top of page

Ethical Compliance: Why Organisational Culture Matters More Than Rules

  • Writer: Julien Haye
    Julien Haye
  • Apr 29, 2024
  • 18 min read

Updated: Jul 27

An illustration of Compliance Management

Organisations today operate in an increasingly complex environment where strategic decisions are shaped by evolving regulation, technological disruption, stakeholder expectations and interconnected enterprise risks. While most organisations have well-established compliance frameworks, many continue to experience governance failures, conduct issues and reputational damage despite having comprehensive policies and mandatory training in place.


The challenge is rarely the absence of compliance. More often, it is the failure to embed ethical principles into everyday governance and decision-making.


Ethical compliance should not be viewed as a standalone compliance programme or a series of regulatory obligations. It is a governance capability that connects leadership, organisational culture, risk management and decision-making. When ethics becomes embedded throughout an organisation's integrated risk management framework, it strengthens governance, improves decision quality and enables organisations to identify and address emerging risks before they develop into enterprise failures.


This article explores how organisations can move beyond traditional compliance by integrating ethics into governance, leadership and organisational culture. It examines how behavioural drift develops, why psychological safety and constructive challenge are essential for effective governance, and how ethical compliance strengthens enterprise risk management, organisational resilience and long-term business performance.


Whether you are a Board member, Chief Risk Officer, Compliance leader or senior executive, understanding how ethical compliance influences governance is increasingly critical. In today's operating environment, sustainable success depends not only on complying with regulations but on consistently making decisions that reflect organisational values, strengthen stakeholder trust and support effective enterprise risk management.


Executive Takeaways


For readers scanning rather than reading in full, five governing insights frame the argument:

  1. Ethical compliance is a governance capability, not simply a compliance function.

    While compliance establishes legal and regulatory expectations, ethical compliance influences how decisions are made when regulations alone cannot provide every answer. It connects governance, leadership, organisational culture and decision-making to strengthen enterprise risk management.

  2. Leadership and organisational culture determine how ethical standards operate in practice.

    Policies and Codes of Conduct establish expectations, but leadership behaviours shape organisational culture. Ethical organisations consistently reinforce integrity, accountability and constructive challenge through the decisions leaders make every day.

  3. Behavioural drift often develops long before governance failures become visible.

    Major organisational failures rarely result from a single unethical decision. They typically emerge through gradual behavioural drift, weakening psychological safety, delayed escalation and disconnected governance. Recognising these early warning signs allows organisations to intervene before risks become enterprise-wide issues.

  4. Ethical compliance strengthens integrated risk management and organisational resilience.

    Embedding ethics throughout governance, risk appetite, decision-making and organisational culture enables organisations to identify emerging risks earlier, improve decision quality and respond more effectively to uncertainty and change.

  5. Ethical governance transforms organisational values into better decisions.

    Sustainable organisations do more than comply with regulations. They consistently align governance, leadership, culture and risk management so that ethical principles influence everyday decisions, strengthen stakeholder trust and support long-term organisational resilience.


What Is Ethical Compliance?


Ethical compliance is the integration of regulatory compliance, organisational values, governance and ethical decision-making. It ensures that an organisation not only complies with laws and regulations but also acts with integrity, accountability and fairness when making business decisions.


Unlike traditional compliance, which focuses on meeting legal obligations, ethical compliance shapes how decisions are made when regulations alone do not provide the answer. It recognises that sustainable organisations depend not only on effective controls, but also on leadership behaviours, organisational culture and sound governance.


Ethical compliance typically incorporates:

  • Regulatory compliance with applicable laws, regulations and industry standards.

  • Ethical leadership that models integrity, accountability and responsible decision-making.

  • Organisational culture that encourages openness, challenge and ethical behaviour.

  • Corporate governance that provides oversight, accountability and independent challenge.

  • Integrated risk management that considers ethical risks alongside strategic, operational, financial and compliance risks.

  • Decision-making frameworks that balance legal obligations with organisational values and stakeholder expectations.


Taken together, these elements help organisations move beyond simply complying with regulations. They create an operating environment where people consistently make decisions that protect customers, support long-term organisational performance and strengthen trust.

Definition: Ethical compliance is the integration of legal compliance, organisational values, governance and ethical decision-making to ensure people consistently act with integrity, manage risk responsibly and support sustainable organisational performance.

