What Your Audit Committee Really Wants to Know
By Suzie Thoraval
A policy may satisfy the law. The real test is whether decisions, behaviour and culture actually change.
“The only thing of real importance that leaders do is to create and manage culture.”
As an independent audit and risk committee member, I am first looking for assurance that management has created the policies and processes needed to comply with a new law.
The harder question is whether anything will actually change.
How are leaders viewing the new requirement: as a compliance exercise, or as a prompt to change the decisions, behaviours and culture of the organisation?
Without that deeper work, six months later the policy may be in place while leaders and staff continue working much as they did before. The organisation has complied on paper, yet the behaviour the law sought to address remains unchanged.
Embedding legal change takes time. It is also where the real value lies.
Recent laws needing a different leadership approach
This year alone, several regulatory changes have placed greater expectations on leaders. Victoria’s psychosocial hazard regulations made matters such as workload and role clarity a legal duty from 1 December 2025. A bill currently before the Victorian Parliament would replace a manager's discretion to decline a work from home request with a presumptive right, refusable only on narrow, specified grounds. Directors of Australia’s largest companies are now personally accountable for the accuracy of climate-related disclosures.
The subject matter is different in each instance. The common thread is that leaders need to demonstrate more than good intentions through a written policy. They need a clear process, credible evidence and visible follow-through to embed the legal change.
Baseline compliance is one thing. Leadership determines how meaningful the organisation’s cultural response becomes.
Where Does Your Organisation Sit?
I find it useful to think about leaders’ approaches to regulation as a Regulatory Maturity Ladder.
At the bottom, the organisation resists the change or waits until enforcement makes action unavoidable. Further up, it does enough to satisfy the immediate requirement. Policies are written, responsibilities are allocated and reports are produced.
Many organisations do not move beyond that point.
The documentation may be sound while everyday decisions and behaviours remain largely unchanged. From a distance, that can look like success. Having worked in this space for many years, I know the gap usually becomes visible through employee experience, an incident, a complaint or closer regulatory scrutiny.
At the top of the ladder, the organisation has translated the obligation into the way leadership actually works. Managers understand what is expected. Decisions reflect the new standard. Systems reinforce it. Leaders, boards and committees ask for evidence that practice has changed. In other words, it is embedded.
Agreement Does Not Predict Action
One of the most useful distinctions leaders can make is between their personal view of a regulation and their responsibility to respond well.
A leader can support a new law and still oversee a superficial response. Another may find the requirement frustrating and still build something rigorous, practical and lasting.
Adaptive Stability helps leaders manage that distinction. They can notice their own reaction, understand what the changed environment requires and adapt before external pressure forces a hurried response.
A few questions are worth asking:
Name your rung. Where does your organisation genuinely sit on the Regulatory Maturity Ladder today?
Look beyond the policy. What has changed in decisions, behaviour and employee experience?
Ask for evidence. What would show the board, regulator or workforce that the new approach is operating in practice?
A policy can show that an organisation has responded. Changed behaviour shows that it has adapted.
Which rung of the Regulatory Maturity Ladder would your team place your organisation on?
