CyberKainos. Reading time: 5 mins

Why Culture Trumps Documentation When It Comes To Compliance

Most organisations actually possess pretty good compliance documentation. Detailed policies. Comprehensive frameworks. Annual training modules with completion certificates. Risk registers that run to dozens of pages. These will have taken hundreds of hours to put together, yet some are still finding themselves on the wrong side of a regulatory investigation, a conduct failing, or a near-miss that shouldn’t have happened.

The issue is often that the documentation was there, but the culture wasn’t.

This is a gap that regulators are increasingly focused on, and it can’t be closed with an update to a policy document. Operational resilience frameworks and regulatory compliance standards are, at their core, about outcomes: Did the right thing happen, or was a risk / threat prevented from happening and for the right reasons. These successes happen because the people involved understand why it matters, not because a procedure told them what to do.

Embedding compliance in culture rather than documentation is not a soft ambition. It is a practical necessity. And it looks very different from what most firms are currently doing.

Focusing on documentation alone will lead to problems

Documentation serves a purpose. It sets expectations, creates accountability, provides evidence, and gives regulators something to review, and to be clear, all of this is important. However, problems will arise when documentation becomes the goal rather than the mechanism.

When compliance becomes a primarily documentation exercise, a predictable set of behaviours follows. Policies are written to satisfy audits rather than to guide decisions. Training is completed to generate completion rates rather than to change behaviour. Risk registers are updated annually because review timelines say they have to be, not because the risk picture has changed. When a genuinely difficult situation arises such as an ambiguous customer interaction, an unusual transaction, a grey-area decision under time pressure the key people in the room reach for the procedure, discover it doesn’t quite fit, and either escalates reluctantly or makes a judgement call with limited real-world support.

That last scenario is where most failings actually begin. Not in a deliberate decision to do the wrong thing, but in a system that trained people to follow process rather than to exercise judgement and then puts them in a situation where process wasn’t enough.

Risks evolve too quickly for point-in-time reviews. A policy written in January may already be inadequate by April if the regulatory environment has shifted, a new product has been launched, or a new technology has been deployed. Firms operating in high-risk sectors cannot afford a compliance culture that only updates itself once a year.

‘Tone from the top’. What does this actually mean?

“Tone from the top” is one of the most overused phrases in governance. It has been reduced, in many firms, to a CEO message in the annual report and a board-level sign-off on the compliance framework. That is not tone from the top. That is documentation of tone from the top which is a different thing entirely.

Real tone from the top is visible in the decisions that leaders make when compliance and commercial pressure pull in different directions. It is present in how senior managers respond when someone escalates a concern and whether that person is thanked, supported, taken seriously, or quietly sidelined. It is reflected in what gets celebrated: whether the firm’s internal recognition goes to the people who hit their targets, or also to the people who raised a difficult issue, slowed a process down to get it right, or pushed back on a decision that didn’t feel right.

Leaders who want to embed compliance in culture need to be deliberate about all of this. That means speaking about compliance in terms of values and outcomes not in terms of regulatory requirements. It means being visible in their own adherence to the standards they set, and it means treating escalation not as a problem to be managed but as evidence that the culture is working.

Training That Changes Behaviour

Annual compliance training is, in most organisations, a missed opportunity. It is typically designed to demonstrate coverage that every employee completed a module on a given topic rather than to change how people think and act in real situations.

Effective compliance training looks quite different. It is scenario-based rather than abstract, placing people in realistic situations where they have to make a judgement call rather than select the obviously correct answer from a multiple-choice list. It is frequent and varied rather than a single annual event. Short and targeted interventions that are calibrated to role and risk keep compliance thinking alive throughout the year.

The most effective training programmes also create space for discussion. Case studies based on real incidents are far more powerful than hypothetical scenarios, because they demonstrate that the situations being trained for actually happen, and that the decisions people make in those moments have real consequences.

Building an escalation culture

The quality of a firm’s compliance culture can be measured by how people behave when something goes wrong, or when they’re not sure whether something is right. Do they escalate? Do they feel safe doing so? Do they trust that raising a concern will be taken seriously rather than treated as an inconvenience?

Building a genuine escalation culture requires three things:

1. Accessible channels. People need to know where to go and how to get there, and the route needs to be simple enough that they’ll actually use it under pressure.
2. Psychological safety. People need to believe that raising a concern will not damage their standing, their relationships, or their career.
3. Visible follow-through. When concerns are raised, people need to see that something happens as a result, even if they don’t see every detail of the outcome.

The absence of escalations is not a sign of a healthy compliance culture. It is usually a sign of the opposite, that people have learned, through experience or observation, that raising concerns isn’t worth the effort or the risk.

Make it stick day after day

Culture is built in small moments, not large ones. It is the manager who takes five minutes to discuss a compliance question rather than deflecting it. The team meeting where a recent near-miss is discussed openly rather than quietly resolved. The onboarding process that introduces new joiners to the firm’s values through real stories rather than policy summaries. The performance review that includes a genuine conversation about conduct and judgement, not just outcomes and targets.

None of this requires a large budget or a dedicated culture programme. It requires consistency and leadership that understands that compliance culture is not something you declare and then maintain. It is something you actively tend, every day, at every level of the organisation.

How CyberKainos can help

At CyberKainos, we work with firms to build compliance frameworks that go beyond documentation. We help leadership teams understand what genuine cultural embedding looks like in practice, and how to close the gap between the standards a firm sets on paper and the behaviours that actually show up in the room.

Whether you need to assess the current state of your compliance culture, redesign your training programme to drive genuine behaviour change, build a more effective escalation framework, or support your senior managers in modelling the right tone from the top — we bring the expertise and the honest perspective that makes a practical difference.

Good documentation tells people what to do. Good culture means they do it — even when no one is watching. Visit CyberKainos.com to find out how we can help you build both.