I've got to say it: 𝗖𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗢𝗳𝗳𝗶𝗰𝗲𝗿𝘀 𝗶𝗻𝘃𝗲𝗻𝘁 𝗿𝘂𝗹𝗲𝘀.

I don't mean they ignore actual regulations; they're usually on top of those. But to implement the '𝘳𝘦𝘢𝘭' rules, they use a second layer of unwritten ones: norms, conventions and assumptions about what a '𝘨𝘰𝘰𝘥' compliance programme is supposed to look like.

Those unwritten rules help shape the reality of compliance: how, for example, training, communications, policies and controls are designed, and how they actually land.

What's odd is that while the written rules are challenged all the time, the unwritten ones often aren't. That's where I come in, asking simple but uncomfortable questions.

𝘞𝘩𝘺 𝘢𝘳𝘦 𝘺𝘰𝘶 𝘳𝘦𝘢𝘭𝘭𝘺 𝘥𝘰𝘪𝘯𝘨 𝘪𝘵 𝘵𝘩𝘪𝘴 𝘸𝘢𝘺? 𝘐𝘴 𝘪𝘵 𝘢𝘤𝘵𝘶𝘢𝘭𝘭𝘺 𝘢 𝘳𝘦𝘨𝘶𝘭𝘢𝘵𝘰𝘳𝘺 𝘳𝘦𝘲𝘶𝘪𝘳𝘦𝘮𝘦𝘯𝘵, 𝘰𝘳 𝘪𝘴 𝘪𝘵 𝘴𝘪𝘮𝘱𝘭𝘺 𝘦𝘢𝘴𝘪𝘦𝘳 𝘧𝘰𝘳 𝘺𝘰𝘶? 𝘏𝘰𝘸 𝘥𝘰 𝘺𝘰𝘶 𝘬𝘯𝘰𝘸 𝘺𝘰𝘶𝘳 𝘢𝘱𝘱𝘳𝘰𝘢𝘤𝘩 𝘸𝘰𝘳𝘬𝘴? 𝘈𝘯𝘥 𝘪𝘧 𝘺𝘰𝘶 𝘥𝘰𝘯'𝘵, 𝘸𝘩𝘺 𝘢𝘳𝘦𝘯'𝘵 𝘺𝘰𝘶 𝘵𝘳𝘺𝘪𝘯𝘨 𝘴𝘰𝘮𝘦𝘵𝘩𝘪𝘯𝘨 𝘦𝘭𝘴𝘦?

I ask them because I want Compliance Officers to think more deliberately about what they're doing, and to give themselves permission to do things differently. But only if and when that makes sense.

I'm not telling them to change their approach. After all, they'll always know far more about their industry than I ever will. I'm helping them recognise that the way they're doing things is very much a choice, and they have far more options than they might think.

Because following those unwritten rules might just be the difference between doing a good job and merely looking good on paper.