Tone at the Top
5 minutes
5 Questions
Tone at the Top refers to the ethical atmosphere and attitude toward governance, risk management, and internal control that an organization's leadership—its board of directors, audit committee, and senior executives—establishes and communicates throughout the enterprise. In the context of the Certification in Risk Management Assurance (CRMA) and risk management governance, it is recognized as the foundation of the control environment, the first component of the COSO Internal Control and Enterprise Risk Management frameworks. Leadership's words, decisions, and, most importantly, actions signal to employees what behavior is acceptable, how seriously risk is taken, and whether integrity will be rewarded or sacrificed for short-term results. A strong tone at the top is demonstrated when executives model ethical conduct, enforce codes of conduct consistently regardless of seniority or performance, support independent assurance functions such as internal audit, allocate adequate resources to risk management, and respond transparently to control failures or misconduct. Conversely, a weak or inconsistent tone—such as tolerating aggressive accounting, overriding controls, pressuring staff to meet unrealistic targets, or punishing whistleblowers—undermines even well-designed risk frameworks and is a common root cause of major corporate scandals. For risk management assurance professionals, evaluating tone at the top is a critical, though inherently qualitative, part of assessing the overall effectiveness of governance and the enterprise risk management process. Techniques include reviewing board minutes and communications, surveying employee perceptions of ethical culture, analyzing hotline reports and how they are resolved, examining compensation structures for perverse incentives, and observing management's responsiveness to audit findings. CRMA holders are expected to provide assurance that leadership's stated risk appetite aligns with actual behavior and that the culture reinforces accountability. Ultimately, tone at the top determines whether risk management is embedded as a genuine organizational value or treated merely as a compliance exercise, making it indispensable to sustainable governance.
Tone at the Top: The Foundation of Risk Management Governance (IIA CRMA Guide)
1. Why Tone at the Top Matters
Every major corporate failure of the last few decades (Enron, WorldCom, Wells Fargo, Volkswagen, Wirecard) shares a common root cause: the people at the top either tolerated, encouraged, or modelled behaviour that undermined the organisation's stated values. Policies existed. Controls were documented. Codes of conduct were signed. Yet none of it mattered because the real message sent by leadership contradicted the written message.
This is why Tone at the Top is treated in the CRMA syllabus as the cornerstone of Risk Management Governance (Domain II). It is the single most influential 'soft control' in any organisation. If it is weak, every hard control (segregation of duties, approvals, reconciliations, monitoring) becomes vulnerable to management override, rationalisation and selective enforcement. If it is strong, controls are respected even when nobody is watching.
For a risk management assurance professional, understanding tone at the top is essential because:
• It determines whether a risk management framework is lived or merely documented.
• It is the primary driver of risk culture, which in turn determines how risk appetite is actually applied in day-to-day decisions.
• It is the area where internal audit adds the greatest value, and faces the greatest independence challenge, because the subject of the assessment is the very leadership the function reports to.
2. What Is Tone at the Top?
Definition: Tone at the top is the ethical atmosphere created in an organisation by the attitudes, actions, communications and decisions of its board of directors and senior management. It reflects the degree to which leadership demonstrates a genuine commitment to integrity, ethical values, accountability and sound risk management.
Key features to remember:
• It is set by the board and senior management (the board exercises oversight; the CEO and executive team set the day-to-day example).
• It is communicated far more through actions than words. What leaders reward, punish, tolerate and prioritise speaks louder than the code of conduct.
• It is a soft control, meaning it is intangible, difficult to measure, and assessed through indicators and evidence rather than through a single test.
• It is foundational: it sits at the base of the control environment and of the governance and culture component of enterprise risk management.
Tone at the top within the frameworks examined in CRMA:
COSO Internal Control – Integrated Framework (2013): The Control Environment component is the foundation of the five components. Principle 1 states that 'the organisation demonstrates a commitment to integrity and ethical values'. Principle 2 covers board independence and oversight. Tone at the top is the practical expression of these principles.
