The Question at Hand
Your compliance program has a decision tree for every scenario. You've trained your team on the Standards of Business Conduct. You track attestations, log hotline reports, and investigate when something goes wrong. But here's the harder question: are you measuring whether people actually want to do the right thing?
The Financial Conduct Authority (FCA)'s recent enforcement action against hedge fund director Crispin Odey, which resulted in a lifetime ban and a £1.5 million fine, highlights this issue. The FCA's executive director of enforcement emphasized that the regulator won't tolerate a "slapdash" approach to non-financial misconduct. This isn't about missing a form or filing late; it's about the quality of your ethical environment.
This raises a real dilemma for compliance leaders: do you focus your resources on building systems that detect and punish misconduct, or on shaping a culture where misconduct is less likely to happen in the first place?
The Case for Enforcement-First Compliance
Start with what you can control. Rules are measurable. You can count who completed training, track how quickly you closed investigations, and document every policy acknowledgment and disciplinary action. When regulators come asking, you have evidence.
This approach treats compliance as risk management. You identify behaviors that create legal exposure, prohibit them clearly, and enforce consequences when people cross the line. It's defensible because it's documented. If an employee violates your Anti-Retaliation Safeguards, you can show you trained them, they signed off, and you acted when they broke the rule anyway.
There's also a practical argument: culture is subjective, enforcement is not. You can't prove you have a "good culture" in a regulatory exam. But you can prove you investigated 47 hotline reports, substantiated 12, and took disciplinary action in every substantiated case. That's the kind of documentation that holds up under scrutiny.
Some compliance leaders will tell you they've seen culture programs turn into expensive theater. You hire consultants, run engagement surveys, plaster values on conference room walls, and nothing changes. Meanwhile, the one thing that does change behavior is seeing someone get fired for doing the wrong thing.
The Case for Culture-Building Compliance
Now flip it. If you're only enforcing after the fact, you're always playing defense. You're waiting for misconduct to surface, then reacting. That might satisfy a regulator's checklist, but it doesn't prevent the next problem.
Culture-focused compliance leaders argue that your real job is to make people not want to break the rules. That means you're measuring different things: how comfortable people feel raising concerns, whether managers model ethical behavior, and how quickly small problems get addressed before they escalate. These are leading indicators, not lagging ones.
Here's the practical version of this argument: if your team doesn't trust Internal Reporting Channels, your enforcement system is blind. You can have the best investigation protocols in the world, but if people won't report what they see, you'll never use them. Culture isn't soft. It's the infrastructure that makes your enforcement tools work.
The FCA's language about "slapdash" approaches suggests they're looking for something beyond procedural compliance. They want to see that firms are actually trying to prevent ethical lapses, not just documenting that they happened. That requires understanding what drives behavior in your specific organization.
Consider what happens when you only enforce. You catch the obvious violations, but you miss the gray areas where most real ethical decisions happen. Someone wonders if they should escalate a concern about a colleague's conduct. They look around, assess the risk, and stay quiet. No rule was broken. Your enforcement system has no data point. But your culture just failed.
Where Practitioners Actually Land
Most compliance programs try to do both, but the resource allocation reveals where they really stand. If you're spending 80% of your budget on investigation management software and 5% on manager training, you've made a choice.
The practitioners who seem to get this right don't treat it as either/or. They recognize that enforcement without culture is whack-a-mole, but culture without enforcement is wishful thinking. You need the enforcement system to be credible. You need the culture work so the enforcement system doesn't have to run constantly.
What that looks like in practice: you track investigation outcomes, but you also track whether people who report concerns in Good-Faith Reporting would do it again. You document policy violations, but you also ask managers to identify ethical dilemmas their teams face before they become violations. You run the numbers on training completion, but you also look at whether training actually addresses the scenarios people encounter.
Our Take
Build your enforcement system first, then use it to inform your culture work. You can't skip the documentation, the investigation protocols, or the clear consequences. But if that's all you do, you're building a compliance program that only works after something goes wrong.
The FCA's warning about non-financial misconduct should tell you something: regulators are starting to ask whether your program actually prevents problems. That's harder to prove with a policy library. It requires evidence that people throughout your organization understand what ethical behavior looks like in their specific role, and that they see it modeled by the people above them.
Start with what you can measure today. How many reports do you get through Confidential Reporting channels? How many of those are substantiated? How long does Investigation Triage take? Then ask the harder question: are you only hearing about problems after they're serious, or are people raising concerns early? If it's the former, your enforcement system is working but your culture isn't.
The tradeoff is real. Culture work is harder to measure and slower to show results. But enforcement without it means you're always reacting. And if the FCA's recent action shows us anything, it's that regulators are losing patience with programs that look good on paper but don't actually shape behavior.
