Compliant and Compassionate: The Skill Nobody Teaches

For twenty years, the compliance industry has been solving the wrong problem.

We identified the gap — people doing harmful things in the workplace — and we diagnosed it as a knowledge problem. If people knew the rules, they'd follow them. So we built an entire infrastructure around knowledge transfer: modules, videos, quizzes, completion certificates. We got very good at proving that people had been told the right thing.

What we never solved was the moment itself. The closed door. The silence after difficult news. The customer who says something that changes the nature of the call entirely. Those fifteen-second windows where a person has to be simultaneously human and institutionally correct — and has never once been given a safe place to practise being either.

That is not a knowledge gap. It is a performance gap under pressure. And it's the gap that employment tribunals, the FCA, and the EHRC are now charging organisations for leaving open.

When the Door Closes

Sarah has been a manager for three years. She's good at her job. Her team like her. She completed the harassment and disclosure module that appeared in her learning portal last March — clicked through it on a Tuesday afternoon between two back-to-back meetings, scored 90% on the quiz.

On a Wednesday morning in November, one of her team members — a quiet, reliable man called David — asks if they can close the door before their one-to-one starts.

"Before we go through anything else," he says, "I need to tell you something. I was assaulted at the weekend."

Sarah feels the air change. She knows there's a process. Somewhere in that module there was a slide about disclosure. But right now, in this room, with David looking at her, she has no idea what to say first. So she says the first safe thing she can find: "Right, okay, let me just make a note of that and we can make sure we get the right people involved."

David nods. The conversation moves on. He doesn't bring it up again.

Three months later, David raises a formal grievance. Not about the assault. About how he was made to feel when he disclosed it.

Sarah didn't fail David because she didn't know the policy. She failed him because the policy never prepared her for the moment before the policy kicks in. The moment where a person needs to feel heard before they feel processed.

That moment is now a legal liability. And it's one that no amount of additional module content will fix.

The Legal Standard Has Moved. The Training Hasn't.

The irony of heavy investment in compliance training is this: the more an organisation puts in, the more confident it becomes that its people are prepared. That confidence is increasingly the real liability.

Because the legal standard has shifted — quietly, significantly, and in ways that most L&D functions haven't fully reckoned with.

The Worker Protection Act 2023, with its enhanced duty coming into full effect in October 2026, does not ask whether your organisation has a harassment policy. It asks whether you took all reasonable steps to prevent harassment. That is an active standard. It asks what your people actually do in the moment — not what document exists on your intranet, and not what module sits in your LMS with a 94% completion rate.

The FCA's Consumer Duty (Principle 12) has made the same move in financial services. Vulnerable customer handling is no longer assessed on process compliance — whether the agent followed the script — but on outcome. If the customer felt unheard or mishandled, that is a regulatory failure. The FCA now audits the experience, not the checklist.

Allay (UK) Ltd v Gehlen made the same point from the bench. The Employment Appeal Tribunal ruled that brief, outdated training was insufficient to mount a reasonable steps defence. It looked at what the training actually produced in terms of behaviour — and found it wanting.

The direction of travel is consistent across every regulator: they are no longer satisfied with evidence that people attended. They want evidence that people can perform.

Most organisations cannot produce that evidence. Not because they haven't invested. Because they've been investing in the wrong thing.

The TSB Fine Was an Empathy Fine

Consider what it means to be the Chief Risk Officer at TSB in 2023, sitting in a room and being told your organisation has been fined £10.9 million.

Some of the reasons were technical — systems failures, inadequate controls. But inside the FCA's enforcement decision was a finding that should have unsettled every regulated firm in the country: customers in vulnerable circumstances had not been identified and handled with appropriate care.

The FCA fined a major bank, in material part, because its people didn't sound like they cared.

That is worth sitting with. Not because TSB's agents were indifferent — they almost certainly weren't. They knew what vulnerability meant. They had completed the training, could define the term, understood the policy. What they could not do, under the pressure of a live call with a distressed customer, was demonstrate the empathy that Consumer Duty demands. The policy was present. The human behaviour wasn't.

This is the version of the problem that the TSB fine made visible: competence under pressure is not the same as knowledge at rest. And the FCA — along with the EHRC, the Employment Tribunal system, and increasingly the courts — has decided that it will hold organisations to the harder standard.

Every Chief Risk Officer in financial services should read the TSB enforcement decision not as a story about a bank that failed, but as a precise description of what their own organisation's exposure looks like the next time a customer discloses vulnerability to an agent who knows the rules but can't find the words.

Three Moments. The Same Impossible Tightrope.

This tension — between being compliant and being genuinely human — isn't theoretical. It plays out in specific, recurring conversations across every regulated organisation in the country. Conversations that most organisations have never properly prepared their people for.

The vulnerable customer call. Priya is ninety minutes into a shift in a busy collections centre. She's working through a call about a missed payment when the customer says quietly: "I'm sorry, I just — I've been choosing between heating and eating this month."

Consumer Duty is explicit: this is a vulnerability signal. Priya must identify it, respond with genuine warmth, and flex away from the collections script — all within the next thirty seconds. She knows this in theory. But her nervous system is in collections mode. Her call target is on a screen in front of her. Sounding authentically human and procedurally correct at the same time, in real time, is not a knowledge task. It is a performance task. One that cannot be acquired by watching a video.

The redundancy conversation. A senior manager — experienced, decent, someone who genuinely cares about his people — sits down with a team member to tell her that her role is at risk. He's followed the HR guidance. He delivers the message clearly.

