Cultures of Compliance

Regulators have become more insistent that business enterprises implement high-quality compliance programs to prevent criminal and civil wrongdoing by managers and employees. By now, the structural elements of compliance are fairly well defined: The common framework includes (1) a commitment from senior leadership to the task, setting a right “tone at the top;” (2) delegation of authority to officials with distinct compliance responsibilities and the resources to do their task; (3) firm-wide education and training about both the substance and process of compliance;  (4) informational mechanisms to alert as to suspicious activity (eg, whistleblowing procedures); (5) audit and surveillance tactics to detect compliance failures or risks; and (6) internal investigation, response, discipline and remediation so as to learn and adjust when failures occur. 

But even with such structures in place, compliance failures occur, leading an increasing number of regulatory authorities on both sides of the Atlantic to add culture to the list, fearing that without a healthy firm-wide normative commitment to ethics and law-abidingness, compliance will be weak at best. In my paper “Cultures of Compliance”, I draw from a variety of disciplines to define a compliant culture, identify sources of resistance to it, and suggest ways in which regulators, leaders and compliance officials can try to counter the resistance.

Research in organizational behavior and behavioral ethics has long called for values-based interventions, hopeful that certain forms of leadership can prompt ethical corporate cultures. While I am supportive of and sympathetic to this effort, a wider, deeper look at organizational economics, psychology and sociology shows how easily both cognition and culture turn to the dark side. Selection biases, and the grease of normalization and rationalization, can too easily flourish in the conditions present in so many businesses. (I explore this in greater detail in a recent book.) Compliance norms threaten the beliefs, behaviors and cultural tropes that are instinctively success-producing. These instincts may be myths: managers may well underestimate the benefits to the firm that come from heightened compliance and social responsibility. But they are common myths, and sticky ones. This is especially so where those inside the organization feel a sense hyper-competition, ie, a survival threat. What pro-social ethics and law-abidingness are then up against is daunting. The culture enables beliefs that either suppress the perception of inappropriate ethical and legal behavior in the first place, so that it is not recognized as a problem at all, or justify the behavior to buffer against burdens of guilt and anxiety. These subtle forces allow people and firms to maintain a positive self-image and identity while competing effectively, even viciously. 

The work of compliance is somehow to counter these tendencies, being neither naively optimistic nor naively cynical. I thus suggest ways those responsible for ethics and compliance can try to counter the “scripts” commonly invoked to normalize noncompliance—the denigration of regulation, self-serving interpretation of law, and planting seeds of doubt about the legitimacy of compliance itself. For example, it can be useful in ethics training to have managers put themselves in the role of regulators in order to make it harder for these managers to denigrate regulatory demands as bureaucratic excess. Tone at the top matters, for sure; consistency in sending messages that interfere with convenient, self-serving myths that celebrate competition do, too.

 My message is constructive, and far from hopeless. Compliance is a struggle to be sure, but without the struggle the risks of noncompliance are far greater. In this spirit, I offer a variety of suggestions about the cultural dimensions to compliance for both firms and regulators. In the end, the most important message about cultures of compliance is for corporate leaders and, especially, boards of directors. It is much too easy to look around and see good people working hard at difficult jobs and assume that a good compliance culture exists simply because everyone has been warned of the damage that can come from getting caught doing wrong. Or worse, to assume that an observable abundance of intensity, loyalty and creativity are signs that all is good. Taking culture seriously—appreciating the opportunities for transmitting values as well as anticipating the many hidden pathways of resistance and denial—is a necessary step toward the sort of compliance that never attracts prosecutors’ unwanted attention.

Donald C. Langevoort is Professor of Law at Georgetown University.