Why the Strongest Compliance Programs Focus on Culture, Not Just Rules

Many organizations still approach compliance as a checklist—policies written, training completed, audits performed. But as Jill Fallows Macaluso explains in this episode of Compliance Conversations, the most effective compliance programs go far beyond requirements. 

Jill argues that ethical culture is not a “soft” concept—it’s a measurable business advantage. Organizations that foster psychological safety, empower employees to make informed decisions, and anchor behavior in shared values are more innovative, more resilient, and better positioned to earn public trust. 

A key theme of the conversation is risk-based decision-making. Rather than positioning compliance as the final approver, Jill emphasizes the importance of shifting compliance teams into advisory roles—equipping the business with principles, tools, and confidence to make responsible decisions in complex, fast-moving environments. 

The takeaway is clear: when people feel safe to speak up, challenge assumptions, and learn from mistakes, compliance becomes part of how the organization succeeds—not just how it avoids penalties. 

Ready for a deeper dive? Read Jill’s recent article on this topic here. 

About Jill Fallows Macaluso:

Jill Fallows Macaluso is the Chief Ethics & Compliance Officer at Novo Nordisk. Jill, who is trained as a lawyer and a nurse, is also the Executive Sponsor of two Employee Resource Groups (ERGs) at the company, EMERGE, which develops emerging leaders, and Nurses in Novo Nordisk. Jill is a leader outside of Novo Nordisk as well, serving as a twice-elected member of the Moorestown, N.J., Board of Education, where her focus is on maximizing the potential and well-being of every child. The opinions expressed by Jill in this podcast are her personal opinions. 

The views and opinions expressed in this podcast episode are solely those of the guest and do not necessarily reflect their organization. 

Episode Transcript

Hello, welcome everybody to another episode of Compliance Conversations. I am CJ Wolf with Healthicity and super excited for our guest today, Jill Fallows-Macaluso. Welcome, Jill. 

Yeah. Thanks, CJ. I'm really excited to be here and I'm super passionate about a cap culture of ethics and compliance. So I'm excited to have this conversation with you. I'm currently the Chief Ethics and Compliance Officer at Novo Nordisk, which is about a hundred-year-old Danish pharmaceutical company that's really primarily focused on diabetes, obesity, and other chronic diseases where we can make a difference. By way of background, I'm a nurse and a lawyer. I'm a mom of three teenage daughters, a 10-year Girl Scout leader, and currently serving in my fourth year in a leadership role as a publicly elected member of the school board in my hometown in Moorestown, New Jersey. So all of those things are very much related to culture, and I'm excited to talk to you. 

So true. And I think of listening to all of those, I imagine that the most difficult of all those is a mother of three teenagers. 

Perhaps, yeah. But it's also the most rewarding. 

So absolutely, right? Absolutely. Well, thank you for sharing a little bit about yourself. And uh, you know, I don't know if I told you this before, but I was a chief compliance officer of a medical device company. Um, and so I I kind of, you know, know that kind of general space of industry a little bit. And so we're really excited to have you uh share a little bit about your thoughts. And um we we so we uh just to like introduce the topic, we wanted to talk about kind of how leaders can foster kind of this creative risk taking, you know, innovation while still maintaining public trust, right? Like I'm sure Jill, the the company you work for is has to have a good reputation with the public. And and but you also, you know, innovative companies need to take some risks and those sorts of things. And so how do you do all that? And so that's kind of what we wanted to talk about. Um, and if it's okay, the first question I'd like to ask you is, you know, how can ethics, like you know, you're talking to your board or your CEO, how can ethics actually become a competitive edge, not just this compliance goal? 

Yeah, yeah. And it really can be a competitive advantage. And I think it's very easy to think about the requirements and having the foundational elements of a compliance program and you know, check the box exercises like training and monitoring and auditing. And those are all really important. And you know this as a former chief compliance officer, but it's so much bigger than that. Companies with an ethical culture, both in the four walls of the organization and that trust that you talked about with society, they definitely have a competitive advantage. I mean, data shows it time and time again that companies with these cultures are more profitable, they're more sustainable, they attract and retain talent, people want to work hard to win, so they're more productive, which just means better business results overall. Um, and for me, when I started into this chief, I've been at Novo Nordis for 22 years. But when, yeah, so when I moved into the chief compliance officer role, actually just 10 years ago, um, this month, um, we were really not thinking about um a culture of ethics and compliance as much as we were thinking about the compliance requirements. And at the time we had a corporate integrity agreement, like so many other folks in highly regulated industries do. Um, and I had this really neat opportunity to say, can we continue to deliver on the requirements in the corporate integrity agreement? But think about this taller order of ethics and the broad benefits of a culture of ethics. So I took this holistic approach to transform not just the work that we were doing, but how we deployed the resources in the department, and then how would we kind of water those culture seeds throughout the organization? 