COSO Enterprise Risk Management – Integrating with Strategy and Performance (2017): The first component, Governance and Culture, contains five principles: exercises board risk oversight, establishes operating structures, defines desired culture, demonstrates commitment to core values, and attracts, develops and retains capable individuals. Tone at the top is explicitly referenced as the mechanism through which culture and core values are embedded.
ISO 31000:2018: The 'Leadership and Commitment' element of the framework requires top management and oversight bodies to ensure risk management is integrated into all activities and to demonstrate commitment through policy, resourcing and accountability.
The IIA Three Lines Model (2020): The governing body is accountable to stakeholders for organisational oversight, sets the tone, and establishes structures and processes for governance including an independent internal audit function. Management (first and second lines) acts within the tone set by the governing body.
Global Internal Audit Standards (2024): Domain III (Governing the Internal Audit Function) emphasises the board's role in supporting internal audit's independence, which is itself a manifestation of tone at the top. Domain I (Purpose) and Domain II (Ethics and Professionalism) require internal auditors to promote ethical culture and act with integrity.
3. How Tone at the Top Works
3.1 The transmission mechanism
Tone at the top works by cascading through the organisation:
• Tone at the top (board and C-suite) sets expectations.
• Mood in the middle (middle management) interprets and transmits those expectations; this is where the message is most often distorted or diluted.
• Buzz at the bottom (front-line staff) reflects what employees actually believe is expected of them.
Internal auditors assessing culture must evaluate all three layers, because a strong tone at the top that does not reach the middle and bottom is ineffective.
3.2 Elements that demonstrate a strong tone
• A clearly articulated and visibly supported code of conduct that applies equally to executives and staff.
• Leaders who 'walk the talk' and are seen to comply with policies themselves (expenses, approvals, disclosures).
• Consistent consequences for misconduct regardless of seniority or performance.
• Incentive and remuneration structures aligned with long-term, ethical performance rather than short-term targets that encourage corner-cutting.
• Open communication channels, including a whistleblowing hotline, protection against retaliation, and evidence that concerns raised are acted upon.
• An independent, empowered board and audit committee that challenge management, approve risk appetite, and oversee risk management.
• Support for assurance functions: adequate resourcing of internal audit, risk and compliance, unrestricted access to information, and direct reporting lines to the board.
• Transparency in reporting risk information, including bad news, to the board and stakeholders.
3.3 Red flags indicating a weak tone
• Frequent or unexplained management override of controls.
• Aggressive, unrealistic targets with severe penalties for missing them.
• A dominant CEO with an unchallenging or captive board.
• High turnover in finance, compliance, risk or internal audit roles.
• Restrictions on internal audit scope, budget, or access to the audit committee.
• Disciplinary action applied inconsistently, with 'star performers' exempt.
• A 'shoot the messenger' response to bad news or whistleblowers.
• Ethics training that is treated as a tick-box exercise and not attended by senior leaders.
• Disconnect between stated values and actual decisions (e.g., stating 'safety first' while cutting maintenance budgets).
3.4 The link to risk appetite and risk culture
Risk appetite is approved by the board, but whether it is respected depends on tone. If leadership celebrates deals that breach limits, the real risk appetite is higher than the documented one. Risk culture is the collective set of attitudes toward risk within the organisation, and tone at the top is its primary input. For CRMA purposes: tone at the top shapes risk culture, and risk culture determines whether the risk management framework operates as designed.
3.5 Internal audit's role regarding tone at the top
Internal audit does not set the tone; that is a board and management responsibility. Internal audit's role is to:
• Assess the design and effectiveness of the control environment, governance and culture, including tone at the top, as part of its risk-based plan.
• Gather evidence through interviews, employee surveys, exit interviews, whistleblower data analysis, review of board minutes, examination of incentive schemes, review of disciplinary records, analysis of policy exceptions and override logs.
• Report findings objectively to the board or audit committee, including uncomfortable conclusions about senior management behaviour.
• Escalate when management fails to act on significant culture or ethics concerns, in line with the Standards.
• Model ethical behaviour itself, maintaining independence and objectivity even under pressure.
Because evaluating tone at the top involves assessing those to whom internal audit reports administratively, functional reporting to the board and the chief audit executive's unrestricted access to the audit committee are critical safeguards.
