Compliance that works around how people actually work

Part one of a series on people, machines and compliance that actually works.

Here’s a confession most compliance people will recognise: we write policies for someone who doesn’t exist. He reads every page, remembers his training six months later, never skims and never has a Friday afternoon. Christian Hunt, who used to run behavioural science at UBS, even has a name for him. Mr Logic.

Most compliance failures in Guernsey firms aren’t failures of knowledge. They’re failures of attention, timing and trust. That’s the bad news. The good news is that they’re predictable, and anything predictable can be designed around: by people, by machines, and best of all by the two working together. That’s what this series is about.

Mr Logic’s world

In Mr Logic’s world, a policy that’s been written has been read, understood and accepted. Nobody who has worked in a first line of defence has ever lived there.

The traditional toolkit (policies, training, attestations and the occasional stern email) assumes rational people weighing up the odds of getting caught. Decades of behavioural science say otherwise. Daniel Kahneman showed that most of our decisions are made by fast, automatic thinking; the slow, careful kind is expensive and we ration it. Herbert Simon showed that every decision is boxed in by three things: time, information and mental capacity.

I learned this as a Head of Governance long before I wrote about it. High volumes, tight deadlines and a first line still finding its feet don’t leave much room for slow thinking. Of those three limits, the one you can do most about is information: what people see, when they see it, and how much of it. Hunt puts it neatly. You can’t reprogram the human operating system, and you can’t upgrade the hardware. You can change the data it runs on.

Five human limits, and how to design around them

None of these are character flaws. They’re how capable brains save energy, which is handy, because it makes them predictable.

1. Autopilot. Think of the periodic review on a trust that hasn’t changed in a decade. Same settlor, same beneficiaries, same answers as last year, so it gets done on fast thinking and waved through. Which is fine, right up until the year something did change. Design answer: small, plain questions in the order the decision is actually made, with just enough information at each step, and the thing that changed since last time put in front of the reviewer. Hunt calls it chunking. Your first line will call it a relief.
2. The nodding reviewer. Itiel Dror and Simon Cole found that forensic examiners who knew a colleague’s conclusion tended to agree with it. Four eyes, one opinion. It’s the second signatory on a payment who sees the first signature and not much else. Design answer: the person approving isn’t the person who set it up, and sees the evidence, not just the verdict.
3. The very nice board. Irving Janis showed that the better a group gets on, the more harmony crowds out challenge. In a small jurisdiction where the same people sit around several tables, that’s worth a moment’s thought. Lovely for morale, less so for risk. Design answer: put the awkward questions on the agenda, so challenge doesn’t depend on one director’s nerve.
4. The stories we tell ourselves. Albert Bandura catalogued them: “it’s standard practice”, “nobody got hurt”, “I was only doing my job”. Add the local favourite: “we’ve known this client for twenty years”. Leon Festinger explained why changing behaviour without touching the belief behind it rarely sticks. Design answer: explain why a rule exists, not just what it says, and name the stories out loud in training so people catch themselves telling them.
5. The confident machine. Yuval Noah Harari describes how we learn to trust a sat-nav: ignore it once, sit in traffic, and before long we follow it without a second thought. (Occasionally into a field.) An AI-drafted adverse media summary that reads beautifully and cites nothing will be trusted in exactly the same way. Design answer: label what the machine drafted, show where it got it from, and keep the decision with a named person who can overrule it.

People and machines, covering each other’s blind spots

Here’s the encouraging bit: machines and people fail in different places.

A machine doesn’t get tired at five on a Friday. It doesn’t skip the step that felt routine, it applies the same rule the same way every time, and it can keep every source and reference in view at once. That’s exactly where human attention slips.

People bring what no system can: judgement about context, a sense of what’s fair, the nerve to ask an awkward question, and accountability. You can’t hold an algorithm responsible. You can hold a director responsible, as the Commission will happily remind you.

The trick is trusting the machine without trusting it blindly. That means everything it tells you should come with its working (the provision, the page, the document and its version) so anyone can check it if they want to. Confidence should come from being able to check, not from being asked to believe. Even Uber learned this one: its surge-pricing algorithm couldn’t tell a rainy Friday from an emergency, so it put people in a position to switch it off.

Where this is heading

This isn’t a theoretical debate for some future strategy day. The Commission has moved from “technology neutral” to “technology positive”, the Handbook now expressly recognises electronic verification and AI-assisted tooling, and its AI policy statement lets firms adopt AI without asking permission first. The tools are arriving, quickly.

So the choice in front of most firms over the next few years isn’t whether to automate. It’s whether the automation they buy is designed around how their people actually work, or bolted on top and left to be trusted blindly. Get the design right now and every tool added later makes the firm stronger. Get it wrong and you’ll have built Mr Logic’s world in software, which is the same old problem, only faster.

A rule problem, not a people problem

Hunt’s fifth rule deserves a place in every board pack: “If one person breaks a rule you’ve got a people problem. If lots of people break a rule, you’ve got a rule problem.”

