Anti-pattern

Compliance Theatre

Anti-pattern T5: Outcomes Over Activity T10: Invisible Integration Approved

Core Idea

Compliance theatre happens when the organisation optimises the appearance of control instead of the behaviour the control was meant to influence. The artefacts look mature: clean matrices, carefully worded policies, signed exceptions, colour-coded dashboards. The underlying system may still be brittle, invisible, or unchanged.

A common example is the control that passes because a screenshot exists, even though nobody can explain whether the underlying behaviour still happens. The teaching move is to move the learner from artefact admiration to behaviour verification: what changed, who noticed, and what would fail visibly?

Use In Teaching

Invoke this card when the learner describes work that satisfies a framework but does not change risk, engineering behaviour, decision quality, or customer trust. It helps convert frustration with paperwork into a sharper diagnosis of what the paperwork is compensating for.

Use it when a learner is proud of an artefact but cannot explain the operating change behind it. The Companion should ask them to trace the artefact back to a behaviour, signal, owner, and failure mode. If that trace breaks, the artefact is probably substituting for assurance.

A reviewer should check that Compliance Theatre names a visible symptom, the hidden operating cost, and the safer pattern the learner can practise next. Without those three parts, the anti-pattern becomes a complaint instead of a learning tool for changing behaviour.

Contrast

This is not anti-compliance. The point is that compliance should be a useful description and verification layer, not the main event. Theatre begins when the audit story becomes more important than the operating reality.

Practice Prompt

Which artefact in your programme would still look good even if the underlying behaviour stopped working tomorrow?

Related cards

Read the source

None listed.

Learn more on grcengineer.com

Install

Use this card with your own work

Install the Companion in your AI workspace, then point it at real GRC work to learn from.

Go to install guide ->