I have been running workshops on auditing culture for around 12 months 
Here are some of my main reflections:

1. There are really good reasons this is an area that this has not been addressed by audit in the past – reasons include the question of what we mean by culture – what is suitable evidence to judge the culture – how wide / narrow to tackle this topic ( as part of an ordinary audit or as part of a theme) – what criteria to choose to determine whether the culture is good enough.
2. After the workshops most participants recognise that culture is very complex and no single model can be used to pin it down – any model chosen to measure culture a) will have gaps and b) will often be chosen because it is acceptable to the culture!
3. There is an important FSB guide on key attributes of a good culture but it could easily become a tick box compliance matter and not really ‘grip’ what is happening – in addition it will require serious management leadership to ensure the spirit of the right culture is led by management – this goes beyond high level instances of communicating the right tone – indeed a really good time at the top will ensure this is lived at lower levels (including the famous “tone in the middle”) 
Thus I am not sure I believe comments along the lines: ‘the tone at the top is good, the problem is the tone in the middle’ – To me this is a culturally acceptable statement that is safe but risks addressing important improvement areas in the activities of senior managers.
4. A key problem is that any criteria used to measure the culture are prone to biases – for example when considering if there is there appropriate challenge – there may be instances of challenge on some topics that enables a positive response to be given but this ignores that some topics are of limits in relation to challenge (and these off limit points may not be obvious within the organisation)
5. An additional problem is that desirable cultural attributes may have spin off downsides; consider for example “I would like to ensure everyone is in line with delivering the strategy” an understandable cultural attribute until you see that this could cause the spin off problem of too much conformity / group think and not enough challenge to what is being done. Likewise ‘Lets drive greater accountability’ (an FSB area for attention) sits in a degree of attention with suggestions that there should be greater challenge and more openness – after all ‘why are you challenging me, this is my accountability’ or a fear of being open for fear of suffering consequences from admitting issues or short-comings.
6. Culture often ‘hides in plain sight’ and this is easily underestimated by audit – and in my work a key task is to help audit departments ‘re-see’ what is under their noses.. For example, what norms exist in terms of what audit is / is not allowed to audit? – What is expected in terms of management ownership of driving closure of audit actions (versus audit driving the follow-up process)? What do management do when negotiating remediation timescales, the wording of reports and when the report is being rated?
7. Finally (for this up-date) is the question of the ability of audit (and management) to carry out rigorous root cause analysis. Many audit departments profess a degree of expertise in root cause analysis, but often reflect this is done intuitively, rather than using a particular technique. In addition root cause categories may not be particularly strong and sometimes there is a tendency to confine the Root cause analysis to just one root cause – there is NEVER just one root cause for an issue!

In later blogs I will discuss patterns, organisational behaviour (and links with systems, processes etc.), the question of audit behaviours and the challenge of giving a positive assurance on culture – Comments most welcome – see my LinkedIn page also.

Also see my ‘thought piece’:  Culture: Surveys vs. Root Cause Analysis (PDF)