Skip to main content
Governance Authority
Category: Enterprise Risk Management

Governance and Culture

Also known as: Corporate Governance and Culture, Organizational Culture and Governance
Simply put

Governance and culture describes the relationship between the formal systems an organization uses to direct and control itself and the shared values, attitudes, and behaviours that shape how people actually act day to day. Governance provides the rules, structures, and oversight, while culture reflects how those expectations are lived out in practice. The two are closely linked because governance arrangements can influence culture, and culture in turn affects whether governance works as intended.

Formal definition

Governance and culture refers to the interaction between an organization's governance framework, which comprises the systems, rules, and oversight mechanisms by which an entity is directed and controlled, and its corporate culture, generally understood as the combination of values, attitudes, and behaviours manifested by a company in its operations and relationships. Governance is typically described as the system that regulates and guides behaviour and can shape the resulting organizational culture, while providing structures and practices intended to sustain culture and support compliance. In practice, responsibility is distributed across the organization: boards and their committees generally exercise oversight of culture and set the tone, whereas management is generally accountable for embedding values and behaviours through operations. The nature and enforceability of governance and culture expectations vary by jurisdiction, sector, and entity type, and are addressed through a mix of binding requirements and non-binding codes and guidance; specific obligations depend on the applicable regime and facts.

Why it matters

Governance and culture matter because formal structures alone do not determine how an organization actually behaves. An entity can have well-drafted policies, board committees, and control frameworks on paper, yet still experience misconduct or failure if the shared values, attitudes, and behaviours of its people do not align with those stated expectations. Culture reflects how governance is lived out in practice, and a gap between the two is often where risk accumulates unnoticed.

The relationship works in both directions. Governance arrangements can shape culture by setting the tone, establishing rules, and providing structures and practices intended to sustain expected behaviours and support compliance. At the same time, culture affects whether governance works as intended, because employees generally act on what is rewarded, tolerated, and modelled by leadership rather than solely on written rules. When these reinforce each other, governance becomes more effective; when they diverge, oversight can become a formality that fails to influence conduct.

Because of this interplay, culture has become a recognized area of board and regulatory attention in many jurisdictions, addressed through a mix of binding requirements and non-binding codes and guidance rather than a single universal standard. The specific expectations depend on the applicable regime, sector, and entity type, so organizations generally need to assess their own facts rather than assume a uniform obligation applies.

Who it's relevant to

Boards and board committees
Boards generally exercise oversight of culture and set the tone at the top, monitoring whether the organization's actual behaviours align with its stated values and governance framework. This is an oversight role rather than an operational one, and the specific expectations placed on directors depend on the applicable code, regulation, and entity type.
Executive and senior management
Management is generally accountable for embedding values and behaviours through the organization's operations, translating governance expectations into everyday practice. Because employees tend to act on what is modelled and rewarded, management's own conduct is central to whether culture reinforces or undermines the governance framework.
Compliance and risk functions
Compliance and risk professionals are typically concerned with whether governance structures and cultural conditions support adherence to obligations. A gap between stated policies and lived behaviours is often where conduct and compliance risk accumulates, making culture a relevant input to how these functions assess and monitor risk.
Internal audit and assurance providers
Assurance functions may be asked to evaluate whether governance arrangements are operating as intended and whether culture supports or hinders control effectiveness. Their role is generally to provide independent assurance on these matters rather than to own the culture itself, and the scope of any review depends on the organization's mandate and the applicable framework.
General counsel and governance professionals
These roles often help design and maintain the governance framework and advise on how binding requirements and non-binding codes apply to the organization. They are typically positioned to identify where legal obligations, best-practice guidance, and cultural realities intersect, recognizing that specific duties vary by jurisdiction and facts.

Inside Governance and Culture

Governance Framework
The structure of oversight bodies, delegated authorities, and reporting lines through which the board directs and monitors the organization. Governance is typically an oversight discipline owned by the board and its committees, distinct from the day-to-day management activities it supervises.
Board Oversight of Culture
The board's responsibility, under many corporate governance codes such as the UK Corporate Governance Code, to assess and monitor whether the organization's culture aligns with its purpose, values, and strategy. This is generally an oversight duty; the shaping and embedding of culture in daily operations sits with management.
Tone at the Top
The example and messaging set by the board and senior leadership regarding ethical conduct, values, and expectations. It influences, but does not by itself determine, behavior throughout the organization.
Values and Behavioral Standards
Codified expectations, often expressed in a code of conduct, that translate stated values into observable behaviors. These are typically internal standards rather than binding law, though they may support compliance with legal or regulatory obligations.
Culture as a Component of Internal Control
Under the COSO Internal Control-Integrated Framework, the control environment, including integrity and ethical values, is treated as the foundation of internal control. Culture is frequently discussed as an enabler of risk management and control effectiveness rather than a control in itself.
Roles and Accountabilities
The delineation of responsibility among the board, management, and assurance functions. Under models such as the three lines, operational management owns and manages risk and culture in practice, while the board provides oversight and assurance functions provide independent evaluation.
Culture Indicators and Assessment
Qualitative and quantitative signals, such as employee surveys, conduct data, whistleblower reports, and turnover, used to inform judgments about culture. These indicators support, but do not replace, professional judgment and are not standardized across jurisdictions or frameworks.

Common questions

Answers to the questions practitioners most commonly ask about Governance and Culture.

