Ethics, integrity and speaking up

In September 2016 Wells Fargo, then one of the most admired banks in the United States, agreed to pay 185 million dollars to regulators after admitting that its employees had opened about two million deposit and credit card accounts that customers had not authorized; later reviews raised the estimate to about 3.5 million. The employees had done it to meet aggressive sales targets, under a strategy of selling eight products to every household that the bank's leaders had promoted for years. Thousands of employees had been fired for misconduct, but the targets that drove it remained. Some employees who called the bank's ethics line had reported being dismissed afterwards. The chief executive resigned within weeks. In 2018 the Federal Reserve barred the bank from growing its balance sheet until it fixed its governance and controls, a restriction that was not lifted until 2025, and in 2020 the bank paid three billion dollars to settle criminal and civil investigations.

Dr. Holloway asks the cohort what the board could have done. Leo Brandt says the board should have looked at the incentives: if you pay people to sell eight products to households that need three, you should expect them to cheat. Hana Kowalski says the board should have looked at the dismissals: thousands of people fired for the same misconduct is not a few bad apples but a system. Both are right, Dr. Holloway says. Most corporate misconduct is not committed by villains but by ordinary people responding to pressures, incentives and norms that leaders created and boards did not examine. This lesson is about why that happens and how organizations can prevent it, with particular attention to the most important safeguard: people who are willing to speak up, and leaders who listen.

Why good people do bad things

Research in behavioural ethics has documented the ways in which people who regard themselves as honest come to act unethically. Max Bazerman and Ann Tenbrunsel called the phenomenon bounded ethicality: people fail to see the ethical dimension of decisions, especially when it is in their interest not to see it. Motivated blindness leads people to overlook wrongdoing by others when noticing it would cost them. Ethical fading occurs when a decision is framed as a business or technical question, such as meeting a target, so that its ethical aspects disappear from view. And misconduct often begins with small steps, each only slightly worse than the last, so that people never face a single dramatic choice.

The criminologist Donald Cressey, who interviewed imprisoned embezzlers in the 1950s, proposed what became known as the fraud triangle. Fraud requires three elements: a pressure, such as a financial need or a target that cannot be met honestly; an opportunity, such as weak controls; and a rationalization, a story that lets the person see the act as acceptable, such as everyone does it, I will pay it back or the company owes me. Controls address opportunity, but organizations also create pressures through targets and incentives, and rationalizations through culture. Steven Kerr's classic 1975 article, On the folly of rewarding A, while hoping for B, made the same point about incentives: organizations get what they reward, not what they say they want.

Social pressure matters too. Classic experiments by Stanley Milgram in the 1960s showed that many people would obey an authority figure's instructions to inflict what they believed were dangerous electric shocks, and studies of conformity show how strongly people follow what those around them do. In organizations, the behaviour of immediate managers, what employees see rewarded and tolerated, is a far stronger influence than codes of conduct or messages from the top.

Building an ethical organization

Organizations try to promote ethical conduct through several means. A code of conduct sets out expected behaviour on matters such as conflicts of interest, gifts, bribery, fair dealing, data protection, harassment and the use of company assets, and explains how to raise concerns. Training explains the code and helps employees recognize ethical issues in their own work. Policies and controls address specific risks, such as anti-bribery due diligence on agents. And leaders set the tone, not only through what they say but, more importantly, through what they do, whom they promote and how they respond when results and integrity conflict.

Dr. Holloway emphasizes three practices that she has seen make a difference. The first is examining incentives, as Leo suggested: any target that can be met by cheating will eventually be met that way by someone, so the board and management should ask of every major incentive how it could be gamed and add measures, such as customer complaints, quality or audit findings, that would reveal gaming. The second is consequences that apply equally to high performers: nothing destroys an ethics program faster than a star seller who breaks the rules and is promoted anyway. The third is measuring culture, through employee surveys that ask whether people feel pressure to compromise standards, whether they have observed misconduct and whether they would feel safe reporting it.

Speaking up

In most organizations, the people who first know about misconduct are employees. As lesson 3 noted, studies of fraud consistently find that tips, mostly from employees, are the most common way it is detected. Whether employees speak up depends on two judgments: whether doing so will make a difference and whether it is safe. Amy Edmondson's research on psychological safety, which the cohort met in MBA-603, shows that teams in which people believe they will not be punished for raising problems learn faster and make fewer serious errors. Where employees expect retaliation or indifference, they stay silent, and leaders hear about problems only when it is too late.

An effective speak-up system has several parts. Employees, contractors and, increasingly, workers in the supply chain must have several ways to raise concerns: their manager, other managers, human resources, compliance and a confidential hotline, operated independently, that allows anonymous reports. Reports must be triaged quickly, investigated by people independent of those implicated, and resolved with feedback to the reporter where possible. Retaliation must be prohibited and punished, and the organization should check on reporters afterwards. Serious matters, and those involving senior executives, should go directly to the audit committee chair.

Canadian law protects whistleblowers in several ways. The Criminal Code makes it an offence for an employer to retaliate against an employee who provides information to law enforcement about an offence. The Ontario Securities Commission launched a whistleblower program in 2016 that offers awards of up to 5 million dollars for information leading to enforcement action for securities law violations, and other provincial regulators have whistleblower protections. Federal and provincial public sector employees are covered by specific disclosure laws. Protection for private sector employees is otherwise patchier than in the United States, which makes internal protections more important.

