A compliance framework is often considered, to the extent it’s considered at all, as a static control system with rules to follow, boxes to tick, and penalties to avoid.
But in practice, at least in my experience, it behaves more like a dynamic system: it evolves, reacts, and, if poorly designed, distorts the very behaviours it intends to shape.
Inspired by my superficial understanding of Newton’s Laws of Motion, I’ve been developing what I call the Laws of Compliance: a set of observations drawn from my personal experience and from my understanding of behavioural economics, systems thinking and psychology. These aren’t immutable truths, but principles against which we can examine why even well-intentioned compliance efforts sometimes backfire (spectacularly).
One final warning: These are not scientific principles but reflective tools and deliberate provocations drawn from bitter experience and obsessive observation. Like Newton’s insights into physical behaviour, they’re intended to illuminate the forces shaping compliance outcomes, even when intentions are good and systems are complex.
First Law: The Law of Inverse Outcomes
“A compliance framework, if poorly designed, can produce behaviours contrary to its purpose.”
Just as Newton observed that bodies remain in motion unless acted upon, people tend to follow the path of least resistance. If a compliance process makes honesty or transparency costly, inconvenient or risky (for instance, because of reputational damage, bureaucratic hurdles, or possible penalties) it actively discourages the very conduct it’s meant to promote.
Take, for example, the push for public disclosure of mandatory breach reporting. It may well encourage licencees to conceal rather than report breaches, fearing media or reputational consequences more than regulatory ones. Similarly, Adviser Leaderboards, often designed to celebrate professionalism, often distract focus from issues to positions.
Design Implication: Align incentives with outcomes. Make doing the right thing the path of least resistance.
Second Law: The Law of Virtue Signalling
“Public commitments to high ethical standards can be performative, concealing rather than correcting actual conduct.”
When compliance becomes a tool for branding, it can drift from substance to signalling. Organisations may adopt aspirational codes or publish values-driven charters that are not meaningfully embedded in practice. This is particularly likely when the organisation relies on internal compliance resources rather than subjecting itself to external scrutiny and challenge. Some organisations apply ethical standards more stringently to others than to themselves, undermining credibility and trust.
This disconnect not only erodes internal trust but can obscure real issues. The louder the virtue signal, the more scrutiny it sometimes deserves. This law correlates with what’s commonly known as the Barrett Principle – “saying is more important than doing”.
Design Implication: Prioritise integrity over image. Align external commitments with internal culture and enforcement.
Third Law: The Law of Rationalisation
“Non-compliance can be normalised and rationalised by reference to technical rules or internal standards.”
People rarely believe they are doing the wrong thing. Often, non-compliance is reframed as pragmatic adaptation or client service. Internal policies, past precedent, or loosely defined standards can be used to justify choices that conflict with external obligations or core ethics.
This rationalisation is not always malicious, it’s often cultural, incremental, and deeply embedded.
Design Implication: Outcomes are more important than technicalities. Challenge norms regularly. Question opinions. Encourage critical review of practices, especially those justified by “this is how we’ve always done it.”
Fourth Law: The Law of Commercial Pragmatism
“For every compliance rule imposed, there is an equal and opposite workaround developed.”
This is the compliance equivalent of Newton’s third law. Rules, especially prescriptive ones, become puzzles to solve. Creative professionals and legal teams find ways to technically comply while completely missing the point. At an adviser level, more convenient options may be preferred over more correct options. For example, because of the SoA “compliance burden”, recommendations may be presented as “client-directed transactions” or the retail client re-classified as wholesale.
The consequence? Rigid Anti-Money Laundering (AML) rules may lead to “de-risking” whole customer groups, thereby excluding legitimate users rather than managing the risk intelligently.
Design Implication: Regulate for principles and outcomes, not just rule adherence.
Fifth Law: The Law of Bureaucratic Complexity
“The more complex and detailed your compliance framework is, the less effective it becomes at engaging people or preventing core risks.”
Like Newton’s second law, this one addresses force and resistance. Compliance programs can become so weighed down by documentation, sign-offs, and procedural excess that they lose the capacity to respond to real risk. Worse still, even well-intentioned actors struggle to manage complexity. When obligations aren’t easily understood, errors occur.
Too often, organisations confuse activity for effectiveness, creating what some call performative compliance or “compliance theatre.” The show looks impressive, but the substance is hollow.
Design Implication: Strip away complexity. Design for clarity and responsiveness, not bureaucracy.
Sixth Law: The Law of Ethical Substitution
“When compliance becomes a checklist, procedure trumps ethical judgment.”
