Compliance has never been more visible, yet misconduct has not disappeared. That tension should prompt leaders to ask a more demanding question: do their compliance programmes lead to positive change in behaviour, or do they simply prove that compliance activity took place?
Regulatory compliance is often treated as one of the clearest indicators of good corporate governance. Across the public and private sectors, organisations invest significant resources in compliance frameworks, policies, mandatory training, registers, reporting processes, and internal controls. These measures are designed to minimise legal exposure, satisfy regulatory obligations, and promote accountability.
Yet despite increasingly sophisticated compliance programmes, organisational misconduct remains stubbornly persistent. Fraud, corruption, procurement irregularities, data breaches, insider misconduct, and cybercrime continue to affect organisations that, on paper, appear to have mature governance and compliance structures.
This creates a governance paradox: if organisations are investing more than ever in compliance, why does misconduct continue to occur so regularly?
The answer may not lie in the absence of compliance, but in how organisations define, measure, and test whether compliance is working. The real test is not whether policies, controls, and reporting processes exist; it is whether those mechanisms shape decisions, deter misconduct, and make ethical conduct the normal operating standard.
This article argues that compliance effectiveness should be assessed through outcomes rather than activity alone, and that boards and leadership teams should test whether compliance programmes are reducing misconduct, improving accountability, and strengthening ethical culture.
The Evolution of Compliance
Over the past two decades, compliance has evolved considerably. Once viewed primarily as a legal function responsible for ensuring adherence to legislation, compliance has become an integral component of enterprise governance and risk management. Legislative developments, heightened regulatory scrutiny, and increasing stakeholder expectations have elevated compliance from an operational obligation to a strategic governance function.
South Africa’s regulatory landscape reflects this evolution. The Constitution, the Companies Act 71 of 2008, the Prevention and Combating of Corrupt Activities Act 12 of 2004 (“PRECCA”), the Promotion of Access to Information Act 2 of 2000,the Protection of Personal Information Act 4 of 2013, the Cybercrimes Act 19 of 2020, and sector-specific frameworks collectively impose obligations aimed at promoting accountability, transparency, responsible corporate conduct, and public confidence.
Corporate governance frameworks have developed in parallel. King V encourages organisations to adopt an integrated approach to governance, while international standards such as ISO 37301 (Compliance Management Systems) provide structured methodologies for identifying, managing, and monitoring compliance risks.
These developments are valuable and necessary. No organisation can govern responsibly while disregarding its legal and regulatory obligations. The issue is not whether compliance matters, but whether compliance programmes are producing the behavioural and governance outcomes they are intended to achieve.
Compliance Activity Is Not the Same as Compliance Effectiveness
One of the most significant misconceptions within modern governance is the assumption that compliance activity necessarily translates into compliance effectiveness.
Many organisations assess compliance maturity through administrative outputs: policies approved, employees trained, declarations submitted, audits completed, risk registers maintained, and regulatory reports filed. These indicators demonstrate activity and may satisfy important regulatory requirements, but they do not necessarily show that organisational behaviour has changed.
An organisation may achieve full participation in mandatory compliance training while continuing to experience procurement irregularities. It may maintain comprehensive anti-fraud policies while investigations continue to uncover management override of controls. It may satisfy every reporting obligation imposed by regulators while simultaneously experiencing repeated data privacy breaches or conflicts of interest.
These examples should not be interpreted as failures of compliance. Rather, they expose the limitations of relying exclusively on administrative indicators to assess whether a compliance programme is genuinely effective.
Compliance should not merely be evaluated by whether required activities have been completed. It should also be evaluated by whether those activities are influencing organisational conduct and reducing governance risk.
Measuring What Matters
King V offers an important perspective because it adopts an outcomes-based approach. It recognises that governance should not be assessed solely by the existence of policies, committees, or reporting structures, but by whether those mechanisms produce ethical culture, effective control, legitimacy, and sustainable performance.
This distinction is significant because it challenges organisations to reconsider what they measure.
Many compliance programmes still prioritise implementation metrics over effectiveness metrics. Training attendance, policy acknowledgements, regulatory reporting, and audit completion rates are relatively easy to quantify. Measuring whether compliance influences decision-making, encourages accountability, strengthens resilience, or reduces misconduct is more complex, but it is also more meaningful. These are, after all, the outcomes that matter.
A compliance framework should not merely exist to demonstrate regulatory diligence. Its purpose is to influence behaviour, strengthen governance, and reduce organisational risk.
The Risk of “Compliance Theatre”
As regulatory obligations continue to expand, organisations face an increasing risk of compliance theatre: the appearance of robust compliance without corresponding improvements in organisational conduct.
- Compliance becomes performative rather than transformative.
- Policies are developed because regulators expect them.
- Training is completed because annual plans require it.
- Declarations are signed because governance processes demand them.
- Registers are maintained because audit committees require oversight.
While each of these activities remains necessary, they can become disconnected from their intended purpose. Compliance risks becoming an administrative exercise focused on demonstrating diligence rather than strengthening organisational integrity.
This is particularly evident following major organisational failures. Investigations frequently reveal that policies existed, compliance frameworks had been implemented, training had been conducted, and governance structures were formally established. The question therefore shifts from whether organisations complied with procedural requirements to whether those compliance mechanisms were capable of influencing organisational behaviour in the first place.
A Governance Challenge for Boards and Leadership
This should concern boards as much as compliance practitioners.
Boards routinely receive reports detailing policy implementation, training statistics, regulatory submissions, and audit findings. These reports provide assurance that compliance activities are taking place. They do not necessarily provide assurance that compliance programmes are achieving their intended purpose.
Perhaps boards should begin asking different questions.
- Has our compliance programme reduced repeat incidents?
- Are employees raising concerns with confidence?
- Have policy interventions influenced decision-making?
- Which compliance initiatives demonstrably reduce organisational risk?
- Can we evidence behavioural change rather than procedural completion?
These questions move governance beyond administrative oversight and towards evaluating organisational effectiveness.
Rethinking Compliance
None of this diminishes the importance of regulatory compliance. On the contrary, compliance remains an indispensable pillar of good governance and an essential mechanism for promoting accountability and protecting organisations from legal and regulatory risk.
However, organisations should resist merely equating compliance with organisational integrity or assuming that compliance activity is synonymous with compliance effectiveness.
The future of governance will not simply depend on developing increasingly sophisticated compliance frameworks, but on understanding whether those frameworks are genuinely influencing organisational behaviour and contributing to sustainable governance outcomes.
Perhaps the question boards, executives, and governance professionals should be asking is no longer, “Are we compliant?” Instead, the more meaningful question may be, “How do we know our compliance programme is actually working?”
At Motsoeneng Bill Attorneys, we assist public and private sector organisations in strengthening the effectiveness of their compliance and governance frameworks through strategic legal, governance, fraud risk, and advisory services. Our work supports organisations in moving beyond compliance as a regulatory obligation and towards compliance as a strategic enabler of good governance, accountability, and organisational resilience.
