Management builds visible rules, training, and attestations that satisfy auditors and regulators while behavior stays the same, so oversight is discharged without any change in how the business runs.
An example
After a regulator's exam flagged weak controls over sales incentives, a regional bank's management built a conduct program in five months: a forty-page policy, a mandatory online training module, a quarterly attestation for every branch manager, and a red, amber, and green heat map for the board. Completion rates passed ninety-eight percent. A former bank examiner who joined the board's risk committee that spring asked a different question at her first meeting: how many accounts had been opened without customer consent before and after the program. Management said that measure was not tracked. Branch sales targets had not changed. The heat map was built from the branch managers' own attestations, and the committee's agenda gave it twenty minutes each quarter, most of them spent on closed action items.
Why it works
The visible artifacts, the manuals, sign-off matrices, completion dashboards, and heat maps, are themselves what the oversight audience came for, so the program looks better than anything else on offer: it turns concern into a program. It is cheap to run, because attestations and online training sit apart from how the business makes decisions, and people sign and carry on. And it makes real change costlier to demand, since anyone who wants it must now argue that a visible, documented, expensive-looking program falls short. It satisfies overseers who are short of time, rely on the operator's own reports, and are rewarded for closing items.
The thinking behind it
Erving Goffman Goffman's The Presentation of Self in Everyday Life (1956) describes performances in a front region before an audience, with contradicting facts kept in a back region, and teams that share an interest in the show succeeding. A compliance program's dashboards and attestations are the front region, and branch sales incentives sit in the back. The defense moves the question backstage, asking for outcome measures and independent testing that the performance cannot supply.
Murray Edelman Edelman's The Symbolic Uses of Politics (1964) argues that much of politics works through symbols, rituals, and official language that reassure a broad audience while tangible benefits go to a few. Compliance theater does the same inside a company: a policy, a training module, and a heat map reassure the board while the incentives that caused the problem stay in place. Asking what behavior has changed separates the symbol from the substance.
Warning signs
Policy counts, attestation rates, and training completion keep rising while incident and behavior measures stay flat or go untracked. Oversight relies on the operator's own reports. The incentives that drove the original problem are unchanged. Committee time goes to closing action items. When someone asks what behavior has changed, the answer describes the program's activities.
How to defend yourself
Ask the question the program avoids: has anyone's behavior actually changed, and how would we know?
- Request outcome measures alongside completion counts: incidents, complaints, exceptions, the specific behavior the program was built to stop.
- Check self-reports against something independent, such as incident data, outside testing, or mystery shopping.
- Look at whether the incentives behind the problem changed. If they did not, the program is probably decoration.
- Put the question in writing, so the answer goes on the record.
If you work inside the program and see the gap, write it down early. The longer the theater runs without a test, the worse the eventual exposure.
How a leader shuts it down
Judge compliance programs by outcomes and independent testing, and treat completion rates as inputs. Change the incentives that produced the problem, or accept that little else will move. Reward the people who report that a control is not working. A program that discharges audit pressure efficiently often touches operations least, so ask the hard question before an outside event asks it for you.