Culture Risk Is Now Conduct Risk Governance

Culture Risk Is Now Conduct Risk Governance

In a shift that redefines boardroom priorities, the UK Financial Conduct Authority (FCA) is extending its reach into workplace misconduct beyond banking. From September 2026, more than 37,000 regulated financial firms will be subject to new oversight rules addressing non-financial misconduct, including bullying, harassment, and discrimination.

This isn’t just regulatory housekeeping. It’s a landmark evolution in what conduct risk governance really means. And for Non-Executive Directors (NEDs), it’s a call to action: cultural oversight is no longer a soft issue. It’s a strategic, reputational, and regulatory imperative.

Culture as a Boardroom Accountability

Culture has long been seen as the domain of HR or executive leadership. But in the post-SM&CR era, and especially with the FCA’s expanded mandate, boards are expected to treat culture risk with the same seriousness as financial or operational risk.

The stakes are high. Misconduct scandals can devastate a firm’s license to operate, talent pipeline, and shareholder trust. And boards that fail to govern culture will increasingly find themselves on the wrong side of regulatory attention.

“The message is clear: boards must hardwire culture oversight into their governance frameworks.”

NEDs must ensure behavioural risk is not only monitored, but actively measured, reported, and interrogated.

What’s Changing: The Regulatory Landscape

The new FCA extension will apply conduct rules to:

  • Asset managers
  • Insurers
  • Mortgage providers
  • Credit unions
  • Investment firms
  • Thousands of smaller and mid-sized financial businesses

While these organisations may not have formal SM&CR obligations yet, the expectations for board-level behavioural governance are clear. The FCA’s 2023 “Dear CEO” letters and discussion papers already flagged that culture is material to conduct and consumer outcomes.

Key Shifts for Boards to Understand:

  • Non-financial misconduct will be considered relevant to fitness and propriety.

  • Firms will be expected to act on poor culture signals even without formal complaints.

  • Board oversight of internal investigations, whistleblowing, and DEI initiatives will be scrutinised.


From Policy to Practice: NEDs and Culture Governance

So what does it look like in practice for a NED to govern conduct risk? It requires a mindset shift: moving from passive awareness to active oversight.

Here are six key actions smart boards are taking now:

1. Integrate Behavioural Metrics into Board Dashboards

Just as financial KPIs track profitability, culture KPIs should track behaviour. Consider:

  • Number and themes of internal complaints
  • Whistleblowing volume, resolution times, and outcomes
  • Staff engagement and exit survey data
  • DEI progress against targets
  • Training participation and effectiveness

Boards should review these at regular intervals and look for patterns over time.

2. Ask Smarter Questions About Whistleblowing

Whistleblowing is a frontline cultural indicator. NEDs should:

  • Ensure the board sees regular reporting on whistleblowing activity
  • Query low or inconsistent reporting (a red flag, not a green one)
  • Ask how anonymous complaints are handled and tracked
  • Review whether whistleblowers are protected from retaliation

3. Assess Culture Through Multiple Lenses

Avoid relying solely on tone-from-the-top. True cultural insight comes from triangulation:

  • Middle management behaviour (e.g., are values lived or lip service?)
  • Customer complaints and satisfaction trends
  • Audit findings tied to conduct or interpersonal issues
  • Patterns in turnover, absenteeism, and staff burnout

4. Elevate Misconduct to the Risk Register

Treat culture-related risks as board-level risks:

  • Bullying, exclusion, or lack of psychological safety
  • Poor manager conduct or abuse of power
  • Inconsistent disciplinary actions

Ensure these risks are named and tracked alongside operational risks.

5. Engage with DEI as a Governance Issue, Not PR

Diversity, equity, and inclusion initiatives are part of the conduct risk landscape. Boards should:

  • Oversee DEI targets and progress
  • Examine whether hiring, promotion, and performance systems are fair
  • Request demographic data tied to complaints or turnover
  • Ensure leaders are held accountable for inclusive behaviour

6. Prepare for Regulatory Scrutiny

Boards should stress-test their readiness by asking:

  • If the FCA requested a breakdown of culture risks tomorrow, what would we show?
  • Are we confident in how we investigate, escalate, and resolve non-financial misconduct?
  • Do we know how our firm’s culture compares with peers?

Run culture scenario planning at board offsites. Practice tough conversations about misconduct. Ensure executive teams know the board is watching.


Board Case Study: Culture Oversight in Action

At a mid-sized insurance firm preparing for listing, the board undertook a proactive culture audit. With NED sponsorship, they:

  • Commissioned an external review of staff experience and culture risk
  • Set quarterly board-level KPIs around complaints, engagement, and DEI
  • Reviewed and restructured their whistleblowing policy and escalation routes

The result? Early identification of exclusionary team dynamics in two business units. These were addressed through leadership development and restructuring – before becoming reputational issues.

Culture is Strategy: The NED Imperative

The message for boards is clear: culture isn’t peripheral. It’s strategic.

Misconduct is rarely a one-off incident. It’s a system failure. And boards that rely on reactive signals, like public scandals or tribunal cases, are already behind.

“Smart NEDs are building culture resilience like they build financial resilience: with foresight, data, and disciplined oversight.”

This is the new frontier of governance.

Practical Takeaways for NEDs

  • Add culture KPIs to your next board agenda.

  • Review your whistleblowing reports and ask why the numbers look the way they do.

  • Advocate for anonymous staff surveys and external culture reviews.

  • Ask the CEO: "If I walked through your company tomorrow, what behaviours would I see?"

  • Push for misconduct risks to be discussed in audit and risk committees, not just people or ethics forums.

The FCA’s expanding scope is just the start. Reputational, regulatory, and stakeholder expectations will only increase. And the boards that thrive will be those that treat conduct risk governance as a first-order duty, not an afterthought.