The Quarterly Scramble
Most team leaders know the rhythm of the quarterly compliance review without having to think about it. The days or weeks of preparation of teams documenting what they did or, more honestly, what they're fairly sure they did across a period that ended long enough ago that the details have gone soft. Auditors reviewing processes that have already drifted from what was actually happening. Problems discovered months after they started compounding. Lessons captured, filed, and forgotten by the time the next quarter's scramble begins.
The instinctive diagnosis is that the reviews aren't frequent enough. I think the problem is the model. Quarterly reviews are built on a particular assumption about how compliance works and that assumption is wrong in a way that more frequent reviews wouldn't fix.
The assumption is that if you review the past thoroughly enough, you can prevent problems in the future. Auditing is fundamentally backward-looking. It's designed to find what already went wrong, document it, and recommend corrections. That has value, but it is structurally incapable of preventing the thing it's looking at, because by the time the audit sees it, it has already happened. What operational compliance actually requires is a model where execution is shaped and corrected at the moment it happens, not reviewed months later when the only thing left to do is document the damage.
This is the difference between compliance as an audit function and compliance as a culture. The first is an event that happens to the team a few times a year. The second is woven into how the work gets done every day. The shift from one to the other is not about doing more compliance activity. It's about doing it differently, and at a different point in time.
Why Backward Looking Reviews Fail
There are three structural reasons the audit model underperforms and they compound on each other:
The first is that audits are backward-looking by construction. A quarterly audit reviews the preceding three months. By the time an error surfaces in that review, it has already occurred, any harm it caused has already happened, and the root cause has often become obscured. Was the issue a process failure or an individual one? Three months later, with the specific context gone, it's frequently impossible to tell. The corrective action that follows is therefore aimed at a blurred target, and it arrives long after the moment when it could have prevented anything.
The second is that audits tend to punish rather than prevent and punishment changes behaviour in the wrong direction. This is where the most important research on the topic comes in. Amy Edmondson's work at Harvard Business School found that teams operating in psychological safety, where surfacing a problem was treated as a contribution rather than an admission of failure, reported more errors than teams operating in fear, not because they made more errors but because they surfaced the ones they made.¹ The teams that reported fewer errors weren't performing better. They were hiding more. Google's Project Aristotle, studying more than 180 of its own teams, reached the same conclusion from a different direction: psychological safety was the single largest predictor of team performance.²
When a team knows it's being audited and that non-compliance findings carry consequences, the rational individual response is to optimise for how the work looks at audit time rather than for how the work actually executes. Documentation gets polished, workarounds go underground rather than getting surfaced and fixed and errors get hidden rather than reported. The audit produces the appearance of compliance while actively suppressing the information that would allow compliance to genuinely improve. A culture built on punitive review is a culture that hides its problems and problems that are hidden cannot be fixed.
The third reason is that quarterly frequency is simply too slow for the cadence at which compliance-critical work actually happens. If the work happens daily and the feedback on that work arrives quarterly, there is a ninety-day gap between execution and correction. The behavioural research on habit formation, which we've covered in earlier pieces, is consistent that behaviour change depends on feedback arriving close to the moment of execution. A ninety-day-delayed signal cannot shape a daily behaviour. The feedback loop that would drive improvement is broken by the latency alone, before any of the other problems are even considered.
Compliance As An Afterthought
Underneath all three of these is a more fundamental structural choice that most organisations have made without examining it. They treat compliance as a function separate from operations. The compliance team audits what the operations team executes. The compliance review is a scheduled event while the daily work is something else. Compliance becomes something teams do in addition to their actual work, which makes it a source of friction and resentment rather than something owned by the people doing the work.
In organisations where compliance genuinely works, it isn't a separate function bolted onto operations. It's embedded in the execution itself, woven into the workflows and the feedback loops and the daily improvement of how the work gets done. Similarly, within investment firms, the risk team shouldn't be a separate team sitting in the corner; all investment professionals should understand and live risk and its implication in their investment decision. The compliance requirement is present at the moment of action, not referenced in a document the team is supposed to have read. The check happens as part of the work, not as a separate activity layered on top of it.
This is what the phrase "compliance as culture" actually means in practice. Not a poster on the wall about integrity. A structural arrangement where the right action is built into the workflow at the moment of execution, where surfacing a problem is safe and easy rather than risky and effortful, and where the improvements that result are integrated into the process fast enough to matter.
The Shift Is Already Underway, Slowly
There's reasonable evidence that operations and security leaders know periodic review is failing them, even where they haven't yet changed the model. RegScale's 2026 State of Continuous Controls Monitoring report, a survey of more than 250 information-security leaders, found that while 95% of organisations have implemented some level of governance and compliance automation, only 28% continuously monitor their controls in real time. The remaining 72% still rely on periodic assessment.³ The same survey found that 85% of organisations report delaying or eliminating compliance activities because of resource constraints, and 83% report moderate or major delays caused by manual compliance work, with over half dedicating the equivalent of a full-time person purely to evidence collection.⁴
That research is specific to the information-security domain rather than operational compliance as a whole, so it's worth being careful about over-extending it. But the pattern it describes (leaders who want real-time visibility into compliance but remain stuck on periodic review because their infrastructure was built for periodic review) maps closely onto what I've seen across operational functions more broadly. The intent has moved ahead of the infrastructure. Most organisations default to quarterly review not because they believe it's the most effective model but because it's the industry standard, regulators recognise it, and the tools they have were built for it.
