Steven Jones reports on new research for the Council for the Defence of British Universities revealing the wrong kind of compliance culture in some governing bodies