Common Challenges: Regulatory Compliance
%20(1).png)
Why regulatory compliance is becoming a culture problem, not just a legal one
Regulatory compliance in the workplace has traditionally been treated as a legal and procedural discipline. Policies are written to reflect statutory requirements, training is delivered to ensure awareness, reporting lines are established to demonstrate accountability, and evidence is collected to satisfy audits, regulators, and internal governance structures.
On paper, this creates the appearance of control. But across frameworks like the Employment Rights Act, the Worker Protection (Amendment of the Equality Act 2010) Act 2023, FCA expectations around non-financial misconduct, the NHS Sexual Safety Charter, CIISA Safe Working Standards, and OfS Condition E6 in higher education (to name a few!) a clear shift is taking place. Regulators are no longer only interested in whether policies exist, they are increasingly focused on whether they work in practice - and that shift changes the nature of compliance entirely.
It’s no longer enough for organisations to demonstrate that they have appropriate systems in place, instead they must now demonstrate that those systems are effective in shaping behaviour, handling concerns, and preventing harm. And that is where many organisations are currently exposed.
The gap between compliance on paper and compliance in practice
Most organisations can point to a set of formal procedures that meet regulatory expectations. They have reporting procedures for misconduct. They have whistleblowing policies. They have safeguarding frameworks, grievance processes, disciplinary procedures, and training modules that cover expected standards of behaviour.
But regulatory scrutiny is increasingly focused on a different question: what happens when those mechanisms are used? Because compliance risk is no longer defined solely by whether systems exist. It is defined by whether they function consistently across the organisation.
For example:
- Are harassment or bullying concerns handled consistently, regardless of seniority or role?
- Are employees able to report issues safely, without fear of retaliation or reputational impact?
- Are patterns of misconduct identified early, or only after escalation?
- Do leaders respond in ways that reinforce trust in the system, or undermine it?
When these questions are not answered consistently in practice, compliance frameworks begin to diverge from lived reality, and this divergence is what regulators are increasingly looking to expose.
Why compliance failures often start long before an investigation
When organisations face regulatory scrutiny, the focus is often on the point of failure: the incident, the complaint, the investigation, or the escalation that triggered external attention. But in most cases, the conditions that led to that moment were already present long before.
They typically include:
- low trust in internal reporting mechanisms
- inconsistent handling of behavioural issues
- under-reporting of early-stage concerns
- lack of visibility across teams or locations
- and cultural norms that allow inappropriate behaviour to persist without challenge
These are not isolated compliance failures, they are systemic conditions that weaken the organisation’s ability to identify and address risk early. This means that by the time a regulatory issue becomes visible externally, it is often the result of accumulated internal signals that were not fully captured, connected, or acted upon. This is why modern compliance frameworks are increasingly concerned with early visibility, not just formal response.
The unintended consequence of over-procedural compliance
One of the paradoxes in regulatory compliance is that highly procedural systems can sometimes create a false sense of security. The more detailed the policies, the more structured the reporting routes, and the more comprehensive the training, the easier it is to assume that compliance is being effectively managed. But procedure does not guarantee participation.
If employees do not trust the system, do not believe it leads to action, or do not feel safe using it, then formal mechanisms remain underutilised. And when that happens, organisations may appear compliant externally while lacking the internal visibility needed to meet the spirit of regulatory expectations. This is increasingly important in frameworks that explicitly reference culture, behaviour, and employee experience as part of compliance expectations.
6 ways organisations can strengthen regulatory compliance in practice
Effective compliance in the current regulatory environment requires moving beyond documentation into reality.
1. Align policy with experience
Policies must reflect how issues are actually handled, not just how they are intended to be handled.
2. Strengthen early reporting visibility for behavioural issues
Many compliance risks emerge long before formal escalation thresholds are reached.
3. Ensure consistent handling of misconduct and harassment cases
Inconsistency in response undermines both compliance assurance and employee trust.
4. Focus on cultural indicators, not just incident data
Reporting rates, trust in leadership, and speaking-up confidence are key compliance signals.
5. Embed accountability across leadership levels
Compliance is increasingly assessed through leadership behaviour, not just policy ownership.
6. Demonstrate impact, not just activity
Training delivered and policies updated are not sufficient without evidence of behavioural change.
How Culture Shift supports regulatory compliance in practice
Modern regulatory compliance depends on whether organisations can see and respond to cultural risk in real time, not just document it after the fact. Culture Shift’s Report + Support™ platform supports this by enabling organisations to surface behavioural concerns, misconduct, and cultural issues through a trusted and accessible reporting channel, including anonymous reporting. This helps organisations meet increasing regulatory expectations around visibility and early intervention.
Through structured case management, organisations can ensure that reports are handled consistently, transparently, and with clear accountability. This supports regulatory expectations around fair process, timely response, and traceability of action.
Aggregated reporting insight also allows organisations to identify patterns across teams, behaviours, and time periods - supporting a shift from reactive case handling to proactive risk identification, which is increasingly aligned with regulatory direction of travel across sectors.
Lastly, training strengthens compliance by improving the quality and consistency of response at every level of the organisation. Because many compliance risks are shaped in first-line interactions, where early decisions determine whether issues are escalated or contained appropriately.
What we're reading
Latest insights from the front lines of workplace culture.
Why Whistleblowing Protections Are Not Enough
The launch of the CIISA standards marked a significant moment for the creative industries, signalling growing recognition of the need for stronger protections around bullying, harassment and misconduct across film, television and wider media environments. But in a recent article for Broadcast Now, we highlight that whistleblowing protections alone will not solve the deeper cultural issues that have allowed harmful behaviour to persist for years.
.png)
Speaking Up in the Creative Industries – Embedding Standards in Practice
With the CIISA Standards having been in place for a year and with the introduction of the Employment Rights Act, expectations around creating a healthy and effective speak up culture are shifting. Organisations being asked to move beyond policy and demonstrate how they are creating real, effective speak-up cultures.
.png)
From the Conference Floor: Real-World Lessons for HR Leaders
Workplace misconduct is evolving, and many HR processes are struggling to keep up. At this year’s Culture Shift Annual Conference, one thing was clear: what worked even a year ago isn’t enough anymore. In this webinar join Gemma McCall (CEO) and Charlotte Taylor (Training Manager and ED&I Specialist) as they bring the most important conversations from the conference floor into a practical session for HR, People and Compliance leaders. You’ll hear what industry experts and legal professionals are seeing right now, and what it means for how you design, communicate and manage your approach to misconduct.
Feeling inspired?
Take the first step toward preventative misconduct management with a demo of our Report + Support™ platform. We can show you how to breakdown reporting barriers with anonymous 2-way messaging, and how to act before things escalate with name-matching and pattern-spotting across our analytics dashboard.
