When Governance Doesn’t Change Behaviour
An Australian parliamentary committee recently examined conduct in one of the country's most regulated environments. Codes of conduct exist. Behavioural standards are documented. Mechanisms for raising concerns are in place. Yet the inquiry heard accounts of intimidation, aggression, and disrespectful behaviour. A pattern.
The committee's response was instructive. It did not simply conclude that more rules were needed. It asked a harder question: If the rules already exist and the behaviour persists, what does that tell us about the environment in which those rules are expected to operate?
We Judge Governance by What Exists. Perhaps We Should Judge It by What Happens.
Most organisations assess the strength of their governance by what they can point to. Policies. Committees. Reporting mechanisms. Training programmes. Accountability structures. Audit findings. These things are important. They are necessary. But they are inputs, not outcomes.
If inappropriate behaviour continues despite those inputs, the governance has not failed to exist. It has failed to work as intended.
This is an important note that most organisations are reluctant to make. Acknowledging that governance exists is comfortable. Acknowledging that it is not producing the intended behavioural outcome is considerably less so.
It raises harder questions. Why are concerns not being raised? Why do people not feel safe challenging those in senior positions? Why do consequences appear to depend on influence or seniority? These questions do not have comfortable answers, and they cannot be resolved by writing another policy.
Governance that exists on paper but has little influence on behaviour risks becoming little more than documentation.
Where Insider Risk Enters the Conversation
Insider risk does not begin when someone steals information, commits fraud, or deliberately causes harm. It begins in the conditions that precede those moments.
What people observe around them shapes what they believe is acceptable. When poor behaviour is tolerated, particularly when it comes from people in positions of authority, it sends a signal to everyone watching. It signals that the rules apply selectively. That speaking up carries risk. That the organisation's stated values and its actual values are not the same.
Those signals matter because they affect trust, psychological safety, and the willingness to raise concerns. They affect how disengaged people become, how grievances develop, and whether those grievances find a legitimate outlet or accumulate quietly.
They can also change how people understand trust. If employees see that position or influence affects how standards are applied, trust in the organisation itself can begin to erode.
This is where insider-risk practitioners need to look beyond the individual. The question is not simply what someone might do, but what conditions around them could make harm easier, more likely, or harder to detect.
A culture in which poor behaviour is normalised, accountability is inconsistently applied, and people do not feel safe raising concerns may already be creating greater organisational exposure, whether leaders recognise it or not.
The Measure of Governance
The parliamentary example is useful precisely because it is not a private- sector story or a niche-industry problem. It is a highly visible, heavily regulated environment in which the gap between documented standards and actual behaviour has been placed under public scrutiny.
That gap exists in many organisations. The difference is that most of them have not had an inquiry to surface it.
Leaders who are serious about governance need to ask not only what their organisation has in place but also what it is prepared to accept. Are concerns genuinely heard, or are they quietly managed? Are consequences applied consistently, or do they vary with seniority? Do people feel safe raising issues, or have they learned that it is not worth the risk?
The answers to those questions describe an organisation's real governance culture, not the documented one. The lived one.