The Conventional Wisdom
At compliance conferences, you'll often hear: "We need to prove compliance drives business value." Practitioners focus on ROI calculators and competitive advantage arguments. The belief is that if you can't show how your program boosts market share or cuts insurance costs, you'll struggle to get executive support or budget.
This mindset is so ingrained that compliance professionals spend more time on presentations about theoretical cost avoidance than on actually preventing misconduct.
Why We Disagree
The obsession with a business case creates a risky situation: if compliance must justify itself financially, it becomes negotiable when the numbers don't add up. And often, they don't, especially under short-term profit pressures.
At the SCCE Compliance & Ethics Institute, Piergiorgio Pepe, former compliance and ethics director at AbbVie, highlighted this issue. He argued that focusing too much on compliance as a business advantage makes it seem optional when outcomes aren't favorable.
Consider when market conditions change. A company that once championed DEI as a core value might drop those commitments if stakeholder sentiment shifts. If values were truly fundamental, they wouldn't vanish with changing political winds. But if those values were justified only by business benefits, they'll disappear when the calculus changes.
The same logic applies to your entire compliance program. Frame it as a business advantage, and it's expendable when it becomes a disadvantage.
The Evidence
Cynthia Cooper didn't expose WorldCom's $11 billion fraud because she calculated the ROI of asking tough questions. Her determination came from personal values, not a spreadsheet showing fraud detection's long-term benefits. When advising a young compliance professional facing intimidation, she didn't suggest building a better business case. She said: "You walk through that fear. You just do it anyway."
Research cited at the Institute shows fear of retaliation is a major reason employees don't speak up. This fear is justified, as negative consequences for whistleblowers are common. No business-case argument can address this reality. You can't calculate your way out of the fact that doing the right thing often comes with personal cost.
What to Do Instead
Stop leading with the business case. Use it to open doors if needed, but don't let it be your main message. As Pepe said: "Doing the right thing is the right thing to do, regardless of whether it makes money."
In practice, this means three shifts:
Explain the reasoning, not just the rules. When you explain why a control exists, people start to understand its logic. Someone who knows that segregation of duties in AS 2201 prevents both fraud and error will apply the principle even in edge cases not explicitly covered by the standard. Someone who only knows "it's required for Sarbanes-Oxley Act compliance" will look for workarounds under pressure.
Elevate values to the same level as financial targets. Don't hide your code of conduct commitments at the end of presentations. If integrity only appears after revenue projections and efficiency metrics, you're signaling what truly matters. Put values on page two, not page twenty.
Accept that discomfort is inherent to the work. Pepe's observation that "there's no ethical work without discomfort" should be freeing. If you're always comfortable, you're likely not doing real compliance work. Genuine programs create friction, slow deals, and force tough conversations. That's the point.
When engaging with whistleblowers, remember Jane Norberg, former chief of the SEC's whistleblower office, emphasized: the first touchpoint can "make or break the entire rest of the relationship." Acknowledge reports within 24 to 48 hours. Interview the reporter first if their identity is known. Critically, don't send the complaint immediately to the accused, a common reflex that can harm investigations.
Cooper added another practice: don't isolate whistleblowers. "Empathize with the person. Independence or confidentiality doesn't mean there should be no communication with the whistleblower." Regular contact shows that speaking up matters more than avoiding discomfort.
When the Conventional Wisdom Is Right
The business case isn't wrong, it's just not enough. You need budget and executive support. Demonstrating how your program prevents penalties or enables opportunities can help secure both.
Use the business case tactically when negotiating for resources or explaining program value to financially-minded board members. A well-constructed cost-benefit analysis can win you the headcount for a vendor risk program or the budget to upgrade your control testing tools.
But never let the business case be your program's foundation. If it is, you've accepted that compliance is conditional, values are negotiable, and doing the right thing depends on profitability. That's not a compliance program. It's a risk calculation that will fail when the numbers change.
Your job isn't to make compliance comfortable or consistently profitable. It's to make it durable enough to withstand the moments when it's neither.
