Conduct Risk Framework: When Good People Get It Wrong 

Conduct Risk Framework: When Good People Get It Wrong 

It rarely starts with something obvious. 

More often, it begins quietly. A concern raised in passing. A conversation that did not land quite right. Someone flags behaviour that feels uncomfortable without being clearly unacceptable. A manager hesitates, unsure whether this is a performance issue, a people matter, or something more serious. 

Eventually, someone asks the question most firms would prefer not to confront. 

“Is this a conduct issue?” 

That question tends to shift the tone. Not because firms do not understand the rules, but because it introduces a more difficult reality.  

Firms are very comfortable talking about culture. They are far less comfortable when culture needs to be tested. 

This is where a conduct risk framework moves from something that exists neatly on paper to something that has to work in practice. 

Because Conduct Rules do not sit in isolation. They form part of the wider SMCR framework, alongside the Senior Manager and Certification Regimes, all designed to create accountability and ensure individuals can be held to account where necessary.  

A Practical View of Conduct Risk 

A conduct risk framework is not there to describe good behaviour. It is there to deal with situations where behaviour falls short. 

And that distinction matters, particularly when it comes to understanding what is, and is not, a Conduct Rule breach. 

Not every mistake meets that threshold. In fact, most do not. A misunderstanding with a client, an unclear explanation, or a process error may require correction, training, or better oversight. It does not automatically mean someone has breached the Conduct Rules. 

Those breaches tend to arise where behaviour is serious enough to result in formal disciplinary action, such as a written warning, suspension, or dismissal. Conflating the two creates problems in both directions. Over-escalation reduces credibility, while under-recognition leaves firms exposed. 

A well-functioning framework allows for judgement. It creates space to identify issues early, assess them proportionately, and recognise when behaviour has genuinely crossed into regulatory territory. 

Being Honest About the Risk 

There is often a degree of optimism in how firms approach conduct risk. Strong recruitment processes, comprehensive training, and a positive culture are all part of the picture. 

But a credible framework starts from a more realistic position. 

Even in well-run firms, with capable and well-intentioned people, things can go wrong. Pressure, incentives, poor oversight, or simple misjudgement can lead to behaviour that does not meet expected standards. Ignoring that possibility does not reduce the risk. It simply delays recognising it. 

This becomes particularly relevant as the regulatory lens evolves. The extension of non-financial misconduct into the Conduct Rules from September 2026 brings behaviours such as bullying or harassment more clearly into scope where there is a sufficient connection to work. That does not create new risks. It reinforces that some behaviours traditionally viewed as internal matters can, in certain circumstances, become regulatory ones. 

Recognising Issues Without Overreacting 

In practice, conduct risk rarely appears in isolation. It tends to surface through a combination of signals: complaints, supervision, internal feedback, grievance processes, and informal escalation. 

The difficulty is not usually a lack of information. It is how confidently firms interpret it. 

If every concern is treated as a potential breach, the framework becomes overly sensitive and quickly loses credibility. If concerns are consistently downplayed, issues can develop unnoticed until they become harder to manage. 

The balance sits in recognising that not every issue is a breach, but every concern deserves consideration. That is where judgement, supported by a clear framework, becomes critical. 

The more challenging cases are often not procedural failures but behavioural ones. They sit in the grey space between intent, judgement, and impact, which is precisely where a framework needs to be most effective. 

Monitoring What Actually Matters 

Monitoring conduct risk is less about producing reports and more about understanding patterns. 

It is not enough to record issues. Firms need to be able to explain what they mean. Are similar concerns appearing repeatedly? Are certain areas generating disproportionate issues? Are problems being resolved, or simply reappearing in slightly different forms? 

This is where frameworks can quietly fail. Data exists, reports are produced, and governance appears intact, but the underlying behaviour does not meaningfully change. 

Board oversight plays a key role here. Effective oversight is not simply receiving management information; it is interrogating it. Asking why issues are occurring, whether actions are working, and whether the same themes are resurfacing. 

Without that level of engagement, monitoring risks becoming a process rather than a control. 

Embedding Conduct Risk into Governance 

Ultimately, a conduct risk framework only works when it is embedded into how decisions are made. 

It should not sit separately from governance. It should intersect with SMCR accountability, fitness and propriety assessments, and day-to-day management oversight. Senior Managers are expected to take reasonable steps to ensure their areas are effectively controlled and compliant with regulatory standards. That expectation includes how conduct risk is identified and managed. 

The practical implication is straightforward, even if it is not always comfortable. 

Firms need to be able to identify issues, investigate them fairly, and take appropriate action where necessary. That includes recognising when behaviour meets the threshold for a Conduct Rule breach and being willing to act accordingly. 

Final Thought 

Most firms never expect their conduct risk framework to be truly tested. That is entirely understandable, but it is also precisely what it is there for. 

A strong framework is not built on the assumption that something will go wrong, but on the recognition that, occasionally, it might. When it does, the firm needs to respond with clarity, consistency, and confidence. 

If there is any uncertainty over whether your SMCR approach and Conduct Rules processes would stand up in that moment, it is worth addressing now. At B-Compliant, we work with firms to ensure frameworks are not just documented, but genuinely workable, supporting practical preparedness when it matters most, why not get in touch today.