Yeah, uh, so important. And I really agree with what you said. You know, we've got kind of the nuts and bolts of what we have to do day to day. Yes, we have to stay up on the regs. Yes, we have to have policies and you know, all of these things. And then there's kind of this, maybe it's a softer skill. I don't mean to say it's less important, but it's it's less defined. Um, it's harder to measure, measure sometimes, maybe. But I think, you know, I deal with a lot of clients and I step into these different uh organizations and I can tell within the first few minutes of okay, they they've they've got a different culture than that last group I was with, right? And so the culture is palpable, but it makes such a huge, huge difference. It does. 

Yeah. Yeah. And sometimes the word that you use, the word I use sometimes is it's squishy. Yeah. Yeah. You're not going to change culture with a traditional project plan, but you need to have an intentional plan. How am I gonna change culture? Really, not even by talking about culture. You're gonna have all these little um kind of levers that you pull through this holistic approach where you're making small changes by watering these seeds to see, like you said, that the way the organization feels. I guess experts say culture is the values, beliefs, and behaviors of an organization. It's the collective culture and the individual mindset of every employee. And you can feel it when you walk through the doors, you feel it when you work there. It's what brings people, it what's got people to leave. Um, and even actually the most important person in an individual employee's life is that people manager. So that mood at that middle is so, so incredibly important. If you want to go on a culture journey, you got to get the people managers on the uh same page as you. 

Yeah, exactly. That's and you're and I think, you know, in larger organizations that are probably geographically geographically diverse like yours, it's it's probably not as easy as if as if everyone is like in one physical location. Um, I do you have any thoughts on that, on on you know, balancing you know, a diverse uh workplace and workplace? 

I do, because um, you're right, we're all in countries all over the world. But when you think about that that textbook definition, to be nerdy for a second, of culture, that it starts with your values. Novo Nordisk is um a hundred-year-old company headquartered in Denmark, and we have incredibly deep values. And those values have been the same. They've been the constant over the 22 years that I've been there, and probably the whole hundred that the companies existed. So we anchor the work that we do in those values. And sometimes deep held beliefs and ways of doing things get in the way and change people's behaviors. But if you can anchor it all back to the values, the reason that we exist is to serve patients, to bring innovative products to market, putting the patient at the center of every decision and really, really anchoring back to those. You can actually across the world uh change culture and foster cultural change. Does that make sense? Yeah. 

It totally makes sense. And you know, um, when you just hearing you talk, it sounds very intentional. My guess is that you know, these values have been discussed, like you said, for decades. Um, and and somebody is leading out on what those values are, and then others are following that lead. Do you have thoughts on, you know, maybe you mentioned like the people manager, right? Or the person manager, that's important. My direct supervisor, hearing and feeling that from them. But it to be consistent, it has to somehow pervade the the whole organization. And do you have any thoughts on how it's intentionally done? 

