While the conduct of people entrusted with upholding the espoused values and principles of the organisation has always carried inherent risk, Conduct Risk has only recently been brought into sharp focus following the events of the Global Financial Crisis (GFC). Unlike market risk, credit risk or operating risk, this aspect of risk is the least understood and consequently an aspect of risk that is not being managed well.  The Financial Conduct Authority (FCA) UK (created in 2013 along with the Prudential Regulation Authority to replace the Financial Services Authority thought to have failed in safeguarding markets and consumers during the GFC) has provided guidance on Conduct Risk. Regulators all around the world are watching closely. The approaches to managing Conduct Risk have so far focused on driving more  regulation, rewriting risks manuals, introducing new risk frameworks and governance structures. While these are necessary for consistency, these alone will not guarantee success in driving down Conduct Risk or developing more ethical corporate cultures. The reason is obvious – because it is not possible to create rules to cover every eventuality. In fact worryingly, the more rules you create the more people are lulled into a false sense of security, relying on the existence of the rules and failing to think more deeply about what is right and the role our personal conduct plays. Added to this inherent complexity is that an action can be legally right but morally reprehensible. That is to say conduct risk can lurk in the case of decisions where the legality of the choice is not in question, but where the longer term consequences of the decision generate questions of morality. While this pre-occupation with rules and regulation has continued since 2008, compliance costs have risen dramatically, without any guarantee that our organisations are operating in more ethical ways. It has even paralysed some organisations into not pursuing genuinely good opportunities for fear of failing the conduct test in the eyes of a more critical public. Conduct Risk is about individual judgment and until our judgment skills are strengthened, pretending we can legislate or regulate for every instance of poor or sub optimal conduct is not only ill thought. It is also based on the flawed assumption that as leaders of large complex organisations, we have in our power the ability to manage the entire human chain of judgments  a long way from the Risk Function of a large dispersed organisation. The answer is found in building deeper understanding and skills in how we judge. Risk frameworks will not help you do that.  Skilfully facilitated conversations that generate deeper insights and slowing down our thinking in more heedful ways are required for real individual and collective...