How to Run a Culture Audit: A Step-by-Step Guide

Updated August 2026

A culture audit is a structured diagnostic of how an organization actually works, not how it says it works, built by combining employee surveys, structured interviews, review of visible artifacts, and behavioral data such as turnover and promotion patterns. Done well, it uses a layered model like Schein's three levels to separate surface impressions from the assumptions that actually drive decisions.

Most companies never run one. They run an annual engagement survey, glance at the score, and call it culture work. That's not an audit, it's a temperature check, and it misses almost everything that matters: why people stopped raising problems in a specific team, why two capable managers quietly drove out five hires between them, why the values on the wall stopped describing what actually happens in a decision meeting. A real audit is heavier to run and rarer to see done right, which is exactly why it's worth doing properly. This guide walks through the process a leader can actually execute: the diagnostic lens, the data sources, how to sample without wrecking honesty, and what to do with what you find.

Key Facts

• Only 20% of employees worldwide were engaged at work in 2025, Gallup's lowest reading in over a decade, and a gap Gallup estimates costs the global economy roughly $10 trillion in lost productivity. A culture audit is how you find out which teams and managers are driving that number down. Source: Gallup, State of the Global Workplace
• 82% of executives in Deloitte's Global Human Capital Trends research believe culture is a potential competitive advantage, but only 28% believe they truly understand their own organization's culture, the exact gap an audit exists to close. Source: Deloitte
• McKinsey's Organizational Health Index, one of the largest standardized culture diagnostics in use, draws on more than 8 million survey responses across over 2,500 organizations, evidence that a rigorous, multi-source audit process scales well beyond any single company's homegrown survey. Source: McKinsey
• Edgar Schein's three-level model, first published in a 1984 Sloan Management Review article, remains the default diagnostic framework taught in MBA programs and used by consultants running culture audits four decades later. Source: MIT Sloan Management Review
• 66% of office professionals have used AI tools at work they believed were not approved under company policy, and 88% have shared work-related information with public AI tools like ChatGPT, Claude, or Gemini, a shadow-AI gap most culture audits don't yet think to ask about. Source: PagerDuty, 2026 Shadow AI Workplace Survey
• 65% of organizations in Deloitte's 2026 Global Human Capital Trends research say their culture needs to change significantly because of AI, and 34% say culture is currently blocking their AI transformation goals, a case for adding AI-specific questions to any audit run this year. Source: Deloitte, 2026 Global Human Capital Trends

Why Run a Full Audit Instead of Just a Survey

An engagement survey answers one question well: how do people feel right now, on average. A culture audit answers a harder set of questions: what do people actually do when nobody's grading them, what unwritten rule explains a pattern of behavior that contradicts the stated values, and where specifically, by team or manager, is the gap between the two widest.

Business culture is a system: hiring criteria, what gets rewarded in a promotion cycle, who gets interrupted in a meeting, what a new hire learns to imitate in their first month. A single survey score can't diagnose a system. It can tell you the temperature dropped; it can't tell you which pipe is leaking. An audit exists to find the pipe.

The other reason to run a full audit rather than lean on one instrument: any single method has a specific blind spot. A survey misses what people won't type even anonymously. An interview misses what a nervous employee won't say to a stranger with a notebook. Behavioral data misses intent and context. Combine several sources and cross-check them against each other, and the blind spots mostly cancel out. That triangulation is the entire logic of an audit, and it's why how to measure company culture treats no single metric as sufficient on its own.

The Diagnostic Lens: Schein's Three Levels

Before collecting a single data point, decide what layer of culture each piece of evidence is actually telling you about. Schein's three levels of culture give the clearest structure for that: artifacts, espoused values, and basic underlying assumptions, ordered from most visible to least, and from least powerful to most.

Level 1: Artifacts (what you observe)

Artifacts are everything you can see, hear, or read without asking anyone anything: office layout, who talks in a meeting and who stays quiet, what gets celebrated in a company Slack channel, how a performance review document is actually written versus how the policy says it should be written, what the org chart implies about who real decisions run through. Artifact review in an audit means sitting in on real meetings (not staged ones), reading a sample of real Slack threads and review documents, and walking the physical or virtual workspace with fresh eyes.

Artifacts are the easiest evidence to collect and the easiest to misread. A "no meetings before 10am" policy could mean genuine respect for focus time, or it could mean nobody trusts the policy enough to actually decline a meeting that gets scheduled anyway. Artifacts tell you what to ask about next; they rarely explain themselves.

Level 2: Espoused Values (what the organization says)

This is the stated layer: the values on the careers page, what leadership says in an all-hands, what a manager tells a new hire during onboarding. In an audit, gather this from the same sources: the employee handbook, onboarding materials, recent all-hands recordings or slides, and leadership interviews about what they believe the culture is.