Where you Yeah, I mean, yes, I think that you're planful and intentional, but again, it's not that traditional project plan. So I I mentioned that mood at the middle. Um, people people call it different things, but there's you know, the tone at the top, and then there's the buzz at the base. And you want that culture to be woven into the fabric of the organization. So you need to intentionally think about those, you know, if it's a triangle, are you do you have buy-in from the folks at the top of the organization to row in this session? Yeah. And I can give a specific example around when I want it to foster psychological safety if we have time to talk about that. Um do you have yeah, so do you have the buy-in? Um, and yeah, so okay, so psychological safety, I'll just kind of start talking about it. It's so incredibly important to um an effective compliance program. You know, you as a chief compliance officer, you know it's the the box check is that employees know they have to report compliance concerns. They know they have to speak up, but we want them to feel safe when they report concerns and know that um retaliation is not going to be tolerated. So that's sort of like the floor, but the ceiling is so much higher because if you have a speak up culture and every employee feels psychologically safe to um, you know, speak up about everything from compliance concerns to feedback to questions to great ideas, it leads to so many benefits. It leads to greater innovation and creativity. It actually leads to what you opened with, which is um increased risk taking, trying new things without the fear of failing. But when we do fail, fail fast and learn from those mistakes, knowing that they're not going to define us, but they're just gonna propel us to do better as we move forward individually or together. So the theory around the value of psychological safety is there. And when I made this commitment to foster psychological safety, I guess back in 2020 or 2021, it was very much related to DEI and B commitments that we were making across the organization. And I felt like, wow, if if we can really get this right, we can foster a culture of inclusion where each person is gonna be their whole self at work and bring all these creativity ideas and innovation and we're gonna be a better company. And hey, by the way, we're gonna maintain a strong compliance program. So back to the tone at the top, the business case was there. So the first thing I did was present it and pitch it, you know, individually in one-on-one meetings to each of my executive colleagues to see, you know, did they buy in? Were they on board? And it was easy to say yes. Yeah, of course. How can you argue with that? Strong compliance, greater innovation, better business results. It seems like a no-brainer, but it's still kind of squishy on how to do that. And so, you know, a little more at the top and really reaching that broad employee base. One of the first super cool things I did was invite Amy Edmondson for a fireside chat. And she's the founder of or coined the terms psychological safety back in the 1990s. So she, me, and another executive colleague hosted a fireside chat where we talked about the theory and the power of psychological safety. So we set the tone at the top and invited everyone to join and hear about this. Um, and then we really honed in on that middle and how could we have those ambassadors or flag bearers for psychological safety in every people manager? And so there we developed um tools and resources that would help people managers think about psychological safety and how could they foster it within their team. And because it's, you know, when you're changing behaviors, you sometimes need that like mental sticky note. Like, what am I supposed to be doing? So, what should I be practicing? What should I be intentional about? And it's actually not that hard to do to foster psychological safety. I mean, I guess some of it's uncomfortable, but um, there were um, you know, you need to give space to the quiet voices, you need to um be vulnerable, you need to share your own personal story, something we often shy away from as people managers. Um, we need to talk about mistakes, um, you know, celebrate messengers and really create this environment where the team just is everybody's sort of kind of chomping at the bit to share their point of view, to bring their idea, to talk about trying something different, to challenge someone and respectfully disagree with them, but know that they're not gonna be that like wrinkled nose look at them. It's gonna be like, oh, okay, let me think about what you just said. Um, so having that um tone at the top, that kind of, you know, really giving the tools and resources to the mood at the middle really does affect the buzz at the base. And then there were a lot of things, little base things that we did in ethics and compliance. We wrote thank you notes to people who self-reported. Um, we encouraged people managers to talk about compliance mistakes with their team to show them that it's not the end of the world. Um, we use something called way to go points to um, you know, recognize people publicly for things that they had done and their manager and their manager would see it. So it's again, it's squishy, but there are hard tactics, but there are lots of little tactics. So you need to have people like chief compliance officers who are perfectly poised to do this to foster culture change. 

That's such a that's such a great way to put it. You know, um, I I uh another hat that I wear, I teach in a master's program in patient safety leadership. And this culture is so important because if you're a frontline nurse or if you're somebody who makes a mistake, not we're all human and we're gonna make mistakes, but let's say the systems and the processes are set up in such a way that mistakes are more likely. Like there's a way to to organize things. But if you don't let somebody speak up, like if they speak up the first time, and you might have policies about non-retaliation and all this sort of stuff, but if they hear, well, why are you reporting that? We don't report that here, right? If somebody said that, it's like all of the check boxes that you did mean nothing if they are now going to report again because they had one bad experience potentially. You have to rebuild that trust. 

I know. And I mean it's such a great example, the healthcare setting. You don't want people lifting up because they were talking about the safety of patients. You don't want people lifting up the carpet and like sweeping it under the rug. You want them to come forward so that we can improve it. But if that fear factor is real, people are worried about their job, they're worried about the consequences. They're just worried about how they'll be viewed if they bring forward something that's not a good topic. Yeah. 

Yeah. Yeah. Such such a great, such a great point. We're gonna take a quick break. Um, we got some other really good topics and questions to ask, uh, Jill. Uh, but uh we'll be back in a few moments, everybody. 

