By Malcolm Aquilina - Senior Manager, Office of Chief Officer Supervision, MFSA

In financial services, challenge is frequently described as an essential component of good governance.

Boards are expected to challenge management. Non-executive directors are expected to test assumptions. Risk and compliance functions are expected to provide independent oversight. Internal auditors are expected to identify weaknesses. Employees are encouraged to speak up when something does not appear right.

Regulatory frameworks therefore place considerable emphasis on independence, constructive challenge and the ability of control functions to communicate directly with boards and senior management.

On paper, the expectation appears straightforward:

If you identify a risk, you should raise it.

In practice, however, challenge is rarely so simple.

The person being challenged may be the chief executive who determines the compliance officer's future. It may be the executive who approves the risk function's budget. It may be the business leader whose support is needed for a promotion. It may even be the owner of the institution; the same person who ultimately has the power to remove the individual raising the concern.

This creates one of the most uncomfortable tensions in financial governance:

A person may be professionally required to challenge someone who holds considerable power over that person's career and livelihood.

The framework demands independence. The employment relationship creates dependence.

Understanding that tension is essential if institutions and supervisors genuinely want challenge to take place.

Independence on Paper, Vulnerability in Practice

A compliance officer may have unrestricted access to the board. A Chief Risk Officer may have a direct reporting line to the chair of the risk committee. The internal audit charter may guarantee organisational independence.

These arrangements are important. But formal independence does not eliminate personal vulnerability.

Control-function leaders remain employees. They have mortgages, families, professional ambitions and reputations to protect. They understand that challenging a major initiative may affect relationships built over many years. They may worry about being labelled obstructive, overly cautious or commercially unaware. They may fear exclusion from important discussions, a reduced bonus, stalled progression or eventual dismissal.

The concern does not always need to be expressed as a direct threat. Often, it is communicated more subtly.

A compliance officer who repeatedly raises difficult issues may stop being invited to early-stage meetings. A risk professional who questions ambitious growth projections may be described as someone who “does not understand the business.” An employee who escalates concerns may notice that colleagues become guarded around them. A board member who challenges management too frequently may be characterised as disruptive rather than diligent.

None of these reactions needs to appear in a policy or a set of minutes. Yet employees observe them, interpret them and adjust their behaviour accordingly.

Over time, people learn which questions are welcome and which questions carry a price.

The Personal Calculation Behind Speaking Up

When an individual identifies a serious concern, the decision to challenge may involve an internal calculation that is almost invisible to the organisation:

• How certain am I that my assessment is correct?
• Do I have sufficient evidence?
• Has the decision already been made?
• Will this person listen—or react defensively?
• Could I raise the matter privately before escalating it formally?
• Will anyone support me if the situation becomes difficult?
• What could this mean for my role, income and family?
• If I remain silent and something goes wrong, can I justify that decision?

From a distance, it is easy to say that the individual should simply “do the right thing.” But such advice can underestimate the reality of organisational power.

Professional courage matters. Yet institutions should not design governance arrangements that depend on exceptional personal bravery every time an uncomfortable issue must be raised.

If effective challenge requires an employee to risk everything, then the governance system is already weak.

Challenge Is Not the Same as Confrontation

There is also a tendency to imagine challenge as a dramatic moment: one individual firmly opposing a room full of senior executives.

Sometimes such directness is necessary. But effective challenge is not measured by volume, aggression or theatrical disagreement. Its objective is not to defeat another person. Its objective is to improve the quality of the decision.

A challenge can be technically correct and still be communicated badly. It can be delivered too late, based on incomplete information or framed in a way that causes the recipient to defend their authority rather than consider the substance of the concern.

This does not excuse a leader who refuses to listen. Nor does it transfer responsibility for retaliation onto the person raising the issue. Senior decision-makers have a clear obligation to receive challenge professionally.

However, anyone whose role involves influence should recognise an important reality: how a message is conveyed can affect whether that message is heard.

That is where emotional intelligence becomes a governance capability.

