The Human Risk Podcast

Who determines what 'good' Compliance actually looks like?  The obvious answer is regulators (and in some jurisdictions) prosecutors. But what if it were the regulated Firms themselves?  That's the idea behind purpose-driven compliance, which I'm exploring on this episode. Episode Summary To explore this, I'm joined by Veronica Root Martinez, Professor of Law at Duke University School of Law, to explore a deceptively simple but unsettling idea: 100% compliance is impossible. While we often behave as though perfect compliance is the goal — and in some safety-critical domains it must be — most organisational compliance involves humans. And humans make mistakes. Things get missed. Context changes. Stuff goes wrong. So if perfection isn’t realistic, the real question becomes: how do organisations decide what really matters? The traditional answer has been to look outward — to regulators, enforcement authorities, and in some jurisdictions (particularly the US), prosecutors. Their priorities, expressed through sentencing guidelines, enforcement actions, and settlements, end up defining what “good” compliance looks like. Veronica challenges that logic. She argues that this gets things the wrong way round. Instead of letting enforcement priorities dictate behaviour, she makes the case for purpose-driven compliance — where organisations set their own priorities based on their purpose, values, and actual risks, rather than chasing shifting regulatory expectations. Along the way, the conversation explores culture, human judgment, psychological safety, technology, experimentation, and why “best practice” can sometimes make things worse rather than better. This episode is for anyone who writes rules, enforces them — or simply has to live under them. Guest Biography Veronica Root Martinez is a Professor of Law at Duke University School of Law, where she researches corporate compliance, ethics, and organisational culture. Her work on purpose-driven compliance challenges enforcement-led models and explores how organisations can set priorities based on their own purpose, values, and risks. Before entering academia, Veronica practised as an associate at a large law firm in Washington, DC, where she worked on regulatory and white-collar matters — experience that strongly informs the practical orientation of her research. Links Professor Veronica Root Martinez – Faculty Profile https://law.duke.edu/fac/martinez Veronica on LinkedIn https://www.linkedin.com/in/veronica-root-martinez/ Purpose-Driven Compliance (paper discussed in the episode) https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6078766 AI-Generated Timestamped Summary 00:00 – 02:00 | “Because they said so” Christian reframes compliance as a universal human experience — not just a professional discipline — and introduces the problem of rules justified solely by regulatory expectation. 02:00 – 05:30 | Why 100% compliance is impossible Veronica explains why modern organisations cannot realistically achieve perfect compliance when humans are involved — and why pretending otherwise creates problems. 05:30 – 10:30 | Tolerated misconduct and cultural drift How allowing “small” rule-breaking can escalate into bigger issues, drawing on behavioural ethics and real-world corporate failures. 10:30 – 14:30 | Risk, prioritisation, and what really matters A discussion of risk-based thinking, irrecoverable vs recoverable errors, and why organisations — not regulators — are best placed to set priorities. 14:30 – 18:30 | Enforcement swings and resilience Why compliance programmes built around enforcement trends are fragile, expensive, and reactive — and how purpose-driven approaches create stability. 18:30 – 23:30 | Innovation, uncertainty, and guardrails Why regulators are always behind innovation — and how values-based guardrails help employees make decisions in uncharted territory. 23:30 – 30:30 | Technology, AI, and the human in the loop The limits of automation, the danger of over-reliance on tech, and why human judgment remains essential. 30:30 – 36:30 | Rules, loopholes, and malicious compliance How overly detailed rulebooks create loopholes — and why purpose and principles offer a better basis for accountability. 36:30 – 40:30 | The Costco example A powerful illustration of simplicity: four ethical principles that employees can actually understand and use. 40:30 – 45:30 | Training, regulators, and unintended consequences Why blanket training requirements often miss the mark — and how enforcement agreements can accidentally undermine effectiveness. 45:30 – 52:30 | Measuring culture and compliance effectiveness Moving beyond counting inputs to assessing outputs, including psychological safety, Speak Up systems, and cultural indicators. 52:30 – 57:30 | Experimentation and learning Why failed interventions aren’t failure — they’re information — and why compliance should be treated as an evolving experiment. 57:30 – End | Reclaiming responsibility A closing reflection on extrinsic motivation, “because I said so,” and why purpose-driven compliance offers a more human, defensible, and sustainable way forward.