Culture comes from the top. So what is compliance actually responsible for?

At the ECS annual conference in Zurich this October, Nancy Wayland told a room of compliance officers something that rarely comes from a stage: you are not alone, and the culture is not yours to build single-handedly. She has seen it from both chairs, having run a public services IT provider as CEO before moving into independent board work.

Her argument was uncomfortable in a useful way. Most ethics failures do not happen because someone did not know the rule. They happen because knowing the rule turns out to be a weak defense once pressure, ambiguity, or speed shows up.

Rules were followed. It still went wrong.

Compliance programs are good at producing obedience. You write the policies, assign the training, collect the attestations, and the evidence file looks healthy. Then a deadline tightens, a customer threatens to walk, a number has to land before quarter close, and the behavior the policy governs quietly bends.

Obedience depends on supervision. People follow a rule when someone is watching and when following it costs them nothing. Conviction survives the moment the supervision stops, because the person understands what the rule protects and can apply judgment when the situation does not match the policy wording.

That changes where your budget goes. A program built for obedience buys coverage: more modules, more acknowledgments, wider distribution. A program built for conviction buys conversation, local champions, and a decent experience for the first person who raises a hand.

How quickly does bad news reach your leadership team?

Ask your executive team this week: how fast does bad news travel upward here, and how do you know?

Most cannot answer the second half. They have an impression, usually a flattering one, built from the issues that did reach them. The issues that stalled two layers down are invisible by definition.

You already hold enough data to replace the impression. Measure the gap between the date an employee first saw the issue and the date it was formally reported. Count how many concerns arrive informally, through a manager mentioning something in a one to one, rather than through your channel. Then check your repeat reporter rate. If people who report once never come back, their first experience told them something.

Low report volume is the signal that gets misread most often. Executives hear it as proof that the culture is healthy. Often it means people decided the trip was not worth it. Run that diagnosis before your next board update.

An open door is a passive control

Nearly every organization describes itself as having an open door policy. Few can describe what happens after someone walks through it.

An open door puts the whole burden on the person with the least power in the exchange. They have to spot that something is wrong, decide it is serious enough, work out who to tell, judge whether that person will react badly, and accept the career risk of being the one who said it. A door being technically open reduces none of those costs.

Active controls move the burden back to the organization. Ask for objections as a standing item in decision making, so dissent gets requested rather than tolerated. Train managers on the first five minutes after someone raises something, because that moment decides whether a second person ever tries. Give people a route that still works when the problem is their own manager. Close the loop with reporters: 49% of reporters on our platform come back to check their case, so silence after a disclosure lands hard.

Psychological safety grows out of those ordinary behaviors. You cannot launch it as a project.

Build the alliance before you need it

This was Nancy's central message, and it is the part I keep returning to. The leadership team sets the culture, and compliance cannot generate it alone however well the program is designed. What compliance can do is build the relationships that make a fast response possible: HR, communications, quality, legal, and the executive team.

Timing is the point. Those relationships have to exist before the crisis, because during one nobody has the patience to learn who you are. If your first real conversation with the communications director happens on the day a journalist calls, you are negotiating your role in the response while the clock runs.

In practice that means a rhythm rather than ad hoc contact. Half an hour a month with HR to compare case patterns across both intake systems. A named counterpart in communications who already knows your escalation thresholds. An agreement with quality or operations about which categories of report come to you.

What boards are starting to ask

Assurance used to be enough. The program exists, training completion sits at 94%, no material issues to report.

The harder questions are about responsiveness rather than coverage. How long does an investigation take from report to closure, and is that number moving? Which parts of the business report, and which stay suspiciously quiet? What changed as a result of the last ten substantiated cases? Answering those needs case data you can query, which makes it a tooling question as much as a reporting one.

Questions worth sitting with

The session ended without a checklist, which felt right for something nobody solves in a quarter. These are the questions I wrote down. They are as much for leadership teams as for compliance, and most of them are better asked together than alone.

• How quickly does bad news reach the top here, and what evidence do we have for that answer?
• When did someone last change a decision because a colleague objected?
• If a serious issue surfaced tomorrow, who would we call in the first hour, and have we met them before?
• What do the first five minutes after someone speaks up actually look like in this organization?
• Where does acting with integrity cost someone something, and what happens to the people who pay that cost?
• Do people follow the rules because they agree with them, or because someone is watching?

Compliance does not own the culture. It owns the honesty about what the culture currently is.