EV MBA: Run It Like You Own It — Influence, Culture, and Metrics That Matter

If your compliance department were a startup pitching investors, would anyone write a check? Do you have a clear value proposition, a happy customer base, measurable outcomes, and a growth strategy? Those are business questions, and in the sixth and closing session of the Ethicsverse MBA series, host Nick Gallo argues they are exactly the questions every compliance leader should be asking about their own program.

The series began with understanding the business you're in, then moved through the language of the CFO, connecting compliance to strategy, the sales and marketing revenue engine, and operations, supply chain, and technology. This final session, Run It Like You Own It, pulls all five threads together into one closing argument: compliance is not a program you manage, it's a business you run. That means building influence without relying on authority, understanding the behavioral science behind why people cut corners, measuring culture instead of guessing at it, mapping the stakeholders who decide your program's fate, and replacing activity metrics with the impact metrics that actually move a boardroom.

Key Takeaways

Formal Authority Is the Least Reliable Tool You Have

• Compliance officers rarely have direct authority over the people who create risk. The counterparts who most need to change behavior are often peers, or leaders a level up, which makes influence, not authority, the name of the game.

• Power in an organization comes in five flavors: formal authority (title and org chart placement), expert power (credibility from knowledge), relationship power (alliances and reciprocity), referent power (reputation and trust), and information power (access to data others don't have).

• Relationship power is the most sustainable of the five. Titles and expertise can open a door once, but alliances built on reciprocity keep it open, and they hold up even when someone has no formal authority at all.

• Every interaction is either building credibility or eroding it. The most effective compliance officers make people want to comply, through reciprocity, invisibility of friction, or explaining the why behind the what, rather than compelling compliance through fear.

Five Influence Tactics That Work in Any Direction

• Ask before you tell. Understanding someone's world first lowers their guard and makes them far more receptive to feedback than walking in and announcing what they should do.

• Lead with data, not regulations. Framing feedback in the declarative tense, "here is what is happening," is more persuasive than the conditional tense, "here is what you should do because of a rule."

• Make the compliant path the easy path. The less friction a compliant choice carries, the less likely stakeholders are to look for a shortcut around it.

• Celebrate wins publicly, and connect them to the organization's own objectives whenever possible. Compliance teams tend to under-celebrate progress that is genuinely worth showcasing.

• Be available, not just authoritative. Influence tied to mere authority is fragile; influence built on approachability and trusted relationships is far more durable, and it's what separates the compliance officers who change organizations from the ones who don't.

Why Good People Cut Corners

• Most misconduct isn't the work of bad actors. It comes from a handful of predictable, human sources: cognitive biases like anchoring and confirmation bias, social pressure from watching what everyone else actually does, and situational factors like time and budget pressure at the end of a quarter.

• Moral disengagement plays a role too, when employees who started out idealistic get worn down over time and stop believing their choices matter.

• The largest bucket, though, is simple ignorance: good people making bad decisions because they never understood the why behind a policy, not because they intended to violate it.

• Regardless of the source, compliance is usually the function left cleaning up what looks like an isolated violation but is often a systemic gap in process, communication, or incentive design.

Nudge Theory: Make the Compliant Path the Default Path

• Default settings matter: when the compliant option is the default, people have to actively opt out of doing the right thing, which is a much higher bar than opting in.

• Choice architecture works by simplifying the right decision and adding friction to the wrong one, rather than relying on willpower alone.

• Social norms are the most powerful lever available. Telling people that the vast majority of their colleagues already completed their training on time moves behavior far more than a simple reminder, because it shows that doing the right thing is already the norm, not the exception.

• Timely reminders, tied to real decision points rather than a single annual training event, work with the Ebbinghaus forgetting curve instead of against it. People forget roughly 90% of what they learn within thirty days, so sporadic micro-learning throughout the year breaks through where a once-a-year module can't.

• Designing systems where compliance is easy, through pre-populated forms, automated workflow checks, real-time guidance at the decision point, and non-monetary recognition, asks employees to behave like themselves, not like heroes.