Why Ethical Compliance Matters


Ethical compliance is more than a mechanism for avoiding regulatory breaches or preventing misconduct. It is a core component of effective governance and integrated risk management.


As organisations become more complex, leaders increasingly face decisions where policies cannot anticipate every circumstance. Commercial pressures, technological change and competing stakeholder interests all require judgement. In these situations, ethical compliance provides the principles that guide decision-making when rules alone are insufficient.


Culture influences behaviour. Behaviour shapes decisions. Decisions determine how risks emerge, escalate and are managed across the organisation. Ethical compliance therefore strengthens not only compliance outcomes, but also organisational resilience, leadership effectiveness and long-term business performance.


Why Compliance Alone Is Not Enough


Compliance establishes the legal and regulatory standards that organisations are expected to meet. It provides the policies, procedures and controls that help organisations operate within the boundaries defined by laws, regulations and industry standards. Without compliance, organisations expose themselves to regulatory sanctions, financial penalties and significant reputational damage.

However, compliance alone cannot determine how every decision should be made.


Modern organisations operate in increasingly complex environments where commercial pressures, competing stakeholder interests and emerging risks create situations that regulations cannot fully anticipate. Policies may define what is permitted, but they rarely determine what is right in every circumstance. This is where leadership, ethical judgement and organisational culture become equally important.


Many of the most significant corporate failures did not occur because organisations lacked compliance frameworks. Policies existed. Codes of conduct had been published. Mandatory training had been completed. Yet decisions gradually drifted away from the principles those frameworks were designed to protect. The underlying issue was not compliance itself, but the behaviours, cultural norms and governance practices that influenced how those policies were interpreted and applied.


Ethical compliance should therefore be viewed as an organisational capability rather than a standalone compliance function. It is created through the interaction of governance, leadership, behaviour and culture, all of which influence how risks emerge, escalate and are managed across the organisation.


Figure 1. The Ethical Compliance Operating Model™. Infographic illustrating how ethical compliance supports integrated risk management through five connected stages. The model progresses from Compliance & Governance, which establishes legal obligations, policies, standards and accountability, to Leadership & Behaviour, where organisational expectations are interpreted and applied. It then moves to Organisational Culture, which reinforces the behaviours that are encouraged, rewarded or tolerated, followed by Decision Quality, where compliance, governance, values and judgement are integrated into business decisions. The final stage, Enterprise Risk & Resilience, shows how cumulative decision-making strengthens organisational resilience and long-term performance. The figure emphasises that compliance establishes expectations, leadership shapes behaviour, behaviour creates culture, culture influences decision quality, and decision quality determines how enterprise risks emerge, escalate and are managed. A highlighted callout reinforces that ethical compliance is measured by the quality of organisational behaviour and decision-making rather than the existence of policies alone. Branded with the Aevitium LTD logo using a black, grey, white and gold colour palette, and includes copyright and disclaimer information.

Compliance establishes expectations. Leadership shapes behaviour. Behaviour creates culture. Culture impacts decision quality. Decision quality determines how enterprise risks emerge, escalate and are managed.

This progression illustrates a fundamental principle of Integrated Risk Management. Risks rarely materialise because a single policy fails. They develop through the interaction between governance, leadership, incentives, behaviours and organisational culture. Compliance is therefore one component of a much broader system that determines how effectively an organisation manages uncertainty and achieves its strategic objectives.


As explored throughout The Risk Within, culture drives behaviour, behaviour shapes decisions, and decisions ultimately determine how risks emerge, escalate and are managed. Organisations that focus exclusively on regulatory compliance often overlook these behavioural drivers, increasing the likelihood that ethical risks remain hidden until they develop into operational, strategic or reputational failures.


Ultimately, ethical compliance is not measured by the existence of policies, but by the quality of organisational behaviour and decision-making. Organisations build trust, resilience and sustainable performance when governance, leadership, culture and integrated risk management work together to ensure people consistently make decisions that are both legally compliant and ethically sound.


The Relationship Between Ethics, Culture and Risk


Ethics, organisational culture and risk management are often treated as separate disciplines. In practice, they are deeply interconnected. Ethics defines the principles that guide organisational behaviour, culture dictates how those principles are applied in everyday decisions, and risk reflects the cumulative consequences of those decisions over time.


