Culture, Not Checklists: Australia’s Three-Decade Contribution to Global Compliance

As the Australian Compliance Institute (ACI) marks its 30th anniversary, this paper traces a direct lineage running from Australian jurisprudence to modern international governance frameworks. Within three decades, a single 1990 Australian Federal Court ruling regarding corporate culture became the intellectual seed of ISO 37301—the world’s certifiable standard for compliance management systems. This paper examines how this structural shift from written “paper shields” to verified corporate culture evolved into Australia’s single most influential export to the global compliance profession, demonstrating why authentic culture remains a non-negotiable risk-management tool in the modern landscape.

Origins: Where Compliance as a Discipline Began

In the mid-1990s, compliance barely existed as a distinct career in Australia. After a wave of corporate collapses and widespread systemic governance failures in the late 1980’s and early 1990’s, Australian regulators concluded that external enforcement alone could not guarantee market integrity.  Organisations needed internal systems that proactively managed legal and ethical risk.

The catalyst for this shift was judicial. In 1990, Justice Robert French—then a judge of the Federal Court of Australia (later serving as Chief Justice of the High Court from 2008 to 2017) handed down Trade Practices Commission v CSR Ltd. Justice French ruled that corporate penalties must reflect the authenticity of an organisation’s preventative architecture. He famously observed that the court must evaluate whether a company has “a corporate culture conducive to compliance,” warning that without this structural backing, written policies amount to little more than a paper shield. 1

To evaluate a corporation’s true accountability, Justice French established a set of core principles that became known across Australian law as the “French Factors”. When calculating civil penalties, courts were directed to evaluate:

• The nature and extent of the contravening conduct.
• The size and financial position of the contravening company.
• The deliberateness of the conduct and whether it arose from senior management or a lower level.
• Whether the company has a corporate culture conducive to compliance, as evidenced by educational and corrective measures.
• The degree of cooperation shown to enforcement authorities.

The resulting French Factors established that regulatory penalties could not be treated merely as an acceptable cost of doing business. By explicitly tying penalty mitigation to corporate compliance infrastructure, Justice French gave boards a direct incentive to build genuine, auditable oversight systems. The French Factors became, and remain to this day, the bedrock framework Australian courts used to evaluate corporate accountability.

However, as corporations increasingly sought penalty reductions by pointing to superficial compliance policies, the Federal Court faced a new challenge: distinguishing between a genuine compliance culture and a mere bureaucratic facade.

Justice Robert French addressed this challenge by establishing the foundational legal architecture. He famously warned corporations against relying on mere “paper shields”. His Federal Court colleague, Justice Alan Goldberg, then operationalised the specific criteria for what made a compliance program truly effective.

This legal development began in late 1996, the exact year the ACI was founded. It culminated in a landmark 2006 penalty judgment, ACCC v Australian Safeway Stores Pty Ltd. In this case, Justice Goldberg built directly upon the French Factors. He codified exactly how an internal program must look to satisfy the law. This work turned the warning about paper shields into an actionable legal reality.

In his final penalty ruling, Justice Goldberg crystallised the “Goldberg Test.” He stated: “the key points the Court needs to consider are the nature and extent of the program, its effectiveness and whether it has permeated through the corporation.” In this case, the business committed five separate contraventions. This volume of breaches indicated to Justice Goldberg that the internal compliance program had failed to permeate the organisation.

Justice Goldberg also noted that in determining an appropriate penalty, he took into account that Safeway’s conduct was deliberately calculated to restrict competitive conduct, asserting that penalties must be substantial to achieve general deterrence.

The Australian Competition and Consumer Commission (ACCC) and the Australian Securities and Investments Commission (ASIC) responded to this judicial momentum by sponsoring the professionalisation of internal compliance. A regulatory steering committee chaired by Bill Dee, then Director of Compliance Strategies at the ACCC, brought together early pioneers to brainstorm the challenge.

