Culture & Compliance Chronicles: Humanizing Compliance—Creative Approaches with Nicole Rose

At a glance: Click the links below to advance directly to the corresponding sections of the transcript:

• [1:50] Getting to Know Nicole
• [3:45] “Moneyballing” Compliance
• [6:40] Designing Effective Training
• [12:25] Bringing the Human Element into Compliance
• [17:50] Building Trust with the Business
• [21:55] The Power of Pilots & Testing
• [24:05] What Works and What Doesn’t in Training
• [27:10] Key Takeaways

Nitish Upadhyaya: Welcome back to the Culture & Compliance Chronicles, the podcast that gives you new perspectives on legal, compliance and regulatory challenges faced by organizations and individuals worldwide. The clue is in the title—culture is at the heart of everything. It’s the endlessly shifting patterns that govern our environment and behaviors. The magic is in amplifying certain patterns and dampening others. Let’s see if we can pique your curiosity, get you to challenge some of your perceptions and give you space to think differently about some of your own challenges. I’m Nitish Upadhyaya, and I’m joined by Amanda Raad and Richard Bistrong. Hello, Amanda and Richard.

Amanda Raad: Hi there. How are you, Nitish?

Nitish Upadhyaya: Well, thanks. I am really excited to be back. Last time out we were recording with Dina Denham Smith on the heightened emotional demands on leaders, strategies for managing emotions in the workplace, and some top tips from a coaching perspective of how to deal with your teams. Who have we got joining us today?

Richard Bistrong: Nitish and Amanda, we have Nicole Rose joining us today from Australia. I am so happy to be introducing Nicole—we have known each other, in let’s just call it, forever. Nicole was one of the first people, even a little pre-Amanda, that I met in this field. We produced an animation together called, “Why We Say Yes,” and we can put the teaser in the show notes. So, it’s such a pleasure to reconnect—Nicole, welcome to the podcast.

Nicole Rose: Richard, thank you so much, and Amanda, and Nitish. I’m really excited to be here.

Nitish Upadhyaya: Let’s hit you with some rapid-fire questions so the audience gets to know you before we really dive into some of your amazing experiences. Give us three things we should know about you.

[1:50] Getting to Know Nicole

Nicole Rose: Firstly, I’m a creative and an artist, and I spend a lot of my time in that space, in fact, mostly in my work life. Second thing is I love what you do. I think it’s so important to share with our community and learn from others. In fact, I’ve got my own podcast which I co-host with the fabulous Jason Meyer, The Eight Mindsets podcast, so I’m really, really familiar with this whole process. And I guess I should say the sensible thing is that I live and work in risk and compliance, and I’m currently leading a compliance program for Aristocrat.

Nitish Upadhyaya: Amazing. Well, I think we have questions to dive into all of those things in just a second. But before we get there, tell us one thing you’re curious about.

Nicole Rose: I was at a think tank session yesterday, and AI came up a lot. I am really, really curious about what’s going to happen with my role, with all of our roles, once genAI is a real, full partner to our compliance business. By the way, I don’t think our roles are going to go—I think they’re going to improve. But I’m really, really curious to watch this space.

Nitish Upadhyaya: Well, let’s see if we can explore some of your thinking on that in a little while. Last question before we dive in is: What’s the last thing that surprised you?

Nicole Rose: I got a photo on my phone a few weeks ago, and the photo was of three colleagues that I work with in London quite closely. Now, bear in mind, I’ve never met these colleagues, and Richard was in London with them. That was a wonderful surprise actually to see all of them together.

Nitish Upadhyaya: It’s a small world.

Richard Bistrong: Nicole, it was so nice to meet your colleagues—such a pleasure to have them join us. I’ll also add, Nitish, that Nicole was quite modest—her artwork is just spectacular. I am proud to share that a few of her paintings are hanging in my home.

Nicole Rose: Thanks, Richard. It’s always lovely to be able to do something that you really feel so much joy doing, so thanks for sharing that.

[3:45] “Moneyballing” Compliance

Nitish Upadhyaya: I think on top of that thing that has surprised me, I was also really intrigued by some of the conversations we had before putting this episode together, and this term that you used around “moneyballing” compliance. Most of our listeners, I think, will be familiar with moneyballing generally, but give us a sense of what it is, and how does it apply to compliance?