This relationship extends far beyond regulatory compliance. It influences how leaders respond to uncertainty, how employees raise concerns, how information is escalated and how organisations balance commercial objectives with their responsibilities to customers, employees, shareholders and society. An organisation's ethical standards are therefore demonstrated not by its published values, but by the behaviours it consistently encourages, rewards and reinforces.


Organisational culture is one of the most significant drivers of enterprise risk. Culture shapes how people interpret policies, respond to pressure and exercise judgement when regulations or procedures cannot provide every answer. It determines whether concerns are challenged or ignored, whether lessons are shared or concealed, and whether governance supports informed decision-making or simply reinforces existing assumptions.


This makes psychological safety a critical component of ethical compliance. Employees must feel confident that they can question decisions, report concerns and challenge inappropriate behaviour without fear of retaliation or adverse consequences. Organisations that encourage constructive challenge are better able to identify emerging risks before they develop into operational, strategic or reputational failures.


Similarly, effective speaking-up arrangements and whistleblowing frameworks are only valuable if people trust they will be taken seriously. Policies alone cannot create trust. Trust develops when leaders consistently demonstrate integrity, respond appropriately to concerns and reinforce that ethical behaviour is valued as highly as commercial performance.


Leadership therefore plays a central role in shaping ethical culture. Every decision made by senior leaders communicates what the organisation truly values. Incentives, resource allocation, performance measures and responses to failure all influence whether employees prioritise ethical decision-making or focus solely on short-term commercial outcomes. Over time, these behaviours establish the cultural norms that determine how the organisation manages uncertainty and responds under pressure.


This relationship becomes particularly important during periods of organisational change, rapid growth or crisis. Decisions are often made with incomplete information, competing priorities and significant time pressure. In these circumstances, ethical principles, supported by strong governance and a healthy organisational culture, provide the foundation for sound judgement and consistent decision-making.


Ultimately, ethical compliance is sustained through leadership behaviour, reinforced by organisational culture and demonstrated through decision quality. When governance encourages openness, accountability and informed challenge, concerns are more likely to be identified, discussed and escalated appropriately. When these conditions are absent, organisations increase the risk that important information remains fragmented, ethical concerns go unreported and small issues gradually accumulate into significant enterprise risks.


Figure 2. Ethics, Culture and Risk: A Connected System. Infographic illustrating the continuous relationship between ethics, leadership, organisational culture and risk management within an integrated governance framework. At the centre is a circular governance cycle connecting five interdependent elements: Ethics, Leadership Behaviour, Psychological Safety, Organisational Culture, and Risk Management. The cycle demonstrates that ethics establishes organisational values and principles; leadership behaviour translates those values into everyday actions; psychological safety enables constructive challenge, open communication and speaking up; organisational culture reinforces the behaviours that are encouraged, rewarded or challenged; and risk management integrates governance, culture and decision-making to strengthen organisational resilience. The left-hand panel explains the primary role of each element, while the right-hand panel describes its contribution to effective risk management. Ethics provides the foundation for responsible decision-making. Leadership behaviour shapes trust, accountability and decision quality. Psychological safety supports the early identification, escalation and management of emerging risks. Organisational culture influences how people respond under pressure and uncertainty. Risk management integrates these elements into organisational oversight, enabling informed, ethical and risk-based decisions that improve resilience and long-term performance. A central callout highlights that strong ethics and culture support better decisions, improve risk oversight and build organisational resilience. A concluding statement reinforces the core message: Ethics defines expectations. Leadership demonstrates them. Culture reinforces them. Psychological safety enables challenge. Effective risk management ensures these principles translate into better organisational decisions. The infographic is branded with the Aevitium LTD logo and uses a professional black, grey, white and gold colour palette. It includes copyright and disclaimer information at the footer.

Ethics defines expectations. Leadership demonstrates them. Culture reinforces them. Psychological safety enables challenge. Effective risk management ensures they translate into better organisational decisions.

This integrated perspective reflects a central principle of the Integrated Risk Management Framework™: enterprise risk is rarely the result of a single compliance failure. More often, it emerges from the interaction between leadership, culture, governance and decision-making. Organisations that strengthen these connections are better positioned to build trust, improve resilience and achieve sustainable long-term performance.