Emotional Intelligence as a Professional Control

Emotional intelligence is sometimes treated as a desirable interpersonal quality—useful for leadership, teamwork or communication, but separate from technical risk management.

In reality, it may determine whether a material risk reaches the decision-making table at all.

For a compliance officer, risk professional, internal auditor or non-executive director, emotional intelligence involves more than being polite. It includes the ability to:

• recognise the emotions and interests influencing a discussion;
• understand how a challenge may be perceived by the recipient;
• regulate one's own frustration or anxiety;
• distinguish urgency from aggression;
• choose the right moment, setting and language;
• remain calm when faced with defensiveness;
• listen carefully without surrendering professional judgement; and
• preserve a working relationship while maintaining a firm position.

These are not techniques for making an uncomfortable truth disappear. They are techniques for ensuring that the truth has the best possible chance of influencing the decision.

A person who feels publicly embarrassed may focus on protecting status. A person who feels accused may search for weaknesses in the accuser's argument. A person who believes their authority is being undermined may react to the perceived challenge to power rather than the underlying risk.

An emotionally intelligent challenger anticipates these dynamics—not to flatter or manipulate, but to prevent avoidable defensiveness from obscuring the issue.

Framing a Challenge So It Can Be Heard

Consider the difference between the following statements:

“This proposal is clearly non-compliant and should never have reached the board.”

and:

“I am concerned that the current proposal may expose the institution to a material compliance risk. Before the board proceeds, could we examine how the proposed approach satisfies these specific requirements?”

Both may reflect the same underlying concern. The second formulation is more likely to invite analysis rather than provoke an immediate contest over competence or authority.

Effective challenge will often contain several elements.

Start with the shared objective

The challenger can make clear that the purpose is to protect the institution, its customers and the quality of the decision—not to obstruct progress or undermine an individual.

Separate the person from the proposal

Challenge the assumption, evidence, process or decision. Avoid turning a professional disagreement into a judgement about someone's character, competence or motives unless conduct itself is genuinely the issue.

Be precise about the concern

General discomfort is difficult to assess. A clear explanation of the relevant obligation, risk, evidence and potential impact gives decision-makers something concrete to consider.

Offer a route forward

Control functions are most influential when they do more than identify obstacles. Where possible, they should explain what additional evidence, safeguards, amendments or alternatives could address the concern.

Ask questions that test assumptions

Questions can create space for reflection: What evidence supports this assumption? What would happen if the expected controls fail? How would we explain this decision to customers or the regulator? Have we considered a less harmful alternative?

Choose the setting carefully

Some issues must be raised immediately and formally. Others may first be discussed privately, allowing the recipient to understand the concern without feeling publicly cornered. The appropriate approach depends on the seriousness, urgency and integrity of the decision-making process.

Know when diplomacy is no longer enough

Emotional intelligence must never become an excuse for indefinite caution. If a significant legal, prudential, conduct or customer risk remains unresolved, the matter may need formal documentation and escalation through the appropriate governance channels.

The objective is not to make every challenge comfortable. Some challenges cannot be comfortable. The objective is to make them clear, proportionate and difficult to dismiss without proper consideration.

The Responsibility of the Person Being Challenged

Much is expected of those raising concerns. But the greater responsibility often rests with those who hold power.

Leaders frequently say that they welcome challenge. The real test begins when the challenge is inconvenient, delays a transaction, questions a favoured strategy or comes from someone with less organisational status.

A leader who genuinely supports challenge should be able to say:

“I disagree with your conclusion, but I want to understand how you reached it.”

The response to challenge teaches the organisation what is safe.

If leaders become hostile, dismissive or retaliatory, the effects extend well beyond the individual involved. Everyone observing the exchange receives the same message: speaking up carries consequences.

Conversely, when leaders thank employees for raising concerns, examine the evidence and explain the final decision (even where they do not agree) they build confidence in the governance process.

The most powerful response may sometimes be:

“You were right to raise this.”

