Most organisations have a reporting channel. Very few have a speak-up culture. The difference is not technical — it is human.

When a compliance function is asked whether the organisation has a speak-up culture, the answer it most commonly gives is a description of its infrastructure. A hotline. A web-based reporting portal. An email address managed by the compliance function or an external provider. A policy that describes how reports are handled and how reporters are protected. Sometimes a dedicated case management system. Sometimes an anonymous reporting option.

This infrastructure is necessary. An organisation without a confidential reporting channel has not built the precondition for a speak-up culture. But the infrastructure is not the culture — and the gap between the two is where the compliance function most commonly overestimates what it has built.

A reporting channel is a mechanism: a technical and procedural system through which concerns can be submitted. A speak-up culture is something qualitatively different: the shared understanding, across the organisation, that raising concerns is safe, that it is expected, that it leads to genuine follow-up, and that the person who raises a concern will be protected and will not be worse off for having done so. The channel enables the behaviour. The culture produces it. No amount of investment in the channel produces the culture automatically — and many organisations have discovered, to their cost, that a well-designed channel that nobody uses is not a compliance asset. It is a compliance gap dressed in the appearance of one.

"A reporting channel that nobody uses is not evidence that nothing is wrong. It is evidence that the channel has not earned the trust it needs to function. Trust is not a feature of the channel design. It is a property of the culture around it — and culture is built by what the organisation does, not by what it has installed."

Three reasons organisations confuse infrastructure for culture.

The first reason is measurement. Compliance functions measure what is measurable — channel registration, number of reports received, case closure rates, time-to-resolution. These are legitimate operational metrics. But they measure the channel's activity, not the culture's health. An organisation that receives few reports and interprets low volume as a positive signal — as evidence of a clean culture — may be correct. It may also be in an environment where people have concluded, through experience or observation, that raising concerns is not worth the risk. Low volume tells you very little without understanding why the volume is low.

The second reason is design focus. The investment in speak-up infrastructure tends to concentrate on the front end — the channel through which reports are submitted — and underinvest in the back end: the case management process, the feedback loop to the reporter, the visibility of outcomes, the manager training that prevents retaliation, and the cultural reinforcement that makes speaking up feel normal rather than exceptional. A channel that is easy to access but difficult to trust is not a functioning speak-up system.

The third reason is the assumption of culture transfer. Organisations sometimes assume that communicating the availability of the channel is sufficient to create the willingness to use it. It is not. Willingness to speak up is determined not by knowledge of the channel's existence but by the accumulated experience the organisation has provided about what happens when concerns are raised — through the stories that circulate about previous reporters, through the behaviour of managers when uncomfortable things are said in meetings, through the visible outcomes of past investigations. Communication creates awareness. Experience creates trust.

Ask the people in the middle of your organisation — not in the compliance function, not in senior management — what they believe would happen if they raised a concern about a colleague, a manager, or a process through the reporting channel. Ask whether they know anyone who has done so, and what happened to them. The answers to those questions tell you more about your speak-up culture than any metric the compliance function tracks.

Culture is built in the space between the channel and the response.

Building a speak-up culture requires sustained attention to the elements that determine whether employees believe that speaking up is safe and worth doing. The most powerful of these is the visible response to reports that have been made. When the organisation demonstrates — not just declares — that concerns are taken seriously, followed up on, and resolved in ways that respect both the reporter and the process, it is providing the most credible evidence available that the channel is real.

The role of managers is decisive in a way that channel design cannot compensate for. A manager who responds to a concern raised informally with curiosity, who does not make the person feel they have caused a problem, who follows through on what they said they would do — that manager is building speak-up culture in real time. A manager who responds defensively, who minimises the concern, or who is later seen to be subtly hostile toward the person who raised it is destroying it. Manager behaviour is the single most influential variable in whether employees believe they can speak up — and it is the variable that most compliance programmes invest least in developing.

"The speak-up culture that functions is the one where raising a concern feels like a normal part of working in an organisation that takes its values seriously — not an act of courage that requires the individual to weigh the risk against the principle. Building that normalcy is the work. It cannot be installed. It has to be lived."

Download this article

Save a PDF copy for offline reading, or share it with a colleague who might find it useful.

Download PDF