Skip to main content
Governance Authority
Category: Compliance Programs

Value-Based Compliance

Simply put

Value-based compliance is an approach that combines a company's ethical values and sense of integrity with its more legally focused rules and controls. Rather than treating compliance purely as following legal requirements, it aims to embed shared values into how an organization behaves. The goal is for people to do the right thing because it reflects the organization's principles, not only because a rule requires it.

Formal definition

Value-based compliance generally refers to integrating an ethical or integrity-oriented perspective into a compliance management system that has traditionally been shaped primarily by legal obligations. In this model, an organization's stated values and integrity standards inform and complement rules-based controls, shifting emphasis from mere legal conformity toward principles-based commitment. This is best understood as a design philosophy and voluntary standard rather than a binding legal requirement; its scope, structure, and effectiveness depend on the organization, sector, jurisdiction, and how it is operationalized within governance and assurance arrangements. The evidence describes the concept at a conceptual level and does not establish a single prescriptive framework; note also that related terms such as 'value-based care' and 'value-based GRC' in the evidence refer to distinct concepts (health care delivery and aligning GRC with strategic objectives, respectively) and should not be conflated with value-based compliance. This entry is educational and not legal, audit, or compliance advice.

Why it matters

A compliance program built solely around legal rules and controls can create a checkbox culture in which people ask only whether an action is technically permitted, rather than whether it is right. Value-based compliance matters because it seeks to close that gap by connecting an organization's stated values and sense of integrity to its formal compliance obligations. The premise is that embedding shared principles into everyday behavior can support decision-making in situations that rules do not clearly anticipate, where employees must exercise judgment rather than simply follow a checklist.

The distinction is significant for accountability and culture. Rules-based controls define minimum expectations and are typically owned and operated by management, with oversight from the board and assurance from functions such as compliance and internal audit. An integrity-oriented layer is intended to complement, not replace, those controls, shaping the tone and intent behind them. Because value-based compliance is best understood as a design philosophy and voluntary standard rather than a binding legal requirement, its influence depends heavily on how genuinely an organization operationalizes its values across governance arrangements rather than treating them as aspirational statements.

It is important to be precise about scope. The concept, as reflected in the available evidence, is described at a conceptual level and does not establish a single prescriptive framework or metrics. Organizations considering this approach should recognize that its effectiveness varies by entity, sector, and jurisdiction, and that value-based language elsewhere, such as value-based care in health care delivery or value-based GRC focused on strategic alignment, refers to distinct concepts that should not be conflated with value-based compliance.

Who it's relevant to

Chief Compliance Officers
Compliance leaders responsible for the design and operation of a compliance management system may consider how an integrity-oriented perspective can complement legally focused rules and controls. This approach speaks directly to the question of whether a program drives genuine ethical commitment or only technical conformity, though it does not replace the legal obligations the function must continue to meet.
Boards and Ethics or Governance Committees
Boards and their relevant committees exercise oversight of culture and the tone at the top. Value-based compliance offers a lens for evaluating whether management is embedding stated values into behavior, while keeping the board's role oversight-focused rather than operational. Judgments about how far to pursue this approach depend on the organization's own circumstances.
General Counsel
Legal counsel navigating the relationship between binding legal requirements and voluntary integrity standards may find this concept useful in framing how ethical commitments sit alongside, rather than substitute for, legal conformity. This entry is educational and not legal advice; the applicability of any approach depends on jurisdiction and specific facts.
Internal Auditors and Assurance Functions
Assurance professionals assessing the design and operating effectiveness of compliance arrangements may encounter value-based elements that are harder to test than discrete rules-based controls. Recognizing that value-based compliance is a design philosophy rather than a prescriptive framework helps set realistic expectations for how such an approach can be evaluated.

Inside Value-Based Compliance

Values-Based Orientation
An approach that anchors compliance in an organization's stated values and ethical commitments rather than solely in the avoidance of legal penalties. It emphasizes shared understanding of why standards exist, in contrast to a purely rules-based model focused on adherence to specific prohibitions.
Culture and Tone
The organizational environment in which conduct expectations are set and reinforced, often described in terms of 'tone at the top' from the board and senior management and 'tone in the middle' from line managers. Culture is typically a factor in how effectively compliance objectives are embedded, though its influence is difficult to measure directly.
Relationship to Rules-Based Compliance
Value-based compliance is generally presented as complementary to, not a replacement for, adherence to binding legal and regulatory requirements. Statutes, regulations, and listing rules still establish mandatory obligations regardless of an organization's cultural approach.
Behavioral and Decision-Making Focus
An emphasis on guiding employee judgment in situations not fully addressed by explicit rules, encouraging decisions consistent with organizational values where specific guidance may be absent or ambiguous.
Accountability and Ownership
The allocation of responsibility across the organization. Management typically owns the design and operation of compliance activities and culture-setting within their remit, while the board and relevant committees generally exercise oversight. Value-based approaches do not alter these accountability lines.
Measurement and Assurance Considerations
The challenge of evaluating a values-based program, since cultural and ethical outcomes are harder to test than discrete controls. Assurance functions may assess indicators of program effectiveness, while recognizing the limits of measuring culture.

Common questions

Answers to the questions practitioners most commonly ask about Value-Based Compliance.