Nicole Rose: This is a theory, a methodology, an approach, and something that I now use in practice that has evolved for years. I’ve been interested in this whole concept for years. It brings together two concepts I loved, so let’s break it down. When we talk about moneyballing compliance, I am not just talking about compliance is to avoid trouble—I’m thinking about how it can create and add value to the business. There’s a really cool way to explain it through moneyballing, and another idea, which is “microlives.” Moneyballing’s to do with baseball, and microlives is essentially what the public health system use to translate to people the good things and bad things that they should be doing for their health.

Let’s start with Moneyball.. For those who don’t know the film, you’ve got Billy Beane. He came in, and he decided that he was going to improve his baseball team. It wasn’t doing very well; it didn’t have very much money, so he couldn’t go for all the flashy players. So, instead, he used data to find undervalued strengths and built a collective team that performed, but they all did different things. When I think about compliance, and I think about compliance controls specifically, that’s how I think we should be thinking about it. Not all controls are equal. Why look at them holistically together? Some are clunky. They’re expensive. The systems aren’t being used properly. Possibly, they don’t reduce the risk. Others are really effective, quite lightweight, don’t have too much tech, they’re just working, and they very, very quietly deliver massive value. I’m really interested in being able to distinguish those and identify those, just like Billy Beane did, and make the best team possible. Essentially, moneyballing’s about assessing our controls, like a coach might assess their players, and looking at how a control performs, not just how it was designed, but how it plays out in the real world. There is real impact—how it actually encourages the right behaviors. It enables the business. Is it there because it’s always been there? You’ve heard of a risk on top of a risk, on top of a risk, etc. Or is it there actually to minimize and manage the risk? So, it’s essentially thinking about an approach that’s grounded in data insight, and human behavior.

[6:40] Designing Effective Training

Richard Bistrong: Nicole, what’s the secret sauce there for parsing out what’s clunky and not working versus where you may be getting more for less? What are the main pillars of differentiating that?

Nicole Rose: The way that I look at it is I am not interested in what controls are there—I’m interested in how those controls are performing. How are people behaving in those controls? I’m going to give you an example of training. So many employees get “just-in-case” training. “Just in case you happen to be given a bribe by a public official, this is what you should think about. Just in case this happens…” So, you can imagine a new employee who is onboarded, and nine months ago, they got training on gifts and entertainment. What we would want them to do is if they were offered or going to offer a gift and entertainment at the right time is go through the benefits system for approvals, and get everything checked, declared, disclosed, etc. Now, the employee, Richard, might well forget that training, and they might well turn around and say, “You know what? It’s just dinner. I know it’s a $500 dinner, after the wine, but it’s just dinner. Who cares?” And so, it wouldn’t even be intentionally—it could be unintentionally, and he hasn’t connected the dots. That is a system that is not effective. Just-in-case training = not effective.

Now, let’s compare that to how we could then make that go from clunky and ineffective, because he spent time on that, the company spent resources on that, and we’ve invested time to put the training together. How about if we have at the very time that maybe this employee is involved in the tender, and the manager turns around and says, “We’re all involved in this tender. Can I just remind you of a few things? Gifts and entertainment policy. I know that you know the policy exists, but can we just break it down and think exactly what that means for us right here, right now? And by the way, here is a short video (just in time), maybe three minutes long.” Just in time. Effective. Simple. We’re not taking away from the other control, but we’re not relying on that control by itself. We’re actually giving something that is useful in real time, is an activity at the time that we need it, so we’ve just made them more effective. And there’s hundreds of ways, by the way, we can do that with compliance controls.

Nitish Upadhyaya: I love that example, because the training one plays to so many people who are having the same experiences. You go through a training on your first day, you won’t remember it. I speak to clients, for example, who do refresher training just before Christmas period comes around, because they know that there is real possibility of gifts turning up, and different tailored training to different people. A receptionist might have another training about what happens when a big package of drinks turns up at the front desk for a client—that’s a different thing to think about. But how do you then get people to make that shift from the broad spread, “We’ve only got so much budget, let’s touch everyone,” to the, “We need to hit key risk takers just in time?” How do you prove the effectiveness or lack thereof of the existing program, to then make the case for moving to just-in-case?