 In 1996, that committee’s work led to two milestones happening almost simultaneously:

• the launch of the Association of Compliance Professionals of Australia (the ACI’s founding name), backed publicly by ACCC Chairman Allan Fels and ASC Chairman Alan Cameron, and The Honourable Sir Laurence Street (Chief Justice of New South Wales from 1974 to 1988);
• the drafting of the Australian Standard AS 3806-1998 (Compliance Programs), the world’s first national ISO compliance standard.

While the pioneering 1991 US Sentencing Guidelines initially leveraged punitive legal pressures to deter corporate crime, they did not originally include reference to corporate culture, ethics or incentives in the compliance program standards. It wasn’t until the later, 2004 revisions, that the American framework integrated “ethical culture” into its language. By contrast, the Australian standard—forged in the mid-1990s from the landmark Federal Court principles of Justices French and Goldberg—placed internal corporate architecture, behaviour, and proactive culture at its absolute centre from inception. It was this systems-driven management model, rather than a localized penal framework, that ultimately provided the blueprint for the global ISO standards used worldwide.

Global Leadership: The ISO Story

AS 3806 could easily have stayed a domestic curiosity. Instead, it became the template for a global standard. As international markets grew more interconnected through the 2000s, regulators worldwide needed a common compliance vocabulary.

The International Organisation for Standardisation (ISO) turned to the Australian framework as its starting point, with Bill Dee leading Australia’s participation in the drafting process. The result, ISO 19600:2014, carried forward AS 3806’s core principles (explicit board-level accountability, independent reporting lines, continuous improvement) into an internationally recognised guideline standard.

However, a guideline was not enough. As regulatory enforcement intensified globally, the compliance profession required an auditable framework. A merely advisory document was no longer sufficient. From 2018, ISO’s technical committee (ISO/TC 309) began converting the guideline into a certifiable requirements standard. Australian representatives again contributed to that process, culminating in the publication of ISO 37301:2021.

The impact of this change was massive. A new international rule, ISO 37301, has completely changed how companies handle compliance. It puts compliance on the same strict, official level as other major global standards. For context, the business world already relies on well-known standard systems. These include ISO 9001 for quality management, ISO 14001 for the environment, ISO 27001 for information security, and the recent ISO 37001 for fighting bribery. However, ISO 37301 is different. Because it is a “Type A” certifiable standard, companies can now hire independent experts to audit their systems and officially certify that they are following the rules. While older standards only focus on one specific topic, ISO 37301 is the very first framework that applies to every single type of risk and compliance law across an entire organisation.

Incredibly, what has resulted is a direct line running from Australian Federal Court judgments about corporate culture to the international standard that multinational enterprises now use to demonstrate their diligence in taking steps to prevent wrongdoing and to adhere to regulatory requirements. Few national compliance frameworks have travelled so far.

Institutional Chronology

The ACI itself has strategically evolved its structure and identity over three decades to keep pace with the shifting corporate landscape:

• 1996: Founded originally as the Association for Compliance Professionals of Australia, establishing the continent’s very first professional network dedicated solely to the discipline.
• 2000: Restructured and renamed as the Australasian Compliance Institute (ACI), broadening its footprint across the region and cementing the “ACI” identity.
• 2010s: Rebranded as The GRC Institute, reflecting an era where governance, risk, and compliance converged under a single operational umbrella.
• 2020s: Reverted to the Australian Compliance Institute, reclaiming a distinct, specialised identity separate from the broader “GRC” label to champion pure compliance as an elite discipline.
• 2026: In June 2026 ACI formally converted from an incorporated association into a company limited by guarantee, establishing a modern, singular national rather than state based legal structure, to sustain the ACI for its next thirty years.

This structural transition was mirrored by the steady evolution of its management, moving intentionally from a volunteer-run steering committee into a highly scalable professional body led by dedicated executive leadership.

