Conduct Risk: Why Culture Is the Metric Regulators Actually Care About

Introduction

Almost every major conduct failure, in hindsight, traces back to a culture that made the eventual outcome close to inevitable — incentives that rewarded the wrong behaviour, a speak-up culture that didn't actually work, management pressure that made cutting corners the path of least resistance. Regulators have drawn the same conclusion, which is why culture has moved from background context to a supervised metric in its own right.

From Policy Compliance to Culture Evidence

Frameworks like the UK's Senior Managers and Certification Regime, and the FCA's Consumer Duty, share a common thread: they don't just ask whether a policy exists, they ask whether the organisation's actual behaviour and culture support the outcome the policy is meant to deliver. That's a much harder thing to evidence than a signed-off policy document, and it's exactly where most firms' current reporting falls short.

A firm can have an impeccable conduct risk framework on paper and still have a culture where employees don't feel safe raising concerns, where pressure to hit targets quietly overrides stated values, or where management behaviour varies wildly by team or region. Policy compliance and culture reality are not the same thing, and regulators increasingly know the difference.

Why Culture Is Hard to Supervise From the Outside — and Why That's Changing

Culture has historically been hard to measure because the people best positioned to describe it — employees — have the least incentive to describe it honestly through formal channels. Anonymous employee surveys help, but response rates and social desirability bias limit what they capture. Anonymous public review platforms remove much of that friction, which is part of why they've become a genuine, if underused, source of conduct-relevant signal.

The firms best placed to demonstrate a credible speak-up and conduct culture are the ones that can show structured, ongoing analysis of what employees are actually saying — internally and externally — rather than a single annual survey score.

What Good Conduct Risk Evidence Looks Like

• Structured analysis of open-ended employee feedback, not just quantitative scores
• Independent monitoring of public employee reviews, uncontaminated by internal filtering
• Clear patterns by team, region, or manager, since conduct risk is rarely evenly distributed
• A documented process for escalating what's found to the right committee or board

Where This Fits Alongside Existing Controls

None of this replaces existing conduct risk frameworks, compliance monitoring, or whistleblowing hotlines. It fills the gap those tools consistently miss: the signal that never reaches a formal channel at all, because the employee didn't trust it, didn't think it was "serious enough," or simply vented on a public review site instead. myCandr's Insight Index and Walk the Floors are built to close exactly that gap for financial services firms managing conduct risk.

A Practical Starting Point

Firms that are serious about this usually start with two questions they can't currently answer with confidence: what are our people actually saying in open-ended survey comments, beyond the headline scores, and what are they saying publicly, on review platforms, that never reaches us at all? Both are answerable with existing data and existing public information — the gap is analysis capacity, not data availability. Most conduct risk teams already have far more relevant signal sitting in unread survey comments than they realise.

Getting a structured answer to those two questions, refreshed on a regular cadence rather than as a one-off review, is usually enough to change how a conduct risk committee prioritises its attention.

Conclusion

Conduct risk isn't really a compliance category, it's a culture outcome. Firms that treat it as a paperwork exercise will keep being surprised by findings that, with the right listening in place, were visible months or years in advance.

Nicole Vaughan, CEO & Founder of myCandr