His example is a firm with a rash of breaches of its personal dealing pre-approval rule. The plan was the usual trio: discipline, retraining and an all-staff email. When someone looked at the pattern instead, almost every breach was staff selling their own vested bonus shares, through the firm’s own system, which never mentioned that pre-approval was needed. One warning on the screen did more than the whole trio.

This isn’t going soft. Fix the cause and you remove what Hunt calls the air cover: once complying is easy, the people still not doing it stand out rather nicely. Or, as Alexander den Heijer puts it, “When a flower doesn’t bloom, you fix the environment in which it grows, not the flower.”

Two more things worth knowing:

• Not every rule weighs the same. Netflix famously splits mistakes into recoverable and irrecoverable. A regulated firm has far more of the second kind than a streaming service: you can’t un-tip-off a customer or un-breach a sanction. Put hard controls and a person’s deliberate judgement there, and keep everything else light enough that people still have attention left for it.
• Fines can become fees. When an Israeli day-care centre fined parents for collecting late, late collections went up. Parents had simply bought the right to be late. A penalty that feels like a price can legitimise the very thing it was meant to stop.

Where Guernsey puts the responsibility

If you were hoping the Commission would write a rulebook for AI, it hasn’t, and it says so. Its Policy Statement on the Use of Artificial Intelligence (29 January 2026) asks firms to treat AI like any other technical or strategic project within the existing framework, applying the Finance Sector Code of Corporate Governance, particularly its principles on accountability and risk management.

The Code isn’t shy about whose job that is. A company should be headed by an effective Board that is responsible for governance (Principle 1), with formal and transparent arrangements for internal control (Principle 4) and suitable oversight of risk management (Principle 5).

So responsibility doesn’t move to the software, however clever it is. The question for a board isn’t whether to use technology. It’s whether its controls, human or automated, make that responsibility easier to exercise, or quietly take it away.

Six questions to ask of your own controls

Hunt’s HUMANS framework has a neat trick: it asks every question from the side of the person being asked to comply, not the person who wrote the rule. Turn it on your own controls and you get a practical test for your board or compliance team this quarter.

And a seventh: would you know if it stopped?

Hunt’s six ask whether people will comply. None of them asks whether you’d notice if a control stopped working altogether, and that’s where the real damage tends to hide.

A control people dodge at least leaves a trail. The dangerous one quietly stops while everything still looks fine: the screening list that hasn’t updated since the supplier changed its file format, the exception report still going to someone who left last spring, the dashboard that’s green because there’s no data in it at all. Nobody broke a rule. Nobody noticed, either.

So this is the question I’d ask first: if this control stopped working tomorrow, how would we find out, and how long would it take? A good control can prove it ran, and complains loudly when it didn’t. Silence should never be mistaken for success.

Coming up in this series

Each of these ideas deserves more room than one article allows, so I’ll take them one at a time:

1. How to build a workflow people will actually follow: steps in the order decisions are really made, guidance at the moment it’s needed, and the irreversible step made impossible to miss.
2. AI governance with people in it: what a board should ask before approving an AI tool, and why approval at go-live isn’t assurance.
3. Confidence you can check: why every answer a system gives should show its source, and what that does for trust, audit and challenge.
4. Designing the second pair of eyes: four-eyes controls that are more than two people nodding.
5. A rule problem, not a people problem: reading breach and monitoring data for patterns.
6. The seven questions in practice: Hunt’s six, plus mine, applied to familiar Guernsey controls, from CDD refreshes to attestations and training.

How we work

At ápeiron we start from people’s real limits and real strengths: we guard where attention slips and strengthen where judgement counts. We think people and well-governed AI achieve more together than either manages alone, and that you should be able to check anything a system tells you.

That runs through our policy and procedure work, our training and AI governance support, and the GRC Suite we’re building. Only a person gives the go-ahead where a step can’t be undone. Warnings inform but never overrule your judgement. Anything the AI drafted is labelled, everything the system tells you cites its source, and nothing fails silently.

If you’d like to put your own controls through the seven questions, I’d be glad to have that conversation.

Traditional expertise. AI-powered delivery.

Sources

• Guernsey Financial Services Commission, Policy Statement – Use of Artificial Intelligence, 29 January 2026.
• Guernsey Financial Services Commission, Finance Sector Code of Corporate Governance, amended February 2026, Principles 1, 4 and 5.
• Christian Hunt, Humanizing Rules: Bringing Behavioural Science to Ethics and Compliance (Wiley, 2023).
• Daniel Kahneman, Thinking, Fast and Slow (2011).
• Herbert A. Simon, on bounded rationality.
• Itiel Dror and Simon Cole, “The Vision in ‘Blind’ Justice”, Psychonomic Bulletin & Review 17(2), 161–167 (2010).
• Irving Janis, Victims of Groupthink (1972).
• Albert Bandura and others, “Mechanisms of moral disengagement in the exercise of moral agency”, Journal of Personality and Social Psychology (1996).
• Leon Festinger, A Theory of Cognitive Dissonance (1957).
• Uri Gneezy and Aldo Rustichini, “A Fine Is a Price”, Journal of Legal Studies 29(1) (2000).
• Yuval Noah Harari, 21 Lessons for the 21st Century (2018).