From Compliance to Conduct
Principal audience: Boards, compliance and risk professionals, regulators, public bodies, professional organisations, accountable executives and institutional leaders.
1. Compliance is necessary but not self-executing
Modern organisations require external and internal systems of control because personal good intention is not enough to govern complex institutions. Law establishes mandatory boundaries. Regulation sets sector expectations. Governance allocates authority and accountability. Policies translate requirements into organisational practice. Audit and monitoring test whether controls operate.
Yet every one of those systems eventually reaches a person. Someone interprets the requirement, designs the process, chooses whether evidence is sufficient, decides whether to escalate, determines how strictly to enforce, responds to pressure, explains an exception or chooses whether to work around the control.
The compliance problem is therefore partly a conversion problem: how does a formal requirement become actual conduct?
2. The Axiological Pyramid
IOWL's Axiological Pyramid distinguishes Values, Morals, Organisational Values, Ethics, Governance and Compliance. Values are personal and internal. Morals are socially influenced. Organisational Values create contextual commitments. Ethics provides professionally determined expectations. Governance provides internal direction, control and accountability. Compliance reflects external law, regulation and mandated requirements.
The model does not suggest that the lower layers are morally superior or that the upper layers should disappear. Strong institutions require professional ethics, governance and compliance. The model instead asks where behavioural guidance originates and how much external control is required when internal judgement is weak, conflicted or misaligned.
This creates the core distinction of the paper: sustainable trustworthiness is developed partly from the inside out, while regulation and formal control necessarily operate from the outside in.
3. The Conduct Gap
A policy can exist while conduct contradicts it. A code can require integrity while incentives reward silence. A control can be documented while staff routinely bypass it. An organisation can report formal compliance while stakeholders repeatedly experience behaviour inconsistent with its stated values.
IOWL uses the Conduct Gap to describe the difference between formal expectation and observed behaviour. The concept is diagnostic, not causal. A gap may reflect poor rules, weak systems, insufficient resources, contradictory incentives, lack of training, ineffective supervision, cultural pressure or poor individual judgement.
The question for Calibre research is whether separately evidencing judgement, integrity, consequence-awareness and behavioural reliability improves diagnosis beyond conventional competency and control assessments.
4. Rules, professional judgement and Calibre
Three questions recur in difficult compliance situations. Rules ask what must, may or must not be done. Professional judgement asks what the particular facts, duties, risks and consequences require. Calibre asks how, why and for whose benefit responsibility will be exercised.
The questions overlap but are not identical. A technically competent compliance professional may interpret the rule correctly and still fail to challenge conduct because commercial incentives or hierarchy create pressure. Conversely, a person with good intent but insufficient technical expertise may make a poor compliance judgement. Dependable conduct requires the dimensions to work together.
5. Doing things right and doing the right thing
Doing things right means, among other things, complying with applicable legal, regulatory, professional and organisational requirements. Doing the right thing concerns responsible judgement within those lawful boundaries when the formal rule does not exhaust the decision.
This distinction matters because compliance systems routinely rely on proportionality, reasonableness, materiality, risk assessment, professional scepticism and escalation. These are not mechanical concepts. They require human interpretation.
IOWL therefore does not use "doing the right thing" as permission to disregard formal authority. The proposition is that outside-in rules and inside-out judgement should reinforce one another wherever possible.
6. Capability can increase both protection and risk
Greater expertise can make a control system stronger. Skilled specialists identify emerging risks, interpret complex obligations and design better controls. The same Capability can also make circumvention more sophisticated when conduct is badly directed.
A person who understands a system deeply may understand exactly where its blind spots lie. A highly capable executive may know how to structure a decision so it passes a formal test while avoiding its purpose. A technically sophisticated organisation may comply with reporting form while obscuring meaningful substance.
This is why Capability and Competency should not be treated as evidence of Calibre. Technical sophistication expands capacity; it does not determine the direction of its use.
7. Culture and incentives are part of the control environment
People learn what an organisation truly values by observing what leaders reward, tolerate, investigate and ignore. Formal values matter, but behaviour under pressure often reveals the operative culture more clearly than a statement on a wall.
The FRC's current Corporate Governance Code Guidance directly connects governance quality with stakeholder relationships, speak-up culture, ethics and compliance, and observes that the effectiveness of risk management and internal control ultimately depends on the individuals responsible for operating the framework.
This independently supports the relevance of the human layer without validating IOWL's specific architecture. It also shows why boards cannot sensibly treat conduct as a specialist issue owned only by compliance.
8. Speaking up, escalation and responsible challenge
Controls often depend upon human beings noticing that something is wrong and taking action before an automated system, audit or regulator identifies it. The decision to speak up can require courage, evidence, proportion, fairness, confidentiality and acceptance of personal cost.
A strong conduct system therefore needs more than a reporting channel. It needs people who recognise responsibility, leaders who receive challenge appropriately, protections against retaliation, and processes capable of distinguishing serious concerns from unsupported allegation.
Calibre development is relevant to both sides of that interaction: the person raising the concern and the person receiving it.
