EDI policy we have in place the right one?

• What are the requirements for success and how is success measured?

• What information do we have?

• What are the sources of this information?

• How accurate and comprehensive is the information?

• What do we want the information to tell us – what will it prove?

• How are we going to use this information – what purposes will it serve?

• Is this the right information or are there gaps?

“It is vital that organisations question why they feel that EDI is important for their business,” says Barberis. “If they can’t answer these questions, then they can’t understand the drivers or benefits.”

Internal audit can also help to detect problems with, or omissions in, EDI strategies. Are diversity and inclusion questions included in employee engagement data and in performance management processes? Have any problems been reported, identified or addressed in particular teams, departments, locations or countries? Does employee data for each location match the demographic data for
that location?

Remuneration is important. All employers with 250 or more employees must disclose their gender pay gap, but there is no such requirement to chart ethnicity pay gap or other pay gaps. This should not stop organisations from identifying it.

Listen and learn

Assessing an organisation’s culture and willingness to embrace inclusivity is not easy. It may be inconsistent, with varying degrees of inclusivity in separate roles and functions and according to types of difference, visible and invisible. It may also change over time as staff move on and other factors affect corporate culture.

Listening to employees is vital. Internal auditors talk to people across the organisation, so can incorporate questions about diversity and inclusion into many different audits, particularly any related to HR, talent management, succession planning and culture.

When it comes to disability, for example, Chris Jay, managing director of awareness training provider Bascule Disability, recommends asking staff with disabilities how they feel – although this depends on identifying these people in the first place. “Ask them about their journey and, if they have non-visible disabilities, why they revealed these to their managers,” he says. “Ask what the organisation does well? Where can it improve? How can you encourage other staff to be more open about their needs?”

Internal auditors can also urge management to establish formal EDI “listening sessions” suggests Ali Shalfrooshan, occupational psychologist and head of international assessment R&D at talent management organisation Talogy. “Ask employees in different locations and/or departments how they experience the organisation, and find out whether they feel valued, included and respected. Would they find employee networks or resource groups useful?” he says. It’s equally important to demonstrate that managers act on the feedback.

One straightforward area for internal audit assessment is the quantity and quality of training and whether staff are aware of EDI policies. “Ask who has received disability awareness training? If it’s confined to HR and EDI teams, management needs to broaden its horizons,” Jay says. “Every staff member should understand disability and there should be an inclusive mindset in all departments and at all levels of seniority. This way, inclusivity feeds into your brand and is considered in your marketing, your recruitment, website, HR, products and services, workplace culture and so on.”

Lead from the top

Visible executive leadership is essential. Rachael Wilson, managing director at diversity consultancy EW Group and Challenge, advises internal auditors to check that EDI initiatives “engage senior leaders so employees recognise the importance of the programme and the audit”.

Organisations also need to be transparent if an audit highlights areas for improvement. “Recognising that you aren’t where you want to be now, but that you are setting out a clear roadmap for how to get there is incredibly powerful,” Wilson says.

“Incremental change is a powerful message to communicate to staff, especially when it’s balanced with a sense of what is realistic given the resources you have and the context in which you operate,” she says. Changes that could appear negative – such as an increase in complaints and grievances – could be positive if they demonstrate a culture where employees feel they can safely raise concerns.

Internal audit can also monitor the EDI information presented to the board and whether executives are aware of data that should be considered when they make decisions. “Is the board just looking at the numbers, or is it looking deeper at how EDI is improving talent management, retention rates and performance, and generating creativity?” asks Fiona Hathorn, CEO of Women on Boards UK, a network to promote female executives.

Any EDI targets set by management should be “intelligent” rather than headline-seeking, she adds. “There’s no point saying that you want your organisation to have 30 per cent women in its headcount by 2030 if female employees currently account for less than 5 per cent of the total,” she says. “Organisations that are transparent about where they are now and that set out plans for achievable targets will fare better than those that are simply trying to hit headline numbers.”

Internal auditors can use their influence to advise executives about what the data shows, what targets will be seen as realistic and achievable and what comparable organisations are doing and saying. They
can also help to establish whether communications to staff are effective and updated and monitor the response they generate – as well as assessing progress towards the targets themselves.

Ultimately, EDI is a risk, as well as a great opportunity. Whether internal audit conducts a specific EDI audit, or whether it seeks EDI data in many audits, it should be highlighting both aspects to the audit committee and to boards regularly. Even those organisations that are currently successful will suffer in future if they are less inclusive and diverse than their competitors. Change may not happen immediately, but internal audit can play an important role by establishing EDI on the board agenda and providing assurance about the extent and pace of change. 

This article was first published in September 2022.