What 15 years of governance work taught me
Over the years, I’ve worked with organisations with sophisticated policies, detailed governance frameworks and clearly documented expectations. And I’ve learned something that sounds obvious, but is surprisingly easy to forget:
Having a policy and having a culture are not the same thing.
A policy can tell people what an organisation expects. Culture tells people what actually happens when reality becomes uncomfortable.
That distinction matters.
Because organisations rarely discover the strength of their governance when everything is going according to plan. They discover it when someone needs to challenge a senior decision. When an employee notices something that doesn’t feel right. When commercial pressure conflicts with a stated principle. When a mistake needs to be admitted. Or when raising an issue would be easier to avoid than confront. In those moments, people don't simply ask themselves, “What does the policy say?” They ask a much more human question:
“What will happen if I do this?”
Policies establish expectations. Behaviour establishes credibility.
Policies matter. They establish boundaries, responsibilities and standards. In regulated environments especially, clear policies and controls are fundamental. But the existence of a policy tells me relatively little about whether it has become part of the organisation. For that, I look at behaviour.
What happens when someone challenges a decision?
How does a manager respond when an employee admits a mistake?
Are concerns welcomed when they are raised early, or questioned until people learn to remain silent?
Do senior leaders hold themselves to the same standards they expect from everybody else?
And perhaps most importantly: What behaviours does the organisation tolerate when performance is under pressure?
Because that is often where the real culture becomes visible.
People learn from what happens around them
Employees are constantly interpreting organisational signals. Not necessarily consciously. They watch what gets rewarded. They notice what gets ignored. They see who gets promoted. They remember what happened to the last person who challenged a decision. They notice whether leaders ask difficult questions or avoid them. And they quickly learn the difference between what the organisation says matters and what actually matters in practice.
That is why culture cannot simply be communicated into existence.
You can launch values. You can introduce policies. You can run training. You can put expectations into performance frameworks. All of those things have a role. But people ultimately believe what they repeatedly experience.
The most dangerous gap can be the one nobody sees
One of the challenges with governance is that organisations can become very good at demonstrating that the right structures exist. Policies have been approved. Training has been completed. Committees have met. Reports have been submitted. Controls have been documented. From a distance, everything can appear reassuring. But there is another question I think leaders need to ask:
What is actually happening when nobody is looking?
Are people following the process because they understand why it matters, or because they know they are being monitored?
Do employees genuinely feel able to escalate concerns?
Are managers addressing difficult issues or quietly working around them?
Are policies helping people make better decisions, or have they become documents people acknowledge and then return to business as usual?
This is where the gap between governance on paper and governance in practice becomes important.
Culture is an operating issue
I increasingly think organisations make a mistake when they treat culture as something separate from governance and operations. Culture influences how quickly problems are raised. It affects how decisions are challenged. It shapes whether accountability is accepted or avoided. It determines whether information travels honestly through the organisation. And it influences what happens when formal rules collide with commercial pressure or operational reality.
Those aren't simply “people issues.”
They are operational issues.
They are risk issues.
And, in many organisations, they can become regulatory issues.
Leadership closes-or widens-the gap
After years working around governance, transformation and complex organisations, I have become less interested in what leaders say about culture and more interested in what they consistently reinforce. Small leadership behaviours matter.
How do you react when somebody brings you bad news?
Do you become defensive, or curious?
Do you reward the person who identifies a problem early, or make them regret raising it?
Do you challenge high performers when their behaviour falls below the organisation's standards?
Do you make exceptions when commercial pressure increases?
Because every one of those moments teaches the organisation something. Culture is being created whether leaders deliberately create it or not.
The question I would ask
If I wanted to understand an organisation's culture, I wouldn't start by reading its values statement. And I wouldn't stop at its policies. I would spend time observing what happens when something becomes difficult. I would ask employees what happens when they disagree. I would look at how problems move through the organisation. I would examine what behaviour gets rewarded, tolerated and challenged. And I would compare those observations with what the organisation says it believes.
Because the distance between those two things tells you something important.
A strong organisation needs policies.
It needs controls.
It needs governance.
But those things become powerful only when they are reflected in everyday behaviour. Perhaps that is the real test of organisational culture:
If we removed the policy document from the room, would people still know what the right thing to do was—and feel able to do it?
That, to me, is when governance has moved beyond compliance. It has become culture.
Written by Nghia Clulee