UK firms boost compliance spend as breaches persist

NAVEX has published UK research on the gap between compliance spending and risk outcomes at British businesses. The study found UK organisations report higher compliance maturity than global peers.

The survey found that 39% of UK organisations had suffered a cybersecurity or data privacy breach in the past two years, compared with 30% globally. UK respondents were also more likely to report a third-party ethics or compliance failure, at 23% versus 18% globally, and adverse media coverage linked to ethics and compliance, at 22% versus 20% globally.

The findings point to a disconnect between formal compliance structures and how decisions are made when commercial pressure rises. While 70% of UK respondents said their ethics and compliance programmes were at either the Managing or Optimizing level on a five-level maturity scale, those higher self-ratings did not consistently translate into fewer incidents.

UK businesses also appeared more willing than international counterparts to spend more on compliance. Some 43% expected compliance budgets to rise by at least 10%, compared with 32% globally.

Budget increases were more common among organisations that had already faced problems. Among UK organisations that reported no compliance issues over the past two years, 29% expected their budget to increase by at least 10%. That rose to 54% among organisations that had experienced two or more compliance issues, suggesting spending may follow incidents rather than prevent them.

Leadership gap

The survey also highlighted tension between leadership messaging and staff perceptions of corporate behaviour. Although 83% of respondents said senior leaders had encouraged compliance and ethical behaviour, 49% believed the C-suite viewed compliance as a "necessary evil" that inhibits business.

One-third of respondents said senior leaders had accepted greater compliance risk in pursuit of new business objectives or increased revenue. That suggests commercial targets can outweigh stated commitments to ethical and regulatory standards.

"UK organisations have not failed to invest in compliance. The challenge is making sure that investment changes how decisions are made when commercial pressure is at its highest. Policies, technology and governance structures may all appear strong on paper, but they will only reduce risk when compliance is treated as an essential part of business performance rather than an obstacle to it. Leaders must reinforce that message through their actions, particularly when difficult trade-offs arise," said Erena Langley, Director of Regulatory Solutions at NAVEX.

Resource strain

Compliance teams are also facing broader demands without equivalent increases in staffing. The survey found that 91% of UK respondents expected investment or activity to increase in at least one area of their ethics and compliance programmes, including technology, training, analytics and cross-functional collaboration.

At the same time, 85% said at least one internal compliance challenge had grown over the past year. The most frequently cited issue was expanded responsibilities without extra resources, identified by 42% of respondents.

Only 20% of UK organisations expected to add compliance staff over the next 12 months. That points to a possible imbalance between growing workloads and the personnel available to manage them.

Speak-up culture

The report also found that formal whistleblowing and speak-up measures were widespread, but many organisations still struggled to convince employees that reporting concerns was safe. Some 96% of UK organisations said they had formal steps in place to encourage a speak-up culture, yet 76% still reported difficulties in creating one.

Among those facing challenges, 79% identified fear of retaliation or negative consequences as a barrier to reporting. The research suggested that while leadership messages and non-retaliation policies were common, fewer organisations tracked outcomes closely enough to build trust.

Only 38% said they monitored retaliation or case outcomes for senior leaders, while 34% said they tracked people who may be especially vulnerable to retaliation, including investigation witnesses.

"Fear of retaliation is a trust problem. Employees need to see that concerns are investigated properly, that action is taken and that people who speak up are protected in practice. Organisations must move beyond telling employees that it is safe to report misconduct and consistently demonstrate that this is true," Langley said.

AI expansion

UK organisations also expect artificial intelligence to play a larger role in compliance work. The survey found that 45% believed AI would significantly transform their programmes over the next two to three years, while 91% said their compliance function was meaningfully involved in organisational decisions about AI use, compared with 78% globally.

Current uses are focused on training, monitoring and reporting, with respondents expecting wider adoption in policy management, third-party risk screening, investigations and speak-up systems. That expansion raises questions about governance, transparency and human oversight in functions that often involve sensitive employee and regulatory matters.

The UK findings were based on responses from 114 executives at British organisations, part of a global survey of 1,179 executives across a range of industries. Respondents included C-suite executives, senior managers, department heads and managers involved in ethics and compliance.

The results suggest UK companies have built more mature compliance frameworks on paper and are continuing to direct more money into them than many overseas peers. But the figures also show that higher spending, broader programmes and more formal policies have not removed exposure to cyber incidents, third-party failures and internal mistrust.

Only 20% of UK organisations expect to add compliance staff over the next 12 months, even as 91% expect investment or activity to increase in at least one part of their ethics and compliance programmes.