When a regulatory failure becomes public, the subsequent investigation almost always finds the same thing. The policies existed. The controls were documented. Training had been completed and attested. And yet people across the organisation made decisions that the policies were supposed to prevent, sometimes knowingly, often because the pressures and incentives around them pointed in a different direction.
This is the central challenge of compliance. Frameworks, policies and controls are necessary, but they are not sufficient. What determines whether an organisation behaves well when nobody is checking is its culture: the shared beliefs, habits and expectations that shape everyday decisions.
Regulators have recognised this for some time. Supervisors in many jurisdictions now assess culture and conduct directly, looking at how firms identify and manage the drivers of behaviour, not just whether rules are written down. This article sets out what a genuine compliance culture looks like, why most programmes struggle to build one, and the practical steps that make a difference.
Why policies alone do not work
Most compliance programmes are built around a familiar cycle: identify regulatory requirements, write policies, implement controls, train staff, monitor, and report. Each step is sensible. The problem is what the cycle assumes about people: that if they know the rules and are monitored, they will follow them.
In reality, behaviour is shaped by a much wider set of influences:
- Incentives. What people are rewarded and promoted for, formally and informally.
- Leadership signals. What senior people say, and, more importantly, what they do when targets and principles conflict.
- Peer norms. What colleagues treat as normal, acceptable or expected.
- Friction. How easy it is to do the right thing compared with the shortcut.
- Psychological safety. Whether people feel able to raise concerns without damaging their careers.
When these influences point in the same direction as the policies, compliance is largely self-sustaining. When they point in a different direction, no amount of policy writing or training will close the gap.
What a strong compliance culture looks like
In organisations with a genuinely strong compliance culture, a few characteristics consistently stand out.
Compliance is seen as part of the business, not a function beside it
Business leaders own the compliance risks in their areas. The compliance function advises, challenges and monitors, but it is not treated as the department responsible for keeping everyone else out of trouble. Front-line managers can explain the main regulatory risks their teams face and how they are managed.
Concerns are raised early and welcomed
People raise issues when they are small, because experience has taught them that doing so is valued. Leaders respond to concerns with curiosity rather than defensiveness. Speak-up channels are used, and people who use them see action taken.
Difficult trade-offs are discussed openly
When commercial objectives and regulatory obligations appear to conflict, the conflict is discussed openly and resolved at the right level, rather than resolved quietly by individuals under pressure to hit a number.
Mistakes are treated as information
When something goes wrong, the response focuses on understanding why and preventing recurrence. Individuals are held accountable for deliberate misconduct, but honest mistakes reported promptly are treated as opportunities to improve systems.
The five levers that change behaviour
Culture cannot be changed by announcement. It changes when the things that shape behaviour change. In our work, five levers consistently make the greatest difference.
1. Leadership behaviour
Nothing shapes culture more powerfully than how leaders behave when the stakes are high. A single decision to delay a product launch because of an unresolved compliance concern sends a clearer message than any number of speeches. Conversely, a leader who is seen to overlook a breach by a high performer teaches the whole organisation what really matters.
We work with leadership teams to identify the moments that matter (the recurring decisions where commercial and compliance considerations meet) and to make their approach to those moments explicit and consistent.
2. Incentives and consequences
If sales targets are rewarded generously and conduct is assessed only when something goes wrong, people will draw the obvious conclusion. Effective programmes build conduct and risk measures into performance assessment, promotion and variable pay, with genuine weight, not as a token adjustment.
Equally, consequences for misconduct must be applied consistently, regardless of seniority or commercial contribution. Nothing undermines a compliance culture faster than visible exceptions for star performers.
3. Making the right thing easy
Many compliance failures happen because the compliant path is slower or more cumbersome than the alternative. Reducing friction, through clearer procedures, better systems, sensible approval thresholds and embedded controls, is one of the most practical and underused levers available.
A useful question for any control is: what would a busy, well-intentioned person do when faced with this process at the end of a long day? If the honest answer is "find a way around it", the control needs redesigning.
4. Training that reflects real dilemmas
Generic, annual e-learning modules rarely change behaviour. People complete them to satisfy a requirement and forget them soon after. Training that works is specific to the role, built around realistic dilemmas the audience actually faces, and delivered in a way that invites discussion rather than passive completion.
The most effective sessions we run are facilitated discussions of real scenarios (anonymised cases from the organisation's own history or from its sector) in which participants work through what they would do and why.
5. Speak-up and psychological safety
An organisation can only fix the problems it knows about. Strong speak-up arrangements include multiple channels, including anonymous options; clear protection against retaliation; visible action on concerns raised; and regular communication about what has changed as a result. Managers need specific training in how to respond when someone raises a concern, because the first reaction largely determines whether that person, and their colleagues, will ever raise one again.
The most important compliance control in any organisation is a colleague who feels safe saying "I'm not comfortable with this".
Measuring culture
Culture is often described as intangible, but it can be measured, imperfectly, but usefully. We combine several sources of evidence to give leadership an honest picture:
- Employee surveys with targeted questions about pressure, speaking up, leadership behaviour and confidence that concerns are acted on.
- Behavioural indicators, such as the volume and nature of speak-up reports, the timeliness of issue escalation, repeat audit findings, and policy exceptions.
- Focus groups and interviews that explore the reasons behind survey results.
- Outcome data, including complaints, breaches, and regulatory findings, analysed for patterns across teams and business lines.
No single indicator is reliable on its own. A low number of speak-up reports, for example, could mean either that there are few problems or that people do not feel safe raising them. The value comes from triangulating across sources and tracking trends over time.
Where to start
For organisations that want to strengthen their compliance culture, we recommend beginning with a focused diagnostic rather than a new policy or training programme:
- Assess the current culture through surveys, focus groups and behavioural data, with particular attention to differences between business areas.
- Identify the pressure points where commercial objectives and compliance obligations meet, and how decisions at those points are actually made.
- Review incentives to understand what behaviour the organisation is really rewarding.
- Test the speak-up process from the perspective of the person raising a concern.
- Agree a small number of priority changes with the leadership team, with clear ownership and measures.
Culture as a competitive advantage
A strong compliance culture reduces regulatory risk, but its benefits go much further. Organisations where people speak up early detect problems before they become crises. Organisations where the right thing is also the easy thing operate more efficiently. And organisations with a reputation for integrity attract clients, partners and talented people who value it.
Our compliance practice helps organisations move beyond policy-centred programmes to ones that genuinely shape behaviour, combining regulatory expertise with a practical understanding of how people make decisions under pressure. Compliance culture is not built in a single programme. But with the right levers, consistently applied, it can be built.