4. Exam Tips: Answering Questions on Tone at the Top
Tip 1: Know who owns it. If a question asks who is responsible for establishing tone at the top, the answer is the board of directors and senior management (frequently phrased as 'the board and executive management' or 'the governing body and the CEO'). It is never internal audit, the risk function, or the compliance department. Internal audit assesses; management sets; the board oversees.
Tip 2: Recognise it as a soft control. Expect questions contrasting hard controls (reconciliations, approvals, access restrictions) with soft controls (tone, culture, competence, trust). When a scenario describes well-designed hard controls that still failed, the examiner is usually pointing to a weak control environment or tone at the top as the root cause.
Tip 3: Link it to the right framework component. In COSO Internal Control, tone at the top belongs to the Control Environment (Principle 1). In COSO ERM 2017, it belongs to Governance and Culture. Do not confuse it with Control Activities, Information and Communication, or Monitoring. In ISO 31000 it corresponds to Leadership and Commitment.
Tip 4: Actions beat words. When answer options describe different indicators of tone, the strongest evidence is always behavioural: consistent enforcement, leaders complying personally, consequences applied to senior staff, resources committed. Weaker evidence is documentary: a code exists, a policy was issued, a memo was circulated. The examiner rewards recognising that a signed code of conduct alone proves very little.
Tip 5: Spot the management override signal. Scenarios involving a CEO or CFO pressuring staff, bypassing approvals, discouraging whistleblowers, or dismissing internal audit findings are testing tone at the top. The best response usually involves internal audit reporting directly to the audit committee or board, not confronting the executive privately and leaving it there, and not ignoring the issue because 'it is outside the engagement scope'.
Tip 6: Understand the cascade. If a question refers to 'mood in the middle' or 'buzz at the bottom', it is testing whether you understand that tone must be transmitted and that internal audit should evaluate culture at all levels, often through surveys and interviews, not just at board level.
Tip 7: Connect to risk appetite and culture. Questions on why a risk appetite statement is not being followed, or why risk limits are routinely breached without consequence, are usually answered by pointing to weak tone at the top and its effect on risk culture, rather than by recommending another policy.
Tip 8: Remember internal audit's own tone. The chief audit executive sets the tone within the internal audit function. Questions about auditor independence, objectivity, and willingness to report bad news to the board are also, indirectly, tone-at-the-top questions, applied to the audit function itself.
Tip 9: Use elimination for 'best answer' items. Eliminate options that: assign tone-setting to internal audit; rely solely on documents as evidence; suggest reporting culture concerns only to the manager being assessed; or recommend adding more detailed procedures without addressing leadership behaviour. What remains is usually the correct answer.
Tip 10: Watch for key vocabulary. Terms such as 'integrity and ethical values', 'control environment', 'governance and culture', 'walk the talk', 'management override', 'ethical climate', 'code of conduct enforcement', 'whistleblower retaliation', and 'board oversight' are strong signals that the question is about tone at the top, even if the phrase itself is not used.
5. Quick Revision Summary
• What: The ethical atmosphere set by the board and senior management through behaviour, communication and decisions.
• Why: It is the foundation of the control environment and risk culture; weak tone enables override and renders hard controls ineffective.
• Who sets it: Board (oversight) and senior management (example). Not internal audit.
• Frameworks: COSO IC Control Environment Principle 1; COSO ERM Governance and Culture; ISO 31000 Leadership and Commitment; Three Lines Model governing body role.
• Evidence: Consistent enforcement, aligned incentives, independent board, supported assurance functions, functioning whistleblowing, transparent reporting.
• Red flags: Override, aggressive targets, dominant CEO, restricted audit scope, inconsistent discipline, retaliation.
• Internal audit's role: Assess, evidence, report to the board, escalate, and model ethical behaviour.
• Exam mindset: Actions over documents; root cause over symptoms; board over management when escalation is needed.
Every major corporate failure of the last few decades (Enron, WorldCom, Wells Fargo, Volkswagen, Wirecard) shares a common root cause: the people at the top either tolerated, encouraged, or modelled behaviour that undermined the organisation's stated values. Policies existed. Controls were documented. Codes of conduct were signed. Yet none of it mattered because the real message sent by leadership contradicted the written message.
This is why Tone at the Top is treated in the CRMA syllabus as the cornerstone of Risk Management Governance (Domain II). It is the single most influential 'soft control' in any organisation. If it is weak, every hard control (segregation of duties, approvals, reconciliations, monitoring) becomes vulnerable to management override, rationalisation and selective enforcement. If it is strong, controls are respected even when nobody is watching.
For a risk management assurance professional, understanding tone at the top is essential because:
• It determines whether a risk management framework is lived or merely documented.
• It is the primary driver of risk culture, which in turn determines how risk appetite is actually applied in day-to-day decisions.
• It is the area where internal audit adds the greatest value, and faces the greatest independence challenge, because the subject of the assessment is the very leadership the function reports to.
2. What Is Tone at the Top?
Definition: Tone at the top is the ethical atmosphere created in an organisation by the attitudes, actions, communications and decisions of its board of directors and senior management. It reflects the degree to which leadership demonstrates a genuine commitment to integrity, ethical values, accountability and sound risk management.
Key features to remember:
• It is set by the board and senior management (the board exercises oversight; the CEO and executive team set the day-to-day example).
• It is communicated far more through actions than words. What leaders reward, punish, tolerate and prioritise speaks louder than the code of conduct.
• It is a soft control, meaning it is intangible, difficult to measure, and assessed through indicators and evidence rather than through a single test.
• It is foundational: it sits at the base of the control environment and of the governance and culture component of enterprise risk management.
Tone at the top within the frameworks examined in CRMA:
COSO Internal Control – Integrated Framework (2013): The Control Environment component is the foundation of the five components. Principle 1 states that 'the organisation demonstrates a commitment to integrity and ethical values'. Principle 2 covers board independence and oversight. Tone at the top is the practical expression of these principles.
COSO Enterprise Risk Management – Integrating with Strategy and Performance (2017): The first component, Governance and Culture, contains five principles: exercises board risk oversight, establishes operating structures, defines desired culture, demonstrates commitment to core values, and attracts, develops and retains capable individuals. Tone at the top is explicitly referenced as the mechanism through which culture and core values are embedded.
ISO 31000:2018: The 'Leadership and Commitment' element of the framework requires top management and oversight bodies to ensure risk management is integrated into all activities and to demonstrate commitment through policy, resourcing and accountability.
The IIA Three Lines Model (2020): The governing body is accountable to stakeholders for organisational oversight, sets the tone, and establishes structures and processes for governance including an independent internal audit function. Management (first and second lines) acts within the tone set by the governing body.
Global Internal Audit Standards (2024): Domain III (Governing the Internal Audit Function) emphasises the board's role in supporting internal audit's independence, which is itself a manifestation of tone at the top. Domain I (Purpose) and Domain II (Ethics and Professionalism) require internal auditors to promote ethical culture and act with integrity.
3. How Tone at the Top Works
3.1 The transmission mechanism
Tone at the top works by cascading through the organisation:
• Tone at the top (board and C-suite) sets expectations.
• Mood in the middle (middle management) interprets and transmits those expectations; this is where the message is most often distorted or diluted.
• Buzz at the bottom (front-line staff) reflects what employees actually believe is expected of them.
Internal auditors assessing culture must evaluate all three layers, because a strong tone at the top that does not reach the middle and bottom is ineffective.
3.2 Elements that demonstrate a strong tone
• A clearly articulated and visibly supported code of conduct that applies equally to executives and staff.
• Leaders who 'walk the talk' and are seen to comply with policies themselves (expenses, approvals, disclosures).
• Consistent consequences for misconduct regardless of seniority or performance.
• Incentive and remuneration structures aligned with long-term, ethical performance rather than short-term targets that encourage corner-cutting.
• Open communication channels, including a whistleblowing hotline, protection against retaliation, and evidence that concerns raised are acted upon.
• An independent, empowered board and audit committee that challenge management, approve risk appetite, and oversee risk management.
• Support for assurance functions: adequate resourcing of internal audit, risk and compliance, unrestricted access to information, and direct reporting lines to the board.