Nicole Rose: I’m not actually saying that we have to spend any more time and resources, by the way. I’m not saying, “Let’s bring in more training.” I’m actually not saying that we should give people more compliance. I’m not even saying that we need to invest heavily. What I’m saying is that when we are thinking about effectiveness of our controls, you have a policy (the governance), training, systems, processes—they are all adequate, they’re there. They might even be good. They might be the best system, best training. Richard’s animation might be there. They might be phenomenal. But then, how do we show they actually work? Here’s what we can do—here’s the difference. In order for behavior change to happen, we need to see people do certain activities. So, it’ll be the difference between me reading a book on exercise, yoga, fasting, and I could tell you the book inside out—it’s very, very different to me rolling out my yoga mat before I go to bed at night, so when I wake up in the morning, I can’t miss it, and I’m going to go out and use it. That’s what we want people to do. We want them to have really, really small behavior activities they can do in real time. What we’re looking at is: How can we create an environment of actions that are really, really simple to do?

For example, a whistleblowing platform. Two things that I believe will increase whistleblowing. Number one: get people used to talking, speaking out, and reporting good things and bad things. Why are we leaving it to the worst thing ever? Why don’t we actually talk about it a lot more? Why don’t we have meetings where we’re actually regularly getting feedback, and we’re regularly challenging people, so we are more used to using our voices? Number two, and here’s a simple one: go onto the speak-out platform. Go on it. Find the link. Go on the first page. See what it looks like and understand how to use it. Now, if I’m an employee, I am prepared. I’ve done two actions. They might have taken me three minutes at best, but there’s an activity that’s getting me closer to using the controls. And then the fun thing comes when you can actually capture that activity, and you can start doing things with it. Does that make sense?

[12:25] Bringing the Human Element into Compliance

Amanda Raad: It really does, Nicole. The point about spending so much time, energy, and resources on controls that are really important to have—I don’t think any of us are saying that you shouldn’t have those—I think sometimes there’s this resistance to analyzing whether those controls are working, because people are maybe afraid that it’s a judgment that it wasn’t the right thing. But what I really hear you saying is, “No, no, no. It’s leaning into: How do you humanize or make personal these controls so that you can actually use them for the benefit of the individual person?” It almost sounds—I don’t want to say “simple,” but—as simple as putting a voice to the systems that you already have. Bringing the human element to, “This is what it actually looks like. This has happened to me. This is how I navigated this.” It’s like bringing the story to the person.

Nicole Rose: 100%. When I wrote about this—I’ve written my framework on this—I used specifically the words “human element.” And the human element is everything, so you’ve actually hit the nail on the head. I share this concept, this methodology within my community as much as I possibly can, because I want everyone thinking about it. But I say the following: It should be simple—we don’t need to make it difficult. In fact, if we want to get this right, we should be making it as simple as possible. And if we want to go one step further, we should be asking the people who are going to be our users—I call them my compliance customers—what works for them.

Nitish Upadhyaya: Absolutely. I think there’s something here about perspectives, and I’d love to get your thoughts on this. Legal compliance risk: we live in this world. We breathe the regulations. We almost have this perception that we think they’re important, and we know what’s going on, so everyone else should. What do you do to help you and your clients, when you’ve been in-house or otherwise, to step into that person’s shoes—the shoes of the salesperson who has got sales targets, the person in procurement who’s trying to navigate hundreds of contract orders. What do you do to get their understanding of the situation, so you can better cater to them, and support them when times get tough, or a gray-area scenario arises?

Nicole Rose: When I was doing a three-day workshop in Laos with a wonderful team—none of them spoke English, I had a great translator—we started conversing about what I did, what their role is. I started asking about their role. In fact, what I had everyone do is just go up and draw a little stick man and explain. And it was great fun, because it broke down loads, and loads, and loads of barriers, so we were really working together as a team. What we ended up doing was we talked about the problems they’re having, because we had a policy, and the policy didn’t work for them in their culture—not in their language, but their culture—and here’s why. They said, “If I refuse to give the policeman some more money, I’m refusing an elder. That’s not okay. I can’t say ‘no.’ I’m not allowed to say ‘no,’” number one. Number two, “If I don’t pay my brother-in-law, whatever it is, a bit of extra money, he can’t feed his family.” So, we were dealing with real-life events that were happening for them, and my gosh, you would never get that from looking at the policy or sitting on a governance committee. We said, “Let’s think about how you would deal with this situation. How would you say ‘no’? What’s our toolkits so that you’re not the one always saying ‘no’?” And what we understood is we need to distance them from the process. If they were saying “no” directly, they were being disrespectful to their community.

