Is culture or compliance more important?

It is tempting, with a new legal duty bearing down, to treat all of this as a compliance problem. Get the policy written, get the training booked, get the certificates filed, and hope you never have to test any of it. Tick, tick, tick.

But compliance was never really the point. Surviving a tribunal is not the goal. The goal is that the next time something happens, and something always happens, someone actually does the right thing, instead of freezing and looking at their shoes.

That is culture, not compliance. And it is a different thing entirely to build.

A policy has never helped anyone in the moment

Think about where the hard moments actually happen. Someone shuts a door and starts to talk. A manager has to pull up a colleague everyone likes. Somebody has to decide what to do about the person who brings in half the revenue.

In none of those moments does anyone reach for the intranet. Nobody thinks "let me recall slide fourteen". A policy on a shared drive, and a slide deck someone sat through seven months ago, having been lured in with a McVitie's Family Circle and the promise of an early finish, are simply not present when it counts.

What is present is whatever that person already has in them. And that is built, or not built, long before the moment arrives.

The bit training always misses

The things that actually matter in these situations are not facts. They are nerve, and instinct, and judgement.

The nerve to say something to a senior colleague when everyone else is letting it slide. The instinct to sit with someone's disclosure without flinching, and without rushing to fix it. The judgement not to quietly let the star performer off the hook because the maths is uncomfortable.

None of that gets installed by a slide. You cannot tell someone into having nerve. It gets built the same way any hard skill gets built: by doing it, badly at first, somewhere it is safe to get it wrong, until it stops being frightening.

That is the whole gap. Training tells people what to think. It almost never lets them practise what to do. So when the moment comes, they know the theory and freeze anyway.

Where the law comes in

There is a legal deadline sharpening all of this. This October the duty to prevent sexual harassment strengthens to all reasonable steps, and it now reaches harassment by clients and customers, not just colleagues. So the pressure to be able to prove you did something real goes up.

But notice the uncomfortable question underneath the law. It is not "have we trained people". Almost everyone can say yes to that. It is whether you could show, if you ever had to, that the training actually changed what people do, and reached the moments that matter.

That is the thing most training cannot evidence. It can prove attendance. It cannot prove capability. And capability, not attendance, is what protects your people and, as it happens, protects you.

So, culture or compliance?

It is a slightly false choice, and here is the happy part. If you build the culture, the compliance largely takes care of itself. People who have genuinely practised these moments behave better when they are real, and the record of that practice is exactly the kind of evidence that stands up.

Do it the other way round, chase the compliance and ignore the culture, and you get a drawer full of certificates and a workforce that still freezes. You will have satisfied the letter of it and missed the entire point.

Scenari was built for the culture, on the quiet understanding that the compliance follows. People practise the hard moments, over and over, somewhere safe, until doing the right thing feels familiar. And every practice builds a record you can stand behind. You do not have to choose. You just have to build the right one first.

Common questions

What are the best ways to build a safety culture at work? There is no single lever. It is a handful of things done consistently: give people more than one way to raise a concern, actually act on what you hear, train managers to respond well when someone does speak up, and let leaders set the tone by calling things out rather than smoothing them over. The building blocks below are the practical place to start.

Should reporting be confidential, anonymous, or both? Ideally both, and more than one route. Some people will speak to a trusted manager, others will only ever use an anonymous channel, and some want an option that sits outside their own line of report altogether. The more doors you offer, the more likely someone is to walk through one. Whatever routes you choose, be honest about what happens to a report once it is made.

How do we find out where the risk actually is? Carry out a proper risk assessment, and treat it as finding where harm is most likely rather than a form to file. Look honestly at power imbalances, lone working, customer and client contact, alcohol at work events, and any history of reports being handled badly. Bigger organisations usually need more than one, since the risks on a shop floor, in a bar, or at a conference are very different from those in an office.

Do staff surveys really help? They can, if you use them well. Regular pulse surveys, and a fuller annual engagement survey, kept anonymous, will often surface a problem long before it lands on someone's desk as a formal complaint. Ask specific questions about respect and safety, not just generic happiness. And the golden rule: only ask if you are willing to act on the answers, because a survey that changes nothing quietly teaches people that speaking up is pointless.

What else makes the difference? A few things worth building in: train managers on how to actually handle a disclosure, not just what harassment is; deal with low-level behaviour early, before "banter" becomes a pattern; make it normal and safe to be an active bystander; protect anyone who reports from any kind of backlash; and close the loop, so people can see that raising something led to something. Then review it all regularly, because a culture is never finished.

Where does practice fit in? This is the piece most organisations miss. Everything above sets the conditions, but people still have to be able to do the hard thing in the moment: the difficult conversation, the disclosure handled with care, the decision not to let the star performer off the hook. That capability is built by rehearsing it, which is exactly what Scenari is for.

Sources

• Worker Protection (Amendment of Equality Act 2010) Act 2023, with the duty to prevent sexual harassment strengthening to all reasonable steps from October 2026, and extending to third-party harassment.