On 14 May 2026, Barcelona hosted Cumplen ONE DAY COMPLIANCE, one of Spain's most significant annual gatherings for compliance and ethics professionals. Against a backdrop of accelerating regulatory change across Europe, practitioners convened to examine not only what their programmes require on paper, but what they are actually producing in practice. The question that ran through much of the day was deceptively simple: how do we know our culture is working?
That question has moved from the margins of compliance discourse to its center. Regulators, prosecutors, and boards are no longer satisfied with the existence of policies. They want evidence of impact. And as the gap between stated values and lived organisational behaviour becomes increasingly visible - and increasingly consequential - the pressure on compliance officers to measure, not merely describe, ethical culture has never been greater.
Guillem Casòliva Cabana, Senior Compliance and Ethics Advisor at LRN, addressed that pressure directly in his roundtable at the event. Drawing on LRN's Ethical Culture Benchmark, which surveys thousands of employees across industries and geographies on the behavioural realities of organizational culture, Casòliva laid out a clear argument: ethical culture is not a values statement. It is the behavioural operating system of a company. And like any operating system, it can be understood, diagnosed, and improved, but only if organisations are willing to look at what is actually running beneath the surface.
Insight 1: Ethical culture drives behaviour and you cannot improve what you have not defined
Edit BG
Image
"Before you can measure your culture, you have to decide what you are actually measuring. That sounds obvious. It rarely is."
The first argument Casòliva pressed upon the room was definitional. Many organizations speak about ethical culture fluently - in annual reports, in onboarding materials, in town halls - without ever having specified what they mean by it. Culture becomes a synonym for values, or for tone-from-the-top, or for the absence of scandal. None of those definitions is operational. None of them gives a compliance team anything to measure.
The framing Casòliva offered was more precise: ethical culture is the set of behavioural norms, expectations, and signals that actually govern how people make decisions when no one is watching. It includes what gets rewarded, what gets tolerated, what gets ignored, and what gets punished. It is the lived experience of working inside an organisation, not the intended experience. And it drives behaviour, good and bad, more reliably than any policy document.
The practical implication of this framing is significant. If culture is a behavioural driver, then the compliance function is not merely responsible for rules. It is responsible for understanding and shaping the environment in which rules are either followed or quietly set aside. That responsibility cannot be discharged (to HR) without a clear definition of what the target looks like. Definition and measurement are not separate activities. They are the same argument made in sequence.
Insight 2: Regulators are shifting from effort to effectiveness, and ethical culture is the new proxy
"The question is no longer whether you have a compliance program. The question is whether your compliance program has changed how people behave."
The regulatory environment in Spain and across Europe has shifted in ways that make the measurement of ethical culture not merely advisable but, in several respects, legally material. The operative word in Spanish criminal liability doctrine, introduced through Article 31bis of the Criminal Code by Constitutional Law 1/2015, is effectiveness. A company seeking to reduce or eliminate criminal liability must demonstrate not that a compliance programme exists, but that it actually functions. Circular 1/2016 of the Fiscalía General del Estado reinforced this direction: prosecutors treat evidence of genuine ethical commitment, including internal investigations and culture-building efforts, as mitigating factors in criminal proceedings. That standard is not met by a policy library.
Spain's Whistleblower Protection Law (Law 2/2023), which entered into force in March 2023 and transposes EU Directive 2019/1937, extended this logic further. All organisations with fifty or more employees are now required to implement internal reporting channels and active ethics and compliance risk management. The law is explicit about its purpose: promoting a culture of ethics and regulatory compliance. Non-compliance carries fines of up to one million euros. The CNMV's Good Governance Code 2020 likewise established ethics codes and whistleblowing channels as governance standards for listed companies, and the forthcoming 2026 revision, currently in expert committee, explicitly frames promoting a true corporate ethical culture that permeates all levels of the organisation, from the board downward, as a new governance expectation.
Insight 3: Ethical culture can be measured empirically
"You are not measuring what people say they believe. You are measuring what the environment around them signals is actually acceptable."
One of the most persistent obstacles to culture assessment is the assumption that culture is too intangible to quantify. Casòliva Cabana challenged that assumption directly. Ethical culture can be measured - empirically, rigorously, and in ways that produce actionable data - through a combination of structured surveys, qualitative insights, and behavioural data analysis. The LRN Ethical Culture Benchmark is built on precisely this methodology, aggregating responses across thousands of employees to track not values in the abstract but the behavioural signals that shape day-to-day decision-making: whether people feel safe raising concerns, whether they believe misconduct is addressed, whether their manager models the behaviour the organisation claims to expect.
Surveys, when well-designed, capture perception at scale. They surface the gap between what leadership believes is happening and what employees are actually experiencing. Qualitative methods like focus groups, structured interviews, open-ended questions, add texture and specificity, revealing the reasoning behind patterns that survey data surfaces but cannot fully explain. Behavioural data, including the use of reporting channels, the nature of issues raised, and how those issues are resolved, provides a third layer of evidence grounded in what people actually do rather than what they say.