Okay. Great. 

Thanks everybody for coming back from the break. Um we're talking to Jill about uh culture and and important um uh concepts that are to use your term a little bit more squishy than kind of the check boxes. Um so we we started a little bit with the concept of risk taking. So what is the role, in your opinion, of risk taking and empowerment in order to another giant squishy topic. Right? 

But it's it's so, so important. Um, you know, especially in the pharmaceutical industry, it's really fast-paced. The risks are very rarely clear cut. Um, you know, you you know we're we're working with laws, regulations, and industry standards and enforcement actions, but because companies in today's world, it's a super competitive environment and we're running really fast to meet patients where we are where they are, which means that we're changing the way that we provide products, looking at our business model, thinking how do we modernize our approach to bringing these innovative products to market. So it really is uncharted territory, which makes the risk conversation even swishier. Um, and I think a lot about it, this word empowerment, it's definitely a corporate buzzword, but it's such a good word, right? Because you want employees, everybody in the organization, when empowerment's working, they feel um like they have the power to do their job autonomously and to really own that decision making. And then that's where the risk comes in. Well, wait, if I own the decision making, am I also responsible for the risk? And the answer is yes. Yeah, we're just advisors. So the business is responsible for making good, well-informed, risk-based decisions. But in my experience in the 20 years in this compliance and legal pharmaceutical space, it's it's so easy to get bogged down in all the rules and kind of to look to compliance to make the decision, to give the answer, to give the green light. It just feels more comfortable, right? And people back to the hospital setting, they're nervous to make a mistake. Um, so so what can you really do? Because that's not empowerment in practice if you're looking for the yes. Um, and it's similar to the psychological safety story around culture. To make empowerment work, it takes intentional effort. Um, and that intentional effort means that as compliance professionals, we need to give the tools, resources, guidance, and support to the business to help them feel competent in making these risk-based decisions. I don't know that, you know, it's not going to be necessarily comfortable, because that's the whole point of this. Trying new things isn't comfortable. Speaking up isn't always comfortable, but you can be competent and capable. So when I think about the way that we've done this and made this intentional shift, we called it risk-based decision making in Novo Nordisk. And we wanted to, as ethics and compliance professionals, empower the business to make better risk-based decisions. So we did a couple of, you know, not easy things, but you know, things that you would naturally think about, which is shifting our policies away from rules towards principles. So having principles-based policies that are simple, easy to access. So you think about that, you know, line field sales employee, you know, they don't, they're not sifting through tons of rules about what they can and can't do. They have the principle, and then they're going to make a good, you know, informed decision relying on that principle. And maybe they won't always get it right, but you know, that's where the mistakes come in. Um, enhance training that's fresh and modern. And then the real work began, which each of us to you know, 40 people in the ethics and compliance department really looking in the mirror and changing our own mindset. Because I think we liked giving answers. 

And we feel like we have worth when we can give the answer or something, right? 

Yeah, yeah, it does. And it's it feels good. Yeah. Yeah. Like, okay, let me help you, let me give you the answer. So we went through a very, very intentional um, I call it an exercise, but we even developed a little bit of a guide and we did some workshopping. Like, if we're really gonna get this right, if we're gonna stop, you know, answering the phone 247 to react to questions and to give answers, we need to change the way we're working, which means we need to change our mindsets. So things like um, you know, you know, actually just pausing and listening to the business um dilemma, and then instead of telling. Telling and having a tell mindset, shifting and having an ask mindset, and actually stop operating as an approver and start acting as an advisor. So those kind of three things, um, you know, it's that mental sticky note again. We're shifting culture. So those those three things were really three good tips that we as compliance professionals rely on. And you know, we're seeing it play out. Um, some some people just like rules and they don't want to make the decision. So it's kind of, you know, how how can we it's definitely not a light switch. Got to keep working on it. Yeah. 

Yeah. Well, and when you're talking about an innovative industry like you're in, um now I'm kind of leaving just the compliance part of it, but if you've developed this appropriate risk-taking kind of approach, you know, innovating in science and innovating right like we know the most successful breakthrough throughs have come from failures over and over and over again. And you said something earlier that said fail fast, which implies, yes, you're gonna take a risk. You're not gonna wallow in it if it's a failure, you're going to fail fast, which implies you're gonna learn from it, and then you're gonna go on to the next decision. And I just like that. That's a great kind of mindset to have. 

