By Atswei Mensah
for the 2025 Risky Women Writing Competition, presented in partnership with Ocorian
In a world obsessed with compliance checklists and policies, it’s crazy how often companies mistake paper for culture. After all, what’s more effective for changing behavior: a thick manual or a compelling story? When it comes to integrity, it seems storytelling might just be the secret sauce we’ve all overlooked.
A leading retail bank had a code of conduct, and a global carmaker had an ethics manual. On paper, both looked impeccable. Yet one ended up creating millions of fake customer accounts, and the other built software to cheat emissions tests. These weren’t failures of policy; they were failures of culture. Compliance programs collapse when they are reduced to checklists. The real safeguard is not the paperwork on the shelf, but the culture that lives in the organization.
And here’s the uncomfortable truth: culture can’t be built with more audits and forms. However, it can be influenced by storytelling.
The Comfort of Checklists
It’s easy to see why companies default to box-ticking. Checklists are measurable. Manuals can be copied. Audits generate binders of evidence to show regulators. Everyone looks safe when the forms are completed.
But this safety is an illusion. Policies don’t shape behaviour; people do. And when policies clash with the unwritten rules of “how things are done here,” culture always wins.
Culture Always Wins
The retail bank’s scandal didn’t erupt because employees didn’t know the rules. It happened because the culture rewarded sales numbers over integrity. The car manufacturer didn’t lack a code of ethics; it lacked a culture that prioritized honesty over market share.
Culture is simply what people do when no one is watching. And when culture runs against compliance, no manual in the world can save you.
When I Got It Wrong
I learned this lesson the hard way. Early in my career, I was asked to present to a group of new associates about risk and compliance fundamentals. I prepared diligently: pages of definitions, regulatory frameworks, and technical slides. I spoke about due diligence, reporting requirements, and monitoring processes. By the second slide, I could see their eyes glaze over. They weren’t misbehaving; they weren’t connecting.
I was teaching rules, not meaning.
Looking back, I realize what was missing: a story. Instead of a wall of text about anti-bribery regulations, I could have told them about the company that lost its license in a single country because of one bribe. Instead of explaining due diligence as a checklist, I could have shared how a vendor scandal sank a global brand’s reputation. A single story would have done more to anchor those concepts than my thirty slides ever could.
That moment stays with me because it mirrors the larger problem in compliance. We assume knowledge transfers through policies and manuals. But people don’t learn rules; they learn stories. And stories are what shape culture.
Storytelling as a Compliance Tool
Storytelling is one of the most underused levers in governance and risk. It’s not soft. It’s not fluffy. It’s how people make sense of risk.
- Stories make risk real. A phishing policy is abstract. A story about the CFO who clicked a malicious link and triggered a $10 million loss makes cybersecurity unforgettable.
- Stories drive empathy. Reading a whistleblower policy is dry. Hearing the story of someone who spoke up and what it cost them inspires courage.
- Stories improve retention. Employees forget bullet points. They repeat stories to each other at lunch. That’s how culture spreads.
- Stories humanize compliance. Leaders who share their own mistakes signal vulnerability and authenticity. That honesty reinforces trust in ways no policy ever could.
The Limits of Storytelling
Of course, storytelling isn’t a silver bullet. Stories can oversimplify complex risks or exaggerate the wrong threats. They can even be manipulative if used cynically. Regulators and boards still need data, evidence, and metrics to test effectiveness.
But paired with hard controls, storytelling becomes a cultural amplifier. It takes the technical language of risk and translates it into lived experience. It’s the bridge between rules and behaviour.
The Way Forward
If compliance culture is truly the backbone of risk management, then GRC leaders must start designing for stories, not just policies.
- Replace dry e-learning modules with narrative-driven case studies that show cause and effect.
- Build an internal “story bank” of compliance wins and failures, drawn from the company’s own history or industry examples.
- Encourage leaders to tell personal stories of ethical choices, including mistakes, to normalize integrity.
- Push regulators and boards to ask not only, “What policies do you have?” but “What stories do your employees tell about your culture?”
- Because in the end, the stories people carry, and repeat define what “doing the right thing” really means in an organization.
Conclusion
Compliance without culture is risk theatre. Checklists and manuals create the appearance of control, but when culture pulls in the opposite direction, the façade will always crumble.
The good news is that culture isn’t built by accident. It’s shaped by the stories we tell and retell. Policies can be copied. Stories become culture. And culture is the only safeguard that lasts.