The point Casòliva made is that measurement is not optional. It is the mechanism by which organisations move from assumption to evidence. The alternative, operating on the belief that culture is healthy because no crisis has occurred, is not a compliance posture. It is the absence of one. The organizations that appear in enforcement actions rarely believed, in the period before those actions, that their culture was a problem. Measurement exists precisely to surface what assumption obscures.
Insight 4: Subcultures reveal what compliance programs must actually address
"Your values statement applies to the whole organisation. Your culture does not. Every team is living a slightly different version of it."
One of the most practically important outputs of ethical culture measurement is the discovery of subcultures. No large organisation has a single, uniform culture. It has a stated culture - the values, behaviours, and expectations articulated at the corporate level - and it has a set of lived cultures that vary by team, function, geography, and leadership. Those subcultures are not aberrations. They are the norm. And they are the level at which compliance behaviour is actually shaped.
Casoliva reveals in his PhD thesis meaningful cultural divergence between units within the same organisation. A commercial function under intense sales pressure may develop norms around cutting corners that are invisible to the legal team three floors away. A subsidiary operating in a different regulatory environment may have internalised different standards of what constitutes acceptable conduct. A team whose manager models openness and accountability will behave differently from one whose manager signals, through inaction, that raising concerns is not worth the effort. These differences do not appear in a culture statement. They appear in measurement.
The compliance implications are direct. If subcultures vary, then programmes designed as if culture were uniform will systematically miss the populations most in need of intervention. Training must be calibrated to the specific behavioural risks present in specific teams. Incentive structures must account for the pressures those teams actually face. Reporting mechanisms must be trusted in the specific environments where they are most needed. None of that calibration is possible without measurement that operates at the subculture level. Compliance leaders who rely on aggregate data risk designing programmes for an organisation that does not quite exist.
Insight 5: Ethical culture assessment is the new maturity benchmark and the cost of waiting is high
"Most organisations are neither in crisis nor at peak maturity. They are somewhere in the middle, and that is exactly where complacency is most dangerous."
Casòliva observed that, in practice, two types of organisations currently take ethical culture assessment seriously. The first are those operating at high compliance maturity: organisations that have embedded culture measurement into their governance frameworks as a standard discipline, not a response to any particular event. The second are those that have suffered an ethical scandal, a crisis, or a prosecution, and are conducting assessments as part of remediation or under external pressure. The cases of Uber and Wells Fargo are instructive here: both companies commissioned independent ethical culture assessments following the crises that reshaped their public identities, and those assessments - publicly available and widely studied - document in clinical detail what happens when culture is treated as background noise rather than a compliance variable. They also document how much ground must be recovered, at what cost, when that assumption proves wrong.
The argument Casòliva pressed most insistently was directed at neither of those groups. It was directed at the majority; the organisations that have not yet suffered a crisis, and that have not yet invested seriously in culture assessment, and that are therefore operating on the assumption that the absence of visible failure is a sufficient signal of health. That assumption is precisely what the Uber and Wells Fargo cases refute. Culture failures are rarely sudden. They accumulate, quietly, in the gap between stated values and behavioural reality, until the accumulation becomes visible in the worst possible way.
The costs of a damaged culture - regulatory exposure, reputational harm, talent loss, and the operational disruption of a crisis - vastly exceed the cost of systematic, ongoing assessment. Internal assessments offer speed and contextual depth; they can be designed and executed by teams with organisational knowledge and are typically faster and more cost-effective. External assessments carry a different and often decisive advantage: independence and credibility. When an organisation must demonstrate the effectiveness of its compliance programme to a regulator, a board of directors, or a court, the credibility of the evidence it presents matters. Both the highly mature and the crisis-stricken increasingly commission external assessments precisely for that reason. The average organisation in the middle has the same need, and the advantage of acting before that credibility is tested under pressure.
Closing: From culture as assumption to culture as evidence
The session at Cumplen's 2026 ONE DAY COMPLIANCE Barcelona pointed toward a conclusion that is increasingly difficult for compliance officers in Spain and across Europe to defer: ethical culture is no longer a soft governance concept. It is a regulatory expectation, a prosecutorial benchmark, a governance standard, and - when things go wrong - an evidentiary question. The organisations best positioned for the next five years are those that treat culture not as the atmosphere in which compliance operates, but as a variable to be understood, measured, and actively managed.
The direction regulators, prosecutors, and governance bodies are moving is consistent and accelerating. Spain's Law 2/2023, the CNMV's forthcoming 2026 governance revision, and the EU's due diligence frameworks are not isolated developments. They reflect a shared judgment that compliance effectiveness, not compliance existence, is the operative standard, and that culture is the most reliable evidence of the difference between the two. The organisations that build that evidence systematically, before they are asked for it, will find themselves far better positioned when the asking begins.
Find out more
LRN's Ethical Culture Benchmark Global Edition provides data-driven insights into the behavioral realities of organizational culture across industries and geographies. Download the report to understand how your program compares and where the clearest opportunities for strengthening culture infrastructure lie.
To discuss how these findings apply to your organization's compliance programme, including how to design or commission an ethical culture assessment, contact our team. LRN's ethics and compliance advisors work with organisations across Europe and globally to translate culture measurement into programme improvement.