How Ethical Failures Become Enterprise Risks


Large organisational failures rarely begin with criminal intent.


More often, they begin with small compromises, unchecked assumptions and acceptable behaviours that gradually drift beyond an organisation's stated values. A commercial target is prioritised over customer outcomes. A policy exception becomes routine practice. A warning is dismissed because previous concerns did not result in immediate consequences. Individually, these decisions may appear reasonable. Collectively, they create the conditions for significant enterprise risk.


This gradual process is often referred to as behavioural drift. Organisations rarely experience a sudden collapse in ethical standards. Instead, behaviours evolve incrementally as commercial pressures, organisational incentives and cultural norms influence how decisions are made. Over time, actions that would once have been questioned become accepted as "the way things are done."


This is why ethical failures are fundamentally governance failures. They reflect weaknesses in oversight, leadership, organisational culture and decision-making rather than isolated compliance breaches. Governance frameworks may remain in place, policies may continue to exist and regulatory reporting may still be completed. However, if behaviours gradually diverge from organisational values, the effectiveness of those frameworks steadily diminishes.


A common pattern emerges across many major corporate failures:

  • Commercial pressure encourages short-term decision-making.

  • Leadership behaviours unintentionally reinforce inappropriate priorities.

  • Psychological safety declines, making employees less willing to challenge decisions or raise concerns.

  • Risk escalation becomes delayed or ineffective because warning signs are normalised.

  • Enterprise risk accumulates until a triggering event exposes underlying governance weaknesses.


By the time regulators, customers or shareholders recognise the problem, the underlying behaviours have often existed for months or even years.


Lessons from Major Corporate Failures


Although every organisation operates within a different regulatory and commercial environment, several well-known failures illustrate how ethical issues can evolve into enterprise risks.


Figure 3. Lessons from Major Corporate Failures. Infographic comparing five major corporate failures to illustrate how ethical issues can develop into enterprise risks through behavioural drift, governance weaknesses and poor decision-making. The figure presents three columns: Organisation, Underlying Behavioural Drift, and Enterprise Consequence. The examples include Volkswagen, where performance targets and organisational pressures contributed to decisions that compromised regulatory compliance, resulting in global regulatory action, financial penalties, reputational damage and loss of stakeholder trust. Wells Fargo demonstrates how sales incentives prioritising performance metrics over customer outcomes led to regulatory sanctions, executive accountability, significant financial penalties and long-term reputational harm. Post Office Horizon highlights how concerns raised by employees and sub-postmasters were not effectively challenged or escalated through governance processes, resulting in prolonged organisational failure, legal action, a public inquiry and substantial loss of public confidence. Boeing illustrates how commercial pressures, governance weaknesses and communication failures contributed to decisions affecting product safety and oversight, leading to fatal accidents, regulatory intervention, production disruption and sustained reputational damage. Wirecard shows how weak governance, inadequate oversight and ineffective challenge allowed financial irregularities to remain undetected, ultimately resulting in corporate collapse, criminal investigations, regulatory scrutiny and significant investor losses. A highlighted callout reinforces the central message that the defining issue across these cases was not the absence of compliance policies, but the gradual weakening of governance, leadership and organisational culture that allowed ethical concerns to remain unchallenged. The infographic is branded with the Aevitium LTD logo and uses a professional black, grey, white and gold colour palette. Copyright and disclaimer information are included in the footer.

While each case is unique, they share a common characteristic. The defining issue was not the absence of compliance policies, but the gradual weakening of governance, leadership and organisational culture that allowed ethical concerns to remain unchallenged.


From Behavioural Drift to Enterprise Risk


This progression rarely follows a single event. Instead, it develops through a series of interconnected decisions.