Is governance and culture the same thing, or is culture just a subset of governance?
They are related but distinct. Governance generally refers to the structures, allocation of authority, and oversight arrangements through which an entity is directed and held accountable, typically involving the board, its committees, and management within defined roles. Culture refers to the shared attitudes, behaviors, and norms that shape how people actually act, often described as the values and behavioral patterns that persist regardless of written policy. Governance can establish expectations and tone, but it does not automatically produce a particular culture; a well-designed governance framework can coexist with a weak or misaligned culture, and vice versa. Treating culture as merely a component of the governance chart understates that it operates through behavior rather than structure. The precise relationship depends on the framework a given entity applies, and this description is educational rather than prescriptive.
Does having a strong governance framework and a published code of conduct mean an organization has a good culture?
Not necessarily. A documented governance framework, policies, and a code of conduct describe intended arrangements and stated values; they do not, on their own, demonstrate how people behave in practice. The distinction parallels control design versus operating effectiveness: a framework may be well designed yet function poorly if behaviors diverge from stated expectations. Assessing culture generally requires evidence of actual behavior, how decisions are made, how concerns are raised and handled, and whether incentives reinforce or undermine stated values, rather than the existence of documents alone. Whether and how culture is formally assessed varies by jurisdiction, sector, and the frameworks an entity chooses to apply. This entry is educational and not legal, audit, or compliance advice.
Who is responsible for governance and culture, the board or management?
Responsibilities are typically shared but differentiated. In many governance frameworks, the board holds an oversight role: setting or endorsing the tone at the top, overseeing that culture aligns with the entity's purpose and values, and holding management accountable. Management generally holds operational responsibility for embedding culture through day-to-day decisions, incentives, communication, and modeling of behaviors, sometimes described as tone in the middle. Assurance functions, where they exist, may provide independent perspective on culture but do not own it. Attributing an operational culture-shaping duty solely to the board, or an oversight duty solely to management, would misstate the usual allocation. Exact accountabilities depend on the entity type, applicable requirements, and how a specific organization structures its roles.
How can a board gain visibility into culture when it is largely intangible?
Boards generally rely on a combination of indicators rather than any single measure, because culture cannot be observed directly. Sources that boards commonly consider include information about how concerns are raised and resolved (for example, whistleblowing or grievance data), engagement and turnover patterns, conduct and disciplinary trends, customer or stakeholder feedback, and direct observation through site visits or exposure to management below the executive level. Boards may also weigh whether incentive and reward structures reinforce stated values. Each indicator has limitations and can be read differently depending on context, so triangulation and professional judgment are typically emphasized. What information is available and how it is used depends on the entity, its sector, and applicable expectations; this is general guidance, not a prescribed methodology.
How does an organization identify a gap between its stated values and actual behavior?
Identifying such gaps generally involves comparing what the entity says it values with evidence of how people actually behave and decide. This may include examining whether outcomes rewarded in practice match stated priorities, whether policies are consistently applied, whether reported concerns are acted upon, and whether behavior differs across parts of the organization. Divergence between design (stated values, policies) and effect (observed conduct) is often the focus, echoing the design-versus-operating-effectiveness distinction used more broadly in controls assessment. Such analysis depends heavily on facts, available information, and judgment, and different functions, management, assurance, or external advisers, may contribute depending on the entity's arrangements. This description is educational and does not substitute for tailored professional assessment.
How should responsibility for monitoring and reporting on culture be allocated across functions?
Allocation varies by entity, but a common approach distinguishes ownership from assurance. Management typically owns culture and the mechanisms that shape and monitor it day to day; certain functions, such as human resources, compliance, or risk, may contribute relevant information within their remits. Independent assurance functions, where present, may assess and report on aspects of culture without assuming responsibility for it, consistent with maintaining their objectivity. The board or a designated committee generally receives reporting and provides oversight. Care is usually taken not to blur these roles, for example, an assurance function that designs and operates cultural controls could compromise its independence. The specific structure depends on the organization's size, sector, applicable frameworks, and requirements, and should be determined through the entity's own judgment. This entry is educational and not legal, audit, or compliance advice.

Common misconceptions

Culture is the responsibility of the board, so directors should manage and change it directly.
In many governance frameworks the board's role regarding culture is generally one of oversight, assessing alignment and monitoring, while embedding and operating culture day-to-day typically rests with management. Attributing an operational duty to the board, or an oversight duty to management, blurs accountability.
A published code of conduct or set of values legally guarantees good culture and compliance.
Codes and values statements are generally internal, largely voluntary standards rather than binding law, and their existence alone does not establish an effective culture. Their design and their operating effectiveness in practice are distinct matters, and outcomes depend on facts, context, and how consistently expectations are applied.
Governance, risk, and compliance around culture are essentially the same activity.
These are related but separate disciplines. Governance concerns oversight and direction, risk management concerns identifying and responding to uncertainty against risk appetite, and compliance concerns adherence to applicable requirements. Culture touches all three, but the function that owns a given activity should be identified explicitly rather than conflated.

Best practices

Clarify in board and committee charters who is accountable for overseeing culture versus who is responsible for shaping it operationally, avoiding overlap between oversight and management duties.
Use a recognized framework such as the COSO Internal Control-Integrated Framework to position culture within the control environment, while recognizing that no single framework is universally mandatory and that requirements vary by jurisdiction, sector, and entity type.
Draw on multiple culture indicators, such as conduct data, survey results, and whistleblower activity, rather than relying on a single metric, and treat these as inputs to professional judgment rather than conclusive measures.
Distinguish between the design of values and behavioral standards and their operating effectiveness, and periodically test whether stated expectations are reflected in actual behavior.
Reinforce tone at the top through consistent leadership example and messaging, while recognizing that leadership signals influence but do not guarantee organization-wide behavior.
Where obligations may be legally binding in a given jurisdiction, seek qualified legal, audit, or compliance advice, as glossary guidance is educational and not a substitute for such advice.