Every major corporate scandal of the last two decades has, at its root, a board that did not know what was happening, did not ask the right questions, or — in the worst cases — chose not to look. Boards have responded, largely, by adding ethics to their agenda: codes of conduct, ethics hotlines, annual compliance training, and ESG disclosures.
These are necessary but not sufficient. The difference between organisations where ethics is lived and those where it is performed lies in what the board does, not what the board documents.
What effective boards do differently
They receive intelligence, not summaries. A board that relies solely on management-prepared summaries for its view of the organisation’s ethical health is operating with a significant blind spot. Effective boards supplement management reporting with direct access to whistleblower data, employee survey results analysed independently of HR, and periodic direct engagement with frontline employees.
They ask about the things that do not get volunteered. Management naturally focuses on positive developments and frames challenges in the most favourable light. Effective boards have developed a set of questions that go to the places management might not volunteer: What was the most serious ethics issue that did not become public this year? How many reports were received on the CEO and direct reports?
They hold the CEO accountable for culture, not just results. In organisations where ethical failures are most common, boards have historically measured and rewarded CEOs almost entirely on financial performance. Boards that embed ethical leadership explicitly in CEO evaluation criteria, and that are willing to act when results are strong but culture is deteriorating, send a clear message about what actually matters.
The role of the Audit Committee
In most listed companies, the Audit Committee carries the primary board-level responsibility for the whistleblower mechanism and ethics function. This responsibility is often discharged by reviewing an annual report from management. It should be discharged by reviewing raw data on reporting volumes and trends, meeting periodically with the Head of Ethics or Chief Compliance Officer without management present, and satisfying themselves that the mechanism is genuinely accessible, genuinely anonymous, and genuinely followed up.
From policy to culture: what the board can actually do
Three practices, consistently applied, move an organisation from ethics-as-policy to ethics-as-culture.
First, the board chair and independent directors speak publicly about ethics using specific language about what the organisation stands for and will not tolerate. Not boilerplate — specific, personal, credible statements.
Second, the board reviews whistleblower data quarterly, asks follow-up questions, and expects management to demonstrate that every report was handled appropriately.
Third, the board celebrates ethical behaviour — including the behaviour of people who raised concerns that turned out to be difficult or disruptive. The message that the organisation values people who speak up, even when it is inconvenient, is most credible when it comes from the top.