Inside are dozens of carefully written policies.

• Consumer Duty.
• Complaints.
• Governance.
• Financial Crime.
• Data Protection.

On paper, everything appears to be in place.

But when I start speaking to the people responsible for delivering those policies every day, I often hear something very different.

Many have never read them.

Some don't know they exist.

Others have never heard of Consumer Duty or don't understand how it applies to their role.

At that point, the question is no longer whether the business has the right policies.

It's whether those policies are actually achieving anything.

Policies Don't Create Culture

A policy is only a document.

• It doesn't protect customers.
• It doesn't improve decision-making.
• It doesn't prevent foreseeable harm.

People do.

Policies should provide guidance, consistency and accountability, but they only become valuable when they influence how people behave every day.

If employees don't understand them, they can't apply them.

If managers don't reinforce them, they won't become part of the culture.

If the Board doesn't understand them, it can't provide effective oversight.

Regulation Shouldn't Live in a Folder.

Too often, compliance becomes something that exists separately from the business.

Policies are written.

Training is delivered once a year.

Documents are updated when regulation changes.

Then they sit untouched until the next audit.

Good governance doesn't work like that.

Regulation should be visible in everyday conversations.

• It should influence recruitment.
• It should shape product design.
• It should guide customer interactions.
• It should be reflected in Management Information, Board discussions and performance reviews.

When regulation becomes part of everyday business, compliance stops being a separate function.

It becomes part of the organisation's identity.

Everyone Has a Role

Consumer Duty isn't owned by Compliance.

Governance isn't owned by the Board.

Risk isn't owned by Internal Audit.

• Every employee contributes to customer outcomes.
• Every conversation with a customer.
• Every decision.
• Every process.
• Every complaint.
• Every improvement.

Each plays a role in building trust.

That means every person within the organisation should understand:

• What the business stands for.
• How their role contributes to good customer outcomes.
• Why the organisation has chosen to operate the way it does.
• When something doesn't feel right and how to raise it.

When everyone understands their role, governance becomes consistent rather than dependent on one department.

The Board Should Lead by Example

Embedding regulation starts with leadership.

The Board shouldn't simply approve policies.

• It should understand them.
• Challenge them.
• Question whether they are working.
• Ask whether they reflect the way the business operates today.

Culture is shaped by what leaders prioritise.

If governance is only discussed before an FCA visit, employees quickly understand where it sits within the organisation's priorities.

If governance is discussed every day, it becomes part of how the business thinks.

Living the Principles

The most successful businesses rarely talk about compliance all day.

They talk about customers.

• Doing the right thing.
• Learning from mistakes.
• Improving processes.
• Supporting colleagues.
• Delivering quality.

Those conversations naturally reflect good governance because regulation has become embedded within the culture rather than existing as a separate obligation.

That is where businesses should aspire to be.

Not simply having the right policies.

But creating an organisation where those policies describe what people already do.

Making Regulation Make Sense

The strongest organisations don't prove compliance by showing a folder full of policies. They demonstrate it through the decisions their people make every day. When every employee understands the organisation's values, their responsibilities and what good customer outcomes look like, regulation becomes more than a requirement—it becomes part of the culture.