9. Boards and accountable executives
Boards create the formal environment in which conduct takes place. They approve governance frameworks, set risk appetite, oversee remuneration, appoint senior leaders and determine whether culture and control receive meaningful attention.
The UK Corporate Governance Code 2024 increases board emphasis on material internal controls and, from 2026, Provision 29 applies to reporting on their effectiveness. The accompanying FRC guidance also focuses on outcomes, integrity, culture, challenge and behaviour.
IOWL's proposition is complementary: a board can strengthen the control architecture while also examining the Calibre of people who exercise authority within it. One is not a substitute for the other.
10. Individual accountability regimes point toward conduct
Regulatory development in financial services illustrates a broader trend. The FCA's Senior Managers and Certification Regime aims to strengthen individual accountability and improve conduct, while its Conduct Rules apply minimum behavioural standards directly to individuals. Following 2026 reforms, the regime continues to emphasise personal responsibility, conduct and accountability while reducing some administrative burden.
Ireland's Individual Accountability Framework similarly combines senior executive accountability, direct Conduct Standards and Fitness and Probity requirements. These frameworks do not provide Calibre assessment in IOWL's sense, but they demonstrate that regulators already recognise a gap between organisational compliance architecture and the behaviour of accountable individuals.
11. Trustworthiness is upstream of trust
Compliance is often intended partly to protect confidence in markets, professions and institutions. Yet compliance and trustworthiness are not identical. A technically compliant organisation may still appear evasive, opportunistic or unfair if its conduct repeatedly frustrates the purpose stakeholders reasonably expect.
IOWL therefore treats trustworthiness as an upstream quality and trust as an outcome. Trust is held by another person. Trustworthiness is demonstrated through repeated conduct.
Within the Axiological Pyramid, trust is not another upper stratum. It becomes more plausible when internal values, social expectations, organisational commitments, professional ethics, governance and external compliance broadly reinforce one another.
12. Technology changes controls but not the human responsibility problem
Technology can automate monitoring, detect anomalies, record decisions and strengthen surveillance. AI can accelerate risk analysis and identify patterns that human review would miss. These are valuable capabilities.
Technology also creates new discretion. Someone decides which data matter, what thresholds trigger investigation, when automated output may be overridden, how false positives are treated, how bias is identified and where human judgement remains necessary.
The control may be technological, but responsibility does not vanish. Increased technical capability therefore intensifies the need for clear accountability and sound judgement.
13. The cost of misalignment
Weak conduct can generate direct and indirect costs: fines, remediation, litigation, customer redress, investigation, rework, lost contracts, management distraction, employee turnover, higher monitoring costs and reduced willingness to cooperate or share information.
Not all such losses are Calibre-related. The research proposition is narrower: where a material portion of avoidable loss is linked to judgement, integrity, silence, misuse of authority or behavioural inconsistency, can Calibre development and longitudinal evidence reduce risk or improve diagnosis?
This connects From Compliance to Conduct with the Performance Gap and Capacity Conundrum. The organisation may possess substantial technical and governance capacity while still losing value during human conversion.
14. PCD as conduct maintenance
Compliance knowledge dates. Regulation changes. Professional responsibilities expand. New technology creates new risks. Organisational authority increases. PCD addresses a different but related problem: whether Calibre is reaffirmed, developed, transferred and recalibrated as those changes occur.
A one-time course cannot guarantee future conduct. Neither can a Calibre credential. PCD provides a continuing framework through which demonstrated judgement and conduct can be examined across changing contexts rather than assumed to remain constant.
This is the distinction from conventional CPD: CPD commonly renews what a person knows and can do. PCD continually examines how, why and for whose benefit that changing Capability and Competency are exercised.
15. What established systems already do
This paper does not claim that compliance, risk or governance practice ignores culture and behaviour. Contemporary frameworks explicitly address them. The FRC links culture, values, ethics, behaviour and speak-up mechanisms to governance and control. The FCA and Central Bank of Ireland apply conduct and accountability standards directly to individuals. Anti-bribery frameworks require preventive procedures. OECD integrity systems distinguish regulations from implementation.
The IOWL contribution is therefore not the discovery that people matter. Its bounded configuration claim concerns the combination of a distinct Calibre dimension, the Axiological Pyramid, structured development through Positive Value Leadership, bounded recognition, and PCD as a continuing development and evidence architecture.
16. Independent evidence of the implementation problem
The OECD Anti-Corruption and Integrity Outlook 2026 reports an average 19 percentage-point gap across OECD countries between the strength of integrity regulations and implementation in practice. The report identifies particularly large gaps in civil-service disciplinary systems and conflict-of-interest management.
This evidence matters because it demonstrates independently that formal integrity architecture and implementation can diverge. It does not demonstrate that Calibre is the missing cause. That remains an empirical proposition requiring measurement alongside legal, institutional, political, cultural and administrative factors.
