By Kate Miller
for the 2025 Risky Women Writing Competition, presented in partnership with Ocorian
In financial services, it’s usually the big scandals that grab headlines, while the real quiet chaos of minor policy violations hums away unnoticed. After all, who would think that late training completions and missed attestations could chip away at trust? It seems even small missteps can have a surprisingly loud impact.
When things go wrong in financial services and the average punter hears about it; the event is usually fairly significant. Risk and Compliance professionals are acutely aware of the interest these ‘high impact, low frequency’ events generate. These are the scandals that make headlines, erode public trust (Toms, S. 2019) and usually drive sweeping regulatory responses.
Yet in most organisations, the lived reality of working in and around Conduct (and related) risks is often far less dramatic, but no less significant. What we see are the small policy deviations, missed attestations, late training completions, or minor process work arounds – and we see these time and time again.
We also know that individually these low-level conduct events rarely escalate into crises and they are usually not the result of malice or ill intent. Yet, collectively they sustain the ‘noise’ that can burden first and second line risk and control teams. These events frustrate employees and managers and will chip away at trust between teams that organistions depend on (Al Hawari, M. (2012). Many of these events stem from, not willful misconduct, but from poor control design – processes and policies that make it difficult for people to do the right thing, to make the right choice in the key moment.
I observe this in my work all the time and wanted to explore why these patterns matter and how behavioural science offers practical tools to reduce the noise. Utilising behavioural re-design we can not only improve the effectiveness of controls focused on conduct, we can work on strengthening reciprocity (Cox, J.C. 2004) between firms and employees so that people don’t feel they are being tripped up or punitively treated.
Getting distracted; high frequency, low impact control noise
There is a principle in Risk Management known as the Pareto principle – being – a small number of risks drive the majority of impact within organisations. Considering the inverse can also be true; where a large / frequent occurrence of small / low impact events drive a disproportionate amount of distraction.
We’re talking;
- Employees regularly missing mandatory training deadlines because reminders are poorly timed or no reminders are provided to employees
- Repeated exceptions on policy attestations that feel disconnected from day-to-day work
- Minor breaches of data handling due to overly complex procedures
Each instance is immaterial in isolation, yet these events require investigation, reporting and likely some form of remediation. First and second line Risk and Compliance employees get weighed down by mountains of these events, diluting focus on the higher-order risks, behaviours and decision making. For employees they end up experiencing controls as obstacles rather than enablers, which fosters only irritation and limits accountability.
The underlying issue here is not a systemic lack of employee integrity, it is a poorly designed control environment. When controls are misaligned with human behaviour, friction (Sunstein, C.R. 2022) is created. This causes people to take shortcuts, workarounds or it creates passive non-compliance – not because people want to break the rules, but they find the rules are easier to bend than follow.
Counting the costs; poor control design and its impact on culture
The consequences of poor control design goes beyond operational efficiency, controls that fail to be behaviourally informed;
- Erode trust (Al Hawari, M. 2012). as employees perceive them to be symbolic or a ‘tick box’ exercise rather than the meaningful safeguards they were intended to be – this undermines how employees think and feel about Risk & Compliance within their organisation.
- Create false signals high volumes of low-level breaches can mask emerging higher-risk patterns, creating noise that muffles or obscures red flags.
- Reduce reciprocity (Cox, J.C. 2004) if employees feel that their organisation does not respect their time or judgement they are less inclined to invest discretionary effort in ‘going the extra mile’ to be compliant.
Cultural fatigue (Meneses, R., Aguiar, J. 2025) a sustained focus on trivial breaches risk desensitising teams to be on guard for more serious and sophisticated misconduct.
Rather than trivial, the high volume of low-level events represent systemic control design weakness, and if left unchecked can degrade operational resilience and an organisation’s ethical culture.
How Behavioural Science can help
Behavioural Science can offer an alternative lens for rethinking controls and control design. We think of these instances in terms of the interactions between humans and systems. By applying our understanding of how people actually behave (vs the way that we expect them to behave) we can redesign the environment to make compliance easier, more intuitive and as a result more meaningful (Bailey, C. & Madden, A. 2016).
We can;
- Reducing friction and simplify (Sunstein, C.R. 2022) – people will follow rules when the path of least resistance aligns with the desired behaviour. Removing redundant steps and using default options** can reduce error rates
- Ensure there are timely prompts and nudges (Sunstein, C.R. 2015) – behaviour is influenced by context and timing – well timed reminders to complete training (e.g. during a natural downtime vs peak workload)
- Salience & framing (Bordalo, P., Gennaioli, N., & Schleifer, A. 2022) – reinforcing the importance of the controls relative to protecting clients or colleagues are likely to be more motivating than generic Compliance language.
When organisations design controls that respect employee’s time, judgement and cognitive load, it signals that there is a culture of trust. In return, employees are more likely to reciprocate with compliant behaviours and ethical decision making.
References
1. Al Hawari, M. (2012). A Comparative Study of Trust as a Knowledge Sharing Enabler and its Influence on Organisational Culture. Journal of Information & Knowledge Management, 11(02) https://doi.org/10.1142/S0219649212500141
2. Bailey, C., & Madden, A. (2016) What Makes Work Meaningful – Or Meaningless. MIT Sloan Review June 2016 https://sloanreview.mit.edu/article/what-makes-work-meaningful-or-meaningless
3. Bordalo, P., Gennaioli, N., & Schleifer, A. (2022). Salience. Annual Review of Economics, 14. 521 – 544 https://doi.org/10.1146/annurev-economics-051520-011616
4. Cox, J.C., (2004) How to Identify Trust and Reciprocity. Games and Economic Behavior, Volume 46, Issue 2, pp 260-281, https://doi.org/10.1016/S0899-8256(03)00119-2
5. Meneses, R., Aguiar, J. (2025). Organisational Culture and Its Impact on Employee Engagement. In: Vrontis, D., Thrassou, A., Efthymiou, L., Weber, Y., Shams, S.M.R., Tsoukatos, E. (eds) Business in a Turbulent Era, Volume I. Palgrave Studies in Cross-disciplinary Business Research, In Association with EuroMed Academy of Business. Palgrave Macmillan, Cham.
https://doi.org/10.1007/978-3-031-89798-6_7
6. Sunstein, C.R. (2022) Sludge Audits. Behavioural Public Policy, 6(4) pp 654 – 673 https://doi.org/10.1017/bpp.2019.32
7. Sunstein, C.R. (2015) Nudging and Choice Architecture: Ethical Considerations (January 17, 2015). Yale Journal on Regulation. Harvard Public Law: https://ssrn.com/abstract=2551264
8. Toms, S. (2019). Financial scandals: a historical overview. Accounting and Business Research, 49(5), 477–499. https://doi.org/10.1080/00014788.2019.1610591