Governing Culture in a Complex World

Governing Culture: The Operationalisation Problem

Boards broadly accept that culture is their responsibility. The AICD's Governing Culture in a Complex World reinforces this well. What the paper, and most governance frameworks before it, still cannot fully answer is the harder question:

Why does culture reporting so rarely produce actionable insight?

The paper reinforces that organisational culture is not a peripheral people issue. It influences strategy, risk-taking, organisational performance, and long-term stakeholder confidence. It also provides Directors with a practical language for discussing culture and their role in overseeing it.

Perhaps its most useful contribution is Principle 4, which highlights the need for Boards to receive integrated and triangulated insight into culture, rather than relying on isolated reporting from individual functions. This reflects an important shift away from viewing culture through a single lens and towards understanding it as something assessed through multiple sources of evidence and perspective.

For many organisations, however, recognising that culture matters is no longer the challenge. The challenge is operationalising culture governance in a way that produces reliable insight and supports better decisions.

The unresolved question

One of the more interesting aspects of the paper is what it does not fully resolve.

The paper appropriately recognises both organisational culture and risk culture. However, it stops short of explaining how organisations should reconcile the relationship between the two in practice.

Over the past decade, many regulated organisations developed dedicated risk culture frameworks in response to increasing supervisory attention and prudential expectations. In many cases, this improved focus on conduct, accountability, and risk management practices. It also introduced a degree of structural complexity.

Risk functions assessed risk culture. People & Culture functions assessed engagement and organisational culture. Internal Audit reviewed culture drivers of risk and controls. Business leaders managed strategic priorities, risk, and operational performance. Each function often developed its own methodologies, reporting approaches, and governance processes.

Boards ended up receiving more culture reporting than ever before, and less insight.

Boards that continue to receive risk culture reporting and organisational culture reporting as separate streams are not getting more coverage. They are getting competing narratives with no common framework for resolution.

The practical reality is that people do not experience separate cultures. They experience governance settings, leadership, accountabilities, capabilities, systems, incentives and consequences as part of a single organisational environment. Those same settings influence how strategy is executed; how risk is taken, how risk and compliance are managed; how issues are escalated; and how decisions are made.

The distinction between culture and risk culture can remain useful for certain governance and regulatory purposes. From an organisational perspective, however, both are shaped by the same underlying culture architecture.

International research confirms the universal challenge

Recent empirical research from Cambridge University suggests these challenges are not unique to Australia. Drawing on interviews with senior executives, regulators, and industry practitioners across UK financial services, the research found many organisations remain caught between competing cultural archetypes. Traditional commercial and performance-oriented norms continue to coexist alongside increasing expectations regarding accountability, conduct, stakeholder responsibility, and governance.

Rather than identifying a stable end-state, the research suggests many organisations continue to operate with competing subcultures, inconsistent behavioural expectations, and unresolved tensions between commercial objectives and external obligations.

This observation is directly relevant to Boards. If multiple cultural influences are operating simultaneously within the same organisation, and the evidence suggests they are, then monitoring values alignment or engagement trends will not surface the tensions that produce serious incidents. Directors need to understand whether organisational settings are aligned, where tensions exist, and how those tensions are influencing outcomes.

Culture is rarely a standalone issue. It is a reflection of how governance, leadership, accountability, capability, enablement, and reinforcement interact in practice. When these elements become misaligned, organisations observe the symptoms through conduct issues, execution failures, compliance concerns, or regulatory intervention - often well after the underlying conditions have taken hold.

The operationalisation challenge

This is where the AICD paper is both useful and incomplete.

The paper establishes a clear expectation that culture oversight should be integrated, evidence-based, and connected to organisational outcomes. It encourages Boards to move beyond employee sentiment, isolated metrics, and siloed reporting, and reinforces the need for culture insights to be triangulated across multiple information sources. But it provides limited guidance on how organisations should operationalise those expectations.

Most organisations already possess extensive culture-related data. Employee listening, risk information, assurance findings, incident trends, leader 360s, performance outcomes, and customer feedback can all provide insight into culture. The challenge is rarely a lack of information. The challenge is determining what information matters, how it should be interpreted, and how it should inform governance decisions.

The problem, in most cases, is that no one owns the synthesis.

Functions continue to report independently. Boards continue to receive sequential updates rather than an integrated picture. And the analytical capability needed to connect culture signals to governance decisions, to read risk data, conduct data, performance data, and culture data together, remains underdeveloped in most organisations.

GCRA as an integrated lens

The GCRA framework of Governance, Culture, Accountability and Remuneration remains one of the more useful tools available to Boards precisely because it resists functional fragmentation. Rather than treating culture as a standalone domain, GCRA examines how these elements interact to produce outcomes. The question it forces is not "what is our culture?" but "how do our governance settings, accountability structures, and incentive systems reinforce or undermine the culture we say we want?"

That framing is more productive than either risk culture or organisational culture approaches in isolation, not because it introduces new data, but because it demands that the available data be read together. It is an interdependency lens, not an additional reporting layer. And it points directly to the capability gap most organisations need to close.

The next challenge is organisational capability

The next evolution of culture governance is unlikely to be characterised by more surveys, more dashboards, or more reporting. It is more likely to involve the deliberate development of an integrated capability. One that connects culture insight to governance decisions across strategy, risk, compliance, and performance.

That means establishing clear accountability for the synthesis of culture-related signals, not just their collection. It means governance forums that receive a coherent, cross-functional picture rather than sequential updates from separate functions. And it means Boards that are equipped to interrogate that picture to understand what the combined signals reveal about organisational health, emerging risk, and execution confidence.

Governance. Leadership. Accountability. Capability. Enablement. Reinforcement. These are not independent variables. Together, they shape the behaviours, decisions, and patterns that emerge in practice. Effective culture governance requires the capability to understand how they are operating, not in isolation, but as a system.

Regulators are moving in this direction. APRA's 2025 Governance Review discussion paper, alongside guidance from the ECB, FCA, OSFI and RBNZ/FMA, signals a consistent shift: from demonstrating procedural compliance to demonstrating that governance settings produce appropriate outcomes. The capability to make that demonstration is not a reporting upgrade. It is a governance maturity question, and the following are a good place to start.

Questions for directors

1. When culture-related concerns are identified, do we have sufficient insight to understand the underlying drivers, or are we primarily responding to symptoms?
2. Are we receiving integrated insight across People & Culture, Risk, Internal Audit, and operational functions, or competing perspectives that require reconciliation?
3. Who in our organisation owns the synthesis of culture, risk, conduct, and performance signals; and does that accountability sit at the right level?
4. Does our current culture governance approach help us understand how culture is influencing organisational outcomes, or does it primarily describe behavioural themes?
5. If a regulator asked us to demonstrate that our oversight of culture produces appropriate outcomes, not just appropriate processes, could we? And if the answer is no, is that a reporting problem or a governance one?