What they came up with was, “Can you print out some small guides, like a code of conduct for us on a PDF, or just the part of it that we need, so we can take it with us, and we can hand it to people? By the way, can we have it in our language, please? And can we have it checked, so people will understand it? So, can we have something that is in our language, that we can give to somebody, that explains that it’s coming from the whole company, and not just us,” number one. Number two, “How about if we don’t have to say that? How about if we tell them to phone up, speak, or email risk and compliance?” Absolutely. Give them my number—I would love to speak to them. “How about if you spent some time going and seeing the elders within our community and explain to them how important it is for us to have jobs, and what we’re trying to do for the community? Could you do that?” Absolutely, we can do that.

Two years later, I got an email from the compliance officer who I was working with at the time. She said, “Nicole, I need to tell you something. It’s just amazing. I’ve just had somebody who’s come into my office so excited. They’ve just left the airport, and they didn’t have to pay a bribe, because they gave them the code of conduct. They just walked through. And guess what? Their colleagues did as well.” Two years later. That isn’t because I’m an amazing trainer, that’s because they spent time, and we spent time with them hearing what they could do, and what their micro-activities were that brought the policy, the governance to life. I love that, and I still think about that so much. It can work. We can get this right, so long as we’re collaborating.

[17:50] Building Trust with the Business

Richard Bistrong: Nicole, that was great. One thing that I’m curious about is your views on controls and trust, because there’s almost this reflexive response to, “We had a breach. There’s a new regulation, more controls.” How do you think that impacts the workforce when you’re giving them not only, as Amanda calls it, a tsunami of regulations, but a tsunami of controls? How does that impact trust from your experience?

Nicole Rose: I’ve done a lot of work with banks, and AML regs (massive), particularly in Australia, but couple that onto all the ones in Europe as well, and the large bank I was working with needed to put in place a ton more controls. Now, what these controls meant was that it was uncomfortable and difficult for managers not only to onboard customers, but also to have a relationship with the customers, because they’d have to go to the customers and say, “By the way, I know you gave me your passport a year ago, and it’s been verified, but we need to go through the entire verification process until you can use your account again.” Those weren’t just controls that are a bit annoying to do internally—those were controls that hit the customer. And these people, they love their customers—they have really, really close relationships with them, and they didn’t want to waste their time. So, I happened to be brought in on this project. What we needed to do was to give them the most extraordinary “why.” That “why” needed to be so good, because that “why” needed to be sold to the customer. If we have these people going out to their customers saying, “Compliance have made us do this again,” we’re going to devalue our brand. We need them going out selling that this is an awesome thing, so we needed to think about what matters to them and get them more engaged with their customer. So, there’s two things that we did. Number one, we gave them the internal “why.” “You’ve been operating, and that’s okay, as a smaller-larger bank, in this particular way. But you’re actually part of something so much bigger. You’re part of all the good stuff in this larger organization, and we want you to be a part of it. We don’t want you to miss out on all the good stuff.” So, we needed to give them a massive “why,” and get them excited with other things. And then, with the customer, we actually plugged it on to some other really, really important legislation that was coming in to do with vulnerable customers, so we could actually tie it into a really great thing that we are doing that was responding to a government initiative.

Nitish Upadhyaya: I love the creativity in aligning on different risks for different people in that and making sure that everyone gets what they need to know to move that behavior forward. I think building on that theme then, what other stories do you have, or advice do you have for compliance teams themselves, or risk, audit, whomever, who are looking to sell the value internally of what they do? You talked at the start about compliance not just being a defensive shield, but a driver of value. How do we do that?