Figure 4. From Behavioural Drift to Enterprise Risk. Infographic illustrating how small ethical compromises can progressively develop into significant enterprise risks through a sequence of interconnected governance and behavioural failures. The diagram presents a seven-stage progression connected by directional arrows, demonstrating that enterprise failures typically result from cumulative behavioural drift rather than a single unethical decision. The sequence begins with Small Behavioural Compromise, where a decision prioritises convenience, commercial pressure or short-term gain over organisational values. It progresses to Repeated Policy Exceptions, where exceptions become increasingly common and accepted as normal practice despite existing controls. The third stage, Normalisation of Deviance, shows behaviours that were once questioned becoming accepted organisational norms. This is followed by Reduced Challenge and Psychological Safety, where employees become less willing to question decisions, speak up or raise concerns because silence feels safer than challenge. The fifth stage, Delayed Escalation of Emerging Risks, illustrates how warning signs are recognised but rationalised, downplayed or escalated too late for effective intervention. This leads to Governance Blind Spots, where fragmented information, ineffective oversight and reduced organisational visibility prevent leaders from identifying the full extent of emerging risks. The final stage, Enterprise Failure, demonstrates how a triggering event exposes accumulated governance weaknesses, resulting in operational disruption, financial losses, regulatory action and reputational damage. Supporting callouts beneath each stage reinforce how minor behavioural deviations gradually become embedded within organisational culture, weakening governance, reducing effective challenge and allowing risks to accumulate over time. A highlighted conclusion emphasises the central message: Enterprise risk is rarely created by a single unethical decision. It emerges when governance, leadership and organisational culture allow small behavioural deviations to accumulate until they become accepted organisational practice. The infographic is branded with the Aevitium LTD logo, uses a professional black, grey, white and gold colour palette, and includes copyright and disclaimer information in the footer.

Ethical Compliance as Part of Integrated Risk Management


Many organisations continue to manage ethics as a standalone compliance activity. Responsibility often sits within the Compliance or Human Resources function, supported by a Code of Conduct, mandatory training and a whistleblowing policy. While these remain important, this approach risks treating ethics as a separate discipline rather than recognising its influence across the entire organisation.


In reality, ethical compliance is most effective when it is embedded throughout an integrated risk management framework. Ethical principles influence how risks are identified, how decisions are made, how concerns are escalated and how governance operates across every function. Rather than existing alongside risk management, ethics helps shape the behaviours and judgements that determine whether risk management succeeds.


This integrated perspective recognises that governance, culture and leadership are interconnected. Decisions made within one function frequently affect operational performance, regulatory compliance, customer outcomes and organisational resilience elsewhere. Ethical compliance therefore provides a common set of principles that enables organisations to make consistent, risk-informed decisions across increasingly complex operating environments.


Ethics Across the Integrated Risk Management Framework™


Ethical compliance should be embedded across every component of an organisation's governance and risk management framework. Rather than operating as a standalone compliance activity, it strengthens the behaviours, governance and decision-making that underpin effective enterprise risk management.


Ethical compliance contributes to each component of an integrated risk management framework by:

  • Risk Appetite: Ensuring commercial objectives remain aligned with organisational values, stakeholder expectations and the organisation's agreed appetite for risk.

  • Organisational Culture: Reinforcing behaviours that promote integrity, accountability, transparency and responsible decision-making throughout the organisation.

  • Conduct Risk: Supporting decisions that consistently deliver fair customer outcomes while maintaining high standards of professional and ethical conduct.

  • Operational Risk: Reducing behavioural drivers of operational failures by strengthening governance, constructive challenge and the timely escalation of emerging risks.

  • Regulatory Compliance: Supporting compliance with legal and regulatory obligations while encouraging ethical decision-making that extends beyond minimum compliance requirements.

  • Third-Party Risk Management: Extending organisational values and ethical expectations to suppliers, outsourced service providers and strategic partners through effective governance and oversight.

  • Whistleblowing and Speaking Up: Creating trusted mechanisms that encourage employees to raise concerns, challenge decisions and report emerging risks without fear of retaliation.

  • Internal Audit and Assurance: Providing independent assurance that governance, organisational culture and leadership behaviours are operating effectively in practice rather than simply existing on paper.

  • Decision Governance: Ensuring significant strategic, operational and commercial decisions consider ethical implications alongside financial, operational, regulatory and reputational risks.


Viewed individually, each of these disciplines performs a distinct governance function. Viewed collectively, they form an integrated system that strengthens ethical decision-making, improves organisational resilience and enables more effective enterprise risk management.


Ethics as a Governance Enabler


An integrated approach changes the role of ethical compliance.


Instead of asking:

  • Have we complied with the regulation?


Leaders increasingly ask:

  • Does this decision align with our values and risk appetite?

