Integration with
Compliance.
Addressing the risk that culture and behaviour sit alongside the formal risk system rather than within it.
Integration with Compliance addresses the risk that culture and behaviour sit alongside the formal risk system rather than within it. It asks whether insights about how people really behave reach Risk, Compliance and Internal Audit, and whether those functions present Boards and their committees with a coherent, behaviour-aware view.
It moves culture from “commentary” to “core control”, so that culture risk is built into identification, assessment and assurance rather than left in narrative.
What is the risk?
The risk is fragmentation. Culture is treated as commentary, while risk and compliance processes proceed as if behaviour could be assumed or prescribed.
This can leave the organisation formally compliant but practically exposed, because the conditions that make breaches more likely are not built into risk identification or assessment.
In practice: The board receives clean compliance reports while culture risk maps and early indicators tell a different story in another part of the system. When this happens, Boards can appear formally diligent yet are judged to have presided over a system that knew about behavioural risk but did not integrate it into governance.
How does it manifest?
When culture is not integrated, stakeholders experience a gap between the “rules” and the “reality”. Individually these experiences can be rationalised; together they indicate a control environment that is formally sound but behaviourally fragile.
| Stakeholder | Effects when culture is not integrated with compliance |
|---|---|
| Employees | Experience compliance as box‑ticking; real dilemmas are handled informally; workarounds become culturally acceptable. |
| Customers | Encounter policies that are technically compliant but feel unfair, opaque or inconsistent, increasing complaint and reputational risk. |
| Suppliers & Partners | See a gap between what is asked of them and how the organisation behaves, reducing willingness to escalate issues. |
| Investors | Face repeated “unexpected” issues in domains that had strong compliance attestations, undermining confidence in governance. |
| Regulators | Conclude that culture and conduct insights existed but were not integrated; findings point to failures of governance rather than of individual compliance. |
For Boards, repeated patterns across these stakeholders are a sign that Compliance may be protecting the rulebook while culture quietly erodes the control environment.
How can boards mitigate it?
Mitigation is about coherence and information flow, not organisational re‑design.
Ask Explicitly
Ask how culture insights are used in compliance planning and thematic reviews, and how culture risk mapping is reflected in findings. Over time, this shifts Compliance planning from "what rules apply?" to "how do people actually encounter and work around these rules in practice?".
Require Analysis
Require that board reports from risk and compliance include behavioural and cultural analysis, not just control status and breaches. Board papers from Risk and Compliance should routinely explain how behaviour and culture are shaping the control environment, not only whether controls exist.
Identify Risks
Expect culture factors to appear in risk identification and assessment for major risks and product or business changes. This ensures that major decisions - new products, markets, business models - carry an explicit view of cultural pre-conditions, not just legal and operational ones.
Check Perspectives
Check for stakeholder perspectives in compliance work: how rules are experienced by employees and customers, not just how they are written. The Board can then see whether formal compliance is experienced as fair, proportionate and credible by those subject to it, which is where conduct risk often begins.
A simple test is whether a serious compliance issue can still arrive as a surprise to the Board despite years of culture, conduct or whistleblowing signals; in integrated systems, such issues may still occur, but they are rarely unexplained. When integration with compliance is working, boards no longer see culture in one section and risk in another; they see how behaviour, controls, appetite and outcomes fit together in a single, governable picture. — Neil Fogarty Research