• Transparency in reporting risk information, including bad news, to the board and stakeholders.
3.3 Red flags indicating a weak tone
• Frequent or unexplained management override of controls.
• Aggressive, unrealistic targets with severe penalties for missing them.
• A dominant CEO with an unchallenging or captive board.
• High turnover in finance, compliance, risk or internal audit roles.
• Restrictions on internal audit scope, budget, or access to the audit committee.
• Disciplinary action applied inconsistently, with 'star performers' exempt.
• A 'shoot the messenger' response to bad news or whistleblowers.
• Ethics training that is treated as a tick-box exercise and not attended by senior leaders.
• Disconnect between stated values and actual decisions (e.g., stating 'safety first' while cutting maintenance budgets).
3.4 The link to risk appetite and risk culture
Risk appetite is approved by the board, but whether it is respected depends on tone. If leadership celebrates deals that breach limits, the real risk appetite is higher than the documented one. Risk culture is the collective set of attitudes toward risk within the organisation, and tone at the top is its primary input. For CRMA purposes: tone at the top shapes risk culture, and risk culture determines whether the risk management framework operates as designed.
3.5 Internal audit's role regarding tone at the top
Internal audit does not set the tone; that is a board and management responsibility. Internal audit's role is to:
• Assess the design and effectiveness of the control environment, governance and culture, including tone at the top, as part of its risk-based plan.
• Gather evidence through interviews, employee surveys, exit interviews, whistleblower data analysis, review of board minutes, examination of incentive schemes, review of disciplinary records, analysis of policy exceptions and override logs.
• Report findings objectively to the board or audit committee, including uncomfortable conclusions about senior management behaviour.
• Escalate when management fails to act on significant culture or ethics concerns, in line with the Standards.
• Model ethical behaviour itself, maintaining independence and objectivity even under pressure.
Because evaluating tone at the top involves assessing those to whom internal audit reports administratively, functional reporting to the board and the chief audit executive's unrestricted access to the audit committee are critical safeguards.
4. Exam Tips: Answering Questions on Tone at the Top
Tip 1: Know who owns it. If a question asks who is responsible for establishing tone at the top, the answer is the board of directors and senior management (frequently phrased as 'the board and executive management' or 'the governing body and the CEO'). It is never internal audit, the risk function, or the compliance department. Internal audit assesses; management sets; the board oversees.
Tip 2: Recognise it as a soft control. Expect questions contrasting hard controls (reconciliations, approvals, access restrictions) with soft controls (tone, culture, competence, trust). When a scenario describes well-designed hard controls that still failed, the examiner is usually pointing to a weak control environment or tone at the top as the root cause.
Tip 3: Link it to the right framework component. In COSO Internal Control, tone at the top belongs to the Control Environment (Principle 1). In COSO ERM 2017, it belongs to Governance and Culture. Do not confuse it with Control Activities, Information and Communication, or Monitoring. In ISO 31000 it corresponds to Leadership and Commitment.
Tip 4: Actions beat words. When answer options describe different indicators of tone, the strongest evidence is always behavioural: consistent enforcement, leaders complying personally, consequences applied to senior staff, resources committed. Weaker evidence is documentary: a code exists, a policy was issued, a memo was circulated. The examiner rewards recognising that a signed code of conduct alone proves very little.
Tip 5: Spot the management override signal. Scenarios involving a CEO or CFO pressuring staff, bypassing approvals, discouraging whistleblowers, or dismissing internal audit findings are testing tone at the top. The best response usually involves internal audit reporting directly to the audit committee or board, not confronting the executive privately and leaving it there, and not ignoring the issue because 'it is outside the engagement scope'.
Tip 6: Understand the cascade. If a question refers to 'mood in the middle' or 'buzz at the bottom', it is testing whether you understand that tone must be transmitted and that internal audit should evaluate culture at all levels, often through surveys and interviews, not just at board level.
Tip 7: Connect to risk appetite and culture. Questions on why a risk appetite statement is not being followed, or why risk limits are routinely breached without consequence, are usually answered by pointing to weak tone at the top and its effect on risk culture, rather than by recommending another policy.
