Every institution drifts.
Few put it that plainly.
Last-minute exceptions, pressure not to lose a client, and operational workarounds expose the gap between written procedure and actual behavior. Where procedure runs out, culture takes over.
Supervisors recognized this long ago. In 2014, the Financial Stability Board framed its guidance on risk culture around norms, attitudes, and behaviors, noting that a sound risk culture enables institutions to identify, assess, escalate, and address emerging risks or activities outside risk appetite in a timely manner.
But that framework, by itself, does not give a Board of Directors a metric it can track.
Actual culture reveals itself through two processes: how quickly an institution corrects a deviation, and how easily it learns to live with one.
The first can be observed in the time between acknowledging the deviation and demonstrating that behavior has changed. The second can be seen in tolerated exceptions, unresolved findings, and issues that resurface after having been declared remediated.
For a Board, looking at both processes changes the object of oversight. The question is no longer what kind of culture the institution says it has, but what happens after the institution discovers that it has drifted.
When the Dashboard Becomes a Substitute for Evidence
Many institutions manage culture as a program, based on the assumption that if the program progresses, behavior improves. They have training sessions, messages from senior management, surveys, and a quarterly dashboard showing percentage completion.
That dashboard is not useless. It becomes misleading when it presents effort devoted to culture as evidence that behavior has changed. One does not prove the other: progress against the plan is controlled by those reporting it; behavioral change is not.
An institution can measure activity and debate progress yet never reach the question that matters: when a deviation occurred, did someone recognize it, did the signal reach someone with the authority to act, and did behavior actually change?
An institution can complete its entire culture program while approving the same exceptions quarter after quarter. It can report favorable survey results while the same underlying findings reappear months later in another business unit under a different label.
When that happens, the dashboard is not measuring culture. It is measuring the activity organized around it.
And the Board, believing it is overseeing culture, is actually overseeing a calendar.
The Moment an Exception Becomes the Norm
Sociologist Diane Vaughan gave the mechanism a name in The Challenger Launch Decision (1996): the normalization of deviance. Faced with repeated signals that something was wrong, the organization gradually came to treat as acceptable what would once have triggered alarm.
Normalization can escape compliance oversight when each deviation is treated as an isolated event. It does not require an outright breach. It advances when a deviation that causes no immediate harm is tolerated and then becomes the benchmark against which the next deviation is judged.
The standard may remain unchanged in policy, yet cease to be the institution's real point of reference. This can be seen when an exception moves from requiring documented approval to being granted as a matter of routine, or when a limit that nobody formally changed is nevertheless interpreted more loosely in day-to-day practice. The deviation no longer needs to be justified because repeated practice has already turned it into the new standard.
The deviation may even disappear from the metrics. Once it is no longer treated as anomalous, it may cease to be recorded as a finding. A risk-taking unit that has gone too long without escalating anything deserves a question before it deserves congratulations.
In 2018, the prudential inquiry into the Commonwealth Bank of Australia concluded that continued financial success had dulled the institution's senses to non-financial risk. It found complacency, a reactive posture, and an inability to learn from experience. The Australian supervisor imposed an additional AUD 1 billion operational risk capital requirement.
The lesson is not that success produces poor cultures.
It is that success does not prove that culture is working.
The Cost of Closing Without Correcting
The risk is not deviation.
The risk is becoming accustomed to it.
One way that happens is by fixing the case without fixing the system.
The 2017 report by the independent directors of Wells Fargo traced the root cause of its sales practices to distortions in the sales culture and performance management system. It also concluded that control functions took a transactional approach that prevented them from seeing the broader context. Case-by-case management fragmented the information while the incentives remained intact.
From inside the institution, the system appeared to be working: issues were detected, disciplinary action was taken, and cases were closed. But none of that demonstrated that behavior had changed.
The report also reveals an incomplete transmission of the scale of the problem. According to the independent directors, the Board learned through the September 2016 regulatory settlements that approximately 5,300 employees had been terminated for sales-practice-related violations between 2011 and 2016.
Correction requires uncomfortable signals to reach someone with the authority to act. Amy Edmondson found, across 51 teams in a manufacturing company, an association between psychological safety and learning behaviors. It is not a banking study, but it points to a relevant condition: if speaking up carries a prohibitive personal cost, critical information is unlikely to escalate.
The consequences can ultimately reach the criminal arena. In 2024, TD Bank, N.A. pleaded guilty to offenses related to serious deficiencies in its anti-money laundering program. According to the U.S. Department of Justice, between 2014 and 2022 the bank added no new scenarios to its transaction-monitoring system despite known deficiencies and emerging risks.
The hidden cost begins before the sanction and before the loss. Every problem closed without being truly corrected teaches the organization that it can live with the deviation.