Building the Profession

Standards and case law established what compliance should look like; formal accreditation made it a genuine profession rather than an offshoot of legal or audit work. Early ACI leadership recognised that the profession needed a benchmarkable educational standard, not just a shared body of knowledge.

The ACI subsequently turned that thinking into practice, securing its status as an accredited Registered Training Organisation teaching and awarding nationally accredited qualifications, from foundational workshops through to a postgraduate Graduate Certificate, under Australia’s formal skills framework. That accreditation infrastructure meant compliance practitioners no longer rely on informal, on-the-job learning to build the skills boards and regulators now expect.

Beyond the Checklist

The ACI’s central argument, that compliance is about culture, not paperwork, was forcefully vindicated by Australia’s own regulatory history. The 2018 Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry found that financial institutions could hold thousands of pages of compliance policies while still failing consumers systemically.

Commissioner Kenneth Hayne’s final report captured this exact systemic vulnerability, warning that legal complexity often reduces compliance to a mechanistic exercise: “The more complicated the law, the easier it is for compliance to be seen as asking ‘Can I do this?’ and answering that question by ticking boxes instead of asking ‘Should I do this? What is the right thing to do?'”3

Commissioner Hayne traced the root of the issue directly to leadership failures. His findings noted that “failings of organisational culture, governance arrangements and remuneration systems lie at the heart of much of the misconduct examined in this Commission.”4 Ultimately, he placed the burden of reform on corporate leaders, stating that “the primary responsibility for financial services misconduct lies with the entities concerned and with those who manage and control them: their boards and senior management.”5

This critical distinction between formal legality and genuine culture is the exact same one identified on the Federal Court bench by Justice French and Justice Goldberg decades earlier. Because of this heritage, Australian compliance professionals were trained, well before the Royal Commission, to act as ethical advisors and cultural challengers rather than checklist administrators.

Yet, the findings of the Royal Commission also highlighted a persistent structural disconnect: a well-trained compliance function cannot shift corporate culture if it is decoupled from executive remuneration models and core business incentives. The 2018 inquiry proved that training practitioners to assess risk culturally is only half the equation; corporate governance must ensure that compliance insights hold equal weight with financial performance at the executive and board levels.

The Modern Landscape

Today, the ACI is a strong industry body supporting Australian compliance professionals across diverse sectors. It is a member of the International Federation of Compliance Associations (IFCA), giving Australian-trained practitioners international portability. As the peak body for the sector, the ACI acts as a vital bridge between industry and regulators, providing the education, professional standards, and advocacy required to navigate a rapidly evolving regulatory environment.

Its cross-industry membership remains active on frontline issues that closely mirror the complex challenges compliance professionals face globally. This includes managing the rollout of Tranche 2 Anti Money Laundering/Counter Terrorism Financing obligations across newly captured sectors, driving corporate ESG compliance, and establishing ethical AI governance frameworks. By delivering targeted training across these high-stakes portfolios, the association aims to position Australian compliance professionals at the forefront of global risk management.

Conclusion

Thirty years on, Australia’s clearest contribution to the global compliance profession is not a specific rule or checklist. It is an idea forged in the Federal Court judgments of Justices Robert French and Alan Goldberg. This concept is now embedded in an ISO standard used worldwide, requiring that genuine compliance is a matter of culture, not paperwork.

Even as technology transforms the profession, and AI becomes a critical tool to drive compliance, this foundational Australian philosophy remains non-negotiable. Software can automate the process, but only culture can manage the risk.

1 Trade Practices Commission v CSR Ltd (1990) 23 FCA 527.

2 Australian Competition and Consumer Commission v Australian Safeway Stores Pty Ltd (No 4) [2006] FCA 21.

3 Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry (Interim Report, 28 September 2018), Volume 1, p. 290.

4 Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry (Final Report, 1 February 2019), Volume 1, Chapter 6 (Culture, Governance and Remuneration), p. 412.

5 Ibid, Volume 1, Executive Summary, p. 4.