Tip 8: Remember internal audit's own tone. The chief audit executive sets the tone within the internal audit function. Questions about auditor independence, objectivity, and willingness to report bad news to the board are also, indirectly, tone-at-the-top questions, applied to the audit function itself.
Tip 9: Use elimination for 'best answer' items. Eliminate options that: assign tone-setting to internal audit; rely solely on documents as evidence; suggest reporting culture concerns only to the manager being assessed; or recommend adding more detailed procedures without addressing leadership behaviour. What remains is usually the correct answer.
Tip 10: Watch for key vocabulary. Terms such as 'integrity and ethical values', 'control environment', 'governance and culture', 'walk the talk', 'management override', 'ethical climate', 'code of conduct enforcement', 'whistleblower retaliation', and 'board oversight' are strong signals that the question is about tone at the top, even if the phrase itself is not used.
5. Quick Revision Summary
• What: The ethical atmosphere set by the board and senior management through behaviour, communication and decisions.
• Why: It is the foundation of the control environment and risk culture; weak tone enables override and renders hard controls ineffective.
• Who sets it: Board (oversight) and senior management (example). Not internal audit.
• Frameworks: COSO IC Control Environment Principle 1; COSO ERM Governance and Culture; ISO 31000 Leadership and Commitment; Three Lines Model governing body role.
• Evidence: Consistent enforcement, aligned incentives, independent board, supported assurance functions, functioning whistleblowing, transparent reporting.
• Red flags: Override, aggressive targets, dominant CEO, restricted audit scope, inconsistent discipline, retaliation.
• Internal audit's role: Assess, evidence, report to the board, escalate, and model ethical behaviour.
• Exam mindset: Actions over documents; root cause over symptoms; board over management when escalation is needed.
Test mode:
CRMA - Tone at the Top Example Questions
Test your knowledge of Tone at the Top
Question 1
During a culture review, an internal auditor finds that senior management regularly communicates the importance of integrity and risk awareness, and every employee has signed the code of conduct. However, executive bonuses are based solely on revenue growth. In the past year, senior management promoted two business unit managers who exceeded their targets by relying heavily on approved policy exceptions. Which conclusion is MOST appropriate for the auditor to report about the organization's risk culture?
Question 2
During an engagement on risk culture, an internal auditor finds that the chief executive officer often speaks about integrity, and the code of conduct is well written. However, executive bonuses are based only on revenue growth. A regional manager with several substantiated conduct breaches was also recently promoted after exceeding sales targets. Which recommendation should the internal auditor make to BEST address the weakness in tone at the top?
Question 3
Which of the following provides the most persuasive evidence of an effective tone at the top when assessing an organization's risk culture?
Unlock Premium Access
Certification in Risk Management Assurance
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3053 Superior-grade Certification in Risk Management Assurance practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CRMA: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Tone at the Top questions
20 questions (total)
Other Risk Management Governance concepts
Assessing Risk CultureBoard Risk Oversight and CommitteesChief Risk Officer and Risk Function RolesComparing COSO ERM and ISO 31000Corporate Governance Structures and RolesCOSO ERM Components and PrinciplesCOSO Internal Control FrameworkElements of Risk GovernanceEmbedding Risk Management in OperationsEvaluating Governance Structure EffectivenessEvaluating the Quality of Risk ReportsGovernance Frameworks and PrinciplesHorizon Scanning and Scenario AnalysisIdentifying Emerging RisksImpact of Culture on the Control EnvironmentIncentives and Risk-Taking BehaviorIntegrated Risk Reporting to StakeholdersIntegrating Risk into Strategy SettingISO 31000 Principles, Framework, and ProcessIT Governance and Control FrameworksKey Risk Indicators and Performance IndicatorsLinking Risk to Objectives and PerformanceManagement Commitment to Risk ManagementPortfolio View of RiskResilience and Business ContinuityResponding to Change and Strategic RiskRisk Appetite StatementsRisk Capacity, Appetite, and ToleranceRisk Culture and Its IndicatorsRisk Reporting to the BoardSelecting a Framework That Fits the OrganizationSoft Controls and Ethical Climate