17. The IOWL research programme
IOWL's current evidence is strongest at the developmental level. Its Emerging Evidence architecture includes quantitative learner measures, assessed learning, qualitative Reflective Transformation evidence and continuing PCD measures. Current internal findings are interpreted as evidence of developmental outcomes relating to judgement, self-regulation, speaking up, responsibility, collaboration and values-led conduct.
The next evidential step is longitudinal application: whether those outcomes are externally observed, sustained under pressure and associated with relevant conduct indicators in workplaces, professions or public institutions.
18. How the compliance proposition could be tested
A useful research design should distinguish Calibre from existing controls and from technical compliance capability.
| Evidence layer | What should be examined | Why it matters |
|---|---|---|
| Formal architecture | Applicable law, regulation, policies, governance, controls, audit arrangements, incentives and escalation mechanisms. | Establishes what the system already requires and what institutional factors may explain conduct. |
| Capability and Competency | Role knowledge, professional qualification, technical compliance knowledge and process competence. | Prevents Calibre from being used as a substitute explanation for lack of expertise. |
| Calibre-related evidence | Judgement, consequence-awareness, integrity-related behaviour, responsibility, speaking up, self-regulation and use of discretion. | Tests whether a separately defined human dimension adds useful information. |
| Conduct outcomes | Control overrides, repeat findings, incident quality, escalation, near misses, disciplinary outcomes, customer or stakeholder harm, remediation and observed behaviour. | Moves beyond course completion toward application in practice. |
| Longitudinal evidence | Repeated observation as roles, authority, incentives and pressure change. | Tests transfer and reliability rather than a single point-in-time result. |
| Independent evaluation | External replication, comparison groups where appropriate and methods capable of testing alternative explanations. | Keeps developmental evidence separate from causal claims. |
The proposition should be capable of failing. If Calibre evidence does not add explanatory or developmental value beyond established controls, competence and organisational factors, the model should be revised.
19. Implications for boards, compliance functions and regulators
- Do not assume every conduct failure is evidence that another rule is required; diagnose whether the weakness is legal, technical, cultural, incentive-related, behavioural or mixed.
- Examine whether stated values, reward systems, leadership behaviour, professional ethics, governance and external compliance are materially aligned.
- Treat speak-up, escalation and challenge as conduct capabilities requiring both systems and human support.
- Keep Capability, Competency and Calibre conceptually distinct when assessing accountable individuals.
- Use PCD to revisit judgement as authority, role, technology and regulatory consequence change.
- Evaluate Calibre interventions independently rather than treating programme participation as proof of reduced conduct risk.
20. Bounded proposition
IOWL does not claim that Calibre eliminates misconduct, replaces compliance, predicts every future decision or makes formal control unnecessary. Nor does a Calibre credential certify that a person will always act well.
The bounded proposition is narrower: whether a distinct, developable and longitudinally evidenced Calibre dimension strengthens the human reliability upon which governance and compliance systems ultimately depend, and whether it adds useful explanatory value to the gap between formal requirements and conduct in practice.
Research questions
- Where do formal compliance systems show the largest gaps between policy and lived conduct?
- Can Calibre-related evidence identify conduct risk not captured by technical competency or control testing?
- How strongly do incentives, leadership behaviour and speak-up culture moderate the relationship between Calibre and observed conduct?
- Does PCD support more reliable judgement as discretion and authority increase?
- Can alignment across the Axiological Pyramid be operationalised without reducing values to another compliance checklist?
- Does stronger inside-out alignment reduce avoidable reliance on surveillance, remediation or repeated enforcement?
- What indicators most credibly distinguish compliant activity from trustworthy conduct?
Source trail and selected literature
- Financial Reporting Council - UK Corporate Governance Code 2024 - Board leadership, culture, risk, internal controls and outcome-focused reporting.
- Financial Reporting Council - Corporate Governance Code Guidance - Culture, conduct, ethics, compliance, challenge and operation of control frameworks.
- Financial Conduct Authority - Senior Managers & Certification Regime - Individual responsibility, accountability, conduct and competence.
- Financial Conduct Authority - Conduct Rules - Minimum standards of individual behaviour, current 2026 guidance.
- Central Bank of Ireland - Individual Accountability Framework - SEAR, Conduct Standards and Fitness and Probity.
- UK Ministry of Justice - Bribery Act 2010 guidance - Preventive procedures for commercial organisations.
- OECD Anti-Corruption and Integrity Outlook 2026 - Cross-country evidence on the gap between integrity regulations and implementation.
- OECD Public Integrity - Public Integrity Indicators and implementation evidence.
- IOWL - Calibre for Compliance Professionals - Rules, professional judgement, Calibre and the Axiological Pyramid applied to compliance.
- IOWL - Calibre Language & Definitions - Canonical definitions for the Axiological Pyramid, trust and trustworthiness.
- IOWL - Emerging Evidence - Current developmental evidence and the continuing PCD research architecture.
- Working Paper - The Capacity Conundrum - The broader question of strong capacity without proportionate realised outcomes.
- Working Paper - From Policy to Public Value - The related policy-to-outcome implementation problem.