The case that compliance is the practical core of governance
One position holds that, in practice, compliance is where governance becomes real. Governance principles — accountability, transparency, sound oversight — are abstract until they are translated into specific, checkable rules: who must approve what, what must be disclosed, which controls must be in place. Without that translation, governance risks remaining aspirational language with no operational teeth. On this view, a strong compliance function is not a substitute for governance but its enforcement mechanism, and an organisation that meets its compliance obligations consistently is, by a reasonable proxy, demonstrating that its governance is functioning.
There is a practical dimension to this position worth taking seriously on its own terms. Boards, regulators and investors generally need some externally verifiable signal that an organisation is being run soundly, and compliance metrics — audited, documented, comparable across organisations — are considerably easier to produce and defend than an outside party’s judgement about the quality of an organisation’s internal decision-making. In this framing, treating compliance as a meaningful proxy for governance is less a conceptual error than a practical necessity: it is the signal available, in a world where the alternative — directly assessing judgement quality — is not something most external stakeholders are equipped to do at all.
The case that compliance can substitute for governance without anyone noticing
The opposing position treats this as a dangerous conflation. Compliance measures adherence to a defined, external or internal rule set. Governance is the exercise of judgement about matters the rule set did not anticipate — precisely the situations where following an existing rule does not tell anyone what the right decision is. An organisation can be fully compliant with every rule that applies to it and still be poorly governed, because compliance says nothing about the quality of judgement exercised in the much larger space the rules do not cover.
Steven Kerr’s research on the divergence between what organisations reward and what they actually want offers a related caution here, even though it was not written about compliance specifically. Kerr’s central finding — published in the Academy of Management Journal and studied across manufacturing, insurance, and other settings — is that organisations frequently create reward and measurement systems that incentivise one behaviour while genuinely hoping for a different one, and that people reliably respond to what is measured and rewarded rather than what is merely hoped for. Applied to governance, a compliance-measurement regime rewards the visible, checkable behaviour of meeting defined rules. It does not reward, and often does not even detect, the harder-to-measure exercise of sound judgement in situations the rules never anticipated. An organisation optimising for compliance metrics can therefore drift toward rule-following as the goal in itself, while the underlying governance — judgement in the gaps — receives no comparable attention because nothing is measuring it.
Why the disagreement persists
The disagreement is not really about facts; both positions agree that compliance and judgement are different things. It is about which one should be treated as the primary signal of governance health when an organisation only has the resources to closely monitor one of them. The first position treats compliance as a reasonable, checkable proxy because judgement itself is difficult to observe and measure directly. The second position treats that same difficulty as the reason compliance is a dangerous proxy — precisely because judgement resists easy measurement, a compliance-focused organisation has every incentive to quietly substitute the thing it can measure for the thing it actually needs, without ever deciding to do so deliberately.
Neither position is straightforwardly wrong. Compliance genuinely is easier to verify, and an organisation with no compliance discipline at all has little claim to good governance either. The tension is real rather than resolvable by better definitions alone.
There is also a scale dimension to the disagreement that neither position fully accounts for alone. In a small organisation, the people setting compliance requirements and the people expected to exercise judgement in the gaps are frequently the same individuals, which makes the conflation between the two considerably less consequential — a founder who is personally both compliant and judicious does not need the distinction drawn carefully. As organisations grow and these functions separate into different roles, sometimes different departments entirely, the gap between what is measured and what is actually needed becomes structurally more likely to open, simply because more people are now optimising for whichever one their specific role is evaluated against.
What it means for a leader
A leader navigating this tension is choosing, whether deliberately or by default, how much weight to place on what can be checked versus what can only be judged — and Kerr’s research suggests that whichever one is measured and rewarded will tend to receive more organisational attention than the one that is not, regardless of which one leadership genuinely considers more important.
The same pattern appears across many kinds of organisation; see Other Sectors for how it is read elsewhere.
Questions worth considering
- If the organisation’s compliance record were perfect, what would that tell its leaders about the quality of judgement exercised in situations the rules never anticipated?
- Which receives more attention in how people are measured and rewarded — what can be checked, or what can only be judged?
- Where compliance and governance sit in different roles or departments, who is responsible for the space between them?
More on this topic: Governance.
Your team is facing similar challenges?
Subscribe to The Riddle Ledger
Perspectives are sent as they are published, with no promotional email, and you can unsubscribe at any time.