Controls Without Values Alignment is Compliance Theatre

I want to describe a situation that will be familiar to many of you.

A conduct issue is identified. The controls worked. It is reported, escalated, and follows every process it should. Consequences are applied, considered carefully, and proportionate. There is a bonus impact and discussion at year-end. The training is completed, the attestation signed.

And you already know it will happen again.

Not because the process failed, but because the process was never designed to do what you needed it to do. Controls capture behaviour. They do not change it. And when the person sitting across from you in that conversation has no sense of alignment between what they genuinely value and what the organisation is asking of them, no consequence structure will move them. They will do what is required to satisfy the process, remain at the fringe, and reoffend.

Hui Chen and Eugene Soltes wrote in HBR that "malfeasance remains deeply entrenched in private enterprises today." Firms spend millions. The frameworks are more sophisticated than ever, and yet the pattern holds.

The question this raises for compliance leaders is an uncomfortable one: if your controls are working and the behaviour isn't changing, what are you actually building?

What I have observed, in organisations and in the coaching room, is that the missing variable is almost always values alignment. Not the firm's stated values, the ones on the wall and in the code of conduct. The individual's own values, and whether their work gives them a genuine way to live by them. When there is alignment, accountability is intrinsic. When there is not, compliance becomes a performance: the attestation, the training, the managed conversation at year-end.

This matters for you and for your team. CCOs often carry a quiet frustration that their function is measuring activity rather than creating change. That frustration is worth paying attention to. It usually signals that the process is working exactly as designed, and that something the process was never designed to do still needs doing.

The reframe I would offer is this: the most sustainable compliance cultures are not built on better controls. They are built on something the controls cannot mandate, a genuine connection between individual values and organisational purpose. That is where behaviour actually shifts.

If values alignment is where behaviour actually shifts, the more useful question for compliance leaders may be; where does that work begin in your team, and who is supporting you to do it?