This session gives senior leaders a diagnostic framework to recognize the harmful messages their policies are already sending and to assess where the misalignment between policy voice and target culture is most acute. From there, the conversation turns to strategy: how to build the internal capacity to fix it, which functions need to be at the table (Legal, GRC, HR, Marketing and Communications, and others all have a stake and often competing instincts), and where accountability for policy voice needs to be set. A Global Head of Information Security who examined his organization’s written rules through this lens saw employees proactively approaching his team to flag potential compliance gaps and ask for guidance, rather than concealing non-compliance and hoping for the best. That shift in employee behaviour is a direct risk management outcome.