Then comes the silence.

She doesn't cry. She doesn't shout. She just looks at him. And in that silence, he panics slightly and starts to fill it. He says something that sounds reassuring but isn't accurate. He implies more flexibility in the process than actually exists. He means well. He's trying to be kind. Six weeks later, that conversation is being read aloud in a consultation meeting as evidence of misrepresentation.

The compliant thing and the compassionate thing, in that silence, had to be the same sentence. Nobody ever taught him how to construct it.

The disclosure that changes everything. Back to Sarah and David — or the version of them that exists in almost every organisation. Someone closes the door and says something their manager has never heard before. An assault. A diagnosis. A domestic situation becoming dangerous.

There is a moment — fifteen seconds, perhaps fewer — where what the manager says next determines whether this person feels safe or silenced. Jump too quickly into procedure and you signal the policy matters more than they do. Fail to reach procedure at all and the organisation cannot manage the risk it now carries. That narrow window is one of the highest-stakes verbal moments in any workplace.

And virtually no one has ever had the chance to practise walking it.

The Problem Underneath the Practice Problem

The logical response to all of this is practice. If people revert under pressure to what they've rehearsed rather than what they've been told, give them something worth reverting to.

But there's an obstacle here that the training industry rarely names honestly, because it sits outside the product-shaped solution most vendors are selling.

The reason organisations don't practise these conversations isn't only that the tools didn't exist. It's that practising them requires people to be seen getting them wrong. And most organisations have never made that safe.

Ask a manager to rehearse a disclosure conversation in a group training session and you're asking them to be publicly incompetent in front of peers and possibly seniors. Most will perform adequacy rather than risk exposure. The exercise produces the appearance of practice without the reality of it. Nobody fails. Nobody learns where the gaps actually are.

This is the layer underneath the knowledge problem and the tools problem: a culture that has made vulnerability in practice — the willingness to be wrong before the real moment arrives — more uncomfortable than the alternative. And the alternative, as TSB and the Employment Tribunal system keep demonstrating, is considerably worse.

Genuine practice requires genuine psychological safety. The willingness to hear "that response would have made things worse" without it feeling like a judgment on your character. Most compliance training has never come close to creating those conditions. It has certified people without testing them and called that preparation.

Why the Conventional Fix Doesn't Work

Even where organisations do try to practise these conversations, they run into a structural problem that rarely gets acknowledged openly.

You cannot ask a colleague to roleplay being suicidal. You cannot ask a willing volunteer to sit across from someone and pretend they've just been assaulted. You cannot put a real manager in a simulated redundancy conversation with someone who genuinely needs the job. The emotional asymmetry makes the exercise either hollow — everyone holds back, no real pressure forms, it feels like amateur dramatics — or actively harmful to the person playing the vulnerable role.

No-one would accept a fire drill where employees simply watched a video of someone escaping a building and ticked a box confirming they'd understood the principle. We accept that verbal equivalent every day. We call it compliance training.

And then we send people like Sarah, Priya and the redundancy manager into their hardest moments, having never once been given a safe space to get it wrong first. We trust that the knowledge will be there when the pressure isn't. It usually isn't.

What Defensible Evidence Actually Looks Like

The "reasonable steps" defence — the legal standard under the Worker Protection Act, Consumer Duty, and the Equality Act — requires evidence of what your people did in the moment, not evidence of what they were shown twelve months earlier.

A completion certificate documents attendance. A transcript of a live, unscripted simulation response — where a real person had to speak out loud, without prompts, to a scenario designed to replicate the pressure of the actual situation — documents something entirely different. It documents behaviour. It documents the hesitation before answering. It documents whether the tone conveyed genuine care or institutional anxiety. It documents whether the person found the words or reached for the script.

That is the kind of evidence that satisfies a Risk Committee. That is what a General Counsel can put in front of the EHRC or the FCA and say: we didn't just tell our people what to do. We tested whether they could do it, under conditions that approximate reality, and here is what we found.

The evidence also does something that completion certificates can't: it tells you where the gaps are before they become incidents. Not which departments have a 94% completion rate, but which teams freeze when a customer says the wrong thing. Which managers reach for procedure when a person needs presence. Where the real liability is living, right now, in your organisation.

The Question You Should Be Able to Answer

Here is the question that no compliance framework, LMS platform, or training programme currently helps you answer:

If a regulator asked you to show them what your people actually say — not the policy they've been shown, but the words they produce under real pressure, in the specific scenario that led to the claim — what would you show them?

Most organisations, if they're honest, would show a completion log and hope for the best.

That answer was borderline acceptable five years ago. Under the Worker Protection Act's enhanced duty, under Consumer Duty's outcome-based standard, under a Tribunal system that has read Allay v Gehlen carefully — it is no longer sufficient.

Sarah didn't fail David because she was a bad manager. She failed him because her organisation gave her knowledge and called it capability. Because nobody ever put her in that room, with that silence, before the real version arrived — and let her find out whether she could handle it.

The organisations that will be best placed when scrutiny comes are not the ones with the highest completion rates. They're the ones that asked the harder question first, in a space where the answer didn't yet cost them anything.

Real Talk Studio builds pressure-tested simulations for regulated enterprises — designed to generate the audit-ready evidence of competence that the Worker Protection Act, Consumer Duty, and the Equality Act now demand. Find out more at realtalkstudio.com