Nicole Rose: I believe that one of the things that we need to do is be actively involved in recruitment. And I don’t mean recruiting people in the business to do more compliance—I mean recruiting our best advocates that we can possibly have, which is our managers and our leaders. I reckon we need to start with them. And that’s not about telling them how great compliance is and how good it is for their business. They should know that—that’s their job. What I mean, and this is what I’m personally doing it with, we’ve got a new policy, we’ve got a new initiative—it is your responsibility to make sure it’s rolled out. “I want to give you every single piece of support I can. How are we going to make this happen? What are we going to do together?” Here’s a video we made or an infographic. “How is that going to work? How are you going to distill that to your team?” I would go with the managers—best sales team ever.

[21:55] The Power of Pilots & Testing

Amanda Raad: One of the things, Nicole, that you’ve talked about throughout this, it’s getting everyone to take some kind of individual accountability. I think what we end up doing is humanizing all of this so that people understand their “why,” so that people will take action, like to move people into the right kind of behavior. I suppose it’s related to what you just said, but how do you empower people to take that first individual step of what they’re going to do, and to realize that actually it doesn’t have to be this huge thing where a bunch of resources are allocated, but to be accountable for something that actually moves the needle? Do you have any tips on that?

Nicole Rose: Are you saying in terms of how would you do that from a compliance perspective, or from an employee perspective?

Amanda Raad: I think it could be either one, because I think that could be related. I’m really glad you asked that question, because to humanize things, I think that it’s a blurring of it all—like, to make compliance actually work, I think we have to look at it from the employee perspective.

Nicole Rose: The truth is that when we think we need to solve everything, we’re not going to do anything. This is personally how I always do everything: I get a team—maybe they’re a difficult team; maybe they’re a new part of the business. I’ll take a new team, and I’ll say, “Let’s run a pilot. Can you be my pilot? I just want to test one thing. All I want to do is measure conflicts of interest, for example. You haven’t really been involved in the process. I just would love to measure how you go about making decisions around conflicts of interest.” That’s it—it’s a very small thing. And in fact, all I’m doing is for one part of conflicts of interest. Maybe I’ll choose something like secondary employment—I’ll just choose one small thing. Then, I’ll say, “I’m going to use this as a pilot, and I’d love to get some data. Can you just help me with this, and capture when these three activities come up in your work life over the next month?” That will be the manager having a discussion. You’ve then got a test case. You’ve got something that you can use, and you can repeat that. You’ve then got a repeatable process you can use for anything. That’s what I do: start small, make it simple.

[24:05] What Works and What Doesn’t in Training

Richard Bistrong: Nicole, you have such a unique perspective in that you have developed training as one part of your career chapter, and you’ve also had to roll out training in other parts of your career chapter. I don’t know anyone else that has seen it from both sides. If you’ve seen one thing that works really well, that our listeners can think about, what would that be? And if you’ve seen one thing that just consistently fails, but is continued to be used, what might that be?

Nicole Rose: The first thing I’m going to say is I don’t care how long or short the training is. I don’t care how engaging and entertaining it is or isn’t. You can make anything great without changing it. Let’s take an example of AML training. Forty-five minutes of regulator-required AML training—it’s tough. It’s not engaging. It’s click mouse, but you have to go through it. And you’ve got to pass an exam at the end. Horrible—everyone hates it. So, our job—and I think what I’ve seen done really well, or what I like to do as well—is to make that palatable. I call it “pre-framing.” How do you pre-frame it? A great way to do it—Amanda, this goes to your human element—I would turn around and say, “Hi, guys. Even I find this training really hideous. We have to do it—we absolutely have to. We cannot operate unless we do this training. That’s it. It’s going to take 45 minutes to an hour of your life. Here are the things that are going to come up. And you might laugh halfway through it, because you’re going to hear what I say—you’re going to hear my words, and you’re going to remember it.” I would try to make it as engaging, funny, and useful as possible before they start the training, but I would also pre-frame it with some things. I think a lot about the brain and how we learn, so however bad the training is, I can give them some pointers so they can reflect on those when they’re actually doing the training. The training then becomes useful—even though it’s boring, it becomes useful. So, let’s humanize it, let’s be absolutely clear about it, and that is what I think makes training successful.

Richard, I will say that—I’m very biased—we were involved in a project together. I have never had such good response to training, ever. People loved that video—they still do. I was showing my team—they were like, “This is awesome.” Everything is a real story, is a real person, and there’s so much humanness to it. So, I love anything like that. The things I don’t love—I’m going to be totally honest, I might get into trouble—is things that are too funny, and they’re just using humor with things that I think are really, really important, and I think it devalues a training. I think compliance can be fun. I think it can be engaging. I love putting together presentations that are fun and engaging, but I don’t think we want to ridicule it, and I don’t think it does it justice.

