What do we mean when we talk about a “culture of compliance”? Intuitively, our first reaction is that we should define the concept of “culture.” Some will turn to formal international standards, such as ISO 37301: 2021, and look for a definition. Others, more pragmatic, will resort to the parameters they already know and will say: “it would be like an organizational culture, but restricted to the dimension of compliance.” Everyone, eventually, will point out “well, how do we measure this”, emphasizing the word “measure”. Also, the majority, due to training or due to haste, will apply data collection techniques such as an interview, without being certain about the aforementioned, asking obvious questions that, by the way, attract politically correct answers, including “set phrases”. Some will even apply questionnaires or small surveys with only closed questions, which can be almost naive.
On the other hand, those who are experienced might use indirect indicators such as: “know” the “code of conduct” of an organization. However, the above does not guarantee that they have internalized it, it only shows that they know its content. At a certain point, some feel that they are building a house out of jelly blocks, very crystalline but inconsistent. All of which should not be considered as an obstacle when trying to clarify the idea.
When trying to define culture, we can find a wide variety of terms that, as a matter of fact, determine different dimensions that must be analyzed. Culture, when conceptualized as meanings and understandings, where subjective aspects are emphasized (mental, ideational), as for example: “It is a set of knowledge (generally tacit) that the members of a community share”. Others add the material conditions in which these ideas develop, the conflict, or speak of “incompletely shared”, and so on.
If we focus on the international standard ISO 37301: 2021, it defines a culture of compliance as “Values, ethics, beliefs and conduct that exists throughout an organization and interacts with the structures and control systems of the organization to produce standards of behavior that lead to compliance ”. We have already seen the elements of beliefs and values, but in addition, the concept of “ethics” is added, which creates new problems when generating a definition (it is a code of conduct, morality, etc.). The international standard also uses the idea of ”behavior”, clearly with the purpose of measuring something (rescuing the behaviorist ideas). Certainly, consensus prevails over coherence.
Nevertheless, if we talk about “organizational culture”, we enter a similar debate as the previous one, for obvious reasons, but with the idea of ”operationalizing” as a concept of culture. A well-known definition by Schein (2010) on organizational culture speaks of “a pattern of shared basic assumptions learned by [an organization] as it solves its problems of external adaptation and internal integration, which has worked well enough to be considered valid, and, therefore, to be taught to new members as the correct way to perceive, think and feel in relation to these problems “. Making the analogy with compliance, as a subsection of the above, we would talk about the problem of adaptation to compliance or better said adaptation to the context (internal and external) that determines a particular compliance management system.
How do we measure a culture of compliance? Given the above and being strict with the methodology of scientific research, depending on the definition we adopt, we will determine which dimensions have to be analyzed. If we opt for a definition that incorporates subjective or material elements (for example: documents) or both, those dimensions will be more or less broad and will incorporate a variety of data collection techniques.
Without doing the homework for you and as a way to start the debate, we can sense that this issue should be approached by more qualitative perspectives. It should be noted that “operationalizing” is an idea more typical of quantitative approaches.