How to Create a Culture of Compliance at Your Company
There is a pressing need for today’s businesses to foster and maintain a culture of compliance. Employees are under considerable personal and professional stress, which can lead some to make decisions that are out of character—and outside of compliance. By introducing individual accountability across a firm, regulation becomes much more than a necessary evil; instead, it can be a vehicle through which team members can excel.
What drives company compliance?
Challenges to company compliance
How to establish a culture of compliance
What is compliance culture?
Naturally, we talk a lot about building a culture of compliance, but what do we mean by it? A culture of compliance is one in which the entire company strives to act in accordance with external legislative, industry-specific, or internally mandated standards, understand the purpose of doing so, and encourage others to do the same.
For an organization to maintain a healthy compliance culture, everyone from leadership to frontline employees must understand what is considered “right” in their industry and see how regulatory compliance upholds their organization’s mission, purpose, and core values. A compliance mindset has a trickle-down effect, as do habits of clear communication, transparency, and honest and constructive feedback. Employees look to managers and leadership for guidance, who should be empowered (through education and infrastructure) to act accordingly.
All processes in an organization should be designed and carried out with an eye to compliance, not just as a final quality assurance measure, but from the very first step.
What drives company compliance?
To many, the obvious answer to this question might be “threat of consequences.” But that should not be the primary driver of compliance culture. To truly achieve a culture of compliance, executives need to rethink their position on rulemaking and see regulation as a catalyst for self-improvement: an incentive to change the way everyone thinks about their roles and responsibilities.
Instilling a culture of compliance goes beyond the occasional email from headquarters or one-off training sessions. Employees need to realize the role they play—individually and collectively—not just in meeting their compliance responsibilities but in upholding the reputation of the company. While culture certainly varies from company to company, the foundation to driving company compliance is in promoting a healthy, sustainable culture of compliance. The Financial Conduct Authority (FCA) identified these four factors as the pillars to identify and manage in order to transform company culture and prevent harm from inappropriate behaviors:
- Purpose and mission: Why a company exists and how it benefits society
- Leadership: How leaders act in and outside of work
- Approach to rewarding and managing people: How employees are recognized or incentivized to promote positive behaviors
- Governance: How firms currently manage key compliance processes (e.g. for whistleblowing or complaint handling) and their effectiveness
These four drivers are the cornerstones of a company’s culture. If executed and managed well, and defined by policy, they contribute to a culture in which every employee and stakeholder is empowered to act ethically and in the company’s best interests. If executed poorly, any of these elements will increase the risks of businesses becoming non-compliant and being harmed financially and reputationally—all bad news for business.
The brand and reputation of any business is at the core of its long-term success. It is, of course, the responsibility of companies to remain vigilant. Putting in place the right tools for individuals to own compliance is a great start. The more ethics is embedded in an organization, the less the likelihood of an unforeseen lapse or accident.
Challenges to company compliance
While organizations everywhere are still vulnerable to the same threats that have been present for millennia—such as conflicts of interest and bribery—today’s world presents some novel challenges compliance teams need to solve for.
WFH: With the proliferation of remote work in recent years, there is more opportunity for bad actors to attempt malfeasance—from both within and without. Working from home can also perpetuate a disconnect from company culture as a whole, so compliance officers need to prioritize engaging with remote employees, ensure they fully understand the ethical constraints of their jobs, and design user-friendly processes to encourage compliance.
Lack of education: While employees may understand the need to comply with regulations, they may not feel comfortable admitting they are not entirely familiar with the details or internal processes for doing so. It’s imperative that businesses and their compliance teams properly educate their employees on the rules, regulations, and processes they need to follow; you can’t avoid something you don’t know is wrong.
Cybercrime: Cyber criminals are getting more creative by the day; as soon as one hacking operation gets taken down, another pops up, more impenetrable than the last. Without secure systems in place, an organization could suffer repeated attacks on its privacy, thereby putting your culture of compliance at risk. Airtight compliance requires airtight security controls, sensitive enough to catch even the faintest flicker of a red flag.
How to establish a compliance culture
For most firms, establishing a culture of compliance is inextricably linked to building a culture of trust. Staff need to be empowered to own their roles as responsible corporate citizens, but to do so they need the right tools for success.
Consistent training: It’s one thing to roll out a framework for maintaining compliance, but success is contingent upon employees truly understanding and embracing the rules set out by regulators. They need to know how and when to take appropriate action to prevent instances of unethical behavior from occurring. As an example, the FCA laid out a multitude of Conduct Rules for its Senior Managers and Certification Regime (SMCR) that employees at regulated financial firms must abide by. If an individual does not know the remit of their accountability, they may struggle to see how they should react to and behave in various situations. All employee training should address key elements of compliance conduct.
Recognition: Beyond training, there is also a case for positive recognition. A rewards-based approach that recognizes responsible actions is far more likely to instill long-lasting change than a fear-based culture of discipline and oversight.
Software and technology: Technology can act as more than an early-warning signal. It can ensure employees know what to do if and when an issue does arise, facilitating better communication and education.
Regulatory technology (regtech) can help companies understand, monitor, and alter employees’ behavior in accordance with industry and corporate guidelines. Software tools like StarCompliance’s Individual Accountability Regime (IAR) act as a single source of truth for both compliance teams and senior managers. IAR provides a systematic way of dealing with and keeping track of constant change by streamlining business processes and providing a clear understanding of what’s required to meet regulations like the SMCR.
Along with enabling employees to recognize, record, and manage breaches, IAR also allows them to certify to their role, complete competency tests, and even track their personal development and continuing education progress. Baked-in FCA Directory reporting makes it easy to maintain directory data and persons. Without these kinds of capabilities, it’s impossible for firms to feel confident they have a true pulse on the health of the firm and its employees.
When it comes to recognition, IAR helps firms surface and reward those employees who have performed well, identifying and acknowledging those who have acted with honesty and integrity when carrying out their responsibilities. This sets an example for others around how they should behave. In this way, a culture of compliance is created almost organically.
Regulatory compliance does not need to be an exercise in enforcement. Instead, it can be an opportunity to differentiate your business and create an environment in which team members are empowered to make good business decisions, ensuring the success and longevity of your organization.
A culture of compliance is within reach.
Download our free guide to building an airtight compliance program at your firm.
