Compliance is often defined through rules, regulation, and control frameworks.

The challenge is not the absence of rules. It is how those rules are interpreted and applied in practice.

In this RiskMasters bonus episode, Jennifer Geary and Natalie McManus explore the difference between rules-based compliance and principles-based compliance, and why starting with harm leads to better decisions.

The discussion focuses on a shift in sequence.

Compliance processes typically begin with the question: what does the rule require.

In practice, decisions are shaped earlier, when potential outcomes and risks are considered.

Starting with harm changes how compliance operates.

It requires organisations to consider impact before interpretation, and to apply rules in context rather than in isolation.

This creates a shift in how compliance decisions are made:

• decisions are anchored in potential harm rather than rule interpretation
• rules are applied in context rather than followed mechanically
• judgement is exercised earlier in the decision process
• supervision is balanced with trust and capability
• compliance supports outcomes as well as adherence

The extract also highlights the role of supervision.

Organisations can increase control through oversight, automation, and monitoring.

This reduces the risk of error. It also increases cost and can reduce flexibility.

Alternatively, organisations can invest in judgement, enabling individuals to act as their own control.

The balance between supervision and autonomy becomes a risk decision.

For organisations, this changes how compliance supports governance and risk management.

Compliance is not only about meeting regulatory requirements. It is about how those requirements are interpreted, prioritised, and embedded in decision-making.

This includes how harm is identified, how rules are applied in context, and how judgement is developed across the organisation.

Strengthening these capabilities improves how organisations manage compliance risk, support decision-making, and align outcomes with regulatory intent.

This extract is taken from the RiskMasters episode with Jennifer Geary and Natalie McManus, discussing principles-based compliance, decision-making, and the role of the Chief Compliance Officer.