Compliance program maturity

The role of organizational culture

Autores

DOI:

https://doi.org/10.12712/rpca.v.201.70058

Resumo

A compliance program's effectiveness depends on behavioral change and value internalization. This study analyzes how elements of organizational culture influence the implementation of compliance programs and proposes a five-stage Organizational Compliance Culture (OCC) maturity model. Using a qualitative approach with content analysis, ten compliance officers were interviewed. Seven OCC elements were identified and five maturity stages proposed: oratory, embryonic, stimulated, full, and internalized. Findings reveal that formal certification does not guarantee culture maturity. Practitioners must focus on cultural internalization, not just procedural compliance, to achieve sustainable integrity.

Downloads

Os dados de download ainda não estão disponíveis.

Biografia do Autor

  • Fabiana Copello, Pontifícia Universidade Católica do Rio de Janeiro (PUC-Rio)
    • PhD student, M.Sc. in Business Administration/PUC-Rio, Bachelor's degree in Business Administration/UFRJ, MBA in Business Management/IBMEC, with 20 years of corporate experience in Internal Controls and Risk Management, the last 10 years of which were in Compliance with a focus on Fraud, Bribery and Corruption and Money Laundering prevention.
  • Patricia Tomei, Pontifícia Universidade Católica do Rio de Janeiro

    Possui graduação em Administração Pública pela Fundação Getúlio Vargas - RJ (1978), mestrado em Administração de Empresas pela Pontifícia Universidade Católica do Rio de Janeiro (1981), doutorado em doutorado sandwich - New School for Social Research (1986) e doutorado em Administração pela Universidade de São Paulo (1988). É professora associada da Pontifícia Universidade Católica do Rio de Janeiro/IAG desde 1982. Foi pesquisadora e professora visitante no exterior da Université Jean Moulin de Lyon (1995),da Ecole des Hautes Etudes Commerciales (HEC) de Montreal (1993), École Superieure des Affaires da Université de Sciences Sociales de Grenoble (1996,1992,1990); da Rissho University de Tóquio (1988), da Florida International University (1994) e da Graduate School of Urban Professions, Department of Management and Human Resources da New School for Social Research (1989). Tem experiência na área de Administração, com ênfase em Administração de Empresas, atuando principalmente nos seguintes temas: cultura organizacional, mudança organizacional, recursos humanos, desempenho organizacional. Publicou vários artigos (vide https://www.webofscience.com/wos/author/record/GRX-4569-2022) e os seguintes livros: "Cultura Organizacional e Privatização: A Dimensão Humana", com Marcelo L. Braunstein (Makron Books,1993), ?Inveja nas Organizações? (Makron Books, 1994) ¿Invidia en las Empresas? (McGraw Hill México, 1994),?Gestão Participativa? (CDRom - CELTEC,1995), Sedução dos Modismos com Adriana Lerner ( Makron Books, 1998), "Cultura e Mudança Organizacional" (organização, Editora PUC-Rio,2008),"Cultura Empreendedora"com Giuseppe Russo e Carla Bottino (Office Book,2008), "O que é a Cultura Organizacional?"( Ed. Brasiliense, 2011),"Lideranças Empreendedoras Cariocas" com Giuseppe Russo e Ana Claudia Pinheiro ( Editora Dedix,2012),"Confiança nas Organizações " com Luciano Quinto Lanz, (PUC-Rio, Elsevier ? Campus,2015), "Humildade nas Organizações"( Editora PUC-Rio,2022) com Sylvia F.Mello e Renato Cuenca. 

Referências

Acar, A. Z., & Acar, P. (2014). Organizational culture types and their effects on organizational performance in Turkish hospitals. EMAJ: Emerging Markets Journal, 3(3), 18-31.

Ahmad, M. R.; Osman, M. H.; Abdullah, A.; Sharif, K.Y. (2024). Evolution of information security awareness towards maturity: a systematic review. Computers & Security, v. 130, p. 103170.

Akinsola, K. (2025). Legal Compliance in Corporate Governance Frameworks: Best Practices for Ensuring Transparency, Accountability, and Risk Mitigation. Accountability, and Risk Mitigation, http://dx.doi.org/10.2139/ssrn.5126542

Altamuro, J. L. M., Gray, J.; Zhang, H. (2021), Corporate Integrity Culture and Compliance: A Study of the Pharmaceutical Industry, Contemporary Accounting Research, vol.39, Issue 1, p.428-458.

Alvesson M.; Sveningsson S. (2016) Changing Organisational Culture: Cultural Change Work in Progress. London: Routledge.

Amankwa, E., Loock, M.,Kritzinger, E. (2021), “Information security policy compliance culture: examining the effects of accountability measures”, International Journal of Technology and Human Interaction, Vol. 17 No. 4, pp. 75-91.

Apooyin, A. (2025). Risk Management and Compliance in a Globalized Economy: Navigating Regulatory Challenges and Strategic Adaptations. GSC Online Press, International Journal of Science and Research, vol. 15 (1) , 985-997.

