Control environment
Also known as: Tone at the top, Control culture
The set of standards, processes, and structures that provide the foundation for internal controls across an organization. It reflects management's attitude toward risk, integrity, and ethics, shaping how employees view and adhere to compliance requirements.
In practice
An auditor assesses this by reviewing a company's code of conduct and interviewing leadership to verify that security policies are consistently enforced rather than just documented.