Checklists are efficient, but dangerously so. When people are rewarded for ticking boxes, they stop thinking critically. Kahneman’s System 1 takes over: fast, automatic, rule-bound thinking replaces reflective judgment.
We’ve seen phone-based advisers focus on disclosure scripts rather than customer comprehension. It’s not deception, it’s disengagement.
Design Implication: Build systems that encourage reflection and judgment, not mere task completion.
Seventh Law: The Observer Effect
“Compliance arrangements change the behaviour they are meant to monitor, often in misleading ways.”
When you start measuring behaviour, you inevitably influence it. This is a version of Goodhart’s Law in corporate form: when a measure becomes a target, it ceases to be a good measure.
Staff start optimising to the metric rather than the intent behind it. This is particularly visible in call centres, where adherence to scripts is monitored, but genuine understanding or care is not.
Design Implication: Measure what matters. And ensure your metrics drive real outcomes, not just superficial compliance.
Eighth Law: The Law of Cultural Entropy
“Without active and deliberate reinforcement, compliance cultures degrade over time.”
Even the strongest compliance cultures erode without conscious upkeep. Familiarity breeds complacency; over time, practices drift, shortcuts become norms, and the original intent of systems is forgotten.
This decay isn’t due to negligence, but to entropy—systems lose integrity without energy applied to their renewal.
Design Implication: Embed cycles of review, retraining and cultural reinforcement. Treat compliance as an evolving discipline.
Ninth Law: The Law of Opposition
“Effective compliance arrangements require an active internal champion; over time, that champion becomes a threat to the business they serve.”
Strong compliance depends on strong advocates—people willing to challenge decisions, resist pressure, and protect integrity. But in many businesses, this role creates inevitable tension. Compliance champions who refuse to compromise are seen as roadblocks; those who relent lose credibility.
This is, I presume, the basis for Holt’s Observation that competent compliance managers rarely survive longer than four years in developing or immature businesses. The counterpoint to Holt’s Observation, the Geoff Principle, is that ineffective and malleable compliance managers are seldom replaced.
Design Implication: Protect the challenger. Build governance systems that support and reward principled resistance, not amiability and quiet acquiescence.
Compliance isn’t just about preventing harm, it’s about designing systems that elevate judgment, resilience, and trust. These laws are a starting point for reflection and refinement. Let’s not aim for more rules, but for better systems that work in practice, not just on paper.
If you’ve observed other “laws” in the field, or if you disagree with these, I’d welcome your thoughts.
Alternatively, if you’re looking to design a compliance framework that encourages ethical judgment, aligns with regulatory obligations, and avoids the pitfalls outlined above, Assured Support offers independent compliance reviews, tailored risk management advice, and regulatory support services across Australia. Let’s build systems that work in practice, not just on paper. Contact us today to explore how we can support your compliance strategy.
Do you want more like this? If so, we recommend that you read:
Compliance 101: Approaches and principles
The Three Lines of Defence: Compliance Miracle or Mirage?
Why Compliance Isn’t Enough: Reconciling Law with Ethical Principles and ASIC’s Expectations
Frequently Asked Questions
1. What is the Law of Inverse Outcomes in compliance?
The Law of Inverse Outcomes highlights that poorly designed compliance frameworks can unintentionally encourage the very behaviors they aim to prevent. When transparency becomes risky or honesty is penalized, individuals may choose concealment or workaround strategies instead of genuine compliance.
2. How does virtue signalling affect compliance programs?
Virtue signalling in compliance refers to performative ethics—when companies promote high ethical standards publicly without embedding them in actual practices. This disconnect can undermine trust, mask systemic issues, and ultimately reduce the effectiveness of the compliance program.
3. Why do employees rationalise non-compliance?
Non-compliance is often rationalised through technical interpretations or internal norms, not malice. People justify behaviour by referencing precedents or ambiguous policies, turning ethical lapses into normalised practices. This cultural drift emphasises the need for outcome-based oversight.
4. How does compliance complexity hinder effectiveness?
Overly complex compliance systems with excessive procedures and documentation can lead to confusion, disengagement, and performative compliance. Simplifying frameworks enhances clarity, usability, and actual risk management rather than just appearing compliant.
5. What is the role of internal compliance champions, and why are they at risk?
Internal compliance champions play a critical role by challenging unethical practices and advocating for integrity. However, over time, their resistance can be seen as obstructive, leading to marginalization or replacement—highlighting the need to protect and empower principled voices in governance.
