Leadership Behaviour Is The Real Policy

Policies sit in folders. Leadership sits in the room.

When a senior executive bends a rule, protects the wrong person, or turns a blind eye, everyone watching learns what truly matters. Not the code of conduct. Not the compliance framework.

The behaviour. That becomes the real policy, the one people follow, the one that shapes decisions under pressure, and the one that endures long after the document has been updated and filed away.

Every organisation has two policies.

1. The first is the written policy. It sets out the standards, expectations, and behaviours the organisation expects of its workforce.

2. The second is the behavioural policy. It is never formally documented, yet every employee understands it. It is shaped by the daily decisions leaders make, the behaviours they reward, the issues they ignore, and the standards they choose to enforce.

When the two align, trust grows. When they don't, employees stop following the written policy and start following the behavioural one instead.

Most organisations have policies. Far fewer have leaders willing to enforce them when doing so carries a cost, such as when a high performer needs to be held accountable, when an audit finding points upwards rather than downwards, or when protecting the organisation requires accepting personal discomfort rather than preserving relationships or reputations.

That gap between written policy and behavioural policy is where organisational exposure begins to increase.

This is what makes the issue difficult for boards to recognise. Policies create a sense of control and comfort.

But policies do not make decisions. Leaders do.

A manager who escalates a concerning pattern rather than protecting a relationship. A CISO who speaks honestly when the evidence contradicts the preferred narrative. An executive who accepts responsibility rather than blaming someone else.

These are the moments that define an organisation's culture far more than any document ever will.

The most significant insider risks rarely arise from missing policies. They emerge because people stop believing those policies will be applied consistently.

When employees see different rules for different people, they adjust their behaviour accordingly. They become less willing to challenge inappropriate conduct, less willing to report concerns, and less confident that accountability applies equally across the organisation.

Culture is not what organisations declare. It is what they tolerate.

Every leadership decision teaches the organisation something:

• When concerns are dismissed as overreactions, people learn to remain silent.

  
  

• When uncomfortable truths are softened to protect senior leaders, people learn that image matters more than integrity.

  
  

• When accountability stops at a particular level of seniority, everyone below that level understands exactly where the real boundaries exist.

Leadership behaviour is always communicating.

The question is whether it is reinforcing the written policy or quietly replacing it.

You cannot outsource leadership. You cannot automate culture. And you cannot build organisational resilience on a foundation where the rules apply differently depending on who a person is.

For boards, the question is not whether the organisation has the right policies. The better question is whether leadership behaviour consistently reflects those policies.

My questions to you are:

• What are your leaders modelling every day?

  
  

• Who feels safe enough to escalate concerns involving someone senior?

  
  

• What happens to people who do?
  

• What happens to those who choose not to?

Because policies tell people what is expected. Leadership behaviour tells people what is permitted.

Employees will always believe the second.