[27:10] Key Takeaways

Nitish Upadhyaya: Absolutely. I think that point around not making it gimmicky but making it time well spent for the individuals that are taking it, is really important. That’s one of my key takeaways from this conversation. Richard, what about you? What’s your biggest takeaway from our chat so far?

Richard Bistrong: Recruit people to help. Recruit people in the business. Bring people in. We’ve seen a lot of data that especially the younger generations want to know why this is important, so that links to the power of “why” that Nicole talked about. And pressure testing it—asking people, “We want to see how you’ve put this into your daily work. Help us understand.” And also, I really liked that, again, it doesn’t mean it’s funny, but there is some power in levity, and how you frame things. It could be the same piece of training, but I love, Nicole, on how you frame it can make a difference into how people absorb it. Wonderful nuggets, tidbits, and actionable—this is great.

Nitish Upadhyaya: What about you, Amanda?

Amanda Raad: I think the thread that comes together for me, which complements the power of “why,” and the human element of all of this is really try to talk to people, and interact with people, to understand what they’re actually facing, and then, help them problem solve with you. I love the fact that when you got to the point of understanding that the team didn’t know how to say “no,” instead of just saying, “Here, you’re going to do X, Y, Z,” it sounds like the team came up with what they would feel comfortable doing, and then, you worked together to figure it out. I think some companies are afraid to even find out that it’s true that they don’t know how to not pay the bribe—some people don’t want to know, and they put their blinders on. But here, you leaned into it, and said, “Great. Now, work with me. Tell me what we can do to make this work for you.” I just think it’s such a great example that pulls all of these themes together—really impactful.

Nitish Upadhyaya: As we come to a close, what final piece of advice do you have for our listeners?

Nicole Rose: I would say keep it really, really simple. Make it about relationships. Think about the other person. Think about the human element. But keep it simple. People understand simplicity, and they really appreciate it.

Nitish Upadhyaya: Brilliant. Well, we have lots to bear in mind. There’s one thing I’m curious about before we do leave you: What’s your next artistic project? Where’s that going to take you?

Nicole Rose: I’ve got a very good friend who takes me to life drawing classes, which is fabulous. And what I’ve realized is that I’m actually going to start thinking about mastery, and I’m going to start learning about the anatomy, because that will allow me to be better at what I do. I love drawing and painting people, but wouldn’t it be great if I actually got it right. So, I’m really looking forward to delving into that, and being more precise and technical.

Nitish Upadhyaya: I have very limited artistic flair, so that sounds like something I can aspire to in the grand scheme of things, but also it reminds me that there are things that you can do in the adjacent that then improve the main thing that you’re really striving to achieve. Thank you so much for all of your wisdom, stories, and experiences. Where can listeners find out more about you and your work?

Nicole Rose: All they’ve got to do is go on to LinkedIn. I’ve got a newsletter, where I talk about all of this stuff, by the way. Connect with me. Say hi. Comment. Reach out. And I’d be delighted to talk.

Nitish Upadhyaya: Well, we are grateful for your time. Thank you very much.

Amanda Raad: Thank you so much.

Nicole Rose: Thank you so much.

Richard Bistrong: Thank you, Nicole. This was great.

Nitish Upadhyaya: Thank you all for tuning in to the latest episode in our Culture & Compliance Chronicles series. For more information about our series and any of the ideas discussed today, take a look at the links in our show notes. You can also subscribe to the series wherever you regularly listen to podcasts, including on Apple and Spotify. Amanda, Richard and I will be back very soon for our next chapter. If you have topics you’d like us to cover or novel perspectives you want everyone else to hear about, get in touch. Thanks again for listening. Have a wonderful day and stay curious.

---

Show Notes:

• Untold Compliance
• “Why We Say Yes” trailer (Bistrong)
• The Eight Mindsets podcast (Meyer, Rose)
• Moneyball: The Art of Winning an Unfair Game (Lewis)
• Nicole Rose, LinkedIn
• Nicole Rose, Untold Compliance newsletter