  • Have we considered the potential impact on customers and other stakeholders?

  • Would we be comfortable explaining this decision to regulators, investors and the Board?

  • Have the right people been encouraged to provide constructive challenge?


These questions encourage organisations to move beyond procedural compliance towards decision quality, where governance supports informed judgement rather than simply verifying adherence to rules.


This perspective also strengthens organisational resilience. Risks rarely remain confined to a single function. A behavioural issue identified within operations may expose weaknesses in governance. A third-party failure may reveal deficiencies in procurement oversight. A conduct issue may indicate broader cultural or leadership challenges. Integrated risk management enables organisations to recognise these connections before individual issues develop into enterprise-wide failures.


Ultimately, ethical compliance should not be measured by the number of policies an organisation maintains or the volume of training completed. Its effectiveness is demonstrated by the quality of organisational decisions, the strength of governance, the confidence with which people speak up and the organisation's ability to consistently manage risk in a manner that reflects both its values and its strategic objectives.

Integrated risk management is not simply about connecting risks. It is about connecting governance, leadership, culture and decision-making so that ethical principles consistently influence how the organisation performs under both routine operations and periods of uncertainty.

Building an Ethical Risk Culture


An ethical risk culture is not created through a Code of Conduct, annual compliance training or periodic declarations. These remain important governance mechanisms, but they rarely influence behaviour on their own.

Culture develops through the everyday decisions leaders make, the behaviours they reinforce and the standards they consistently apply. It determines how people respond when policies provide no clear answer, commercial pressures increase or competing priorities emerge.


Organisations rarely become more ethical because they introduce additional rules. They become more resilient because governance, leadership and culture consistently encourage better decisions.


Building an ethical risk culture therefore requires organisations to strengthen the behavioural foundations that support effective governance and integrated risk management.


Leadership Behaviour Sets the Standard


Employees pay far more attention to what leaders do than to what organisational policies say.


Leadership behaviour establishes the informal standards that shape organisational culture. Decisions about performance, incentives, resource allocation and accountability all communicate what the organisation genuinely values.


When leaders consistently demonstrate integrity, transparency and accountability, ethical behaviour becomes part of everyday decision-making. Conversely, when commercial outcomes are repeatedly prioritised above organisational values, employees naturally adjust their own behaviours to reflect those expectations.


An ethical culture begins with leaders who consistently model the behaviours they expect others to demonstrate.


LinkedIn Poll Insight


Leadership shapes culture more than policies.


In a LinkedIn poll of 353 governance professionals, 63% identified weak leadership support as the biggest cultural barrier to improving governance.

  • 63% Weak leadership support

  • 18% Fear of blame

  • 12% Siloed team dynamics

  • 6% Low engagement with training


Insight: The findings reinforce that governance failures rarely arise because organisations lack policies or training. More often, they emerge when leadership behaviours fail to consistently reinforce the ethical standards those policies are intended to support.


Psychological Safety Enables Better Decisions


Ethical cultures depend on people feeling able to question decisions, admit mistakes and raise concerns without fear of blame or retaliation.


This concept, often referred to as psychological safety, is fundamental to effective governance. Employees who feel safe to challenge assumptions are more likely to identify emerging risks, report control weaknesses and escalate concerns before they become significant issues.


Organisations that discourage challenge often experience the opposite outcome. Important information remains fragmented, assumptions go untested and governance loses visibility of developing risks.


Psychological safety therefore strengthens both ethical compliance and enterprise risk management by improving the quality of organisational information and decision-making.


Constructive Challenge Prevents Behavioural Drift


Strong governance depends on informed challenge.


Constructive challenge should not be viewed as criticism or resistance. It is a governance mechanism that helps organisations test assumptions, identify unintended consequences and improve decision quality before risks materialise.

Leaders should actively encourage alternative perspectives, independent review and healthy debate, particularly when decisions involve significant uncertainty or commercial pressure.


When challenge becomes an accepted part of organisational culture, behavioural drift is identified earlier and poor decisions become less likely.


Effective Escalation Protects the Organisation


Many organisational failures occur because concerns are identified but not escalated effectively.


Employees may assume someone else will act, believe concerns will not be taken seriously or fear personal consequences for speaking up. As a result, early warning signs remain within individual teams instead of informing enterprise decision-making.