That sentence does not require the leader to accept every recommendation. It confirms that challenge itself is legitimate.

Disagreement Does Not Always Mean That Challenge Failed

Control functions do not have to win every argument for challenge to be effective.

Business leaders may possess information the challenger did not initially have. Risk assessments may involve legitimate differences in judgement. A board may decide to accept a risk after considering the compliance or risk function's position.

The key questions are whether the concern was understood, whether it was considered by the appropriate decision-maker, whether the rationale was credible and whether accountability for the final decision was clear.

However, a distinction must be drawn between a properly considered disagreement and the routine overriding of control functions.

If compliance advice is repeatedly ignored, if risk concerns are consistently diluted in board papers, or if control-function leaders are replaced whenever they resist commercial pressure, the issue is no longer an isolated disagreement. It is a pattern of governance behaviour.

Patterns matter.

Protecting Challenge Institutionally

No individual communication technique can compensate for a culture that punishes dissent.

Institutions must therefore protect challenge structurally as well as culturally. This may include:

• direct and credible access for control functions to relevant board committees;
• clear escalation procedures that cannot be blocked by the business function concerned;
• appropriate involvement of board committees in the appointment, assessment and removal of key control-function holders;
• adequate resources and remuneration arrangements that support independence;
• accurate recording of significant disagreements, decisions and rationales;
• protection against retaliation;
• confidential speaking-up channels; and
• board attention to turnover, vacancies and repeated departures within control functions.

Boards should be particularly cautious when a senior compliance, risk or audit professional resigns or is removed following sustained disagreement with management. The departure may have an innocent explanation. But it may also be one of the clearest indicators available that the institution's challenge mechanisms are not functioning properly.

A board should not ask only why the person left. It should ask what they had been trying to say before they left.

The Supervisor's Perspective

For supervisors, assessing effective challenge requires looking beyond reporting lines and committee terms of reference.

A control function may appear independent on an organisational chart while exercising little influence in practice. Supervisory judgement may therefore require consideration of questions such as:

• At what stage are risk and compliance functions involved in important decisions?
• Can they require further analysis or delay a proposal?
• How frequently are their recommendations overridden?
• Are significant disagreements visible to the board?
• How does senior management describe individuals who challenge them?
• Is there unusual turnover in key control positions?
• Do exit interviews, staff surveys or whistleblowing reports indicate fear of retaliation?
• Can control-function leaders provide examples where their intervention materially changed a decision?

The last question is particularly revealing.

If an institution claims to have a strong culture of challenge but cannot identify a meaningful decision that changed because somebody spoke up, supervisors may reasonably ask whether challenge is truly influential or merely ceremonial.

Courage Must Travel in Both Directions

We often associate courage with the person who raises the concern. That courage deserves recognition.

But leadership also requires courage: the courage to hear criticism without treating it as disloyalty; to change direction after committing publicly to a proposal; to admit that a junior employee identified something senior management missed; and to protect a challenger whose message is unpopular.

Effective challenge therefore requires courage in both directions.

The employee must be willing to speak.

The leader must be willing to listen.

And the institution must ensure that neither act depends entirely on personal heroism.

From Permission to Protection

Many organisations tell employees that they are permitted to challenge.

That is not enough.

People need to know that challenge is expected, taken seriously and protected. They need evidence that colleagues who raise concerns remain respected, included and able to progress. They need escalation routes that work when normal relationships break down. And they need leaders who understand that discomfort is sometimes evidence that governance is doing its job.

For those working in compliance, risk, internal audit and board oversight, emotional intelligence can make challenge more effective. It can help them select the right words, timing and setting. It can preserve relationships and reduce unnecessary defensiveness.

But emotional intelligence should never be used to place the entire burden on the challenger. Even the most carefully framed concern will fail in an organisation that has already decided not to listen.

Ultimately, the quality of governance is revealed not when everyone agrees, but when an informed person says:

“I think we may be getting this wrong.”

What happens next tells us almost everything we need to know about the institution's culture.