Berrio, A. A. (2003). An organizational culture assessment using the competing values framework: A profile of Ohio State University Extension. Age, 2(699), 1-052.

Blok, M. (2018) Compliance e governança corporativa: atualizado de acordo com a Lei Anticorrupção Brasileira (Lei 12.846) e o Decreto-Lei 8.421/2015. Rio de Janeiro: Freitas Bastos.

Boss, S. R., Kirsch, L. J., Angermeier, I., Shingler, R. A., & Boss, R. W. (2009). If someone is watching, I’ll do what I’m asked: Mandatoriness, control, and information security. European Journal of Information Systems, 18(2), 151–164.

Cameron, K. S. & Quinn, R. E. (2006). Diagnosing and changing organizational culture: Based on the competing values framework. (Rev. ed.). San Francisco, CA: Wiley (Jossey Bass).

Chang, S. E., & Lin, C.-S. (2007). Exploring organizational culture for information security management. Industrial Management & Data Systems, 107(3), 438–458.

de los Ríos‐Berjillos, A., Rodero‐Cosano, M. L., Ruiz‐Lozano, M., & Mesa‐Pérez, E. (2025). The Institutionalization of an Ethical Culture Through the Implementation of Compliance Systems. Corporate Social Responsibility and Environmental Management, Wiley Online

den Nieuwenboer, N. A., Treviño, L. K., Bishop, D., Kreiner, G. E., & Murphy, C. (2025). Growth through ethical role identity work: the case of ethics and compliance officers. Journal of Business Ethics, 198(1), 85-106.

Delso-Vicente, A.; Diaz-Marcos, L.; Aguado-Tevar, O.; García de Blanes-Sebastián, M. (2025) Factors influencing employee compliance with information security policies: a systematic literature review of behavioral and technological aspects in cybersecurity. Future Business Journal, v. 11, n. 28.

Dubey R, Gunasekaran A, Childe SJ, Papadopoulos T, Hazen B, Giannakis M, Roubaud D (2017) Examining the effect of external pressures and organizational culture on shaping performance measurement systems (PMS) for sustainability benchmarking: some empirical findings. Int J Prod Econ 193:63–76. https://doi.org/10.1016/j.ijpe.2017.06.029

Einhorn, S., Fietz, B., Guenther, T. W., & Guenther, E. (2024). The relationship of organizational culture with management control systems and environmental management control systems. Review of Managerial Science, 18(8), 2321-2371.

Grüninger, S., & Wanzek, M. (2021). Integrity management. In Encyclopedia of Sustainable Management (pp. 1-10). Cham: Springer International Publishing.

Hartnell, C. A., Ou, A. Y., & Kinicki, A. (2011). Organizational culture and organizational effectiveness: A meta-analytic investigation of the competing Journal of applied Psychology, 96(4), 677.

Hsu,J.S.C.; Shih,S.P.(2015)When does one weight threats more?An integration of regulatory focus theory and protection motivation theory. https://aisel.aisnet.org/wisp2015/12

Hu, Q., Dinev, T., Hart, P. and Cooke, D. (2012), Managing Employee Compliance with Information Security Policies: The Critical Role of Top Management and Organizational Culture. Decision Sciences, 43: 615-660.

Ifinedo, P. (2014), Information systems security policy compliance: an empirical study of the effects of socialisation, influence, and cognition, Information and Management, Vol. 51 No. 1, pp. 69-79

Interligi L.(2010) Compliance culture: A conceptual framework. Journal of Management & Organization. 16(2):235-249. doi:10.5172/jmo.16.2.235

Jabeen, F., & Isakovic, A. A. (2018). Examining the impact of organizational culture on trust and career satisfaction in the UAE public sector. Employee Relations, 40(6), 1036–1053. https:// doi.org/10.1108/ER-02-2017-0038.

Kam, H.-J., Mattson, T. and Kim, D.J. (2021), The “Right” recipes for security culture: a competing values model perspective, Information Technology & People, Vol. 34 No. 5, pp. 1490-1512.

Karlsson, M., Karlsson, F, Åström, J.;Denk,T. (2022), The effect of perceived organizational culture on employees’ information security compliance, Information and Computer Security, Vol. 30 No. 3, pp. 382-401.

Mallette, C., & Rykert, L. (2018). Promoting positive culture change in nursing faculties: Getting to maybe through liberating structures. Journal of Professional Nursing, 34(3), 161–166. https:// doi.org/10.1016/j.profnurs.2017.08.001

Mayring, P. (2014). Qualitative Content Analysis: theoretical foundation, basic procedures and software solution. In SSOAR.