Yeah, yeah. And it's even the little things like small, like compliance blips. You can fail fast and be like, oh, I made a mistake. I'm gonna do better the next time. And then the bigger business risks that we take and they don't work out the way that we think um they're they're going to, you just pivot and adjust and apply those lessons learned. Yeah. 

Yeah. So, Jill, I want to ask you. Now, I know you haven't moved around a lot. You've been there over 20 years, you say. But let's let's just theoretically, I don't want to get your uh bosses nervous, but theoretically, let's say you left and you went to a new organization, and that new organization, you kind of like, oh, this culture is not where I came from. Are these transferable kinds of things that you think you or me or somebody else could learn and then make create a new culture at a new organization if it's not there? 

I definitely think they're transferable. I mean, you said it that culture itself is really specific to an organization. You can feel it when you walk in because it's institutional, but that ability or capability or muscle to actually foster culture change is very transferable from company to company, to team to team. It really is like a muscle. Um when I think about the hallmarks of an ethical culture, it's that psychological safety, inclusion, and that outcome of trust. And they're very much transferable. You need somebody like, and that's why Zeta CCO is so perfectly poised, often in partnership with the head of um human resources or PO as we often call it now, to really hold hands to make that culture shift. And again, I'll say it one last time that it's not a light switch, it's that seed that you plant continuously water. Um, but it definitely is transferable. 

Yeah. 

Yeah, it makes me so I'm kind of a sports fan. And so I, you know, I've I've followed um local teams that have had success and then long periods of failure, and then they get a new coach. And it's the exact same personnel. So these are the exact same athletes, these are the exact same people who last year had the same skills. It's the mindset. It's what so it's like this change of culture, and then this team starts to win, not because they they got the best players uh uh to make the change, they had the exact same personnel and talent, but now they're succeeding. So it is a mind, it's a mindset change. And I think that I agree with you, those things are transferable. And you're right, it's not a light switch, it it takes time. 

Yeah, and I haven't really thought about the sports analogy, although my husband's a huge college football fan, and even the three girls are football fans. So there's lots of conversations about coaches in this house. Right. And and uh I'm sure they would agree with you. And it makes perfect sense that it's the same players, it's the same technical skills, but when the leadership behaviors and that tone at the top changes, that team can do different things together that they maybe never you know imagined possible with the old coach. 

Exactly. Exactly. Well, this this has been a great conversation, Jill. We're kind of coming up towards the end of our time. I wish we could spend more time, but I want to see if you have any last-minute thoughts or or parting words on kind of this on this topic, if you do. 

I do. I think you know, the last question you mentioned, you know, I've been at Novo Nordisk for a long time and going to another company. Um, I have been able to deploy these capabilities, this muscle around fostering an inclusive culture in other leadership roles. I mean, even Girl Scouts and just making those meet, making those meetings a safe space where girls from all different backgrounds and experiences come to the meeting and feel like they're part of something bigger. Um, I've reflected on that, you know, now with what I know about culture. But even today, in today's world, um, it's very much a capability that I bring to my role on the school board in this publicly elected office. And so there are oftentimes disagreements at the school board around, you know, what we need to do. Um, but when we push through that disagreement and then discomfort and make decisions that are centered around the values, you know, making good decisions in the best interests of the kids, we really come to great outcomes. And I think I guess I would just leave everyone with this inclusion is sort of the center of it all. It is like a way of living, a state of being. It's a practice, not just in compliance officers and pharmaceutical companies or Girl Scout troops. Yeah, but in life. When you're building a friendship, leading a team, or sitting in a publicly elected office, you'll have greater outcomes if you actually live and breathe inclusion. 

So yeah. Such a great, that's a great way to end this um uh this discussion is inclusion. So thank you so much, Jill, for sharing your thoughts and and your experiences. 

Yeah, thanks for having me. It was fun. And thanks for sharing your experiences too. It was a really great conversation. 

Absolutely. And thank you to all our listeners. Uh, as we always say at the end, we we welcome your uh input. If you know of a guest or a topic that you'd like to hear about or a person you'd like to hear from, please share that with us because we want to make these conversations as beneficial to you as possible. Um, and until next time, everyone, take care.