Compliance has conquered entire organizational charts with codes of ethics, risk matrices, and protocols for almost everything. But there is an uncomfortable question: who supervises those in charge? Who controls the board member, the president, or the management committee? In many organizations, the system works downwards, but not upwards. And that blind spot makes compliance a dangerous illusion: one that leaves those who make the most critical decisions unchecked.
In practice, most regulatory compliance models work in a top-down manner. Obligations are imposed on employees, suppliers, and even external collaborators, but the board of directors, senior management, and, ultimately, those who approve policies are often outside the reach of the same control mechanisms they demand of others. The result: an unowned risk.
This gap is not anecdotal, it is structural. Because true ethical leadership is not demonstrated by signing codes of conduct, but by submitting to them. However, corporate fictions persist that confuse commitment with rhetoric: according to this logic, it would suffice to declare that “the governing body leads by example” to consider the matter resolved. But that is not leadership: it is compliance marketing.
The rules and standards are clear. UNE 19601, ISO 37301, and the Guidelines of the Attorney General’s Office insist that senior management’s commitment must be measurable, verifiable, and auditable. Presumed willingness or declarations of principle are not enough. And yet, in too many compliance audits, the president is never interviewed, strategic decisions are never reviewed under ethical criteria, and the real culture of integrity at the highest level is never evaluated. Thus, the body that should be setting an example falls outside the scope of the model it approves.
This is more than an oversight: it is a crack in governance. And that is where the most costly scandals are incubated, not only in criminal terms, but also in terms of reputation and culture. Because when the top brass is not subject to the same rules as the rest, the organization perceives it. And then compliance ceases to be a pillar and becomes a facade.
A mature compliance system is not measured by the number of policies it accumulates, but by its ability to establish horizontal and vertical controls, without hierarchical exceptions. This implies real independence of the compliance body, unfiltered access to the Board, ethical evaluation of management performance, and the effective possibility of investigating any level. Without these elements, everything else is cosmetic.
Marta Molina
Head of Corporate Compliance
mmb@uhy-fay.com
