Compliance Theater: How to Tell If Your Culture of Compliance Is Real or Just Performed

Most compliance teams have sat through some version of this meeting. Training completion is at 98%. The Code of Conduct got a refresh last year. The CEO recorded a video about speaking up, and the hotline number is on every break room wall. By every visible measure, the program is working. Then someone asks whether employees would report misconduct if they saw it, and the response is “Well, sure! Why wouldn’t they? Right?”

That gap between what a program shows and the behavior and risk mitigation it produces has a name. Compliance theater is the practice of performing visible, check-the-box tasks to satisfy auditors or regulators without delivering real risk reduction. The activities look great on paper and would pass most reviews or audits. Too often, however, they don’t do much to change how people behave when no one is watching.

Other fields have their own versions of this. Greenwashing is the best known: a company markets a product, or itself, as more environmentally friendly than it is. Rainbow washing and ethics washing follow the same pattern with different subject matter. In each case the signal gets ahead of the substance.

For ethics and compliance teams, this creates a real problem. You need senior leaders on board and saying the right things. You need to meet regulatory expectations. You need to pass your audits. All of that work matters, but none of it tells you whether you’re building a culture of compliance or just staging a convincing show.

I want to be fair here. Some compliance theater is deliberate, and most people in this field have seen an example or two. Most of it isn’t. It comes from people working in good faith on programs that never get tested for impact. The intent is there. The impact may not be.

Where Compliance Theater Shows Up Most

In my experience, the parts of a program most likely to slide into compliance theater are the ones tied to culture. Speak-up campaigns, non-retaliation policies, and organizational justice initiatives top the list.

Nearly every organization runs a speak-up campaign now (and if yours doesn’t, it should). The campaign itself is rarely the problem. The trouble is what it asks of employees. Reporting misconduct means trusting compliance and business leaders. It means believing the reporting channel works, that an investigation will be fair, and that nobody will punish you for raising your hand. Training and communications can describe all of that. But do they make employees believe it?

These topics share a structural problem, too. Most employees never deal with senior leaders, the hotline, or the investigations team. When they do, the experience often feels like dropping a note into a black box. A report goes in. Months later, maybe, someone hears it was “addressed,” with no explanation of what that meant. From where the employee sits, a process that worked and a process that went nowhere look about the same.

Picture a warehouse supervisor who notices a colleague logging hours he didn’t work. She’s seen the posters and finished the training. She also remembers that the last person who complained about a shift lead was moved to nights a month later. Nobody ever said the two things were connected, and nobody said they weren’t. She keeps quiet. On paper, your speak-up program reached her. In practice, it lost to one story passed around the break room.

How does a good-faith speak-up program turn into compliance theater? Usually because nobody measures whether it’s working. Organizations track whether training was completed and whether the posters went up. They rarely ask whether employees trust the message or see it as corporate rhetoric to make the organization and its leaders look good. Without that answer, you have no way of knowing which one you’ve built.

Organizational justice runs into the same wall. Employees form opinions about whether discipline is fair from what they see and hear, and most of what they hear is rumor. If a top performer seems to get away with something a junior employee would be fired for, that perception spreads quickly. A policy promising consistent discipline doesn’t compete with a story like that unless employees have some reason to believe the policy over the rumor.

The Risk You’re Carrying

The risk that should worry you most is people-created risk. That’s the chance that employees, contractors, or third parties cause regulatory violations, legal penalties, or data breaches through their behavior, whether they mean to or not. This now includes AI risk. A generative AI tool with solid controls around it is still a liability if employees ignore those controls or find ways around them.

Why single out people-created risk in a conversation about compliance theater? Because a lot of other risk, financial or competitive, shrinks once you identify it and plan for it. A reserve fund or a contingency plan does real work whether or not anyone believes in it. People-created risk doesn’t behave that way. It depends entirely on what people do, inside your organization and across your third parties.

Putting the right words in your Code of Conduct won’t reduce it on its own. Neither will an anonymous hotline, a leadership message about integrity, or another round of speak-up training. Those are inputs, and they only count if they change what employees believe and how they act. A compliance program that never shifts beliefs or behavior is checking boxes.

This is why compliance culture deserves as much attention as policies and controls. Controls tell people what to do, and compliance culture decides whether they do it.

How to Tell Real From Performed

You find out by measuring. Specifically, you need to measure the strength of your compliance culture and compare it with a well-established benchmark. A handful of questions can get to the core of it, although the leading programs dive much deeper:

• What percentage of employees who observe suspected misconduct report it?
• Do employees fear retaliation for speaking up?
• Do they believe discipline is fair and applied consistently?
• Do they trust their manager to handle a concern well?

If your first reaction is “Of course our people trust the process—we’ve trained on this for years,” you’re in good company. I’ve heard that story many times. Organizations measuring their culture of compliance for the first time are often shocked by what comes back.

Ethisphere surveys conducted in 2024 and 2025, covering more than 1 million employee responses, found that only 52.4% of employees who observed potential misconduct reported it. Nearly half stayed quiet. Meanwhile, only 77.4% said they believe their organization enforces its non-retaliation policy. Put another way, more than one in five employees doubt their organization enforces one of its most important policies.

A benchmark gives those numbers meaning. A 60% reporting rate might feel low until you see it sits above the norm for your industry. A 75% score on non-retaliation might feel healthy…until you learn that the score lags behind your peers. Comparing your compliance culture with a reliable outside reference tells you where you stand and which gaps deserve attention first.

The 52.4% and 77.4% figures are averages across many organizations, including plenty with mature programs. Where would yours land? If you don’t know, you’re flying blind, and the completion rate on your training dashboard won’t tell you the full story.

So is your compliance program a true story of integrity, values, and culture? Or is it the next hit on Broadway?

Moving From Theater to Real Culture

There’s no single fix that works everywhere. At Ethisphere, we let the data point the way, and the right next step depends on the specific risks and opportunities inside each organization. A few principles still hold up across most programs.

Managers are often the key. Ethisphere data shows employees have more faith that their direct manager will behave ethically than that senior leadership will. Put that trust to work. A manager who talks about ethics and compliance with their own team, in their own words, carries credibility that a CEO video can’t match. Give managers talking points and real examples, then let them have the conversation their way.

Be as transparent as you can. When something goes wrong, say so. Employees have a keen eye for fakery, and hiding problems does more harm than good. If you run a culture or engagement survey, don’t bury the low-scoring questions. Talk about them openly and explain what you plan to do about them.

Share data where you can. The strongest programs share aggregate reporting data with employees. How many reports came in last year? What share were substantiated? What disciplinary outcomes are available beyond the familiar “up to and including termination”? Answers like these open the black box and show employees that a report leads somewhere.

Confidentiality matters, and you can’t share everything. Start small if needed, and consider publishing data on a lag.

Measure progress over time. Your first survey gives you a baseline. Measuring again tells you whether your work is making a difference. Pair surveys with focus groups and training feedback so you understand why the numbers moved, then let what you learn shape your action plans.

None of this means dropping the visible parts of your program. Keep the training and the leadership videos. Keep talking about speaking up. Then find out whether any of it is landing and be willing to change course when the answer is no. A real culture of compliance holds up when someone looks behind the curtain. It can take years to build and only weeks to undermine. Make sure you know whether your efforts are having the right impact.