Most organisations believe they have a risk culture. In reality, many have a compliance culture. For executives running fast-growth businesses, understanding the difference between the two is where reputations, and sometimes companies, are won or lost.
We put the tension of a risk culture and compliance culture directly to Anne-Marie Paterson, Acting Chief Risk Officer at Medibank, in the latest episode of RelyOn 🎙️. Anne-Marie has spent her career at the intersection of non-financial risk, people risk, and organisational culture — and she pulls no punches about where most leadership teams are falling short.
“Prescriptive obligations drive a compliance culture… a tick-box mentality. That’s not an argument against regulation. It’s an argument for something more.” Anne Marie Paterson
Risk culture and compliance culture: the comfort of rules and their limits
Rules give people certainty. Anne-Marie acknowledges that plainly: “People naturally want to know what are the limits. What can I do? What can I not do?” Defined boundaries reduce anxiety and clarify accountability, and there’s real value in that.
The problem is what happens next. When teams optimise purely for staying inside the lines, they stop asking the harder questions about second-order consequences, slow-burn cultural drift, and the risks that don’t announce themselves until the damage is done. Regulators globally have noticed this. The Institute of Risk Management has long argued that effective risk culture is behavioural, not procedural. APRA has embedded risk culture assessments into supervisory practice for the same reason: formal controls don’t guarantee sound decisions.
“Compliance culture builds structure. Risk culture builds the judgement to use it well.”
Risk culture is a competitive advantage, not a handbrake
One of the more persistent myths in high-growth environments is that rigorous risk management slows momentum. Anne-Marie challenges that directly…”I don’t think you can have high performance without a mature risk culture.”
That reframe matters. Sustainable performance is not just revenue and margin it’s reliability, reputation, talent stability, and the quality of decisions made under pressure. Amy Edmondson’s research on psychological safety consistently shows that teams who surface problems early outperform those who suppress them. Organisations with genuine risk literacy at every level detect weak signals sooner and avoid the compounding failures that undo years of growth.
Risk culture doesn’t constrain ambition. It disciplines it.
Risk is everyone’s job – including HR
One of the most important shifts Anne-Marie describes is the decentralisation of risk ownership. Risk no longer lives in a central function. It sits with product teams, sales leaders, operations managers and HR.
Anne-Marie is unambiguous on this point: “If you’re an HR professional, I think it’s imperative that you also are a risk professional.” Not by acquiring formal credentials, but by recognising that people risk like psychosocial hazards, restructures, speak-up culture, moral injury, carries enterprise-wide consequences. When HR sees its role purely through a performance-management or compliance lens, it underestimates the influence it has on risk maturity. And when risk functions ignore the human context behind their policies, they miss the early warning signs that matter most.
Mature organisations bridge that divide deliberately. The ones that don’t tend to find out why it mattered through a regulator or a front page.
Empathy isn’t enough — you need the infrastructure
There’s a version of the cultural openness conversation that stops at “create a safe space.” Anne-Marie is clear that this is insufficient. “You could be the most empathetic leader, but if you don’t have the tools and processes… you’re no better than the person who says, ‘I don’t want to hear it.'”
A genuine risk culture requires both the courage to surface uncomfortable issues and the systems to respond to them consistently and fairly. Without psychological safety, risks stay hidden. Without infrastructure, surfaced risks are mishandled. Compliance culture tends to focus on policies and documentation. Risk culture integrates behaviour, systems, and shared understanding into how decisions actually get made.
