Compliance frameworks, policies and procedures are important components of good governance, but their effectiveness depends on how they are understood, applied and reinforced across an organisation. A strong compliance culture helps turn documented expectations into everyday behaviours and decisions.
When compliance becomes primarily a process of completing checks or maintaining documentation, a gap can develop between an organisation’s stated expectations and what happens in practice. Policies may be well drafted and controls may exist on paper, but their effectiveness also depends on the decisions and behaviours of the people applying them.
Culture influences how people respond when they encounter uncertainty, competing priorities or pressure. It can affect whether concerns are raised, whether challenge is welcomed, whether procedures are followed when inconvenient and whether inappropriate behaviour is addressed.
Building a strong compliance culture is not simply about having the right framework in place. It involves creating an environment in which expectations are understood, leadership behaviour supports them and organisations have ways of identifying whether those expectations are reflected in practice.
This article considers why compliance culture matters from a governance perspective and some of the practical ways organisations can support it.
Why a box-ticking approach to compliance creates risk
Policies, procedures and controls provide an important foundation for compliance, but their existence does not demonstrate how consistently they are applied in practice. An organisation can have comprehensive documentation while still experiencing weaknesses in behaviours, decision-making, challenge or escalation.
For companies, section 172 of the Companies Act 2006 provides a useful governance context. When exercising their duty to promote the success of the company, directors must have regard to a number of factors, including the interests of employees, relationships with suppliers and customers, the impact of the company’s operations on the community and environment, and the desirability of maintaining a reputation for high standards of business conduct.
Culture is also a prominent feature of the UK Corporate Governance Code 2024. For companies within its scope, the Code places responsibility on the board for assessing and monitoring culture and how the desired culture has been embedded. It also expects alignment between the company’s purpose, values and strategy and its culture.
These principles illustrate why compliance culture is a governance issue rather than simply an operational one. Boards and senior leaders need appropriate information and assurance to understand whether stated expectations are reflected in practice and whether behaviours or incentives are creating areas of concern.
The wider benefits of a strong compliance culture
A strong compliance culture can support more than adherence to individual regulatory requirements. Where people understand the purpose behind policies and controls, and see those expectations reinforced through leadership behaviour, they may be better equipped to recognise concerns and raise them before they develop into more significant issues.
It can also support more consistent decision-making. Employees are more likely to understand what is expected of them when organisational values, policies, management behaviour and incentives point in the same direction, particularly when they encounter situations that are not addressed neatly by a written procedure.
There can also be benefits for relationships with customers, suppliers, regulators and other stakeholders. An organisation that can demonstrate how its standards are communicated, applied, monitored and challenged is better placed to provide evidence of how its governance and compliance arrangements operate in practice.
The objective is not to replace formal controls with culture. Effective compliance requires both: appropriate frameworks, policies and controls, supported by behaviours and organisational practices that help those arrangements work as intended.
Practical steps to embed compliance into your culture
Building a strong compliance culture requires consistent attention across different parts of an organisation. Leadership behaviour is important, but so too are the systems that influence how people are recruited, managed, rewarded, trained and encouraged to raise concerns. Organisations also need ways of assessing whether their intended culture is reflected in practice.
Leadership behaviour and tone
Boards and senior leaders have an important role in establishing and reinforcing expectations. Employees are likely to take account not only of formal policies and communications, but also of the behaviours they observe and the decisions made when organisational values come into tension with commercial or operational pressures.
This can become particularly visible when difficult decisions arise. How leaders respond when due diligence identifies concerns, when somebody challenges an established view or when a compliance issue affects a commercially attractive opportunity can send a strong message about the behaviours the organisation genuinely values.
Leadership should consider whether its decisions, communications and responses to challenge are consistent with the culture it expects elsewhere in the organisation. Appropriate challenge should be encouraged, and concerns should be capable of being raised and considered without individuals being discouraged from speaking up.
Align people practices with organisational values
The way people are recruited, managed, recognised and rewarded can reinforce an organisation’s stated values or undermine them. If performance is judged solely by results, without considering how those results were achieved, employees may receive mixed messages about the behaviours that matter.
Organisations can consider how expected behaviours are reflected across relevant people practices, including recruitment, objectives, performance discussions, progression and recognition. The approach will vary depending on the organisation, but the aim is to create consistency between the standards set out in policies and the behaviours that are encouraged in practice.
Particular attention may be needed where strong performance sits alongside behaviour that conflicts with organisational expectations. How those situations are handled can influence how employees perceive the organisation’s commitment to its stated values.
Recognition can also play a part. Acknowledging people who raise concerns appropriately, demonstrate sound judgement or uphold expected standards when under pressure can help reinforce the behaviours the organisation wants to encourage.
Make compliance training meaningful
Training and communication play an important part in supporting compliance culture, but completing mandatory training does not necessarily demonstrate that people understand how requirements apply to their roles.
Effective training should help people understand why requirements exist, recognise situations in which they may apply and know what to do when the answer is not straightforward. Using realistic scenarios can help employees explore how policies and expectations work in practice, particularly where they may face competing priorities or difficult judgement calls.
Training should also form part of wider and ongoing communication about compliance. Changes to requirements, lessons from incidents, recurring questions and issues identified through monitoring can all provide opportunities to reinforce expectations and improve understanding.
Employees also need appropriate routes for asking questions and raising concerns. Creating opportunities for discussion can help organisations identify areas where requirements are unclear or where written policies do not reflect how work is actually being carried out.
Use different sources to monitor culture
Organisations need ways of understanding whether their intended culture is reflected in practice. No single measure is likely to provide a complete picture, so information from different sources can help boards and senior leaders identify patterns, inconsistencies and areas that may need further attention.
Relevant information might include employee surveys, complaints, grievances, whistleblowing or speak-up data, staff turnover, exit interviews, compliance breaches, incidents, audit findings and themes arising from training or monitoring. Direct engagement between board members, senior leaders and employees can provide additional insight into how policies and expectations are experienced in practice.
The information also needs to be interpreted in context. A low number of whistleblowing reports, for example, could indicate that few concerns are arising, but it could also raise questions about whether employees know how to speak up or feel confident doing so. Looking at several sources together can help organisations understand what the information may be telling them.
Monitoring culture is not simply about collecting more data. The value comes from identifying themes, asking appropriate questions and considering whether the information points to weaknesses in behaviours, controls, communication or oversight.
Our article on practical implementation of Provision 29 also looks at monitoring, assurance and the information boards may use when overseeing controls.
Practical support for compliance and governance
Building and maintaining a strong compliance culture can involve a considerable amount of practical work. Policies and procedures need to remain organised and accessible, actions may need to be tracked, information gathered from different teams and governance reporting supported.
Corporate Assist can provide additional capacity alongside existing Compliance, Governance, Risk, Legal and operational teams. Support can include coordinating information, maintaining compliance and action trackers, supporting policy and procedure reviews, organising documentation and helping to follow up agreed actions.
The organisation and its relevant risk owners retain responsibility for determining compliance requirements, assessing risks, making decisions and approving the controls and responses needed.
If your organisation needs additional capacity to support its compliance and governance work, find out more about our Compliance & Risk Support or get in touch.
Share this post: