Poor corporate culture is often the deep-seated cause of a company's problems or scandals. Richard Chambers, senior risk and audit advisor at audit and compliance platform AuditBoard, said, "A healthy culture is actually the strongest control, while a toxic culture is the biggest risk."

However, for many companies, developing effective strategies to guard against cultural risk is often easier said than done. AuditBoard noted in a recent report that although 80% of governance, risk, and compliance professionals agree on the importance of organizationalculture, responsibility for managing this risk is often unclear.

Chambers noted that CFOs are in a key position to take on such risks because in many companies, departments such as risk management and internal audit typically report to the finance chief. Therefore, it is crucial that finance chiefs "are aware of the risks surrounding culture."

"CFOs bear significant responsibility in helping the CEO, the entire executive team, and even the board by providing the accurate and reliable information they need to make decisions. But I think many times they don't necessarily connect the question of 'what is the financial impact of a toxic culture' to that information," he said in an interview on Wednesday.

Hedging cultural risk

In Chambers' view, culture can simply be boiled down to "the way things are done around here." He said, "That's not an original phrase... but it does reflect the behavioral characteristics that typically define a company." However, this does not mean culture is one-size-fits-all: the norms of business culture can vary by geographic region or department.

"The corporate headquarters may have a tone at the top set by the CEO and executive team, but when you look at different business units, you may find they don't necessarily follow the direction set by the tone at the top," Chambers said.

Incorporating this understanding of culture into risk management strategy is essential for accurately tracking risks and preventing the development of a toxic culture. He said, "I always advise internal audit departments to look at culture in every audit, because culture is often the root cause of the issues they uncover."

However, Chambers also cautioned, "I think it's a mistake for oversight functions—whether audit, risk, or compliance—to try to take over the entire organization, the entire enterprise, at the outset in many cases."

In a 2023 study, AuditBoard identified internal audit as a key component of cultural oversight. But its "2025 Organizational Culture and Ethics Report" noted, "Our 2025 survey results show that internal audit alone cannot bear the assurance responsibility for cultural risk."

The report said, "Cultural risk is now linked to some of the most dynamic and sensitive risk areas facing organizations, such as AI ethics, ESG authenticity, hybrid work norms, and shifting political expectations around DEI (diversity, equity, and inclusion)." It also noted that if business leaders fail to agree on clear strategies for managing such risks, they may "become disconnected from regulators, employees, and stakeholders, not to mention missing out on opportunities for performance improvement."

Chambers, in a 2023 interview with CFO Diveduring an interviewsaid there is a "clear, distinct line" between a healthy culture and long-term business performance.

"You can have a great business strategy," he said on Wednesday, "we can have a vision, a purpose, and know where we want to take the company. But I think culture is often the wind that, if not closely monitored and adjusted when it becomes toxic, can blow you far off course."

Putting the CFO at the helm of culture

As companies face an increasing array of risks, many are asking their CFOs to chart a clear path through macroeconomic and internal challenges, including cultural risk. However, for CFOs to do this, they must be able to see the big picture. When different parts of the business operate in silos, using their own technology solutions to address risks, seeing the big picture can be challenging.

If compliance, risk management, and internal audit departments each examine risks independently, and "their technology systems can't talk to each other, there is no single source of truth," Chambers said. He said finance chiefs can play a key role in bridging these gaps.

"That's where I think CFOs need to stay focused, ensuring that these key roles—many of whom are direct reports to the CFO—have the technology and resources they need," he said. Finance chiefs should also "set expectations" to drive greater collaboration and communication among these previously siloed teams and systems.

However, Chambers advises CFOs not to try to manage these technologies themselves, but rather to "empower the key roles in those so-called silos to identify and acquire the cross-functional technology solutions they need."