The audit's job at this level isn't to record the espoused values, it's to measure the gap between them and what Level 1 actually shows. "We value work-life balance" as an espoused value, next to a promotion history where every promoted manager routinely worked past 8pm, is the single most useful finding a culture audit can surface, because it names exactly where trust erodes.

Level 3: Basic Underlying Assumptions (what actually drives behavior)

This is the layer surveys and casual observation cannot reach directly. Underlying assumptions are the taken-for-granted beliefs nobody states out loud because nobody thinks of them as beliefs, they're just "how things are": "the people who stay latest get promoted," "raising a problem in a leadership meeting gets you labeled difficult," "this team's real priority is speed, whatever the roadmap doc says." These assumptions produce the artifacts and quietly override the espoused values.

The only reliable way to surface Level 3 is structured, one-on-one or small-group interviews conducted by someone the interviewee trusts enough to be candid with, ideally not their own manager, paired with careful reading of the gaps found at Levels 1 and 2. When an interview answer explains a pattern you already saw in the data (why did three people from the same team leave in the same quarter, each citing something different, each pointing at the same manager), you've likely found a real underlying assumption instead of a one-off complaint.

The Culture Audit Process, Step by Step

With the three-level lens in mind, here's the sequence that turns a vague "let's understand our culture" request into a finished, actionable report.

Step 1: Define scope and the questions you're actually answering

An audit without a specific question tends to produce a pile of interesting but unactionable observations. Start narrower: are we auditing the whole company, or one function where attrition spiked? Are we diagnosing a merger integration, checking whether culture matches a new strategy, or investigating a specific complaint pattern? Organizational culture vs. climate vs. values is worth reading before scoping, since conflating the three leads teams to audit the wrong thing, most often climate (this month's mood) when the real question is culture (the durable operating system underneath it).

Step 2: Choose your data sources

No single source is sufficient. The table below is a starting menu; most audits use four or five of these, not all seven.

Step 3: Sample carefully across the organization

A culture audit that only interviews people leadership already trusts, or only surveys the headquarters office while ignoring a distributed team, produces a report that confirms what leadership already believed. Deliberately stratify the sample: mix tenure (new hires see things veterans have stopped noticing), level (junior and senior views of the same policy often diverge sharply), function, location, and, where relevant, whether someone reports into a manager already flagged by attrition data.

Oversample where the behavioral data already points to a problem. If one team has three times the voluntary turnover of the department average, that team deserves more interview slots than its headcount alone would justify, since it's more likely to be where the real signal lives.

Step 4: Protect psychological safety in the audit itself

An audit that isn't safe to be honest in produces exactly the flattering, useless data a healthy-looking audit is supposed to prevent. A handful of design choices decide whether people tell the truth or perform for the interviewer:

• Guarantee and mean real anonymity for surveys, and aggregate any interview or focus-group finding above the level where an individual could be identified from it, especially in small teams.
• Never let a person's own manager conduct or sit in on their interview or focus group. Why teams stay silent in meetings is the same trust dynamic that will quietly sabotage an audit interview if the wrong person is in the room.
• Tell people upfront, specifically, what will and won't be shared with leadership, and hold that line exactly. One broken promise about anonymity ends honest participation for years, not just this audit cycle.
• Watch for uniformly positive, low-variance responses paired with high completion rates. That pattern often signals caution, not health, the same trap covered in psychological safety at work.

Step 5: Analyze for patterns, not averages

A company-wide average flatters everyone and indicts no one. Cut every data source by team, manager, tenure, and function before you look at the company-wide number at all. The real findings usually live in the spread: one manager's team scoring far below every comparable team, a specific function showing a Level 2 vs. Level 1 gap the rest of the company doesn't have, a location where interview themes contradict the survey's flat, positive score.

Triangulate before writing anything down as a finding. A single low survey item, one pointed interview quote, or one exit theme is a lead to chase, not a conclusion. When three independent sources (survey, interview, and turnover data, say) point at the same underlying assumption, that's a finding solid enough to act on.

Step 6: Turn findings into an action plan

An audit that ends in a slide deck nobody revisits is worse than not auditing at all, because it burns the trust needed to get honest answers next time. Every finding needs an owner, a specific intervention (not "improve communication," but "redesign the promotion criteria that currently reward hours in the office over output"), and a date to check whether it worked. How to change organizational culture covers the mechanics of actually shifting the systems an audit exposes: hiring, promotion, recognition, and how decisions get made. Close the loop with everyone who participated, even the teams whose finding is "nothing changes here yet, and here's why," because silence reads as "nothing happened" whether or not it did.

Sampling and Psychological Safety Are the Same Problem

It's worth naming directly: sampling and psychological safety aren't two separate audit design questions, they're one problem seen from two angles. A perfectly representative sample that doesn't feel safe to be honest in produces confidently wrong data. A perfectly safe process run on a biased, self-selected sample (only the most engaged people volunteer for the focus group) produces honestly incomplete data. Get both right or the audit fails quietly, looking rigorous while measuring the wrong thing.