Why Organisations Stay Stuck
The inertia has three sources worth naming, because each one points to what actually has to change:
The first is simply that quarterly audit is the default. It's what regulators expect, what other companies do, what the existing compliance software was designed around. Standard practice has its own gravity, and "this is how it's done" is a powerful reason to keep doing it even when the results are poor.
The second is a genuine technology gap. Continuous compliance requires real-time execution data, feedback loops integrated into the work, and guidance shaping how the work happens as it's happening. Most compliance software was built for the quarterly model: document management, evidence storage, and reporting. It produces the artifacts an audit consumes. It does not shape execution at the moment of action, because it was never designed to. Organisations stay on quarterly review partly because they have no infrastructure that would let them do anything else.
The third is organisational structure. Compliance teams typically sit separate from operations, often centralised while the operations they oversee are distributed. Communication between them happens at scheduled reviews. That separation reinforces the audit mindset structurally. Shifting to continuous compliance requires compliance to become a shared responsibility embedded in operations rather than a separate department's periodic activity, which is an organisational change, not just a tooling one.
What Continous Compliance Looks Like In Practice
A continuous model inverts each of the failures of the quarterly one. Instead of reviewing the past, it shapes the present. Execution is tracked as it happens rather than reconstructed months later. Issues surface within hours or days, while the context that explains them is still intact, rather than appearing in an audit long after the root cause has faded. Improvements come from the people doing the work, surfaced through feedback loops that are safe to use, rather than being handed down from auditors after the fact.
The cultural shift is the part that matters most and is hardest to engineer. For continuous compliance to work, surfacing a problem has to be safe. If reporting an issue carries the same career risk under continuous monitoring that it carried under quarterly audit, people will hide issues just as they did before, and real-time monitoring will simply produce real-time hiding. The Edmondson finding is the load-bearing insight here where the monitoring environment has to be structured so that surfacing is treated as the functional behaviour it actually is, not as an admission that invites punishment. Get that wrong and the technology change accomplishes nothing.
When it's done right, the relationship between the team and compliance changes character. Compliance stops being the thing that happens to you a few times a year and becomes part of how the work is done. The quarterly audit, when it comes, holds no surprises, because the execution data already shows what happened, step by step, as it happened.
How LIVPRO Makes Compliance Continous
LivPro is built to make the continuous model structurally possible rather than aspirational. The compliance requirement lives inside the workflow at the moment of execution. As the team executes a procedure, the relevant compliance checkpoints are part of the steps themselves, with the context for why each one matters present at the point of action rather than filed in a policy document. Compliance falls out of operational excellence. Execution data is captured as a byproduct of the work happening, which means the record of what was actually done, by whom, in what sequence, with what timing, exists in real time rather than being reconstructed at audit.
The feedback medium is the second half of it. After each step, the person doing the work can surface what they noticed while the texture is intact, and process owners can integrate genuine improvements into the workflow quickly. Because the surfacing is built into the work rather than escalated through a separate channel, and because the environment is structured to treat surfacing as routine rather than risky, the psychological-safety condition that continuous compliance depends on is supported structurally rather than left to hope. The improvements that result reach the next execution through the updated workflow, which closes the loop that quarterly review leaves permanently open.
The effect on the audit itself is that it shifts from documentation review to evidence of execution. Rather than asking the team to prove after the fact that they followed the procedure, the auditor can see the actual execution record through the automatically generate LivPro Audit Reports; who did what, when, with what adherence to the standard, which issues were surfaced, and how the process changed in response. The audit becomes a review of a continuous record rather than an interrogation of a reconstructed one. By the time it happens, compliance is already the state of the system rather than a performance staged for the occasion.
Compliance Becomes What The System Does, Not What The Team Performs
Quarterly review creates the appearance of compliance. It produces documentation, findings, and corrective actions on a schedule and it lets everyone feel that compliance has been attended to. What it does not produce is execution that is actually more compliant, because it operates too late, too punitively, and too slowly to shape the behaviour it reviews.
Real compliance culture is structural. It's enabled in execution as it happens rather than auditing it after the fact. It makes surfacing problems safe rather than punishing it. It integrates improvements continuously rather than filing them annually and it embeds the compliance requirement in the work itself rather than treating it as a separate activity the team performs under observation. When those conditions are in place, compliance stops being a thing the team performs a few times a year and becomes a property of how the system runs every day.
LivPro is built to be the infrastructure for that shift. The framework holds whether or not you use it. The product is the operational answer to the question the framework forces.
Adopt the new compliance model now -> Book a Call Today
Citations
- Edmondson, A. C. (1999). Psychological safety and learning behavior in work teams. Administrative Science Quarterly, 44(4), 350–383. See also Edmondson, A. C. (2018). The Fearless Organization. Wiley.
- Google re:Work. (2015). Guide: Understand team effectiveness. Project Aristotle research, conducted 2012–2014.
- RegScale. (2026). State of Continuous Controls Monitoring Report (2nd annual; survey of 250+ information-security leaders). Findings reported via BusinessWire and Help Net Security, January 2026. Note: this research addresses information-security GRC specifically rather than operational compliance broadly.
- RegScale. (2026). State of Continuous Controls Monitoring Report. As above.