Corporate culture is a complex aspect of businesses that has increasingly come into focus as a key determinant of performance and sustainability. Defined broadly as the shared values, ideals, attitudes, beliefs and assumptions that characterise the way in which an entity conducts business, corporate culture directly and indirectly influences employee behaviour, including integrity, ethics and compliance. It may appear to go without stating that a 'bad' corporate culture, characterised for example by a lack of concern for business ethics, vague or ambiguous values or an absence of concern for employee well-being is hardly likely to be conducive to employee morale and integrity. In today's business world blatant cases of this nature are however relatively scarce owing to ever increasing regulatory and stakeholder demands for transparency and accountability. The primary concern regarding corporate culture therefore comes down to more subtle aspects of and their impact on the risk profile of the organization. The focus of this article is specifically on risks of non-compliance. Further articles will address the role of corporate culture in other risks, including financial, operational and security risks.

Despite a plethora of academic research into the topic of corporate culture, it is all too often forgotten that the culture of an organisation comprises multiple levels and components. Ultimately the extent to which compliance and integrity behaviour are facilitated or inhibited by the employees of an organization depends to a large degree on whether these levels and components complement and reinforce each other or, on the other hand, work in direct or indirect opposition to each other. A simple example of this is the vexing question of revenue targets. A key performance indicator in many organizations, revenue targets have traditionally formed a core component of Management by Objectives and Results strategies. This may support compliance and integrity when those values are reflected as explicit and non-negotiable deliverables on the results sheet. All too often, however, they appear to either be implied rather than stated. In several well known corporate scandals of the modern era, including Barings, Enron and Qwest, it has emerged that there was in fact subtle but sustained pressure on senior managers to deliver on revenue targets at the expense of individual integrity and compliance requirements to ensure a well run organisation.

At the crux of the matter is the fact that no matter how clear the compliance standards and ethical values of a company may be it is ultimately the human factor that determines whether those standards and values are realised, compromised or simply abandoned. Blatant dishonesty on the part of employees is an obvious threat to compliance, the most famous example being so-called rogue trader Nick Leeson, who single-handedly brought down Barings Bank through a series of extreme risk trades that were fraudulently concealed from the Bank. While Leeson's behaviour clearly speaks to a profound lack of integrity (something he himself has conceded), it should not be overlooked that the culture of the organization was such that it implicitly and explicitly encouraged and supported his actions by focusing exclusively on the returns that he falsely projected. Corporates have come a reasonable way in terms of compliance and ethics requirements since the collapse of Barings, but there remains an acute lack of understanding of the fact that in many cases incentivizing employees to deliver on high targets almost inevitably sets up an 'inner tension' between values and performance – particularly in organizations where ethics and compliance standards are not explicitly formulated, communicated and assimilated among all levels of the organization.

There is an accumulating body of evidence to support the idea that profound and far-reaching changes in the culture of an organization can result not only in sharp reductions in costly failures of integrity and compliance, but also can improve the bottom line. One recent study indicates that explicit statement of values and ethics, combined with a clear willingness to place those values above revenue in event of a potential conflict between the two, can double shareholder value. Two reasons may be advanced for this. Firstly, stakeholders, including clients and investors, are more likely to place their interests in companies that are unlikely to be a lead news item for the wrong reasons. Secondly, and perhaps more importantly, the positive impact on employees having a clear and consistent framework to guide and encourage positive, value-driven behaviour appears to translate into greater commitment, purpose and productivity on the part of employees.

Given the apparent complexity of these issues it is evident that organizational culture ultimately needs to be treated on a case-by-case basis, allowing for the specific challenges, requirements and people of particular organizations to be factored into systems that support and indeed demand integrity and compliance behaviour. It is however possible to provide some broad guidelines for company executives to consider:

• There is a fundamental difference between compliance and obedience. Compliance is values-driven and principle-orientated, while obedience is rules-driven and conformity-orientated. Companies that implicitly or explicitly encourage obedience may be exposing themselves to risk. As an example, Pasco discovered during a forensic investigation into a US$80 million loss in a large financial institution that lower ranking employees were suspicious of the activities of the senior manager who had perpetrated the fraud, but the culture of the organization emphasized complete loyalty and obedience to the line management system, so the suspicions remained unreported for more than nine years.
• There needs to be a broad 'fit' or synergy between the values of the company and those of employees to ensure compliance and integrity. Ideally, assessment of the degree of fit and potential points of conflict should be included in recruitment and screening processes, particularly at managerial and executive level, and where key or sensitive posts are concerned.
• While high-performing employees should be adequately incentivised, evaluation of their performance should ensure that there is a balance between delivery on revenue targets and consistency on compliance and ethics.
• Organizations require regular monitoring and assessment of the extent to which compliance standards and commitment to values and ethics are understood, spoken about and maintained.