The practical fix is redundancy: use behavioral data (which people can't easily perform for) to sanity-check what surveys and interviews say, and use a mix of anonymous and facilitated small-group formats so people who won't type a criticism into a form might say it out loud in a room with the right person leading it, and vice versa. Building trust in the workplace is the underlying asset an audit is really testing for, and an audit that damages that trust by handling data carelessly costs more than it earns.

Auditing for AI Cultural Debt and Shadow AI Use

Every method described above was designed for a workplace where the person producing the work was, by default, human. That assumption needs an explicit check now. AI cultural debt is the quiet accumulation of unresolved trust, fairness, and ownership questions that builds up when AI tools spread through an organization faster than anyone tracks their effect on how people work together, and a 2026 audit that skips it is measuring an incomplete picture.

Two specific gaps are worth adding as their own audit thread, not folded quietly into a generic "technology" question:

Shadow AI use. Two-thirds of office professionals report using AI tools they believed weren't approved, and most executives who think they have visibility into AI usage are wrong about how much is actually happening. An audit should ask, directly and without punitive framing (punitive framing guarantees people lie), what tools people actually use to get work done, what sensitive information has gone into them, and whether there's a clear, known answer for when AI use should be disclosed. Trust when your teammate is AI and human-agent teams culture cover the deeper trust dynamics this data feeds into.

Attribution and unequal access. When a document or proposal is partly AI-assisted, is it clear whose judgment actually produced the result, and does everyone on the team have equal access to the same AI tools and training? Murky attribution and unequal access both function exactly like the classic underlying-assumption gap Schein describes: nobody states them as a value, but they quietly shape who gets credit and who gets left behind.

Neither of these needs a separate audit process. They're a handful of specific questions added to the interview guide and survey instrument that's already being built, reviewed with the same rigor as every other finding instead of assumed away because the adoption dashboard looks healthy.

How Often to Run a Culture Audit

A full audit, the kind described above with interviews, artifact review, and behavioral data alongside a survey, is heavy enough that most organizations shouldn't run one more than once every 12 to 24 months, or in response to a specific trigger: a merger, a leadership change, a spike in attrition, or a strategic pivot the current culture may not fit. Running the full process constantly produces fatigue without adding proportional insight.

Between full audits, keep a lighter cadence running so problems don't sit undetected for two years: a short pulse survey monthly or quarterly, and a standing review of the behavioral signals (turnover, internal mobility, promotion patterns) cut by team every quarter. That combination, culture and engagement surveys running continuously with a deeper audit periodically layered on top, catches most problems while they're still cheap to fix and reserves the expensive, disruptive full audit for when it's genuinely warranted.

Common Mistakes That Sink a Culture Audit

Treating the audit as a one-time event instead of a diagnostic that feeds an ongoing system. A report that sits in a shared drive changes nothing. Pair the audit with a standing review cadence, the same discipline behind building a culture of accountability.

Letting leadership pre-write the conclusion. An audit commissioned to confirm what leadership already believes will find exactly that, especially if the interviewer is someone leadership trusts more than employees do. Bring in a facilitator, internal or external, credible to the people being audited, not just to the people commissioning it.

Skipping the artifact and behavioral layers because surveys are easier. A survey-only audit is really just an engagement survey with a different name. The artifact review and behavioral data are what let you catch the gap between what people say and what actually happens, which is the entire point of using a three-level model in the first place.

Averaging away the real finding. A flat, healthy-looking company-wide number very often hides two or three teams in genuine trouble. Report by team and manager, not just company-wide, or the audit will systematically protect exactly the managers it should be flagging.

No plan for what happens after. An audit is a diagnostic, not a treatment. If there's no budget, time, or leadership appetite to act on what it finds, either delay the audit until there is, or be explicit upfront that this round is exploratory, so participants aren't promised change that isn't coming.

Where to Go Next

A culture audit is the deep, periodic diagnostic. It works best alongside the lighter, continuous measurement and the follow-through systems that turn a finding into a fixed problem:

• Schein's three levels of culture, for the full model behind the diagnostic lens this audit process is built on
• How to measure company culture, for the lighter, continuous toolkit (surveys, eNPS, OCAI) to run between full audits
• Signs of a toxic culture, for the specific patterns an audit is often commissioned to investigate
• The link between culture and performance, for the business case that justifies the time an audit takes
• AI cultural debt, for the fuller playbook on the newest layer any current audit needs to cover

A culture audit is not a survey with a longer name, and it's not a report you commission once and file away. It's a deliberate, periodic act of looking underneath the artifacts and the stated values to find the assumptions actually running the place, sampled widely enough and made safe enough that people tell you the truth, and followed by real changes to the systems the audit exposes. Run it that way, on that cadence, and it earns the trust it needs to keep working the next time around.