The code below analyses Cedarline's speak-up data for the past year by business unit. Dr. Holloway asks the cohort to look not only at the units with many reports, but also at those with few: silence is often a warning sign rather than evidence that all is well.

# Cedarline speak-up data for the year, by unit
units = {  # employees, reports, substantiated, anonymous, average days to close, retaliation complaints
    "Stores, east":            (410, 9, 4, 5, 38, 0),
    "Stores, west":            (230, 0, 0, 0, 0, 0),
    "Warehouse":               (520, 11, 6, 7, 52, 1),
    "Head office":             (210, 5, 2, 1, 29, 0),
    "Cedarline Care workshop": (80, 2, 1, 2, 61, 0),
}
benchmark_rate = 1.5      # reports per 100 employees a year, a rough median from published surveys
total_emp = sum(u[0] for u in units.values()); total_rep = sum(u[1] for u in units.values())
print(f"company: {total_rep} reports, {100 * total_rep / total_emp:.2f} per 100 employees (benchmark about {benchmark_rate})")
for name, (emp, rep, sub, anon, days, retal) in units.items():
    rate = 100 * rep / emp
    notes = []
    if rate < 0.5 * benchmark_rate: notes.append("very low: check awareness and trust")
    if rep and anon / rep > 0.6: notes.append("mostly anonymous: fear of retaliation?")
    if days > 45: notes.append("slow to close")
    if retal: notes.append("retaliation complaint: escalate to audit committee chair")
    sub_rate = f"{sub / rep:.0%}" if rep else "n/a"
    print(f"{name:24s} rate {rate:4.2f}  substantiated {sub_rate:>4s}  {'; '.join(notes)}")

company: 27 reports, 1.86 per 100 employees (benchmark about 1.5)
Stores, east             rate 2.20  substantiated  44%  
Stores, west             rate 0.00  substantiated  n/a  very low: check awareness and trust
Warehouse                rate 2.12  substantiated  55%  mostly anonymous: fear of retaliation?; slow to close; retaliation complaint: escalate to audit committee chair
Head office              rate 2.38  substantiated  40%  
Cedarline Care workshop  rate 2.50  substantiated  50%  mostly anonymous: fear of retaliation?; slow to close

Cedarline receives about 1.9 reports per hundred employees, near the rough benchmark, and about half its reports are substantiated, which suggests that employees report real problems. The unit that deserves attention, however, is the western stores, with 230 employees and no reports at all. In a group of that size, some concerns almost certainly exist; silence suggests that employees do not know how to report or do not trust the process. The distribution centre, shown as the warehouse in the table, has reports that are mostly anonymous and slow to close, and a retaliation complaint, which together suggest a climate of fear that the audit committee should examine. The workshop's two cases were both anonymous and took the longest to resolve, which in a team of eighty may mean that technicians do not trust their supervisors.

How boards oversee culture

Boards cannot observe culture directly, and the information they receive about it is filtered by the managers whose behaviour shapes it. Directors who oversee culture well therefore combine several sources. They review a culture dashboard each year or more often, combining employee survey results on pressure, observed misconduct and willingness to report, speak-up data like Cedarline's, turnover and exit interview themes, customer complaints, audit findings and disciplinary outcomes by level and unit. They ask for deep dives into units where several indicators point the same way, such as Cedarline's distribution centre.

They also go and see. Directors who visit stores, warehouses and factories, talk with employees without senior managers present and listen to how people describe the pressures of their jobs learn things no report would show. They meet the chief compliance officer and the head of internal audit privately, and make sure both can raise concerns directly with the audit committee chair. And they watch how the chief executive responds to bad news, because that response teaches the rest of the organization more than any policy. Dr. Holloway tells the cohort that in her experience, the most reliable sign of trouble is not a scandal but a leadership team that becomes defensive when a director asks an awkward question.

Regulators and prosecutors in both countries take the quality of compliance programs into account when deciding how to treat companies that discover misconduct. In Canada, a company's compliance program, cooperation and remediation are factors in whether prosecutors offer a remediation agreement and in the penalties courts impose, so a credible program can greatly reduce the consequences of wrongdoing by employees.

Bribery, corruption and human rights in the supply chain

Two areas of ethics have become matters of specific legal obligation. Canada's Corruption of Foreign Public Officials Act, enacted in 1998, makes bribing a foreign official a crime, and amendments in 2013 added an offence for falsifying books and records to hide bribery. In 2018 Canada introduced remediation agreements, which allow prosecutors to suspend charges against a company that admits wrongdoing, pays penalties and improves its compliance. The best-known case, involving the engineering firm SNC-Lavalin, which pleaded guilty in 2019 to fraud over payments in Libya, also became a political controversy over whether the government had pressed prosecutors to offer such an agreement.

For an apparel company, human rights in the supply chain are the most serious ethical exposure. Contract factories in many countries have histories of unsafe buildings, excessive hours, underpayment and, in some regions, forced labour; the collapse of the Rana Plaza building in Bangladesh in 2013, which killed more than 1,100 garment workers, remains the defining example. Canada's Fighting Against Forced Labour and Child Labour in Supply Chains Act requires large companies to report annually, from 2024, on the steps they take to prevent forced and child labour in their supply chains, and the customs tariff prohibits imports of goods made with forced labour. Cedarline is large enough to report.