Effective escalation requires more than documented reporting procedures. Organisations need clear governance arrangements, defined escalation thresholds and leadership behaviours that reinforce the importance of raising concerns promptly and transparently.


When escalation operates effectively, organisations develop a more complete understanding of emerging risks before they affect strategic objectives or organisational resilience.


Figure 5. Building an Ethical Risk Culture Framework. Infographic illustrating the seven core components of an ethical risk culture: Leadership Behaviour, Psychological Safety, Challenge, Escalation, Learning Culture, Accountability and Decision Quality. The framework shows how these interconnected governance and behavioural capabilities strengthen oversight, improve decision-making, build organisational trust and enhance resilience. Branded in Aevitium's black, white, grey and gold colour palette with logo, copyright and disclaimer.

A Learning Culture Strengthens Resilience


Ethical organisations treat incidents, near misses and mistakes as opportunities to strengthen governance rather than simply allocate blame.


A learning culture encourages organisations to ask:

  • What happened?

  • Why did it happen?

  • Which governance, behavioural or cultural factors contributed?

  • What changes will improve future decision-making?


This approach supports continuous improvement while strengthening trust, accountability and organisational resilience (see the book Resilient Risk Management for more information)


Learning organisations do not simply correct individual failures. They improve the systems, governance arrangements and behaviours that allowed those failures to develop.


Accountability Creates Trust


Accountability is often misunderstood as assigning responsibility after something has gone wrong.


Effective accountability begins much earlier. It establishes clear ownership for decisions, ensures responsibilities are understood and creates transparency around how significant risks are managed.


When accountability is embedded throughout governance, individuals understand both their authority and their responsibilities. This improves coordination, strengthens decision-making and reduces the likelihood that important risks fall between organisational boundaries.


True accountability is not punitive. It creates clarity, ownership and confidence throughout the organisation.


Decision Quality Is the Ultimate Measure


Ultimately, ethical risk culture should be assessed by the quality of organisational decisions rather than the number of policies, training courses or compliance activities completed.


High-quality decisions demonstrate consistent alignment between organisational values, governance arrangements and risk appetite. They consider the interests of customers, employees, regulators and other stakeholders while balancing commercial objectives with long-term organisational sustainability.


This is where ethical compliance becomes a strategic capability rather than a regulatory obligation. Organisations that consistently make well-informed, ethically grounded decisions are better positioned to manage uncertainty, strengthen resilience and maintain stakeholder trust.

An ethical risk culture is not defined by the policies an organisation publishes. It is defined by the decisions its people make, the behaviours its leaders reinforce and the governance that consistently aligns ethics, culture and integrated risk management.

Measuring Ethical Culture in Practice


Building an ethical risk culture requires organisations to monitor more than policy compliance or training completion. While no single metric can measure ethics, a combination of behavioural and governance indicators can provide valuable insight into how ethical culture is operating in practice.


Examples include:

  • Employee confidence in speaking up through culture and engagement surveys.

  • The volume, nature and resolution of whistleblowing reports and ethical concerns.

  • Trends in policy exceptions and control overrides.

  • The timeliness and quality of risk escalation.

  • Internal Audit findings relating to governance, leadership behaviours and organisational culture.

  • Conduct incidents, customer complaints and recurring control failures.

  • Lessons identified and implemented following incidents and near misses.


Viewed collectively, these indicators help organisations identify emerging behavioural drift before it develops into more significant governance, conduct or operational risk issues.


For multinational organisations, the objective is not to create different ethical standards for different regions, but to establish a consistent set of organisational principles while allowing local implementation to reflect legal, regulatory and cultural differences. Core values such as integrity, accountability, fairness and respect should remain universal across the organisation. Local governance, policies and training can then adapt how those principles are applied without compromising the organisation's ethical expectations. This balance helps maintain global consistency while recognising that ethical decisions are often shaped by different legal systems, cultural norms and stakeholder expectations.


Conclusion


Ethical compliance is often viewed through the narrow lens of regulatory obligations, policies and mandatory training. While these remain essential, they represent only one part of a much broader governance capability.


Organisations rarely experience major failures because they lacked a Code of Conduct or compliance framework. More often, failures emerge when governance becomes disconnected, leadership behaviours fail to reinforce organisational values and behavioural drift gradually weakens decision-making across the enterprise.


