Contents
Why culture matters more than procedures
The guidance published by COSO and the SCCE in 2020 is blunt: without a culture of compliance and integrity, even the most carefully designed controls remain vulnerable. An employee who sees their leaders bypassing the rules concludes that the rules are optional.
The COSO ERM framework devotes two principles to this: Principle 3 (defines desired culture) and Principle 4 (demonstrates commitment to core values).
The elements of a compliance culture
| Element | In practice |
|---|---|
| Tone from the top | Leaders talk about ethics, apply the rules to themselves and reinforce them in their communications |
| A code of conduct | Approved by the board, written in plain language, available in French and Arabic, with concrete examples |
| Training | For all employees and directors, tailored to the risks of each role |
| Metrics and incentives | Compliance objectives built into performance reviews and remuneration, especially for senior leaders |
| A whistleblowing mechanism | An accessible channel, with the option of confidentiality, and zero tolerance for retaliation |
| Prompt investigations | Every report is examined seriously and within short timeframes |
| Consistent discipline | The same sanctions for the same misconduct, regardless of the person's rank |
| Sharing lessons learned | Mistakes are analysed and lessons shared, without looking for scapegoats |
The Moroccan context
- Hierarchy. In a culture with high power distance, employees often hesitate to contradict a superior or to report conduct coming from the top. A reporting channel that bypasses the line of management is therefore essential.
- Whistleblower protection. Law No. 37-10 of 2011 introduced protection for victims, witnesses, experts and whistleblowers in corruption cases. An internal mechanism should build on this framework and guarantee confidentiality.
- Preventing corruption. The INPPLC (the National Authority for Probity, Prevention and Fight against Corruption), governed by Law No. 46-19, is the national authority on integrity and corruption prevention.
- Data. A whistleblowing mechanism processes personal data, sometimes sensitive data: it is subject to the formalities of Law 09-08 on personal data protection.
Measuring culture
Culture can be measured, even if imperfectly: anonymous employee surveys, the number and nature of reports, handling times, audit findings, training completion rates. Zero reports is not a good sign: it often means that employees do not dare to speak up.
The link with customer experience
Employees who follow the rules out of conviction also treat customers more consistently. A compliance culture and a customer-centric culture reinforce each other.
Further reading
- 4 min read
- 3 min read
- 3 min read
Frequently asked questions
How can you tell whether a company has a compliance culture?
A few signs: leaders apply the rules to themselves, employees know the code of conduct, reports come in and are dealt with, and sanctions are the same regardless of rank. An anonymous employee survey is a good way to check.
Is a whistleblowing mechanism mandatory in Morocco?
There is no general obligation for all companies, but certain sector regulations and the expectations of international partners make it increasingly indispensable. Law No. 37-10 provides protection for whistleblowers in corruption cases.
Is a low number of reports good news?
Rarely. A very low number of reports usually signals that employees do not trust the mechanism or fear retaliation, rather than an absence of problems.
General information, not legal advice.
Report an errorReferences (3)
- ISO 37301:2021 — Compliance management systems — Requirements with guidance for use. (opens in a new tab)
- Law No. 46-19 on the National Authority for Probity, Prevention and Fight against Corruption (INPPLC).
- Law No. 37-10 on the protection of victims, witnesses, experts and whistleblowers (2011).