Culture Eats Compliance for Breakfast, and You Can Measure It

• Culture, not strategy, is the only sustainable competitive advantage in business. If the culture doesn't support ethical behavior, no amount of policy, training, or posters in the break room will close the gap.

• Culture is measurable, not just anecdotal. Speak-up rate trends, the mix of reports coming from managers versus anonymous channels, and changes in anonymity rates over time all say something concrete about how much employees trust the organization.

• Manager behavior surveys, exit and stay interview themes, engagement scores, and retaliation claims round out the picture. Employees are six to eight times more likely to bring risk intelligence to a manager than to a hotline, and just as likely to leave the organization over a bad manager relationship rather than the company itself.

• Leading indicators, like speak-up rates and engagement trends, are predictive. Lagging indicators, like fines and turnover spikes, are reactive. The goal is to spend more time watching the leading indicators so problems surface before they become lagging ones.

• Influencing culture happens through concrete moves: partnering with HR on exit interviews, embedding ethics into performance reviews, publicly celebrating decisions where someone chose integrity over a deal, and recruiting the CEO as an active culture champion, since a whisper from the top is a scream down below.

Map Your Stakeholders Before You Need Them

• Every organization has a recognizable cast: the CEO who sets tone and controls budget, the CFO who thinks in ROI and cash flow, general counsel as a natural ally, HR as a culture and training partner, the CTO as a technology governance partner, and business unit leaders, where compliance and noncompliance actually happen day to day.

• Building these relationships takes deliberate time, not leftover time. Scheduling recurring one-on-ones and treating them as an investment in the program's future, not a networking nice-to-have, is what separates programs that grow from programs that stagnate.

• Skeptics and blockers deserve a strategy too: find common ground, lead with data instead of assumptions, build allies close to the skeptic rather than confronting them head-on, and remember that the vast majority of interpersonal conflict traces back to a misunderstanding rather than bad intent.

Swap Activity Metrics for Impact Metrics

• Training completion rates, policies distributed, and hotline volume are activity metrics. They're fine as a foundation, but on their own they tell executives nothing about whether the program is actually reducing risk.

• Impact metrics tell the real story: regulatory exposure reduced, early detection value, cost avoidance realized, turnover cost reduced through improved culture, and time-to-resolution on cases.

• Most teams only need five to seven metrics that account for the majority of the picture, not a dashboard of a thousand data points. Trend lines matter more than any single snapshot, and benchmarking against peers or your own prior performance gives numbers real context.

• Every metric should connect to a business outcome in as few steps as possible. If it takes several logical leaps to explain why a number matters, it's probably the wrong number to be reporting up.

• For executive audiences, a simple red, yellow, green framework does more work than a spreadsheet of raw figures, because it tells leadership immediately where the conversation needs to go.

Build a Business Canvas for Your Compliance Function

• Treat compliance like its own business inside the business, with customers (employees and the board), products (the speak-up program, training, investigations), a business model that demonstrates ROI relative to budget, and a brand and reputation that shapes what people expect before they ever interact with the team.

• A real mission and vision statement matters. If the compliance function's value proposition can't be stated in one sentence, no one else in the organization can articulate it either, and the function will simply become whatever stakeholders assume it to be.

• A four-year case study of a compliance officer who moved from cost center to the executive committee followed this exact arc: building business fluency and relationships in year one, redesigning metrics around impact in year two, embedding compliance into business processes and earning a budget increase in year three, and joining the executive committee by year four.

• What made the transformation work wasn't a bigger team or a bigger budget. It was patience, consistency, and a genuine, non-performative curiosity about the people compliance was trying to influence.

None of this requires a four-year plan or a large team to start. It requires treating every interaction as a chance to build credibility, measuring the handful of metrics that actually move a room, and being honest about whether your function could survive a pitch to investors. If compliance is going to be run like a business, it has to be led like one, too.