Does adopting a value-based compliance approach mean an organization can move away from clear rules and controls?
No. Value-based compliance is generally understood as a complement to, not a replacement for, a rules-based control environment. It emphasizes shared ethical values and the reasons behind requirements to encourage principled decision-making, particularly in situations that specific rules do not anticipate. However, binding legal obligations, statutes, regulations, and listing rules, remain applicable regardless of an organization's cultural approach, and documented policies, controls, and monitoring are typically still needed to demonstrate compliance and support assurance. In practice, most programs blend rules-based and values-based elements rather than choosing one exclusively.
Is value-based compliance simply a softer term for corporate culture or ethics training?
Not exactly. While value-based compliance is closely related to organizational culture and often uses ethics training as one delivery mechanism, it is generally treated as a broader orientation for how a compliance program is designed and operated, aligning conduct expectations, incentives, decision-making, and tone from leadership with a defined set of values. Culture describes the prevailing norms and behaviors; ethics training is one activity. Value-based compliance refers to the deliberate strategy that seeks to embed values across program design so that behavior aligns with them. The distinction matters because responsibility for these elements is typically shared: the board and senior management set tone and expectations, while the compliance function designs and monitors the supporting program.
Who typically owns a value-based compliance approach within an organization?
Accountability is generally distributed rather than held by a single function. The board (often through an audit, risk, or ethics/compliance committee) typically provides oversight of culture and the compliance program and sets the tone at the top. Senior management is usually responsible for implementing the approach, modeling expected conduct, and allocating resources. The compliance function commonly designs, coordinates, and monitors the program, including values-based elements. Business line management, often described as the first line, generally owns the day-to-day conduct and decisions within their areas. The precise allocation depends on the organization's structure, sector, and applicable governance framework.
How might an organization measure or provide assurance over a value-based compliance approach?
Because values and culture are less directly observable than discrete controls, organizations typically rely on a combination of indicators rather than a single metric. These often include culture and engagement surveys, speak-up and whistleblowing data, patterns in reported concerns, exit interview themes, disciplinary and consequence-management trends, and qualitative reviews of decision-making in judgment-based situations. Assurance functions may assess whether values are consistently reflected in policies, incentives, and leadership behavior. It is worth noting that these measures are generally indicative rather than definitive, and their design and interpretation depend on the organization's context and professional judgment. This is not audit or compliance advice.
How does a value-based approach interact with the incentive and performance management systems?
A common implementation challenge is misalignment between stated values and the behaviors that incentive structures actually reward. Under many governance frameworks and supervisory expectations, organizations are encouraged to review whether remuneration, targets, promotion criteria, and consequence management reinforce or undermine the values the program seeks to embed. In practice this may involve incorporating conduct and ethical considerations into performance assessments and ensuring that misconduct carries meaningful consequences. The specific design of such mechanisms varies by jurisdiction, sector, and entity type, and in some regulated sectors elements of this may reflect binding requirements rather than voluntary practice.
What are the practical limitations or risks of relying on a value-based compliance approach?
Several limitations are commonly noted. Values-based elements can be harder to evidence than documented controls, which may complicate demonstrating compliance to regulators or auditors who often expect verifiable records. There is also a risk that stated values become aspirational language that is not embedded in day-to-day practice, sometimes described as a gap between espoused and enacted values. Reliance on judgment can produce inconsistency without adequate guidance and escalation routes. For these reasons, value-based approaches are generally most effective when paired with clear policies, controls, monitoring, and assurance rather than used as a substitute for them. The appropriate balance depends on the organization's risk profile, regulatory environment, and its own judgment; these entries are educational and not legal, audit, or compliance advice.

Common misconceptions

Value-based compliance means an organization can rely on values instead of following the rules.
A values-based orientation does not displace binding legal or regulatory obligations. Applicable statutes, regulations, and listing rules remain mandatory, and value-based approaches are generally intended to complement, not substitute for, adherence to those requirements.
A strong ethical culture guarantees that compliance failures will not occur.
Culture may support better outcomes, but its effect is indirect and difficult to measure. A values-based program does not eliminate residual risk, and controls, monitoring, and assurance remain necessary. Effectiveness depends on facts, context, and ongoing execution.
Value-based compliance is the board's responsibility to implement day to day.
The board and its committees typically provide oversight of culture and compliance, while management generally owns the design and operation of the program and the setting of tone within its remit. Attributing operational implementation to the board conflates oversight with management duties.

Best practices

Treat value-based compliance as complementary to rules-based obligations, ensuring binding legal and regulatory requirements continue to be identified and met alongside culture-focused efforts.
Clarify accountability so that management owns program design and operation while the board and relevant committees exercise oversight, and document where each responsibility sits.
Reinforce consistent tone at the top and tone in the middle, recognizing that line management behavior often shapes how values are understood and applied in practice.
Develop practical guidance and decision-making support for situations not fully addressed by explicit rules, so employees can act consistently with stated values where specific direction is limited.
Use multiple indicators to assess program effectiveness while acknowledging the inherent difficulty of measuring culture, and avoid over-relying on any single metric.
Periodically review whether stated values are reflected in actual conduct, escalating gaps through appropriate assurance and oversight channels, and adapting to the organization's jurisdiction, sector, and circumstances.