Mong, D. D.; Thanh, H.P. (2025). Relationship between internal legal compliance culture, leadership style, organizational trust, and employee engagement in Vietnam’s banking sector. Banks and Bank Systems, 20(1), 147-160. doi:10.21511/bbs.20(1).2025.13

Musah, A.; Padi, A.; Blay, M. W.; Okyere, D. O.; Ofori, B. S. (2025) Ethical organisational culture, effective internal control systems and tax compliance of small and medium scale enterprises (SMEs): The role of corporate governance. Social Sciences & Humanities Open, [S.l.], v. 11, p. 101331, 2025. DOI: 10.1016/j.ssaho.2024.101331

Ong, T.S.; Magsi H.B., Burgess T.F. (2019) Organisational culture, environmental management control systems, environmental performance of Pakistani manufacturing industry. Int J Prod Perf Manag 68(7):1293–1322. https://doi.org/10.1108/IJPPM-05-2018-0187

Pettigrew, A. M. (1979). On studying organizational cultures. Administrative Science Quarterly, 24(4), 570–581.Pilbeam, C., Doherty, N., Davidson, R., & Denyer, D. (2016). Safety leadership practices for organizational safety compliance: Developing a research agenda from a literature review. Safety science, 86, 110-121.

Quinn, R. E., & Rohrbaugh, J. (1983). A spatial model of effectiveness criteria: Towards a competing values approach to organizational analysis. Management Science, 29(3), 363-377.

Russo, G. M., Tomei, P. A., Linhares, A. B. J., & Santos, A. M. (2013). Correlation between organizational culture and compensation strategies using Charles Handy's typology. Performance Improvement, 52(7), 13-21.

Schein, E. H. (2010) Organizational Culture and Leadership. (2nd ed). San Francisco: Jossey-Bass.

Scott, W. R. (2008). Lords of the Dance: Professionals as Institutional Agents. Organization Studies, 29(2), 219-238

Scott, W. R. (2013). Institutions and Organizations: Ideas, Interests and Identities. 4ª Ed. Thousand Oaks, SAGE Publications.

Soares de Souza, T. & Tomei, P. A. (2024), Cultura Organizacional e Lei Geral de Proteção de Dados (LGPD), Revista Pensamento Contemporâneo em Administração (RPCA), Rio de Janeiro, v. 18, n. 4, out. – dez. 2024, 106 – 130.

Tian, Z. (2025). Compliance Culture Shaping: The Way to Cultivate Compliance Awareness within the Enterprise. In SHS Web of Conferences (Vol. 213, p. 02004). EDP Sciences.

Thai, W., & Lumbreras, J. (2023). Moving beyond compliance to conventional wisdom: How I-O professionals can promote an ethical organizational culture. Industrial and Organizational Psychology, 16(2), 170-173.

Tomei, P. A., & Russo, G. M. (2019). Food Safety Culture Maturity Index [FSCMI]: Presentation and Validation. Revista Ibero-Americana de Estratégia, 18(1), 19–39. https://doi.org/10.5585/ijsm.v18i1.2709

Tsohou A, Karyda M, Kokolakis S (2015) Analyzing the role of cognitive and cultural biases in the internalization of information security policies: recommendations for information security awareness programs. Computer Security, 52:128–141. https://doi.org/10.1016/j.cose.2015.04.006

Tyler, T. R. & Blader, S. L. (2005). Can businesses effectively regulate employee conduct? The antecedents of rule following in work settings. Academy of Management Journal, 48(6), 1143–1158

Tyler, T. R., Callahan, P. E., & Frost, J. (2007). Armed, and dangerous (?): Motivating rule adherence among agents of social control. Law & Society Review, 41(2), 457–492.

Verhezen, P. (2010). Giving voice in a culture of silence. From a culture of compliance to a culture of integrity. Journal of Business Ethics, 96(2), 187-206.

Wiley, A., McCormac, A. and Calic, D. (2020), “More than the individual: examining the relationship between culture and information security awareness”, Computers and Security, Vol. 88, p. 101640.

Willink, S. (2021), “A new approach to compliance: what is compliance culture?”, available at: www.ideagen.com/thought-leadership/blog/what-is-compliance-culture

Downloads

Publicado

2026-07-09

Edição

v. 20 n. 1 (2026)

Seção

Artigos/Papers

Licença

Os autores mantêm os direitos autorais e concedem à revista o direito de primeira publicação, com o trabalho simultaneamente licenciado sob a Creative Commons Attribution License, permitindo o compartilhamento do trabalho com reconhecimento da autoria e publicação inicial nesta revista. 

A Revista usa o CC BY. Essa licença permite que outras pessoas distribuam, remixem, adaptem e desenvolvam seu trabalho, mesmo comercialmente, desde que sejam creditadas pela criação original. Essa é a licença mais flexível oferecida. Recomendado para máxima disseminação e uso de materiais licenciados.

Os autores têm autorização para assumir contratos adicionais separadamente, para distribuição não-exclusiva da versão do trabalho publicada nesta revista (ex.: publicar em repositório institucional ou como capítulo de livro), sempre com reconhecimento de autoria e publicação inicial nesta revista.

A Revista ulitiliza o DOI (Digital Object Identifier ) desde 2007 O DOI com a finalidade de autenticar cada artigo, portanto seu conteúdo digital.