Governing Culture in a Complex World

The harder question is not what your culture is; it is whether it is driving the outcomes that matter.

Culture has been a board priority for decades. The harder question is whether the oversight boards have in place is producing the clarity needed to act decisively.

The AICD's Governing Culture in a Complex World is a welcome contribution to this conversation. It treats culture as central to strategy, risk and performance rather than a peripheral people issue. It gives directors a shared language and reinforces the importance of integrated, triangulated insight rather than isolated functional reporting.

The world boards govern in is genuinely complex. The encouraging part is that the necessary components for effective culture governance already exist in most organisations. The pieces are often sitting in plain sight. They have simply never been assembled.

The missing piece is usually synthesis.

Most organisations already make active use of culture-relevant evidence: employee listening and engagement data, risk and conduct information, internal audit findings, incident trends, leader assessments, performance outcomes and customer feedback. The challenge has rarely been a lack of information. It is that each source of evidence is interpreted independently, with little focus on what those signals mean collectively for organisational culture.

Risk, People and Culture, Internal Audit and business leadership each bring a legitimate but partial lens to culture. Each reports through their own frame. No single function is accountable for what those lenses reveal collectively.

Without a way of reading those signals together, employee perception becomes the default proxy for culture, displacing the more important questions of how decisions get made, to what end, and how the work gets done.

Boards then receive competing narratives without a common frame for interpretation. People do not experience separate cultures. They experience one organisational environment shaped by governance settings, leadership, accountability, capability, systems, incentives and consequences. Those same settings influence how strategy is executed, how risk is managed, how issues are escalated and how decisions are made. Reporting that fragments this environment produces information. It does not produce insight.

Culture is an ecosystem, not a metric.

Culture is not an end in itself. The AICD paper is clear on this point: culture aligned with strategy and values drives performance, supports risk management and sustains long-term value. The governance question is therefore not simply "What is our culture?" It is "How do our organisational settings reinforce or undermine the strategy execution, risk management and conduct outcomes we are accountable for?"

The frame of Governance, Culture, Accountability and Remuneration (GCRA) remains one of the most useful tools available to boards for answering that question. Not because it adds data, but because it forces the data you already have to be interpreted together in service of the long-term value the board exists to protect and create. It treats culture as an ecosystem: a product of governance design, leadership behaviour, accountability structures, capability, enabling systems and the incentives or consequences organisations actually apply. Sentiment data can tell you how people feel within that ecosystem. It cannot tell you whether the ecosystem itself is driving the outcomes that matter.

Real organisations are not culturally uniform, and the expectation that they will arrive at a single culture misreads how culture works in practice. Recent empirical research from Cambridge University is instructive here. Drawing on interviews with senior executives, regulators and practitioners across UK financial services, the research found that most organisations contain not one culture but several coexisting types simultaneously, shaped by regulation, competition, workforce expectations, societal norms, professional identity and entrenched management practices. Multiple culture types coexist as a structural feature, not a transitional one.

There is no stable end-state to reach. Like any complex system, culture is in continuous motion. The governance task is not to resolve that complexity. It is to maintain sufficient sight of how subcultures interact, where they reinforce each other and where the friction between them is producing risk, conduct issues or execution failures.

Where current guidance falls short.

The AICD paper establishes the right principles for governing culture. It reinforces that culture oversight should be integrated, evidence-based and connected to organisational outcomes. It encourages boards to move beyond employee sentiment, isolated metrics and siloed reporting.

What it does not address is how organisations should operationalise those principles.

Most management systems are designed around vertical accountability: ownership and oversight sitting within functions and business units. What those systems rarely capture is the horizontal: the exposures that exist not within functions but in the space between them, where risk appetite meets commercial pressure, where compliance expectations meet sales incentives, where espoused values meet the realities of performance management. Those interactions are where culture shows up under pressure, and they are largely invisible to boards because management systems are rarely explicitly designed to surface them.

For most organisations, the challenge is not collecting information. It is connecting it. Risk, People and Culture, Internal Audit and business leadership each hold a legitimate part of the picture. Each function produces reporting. Each does so through its own lens.

The result is that boards receive multiple perspectives on culture without a clear mechanism for understanding what they mean collectively. Governance forums are left to reconcile separate narratives, identify patterns and determine implications without a common frame or a single point of accountability for synthesis.

This is where culture governance frequently stalls. The constraint is not ambition. Boards generally understand what good culture oversight should achieve. The constraint is that no one owns the task of turning fragmented signals into an integrated assessment of organisational health, emerging risk and execution confidence.

Without that synthesis, culture remains a reporting exercise rather than a governance one.

Closing the gap.

Closing the gap does not require more surveys, more dashboards or a complex data architecture. It requires three relatively modest shifts.

First, establish clear accountability for synthesising culture-related signals rather than simply collecting them. This is an organisational design decision, not a reporting adjustment.

Second, provide governance forums with an integrated picture rather than sequential updates from separate functions. The GCRA frame is a practical tool for doing this, giving the board a structured way to ask whether organisational settings are reinforcing or undermining its strategy, risk and performance objectives, and whether the answer holds consistently across interdependent business units, geographies and functions.

Third, equip directors to interrogate that picture for what it reveals about organisational health, emerging risk and execution confidence. Receiving an integrated view is not enough if the board lacks the frame to question it effectively. This is a capability question as much as a process one.

APRA's 2025 Governance Review discussion paper, alongside emerging guidance from international regulators, signals a shift from demonstrating that governance processes exist to demonstrating that they produce appropriate outcomes. The question regulators are increasingly asking is not whether a board has a culture framework, but whether its oversight is actually working.

The organisations that have quietly closed this gap did not start over. They reorganised what they already had around a single, accountable point of synthesis.

The world is complex. Governing culture within it does not have to be.

Effective culture governance is ultimately demonstrated not by the quality of reporting boards receive, but by the decisions they make and the actions they take as a consequence.

Questions for Directors

1. If a serious conduct or compliance issue were forming right now, are we confident our current oversight would surface it before it became an incident, or only afterwards?
2. Could we show a regulator that our oversight of culture is producing the right outcomes, not just the right artefacts? If not, is that a reporting gap or a governance one?
3. When we discuss culture, are we examining how decisions get made and how work gets done across interdependent parts of the business, or primarily what people report when prompted?
4. Do we receive one integrated picture of culture, risk, conduct and performance, or separate updates we are left to reconcile ourselves?
5. Who owns the synthesis of those signals, and does that role sit at the right level with the authority to act on it?
6. What would it actually take to connect the evidence we already hold, and is that a simpler task than we have assumed?

A useful place to start is an honest conversation about what information already exists, how it is being connected, and whether it is giving the board the clarity it needs to govern culture, not just receive reports on it.