Building an ethical organisation therefore requires more than ensuring compliance with rules. It requires integrating ethics into governance, leadership, culture and everyday decision-making. Ethical principles should influence how organisations define their risk appetite, manage third parties, encourage constructive challenge, respond to emerging risks and continuously learn from experience.


This is where ethical compliance becomes a strategic advantage. Organisations that embed ethical thinking throughout their integrated risk management framework are better equipped to make balanced decisions, strengthen stakeholder trust and respond effectively to an increasingly complex and uncertain operating environment.


Ultimately, ethical compliance should not be measured by the number of policies an organisation maintains or the volume of training completed. Its true measure is the quality of organisational decisions, the confidence people have to speak up, the effectiveness of governance in connecting information across the enterprise and the organisation's ability to consistently manage risk in a manner that reflects both its values and its strategic objectives.


Ethical compliance is not a standalone compliance function. It is the thread that connects governance, leadership, culture and decision-making. When these elements operate as an integrated system, organisations do more than meet regulatory expectations. They build trust, strengthen resilience and create the conditions for sustainable long-term performance.


About the Author: Julien Haye


Managing Director of Aevitium LTD and former Chief Risk Officer with over 26 years of experience in global financial services and non-profit organisations. Known for his pragmatic, people-first approach, Julien specialises in transforming risk and compliance into strategic enablers. He is the author of The Risk Within: Cultivating Psychological Safety for Strategic Decision-Making and hosts the RiskMasters podcast, where he shares insights from risk leaders and change makers.


Frequently Asked Questions


How can an organisation measure the effectiveness of its ethical compliance programme?

Ethical compliance should be assessed using both quantitative and qualitative indicators. While training completion and policy attestations remain important, organisations should also monitor whistleblowing activity, employee confidence in speaking up, conduct incidents, decision governance, audit findings, cultural assessments and leadership behaviours. Together, these provide a more complete picture of how ethics operates in practice.


How does ethical compliance support enterprise risk management?

Ethical compliance strengthens enterprise risk management by influencing the behaviours and decisions that determine how risks emerge, escalate and are managed. When integrated with governance, risk appetite, operational risk and organisational culture, ethical compliance improves decision quality, strengthens resilience and supports more effective risk oversight.


What are the warning signs of a weakening ethical culture?

Early indicators often include declining psychological safety, reduced constructive challenge, repeated policy exceptions, delayed escalation of concerns, inconsistent leadership behaviours and increasing reliance on short-term commercial decisions. Identifying these behavioural signals early allows organisations to strengthen governance before larger issues develop.


Should ethical compliance be owned by the Compliance function?

While Compliance plays an important role, ethical compliance should not be viewed as the responsibility of a single function. Boards, executive leadership, Human Resources, Risk, Compliance, Internal Audit and business leaders all contribute to creating an ethical culture. Ultimately, ethical compliance is a governance responsibility that extends across the entire organisation.


How does psychological safety influence ethical compliance?

Psychological safety enables employees to raise concerns, question decisions and report emerging risks without fear of blame or retaliation. Organisations that encourage constructive challenge are more likely to identify governance weaknesses early, improve decision quality and prevent behavioural drift from developing into enterprise risks.


How can organisations embed ethics into everyday decision-making?

Ethics becomes embedded when governance processes consistently consider organisational values alongside strategic, operational, financial and regulatory factors. This includes aligning decisions with risk appetite, encouraging independent challenge, documenting significant decisions, defining escalation thresholds and learning systematically from incidents and near misses.


Why do organisations experience ethical failures despite having policies and training?

Most major failures occur because governance, leadership behaviours and organisational culture become disconnected from documented policies. When behavioural drift develops gradually, employees may begin to accept practices that conflict with organisational values even though compliance frameworks remain in place. Effective governance helps identify and address these patterns before they become systemic.


What is the relationship between ethical compliance and organisational resilience?

Ethical compliance contributes directly to organisational resilience by strengthening governance, improving decision-making and encouraging the early identification and escalation of emerging risks. Organisations that consistently align ethics, culture and risk management are generally better equipped to respond to disruption while maintaining stakeholder trust.

bottom of page