A compliance culture is a set of shared values, behaviours, governance arrangements and controls that determine how an organisation identifies, manages and escalates legal, regulatory and ethical risk.
A strong compliance culture is not created by policies, training or senior statements alone. It depends on how decisions are made, how accountability is allocated, how concerns are raised and handled, and whether the organisation can demonstrate that compliance is embedded in day-to-day business activity.
Legal and regulatory expectations increasingly focus on outcomes, accountability and evidence of effectiveness. Organisations should therefore be able to show not only that compliance arrangements exist, but that they are risk-based, proportionate, monitored, improved and supported by leadership at all levels.
Compliance culture is relevant across a wide range of legal and regulatory risk areas, including bribery and corruption, fraud, tax evasion facilitation, competition law, sanctions, data protection, consumer protection, workplace conduct, financial services regulation, modern slavery, supply chain risk and the use of data, technology and artificial intelligence.
This subtopic contains key elements of a compliance culture framework, and tools that may assist organisations in assessing, developing and embedding it.
Understanding compliance culture
Compliance