Corporate Governance, Accountability and Ethical Culture

Introduction

Corporate governance is the system through which an organisation is directed, controlled and held accountable. It includes the allocation of authority between shareholders, the board of directors, managers and other stakeholders; the processes used to make decisions; and the controls used to ensure that decisions are lawful, ethical and aligned with organisational purpose.

Corporate governance is closely related to corporate social responsibility (CSR). CSR asks how an organisation affects society and the environment, while governance determines who makes decisions about those effects, how those decisions are monitored, and whether the organisation is answerable for its conduct. A company may publish ambitious sustainability commitments, but weak governance can allow misleading reporting, corruption, unsafe operations or disregard for stakeholder interests.

Effective governance therefore requires more than compliance with company law. It requires responsible leadership, reliable information, independent challenge, transparent reporting, effective internal controls and an ethical culture in which people are expected and enabled to do the right thing.

Learning Objectives

After studying this chapter, you should be able to:

• explain the meaning and importance of corporate governance;
• distinguish the responsibilities of the board, senior management and control functions;
• describe common governance structures and accountability relationships;
• explain compliance, risk management and internal control;
• evaluate the purpose of codes of conduct and whistleblowing systems;
• identify major anti-corruption measures;
• assess how leadership shapes ethical culture and corporate behaviour; and
• apply governance principles to a practical organisational case.

1. The Meaning and Purpose of Corporate Governance

Corporate governance can be understood as the framework of rules, relationships, systems and processes by which organisations are directed and controlled. Its central questions are:

1. Who has authority to make decisions?
2. To whom are decision-makers accountable?
3. What information is needed for responsible decisions?
4. How are risks, conflicts and misconduct identified?
5. How are stakeholders protected and legitimate interests considered?

Governance is necessary because ownership and control are often separated. Shareholders may own a company, but day-to-day control is exercised by directors and managers. This creates the possibility that managers may pursue personal interests, conceal poor performance or take excessive risks. Governance mechanisms reduce this agency problem by requiring oversight, disclosure, independent review and accountability.

Governance also addresses wider stakeholder relationships. Employees, customers, suppliers, communities, regulators and the natural environment may all be affected by corporate decisions. A narrow focus on short-term financial returns can create long-term legal, social and reputational costs.

Governance, management and CSR

These concepts are related but distinct:

Good governance integrates all five. It prevents CSR from becoming merely a public-relations activity and embeds responsibility in strategy, operations and reporting.

2. Governance Structures and the Distribution of Responsibility

The board of directors

The board is the organisation’s highest internal governance body. Its responsibilities normally include:

• approving strategy, purpose and major policies;
• appointing, supporting and evaluating the chief executive;
• overseeing financial performance and major investments;
• identifying and monitoring significant risks;
• ensuring appropriate internal controls and accurate reporting;
• overseeing legal, regulatory and ethical compliance;
• considering stakeholder, social and environmental impacts; and
• reporting to shareholders and other legitimate stakeholders.

The board should govern rather than manage routine operations. It sets direction, asks challenging questions and ensures that management is accountable. However, the board cannot delegate away its ultimate responsibility for oversight.

The chair and chief executive

The chair leads the board, supports constructive discussion and ensures that directors receive adequate information. The chief executive officer (CEO) leads management and implements the strategy approved by the board. Separating these roles can strengthen independent oversight, particularly in larger or more complex organisations. Where one person holds both roles, additional safeguards such as a strong independent director and effective committees become important.

Non-executive and independent directors

Executive directors are involved in daily management. Non-executive directors are not part of routine management and contribute independent judgment, experience and challenge. An independent director should be free from relationships that could materially influence objective judgment. Independence is not simply a label: directors must demonstrate the willingness to question dominant views and resist inappropriate pressure.

Board committees

Committees allow detailed work to be undertaken without removing responsibility from the full board. Common committees include:

• Audit committee: financial reporting, external audit, internal audit and control systems.
• Risk committee: enterprise risks, risk appetite, resilience and emerging threats.
• Remuneration committee: executive pay, incentives and alignment with long-term performance.
• Nomination or governance committee: board composition, succession and evaluation.
• Ethics, sustainability or CSR committee: ethical conduct, human rights, environmental performance and stakeholder issues.

The appropriate structure depends on organisational size, legal requirements and risk profile. Committees must have clear terms of reference, suitable expertise and access to independent advice.

Management responsibilities

Senior management converts approved strategy into action. Management is responsible for:

• implementing policies and procedures;
• allocating resources responsibly;
• maintaining operational controls;
• identifying and escalating risks;
• creating accurate and timely management information;
• training employees;
• investigating concerns; and
• reporting honestly to the board.

Managers must not treat governance as a board-only activity. Every manager exercises delegated authority and is accountable for the consequences of decisions made within that authority.

Figure: A simplified governance accountability structure. Assurance functions provide information and challenge but do not replace board responsibility.

3. Accountability, Transparency and Stakeholder Responsibility

Accountability means being answerable for decisions, actions and outcomes. It requires clearly assigned responsibilities, access to relevant information and consequences for failure or misconduct. A practical accountability system answers four questions:

• What was the person or body expected to do?
• What authority and resources were provided?
• What evidence shows what was done?
• What happens if performance or conduct is unacceptable?

Transparency is the timely and understandable disclosure of relevant information. It does not mean releasing every internal document. It means providing information that enables stakeholders to assess performance, risks, decisions and impacts. Important disclosures include financial statements, governance arrangements, executive remuneration, material risks, political contributions, significant incidents and sustainability performance.

Transparency has limits. Confidential commercial information, personal data and legitimate legal privilege may require protection. The ethical standard is not maximum disclosure regardless of consequences, but honest, balanced and decision-useful disclosure.

Reporting and greenwashing

CSR and sustainability claims should be supported by reliable evidence, clear boundaries and consistent methods. Greenwashing occurs when communication creates a misleading impression of environmental or social performance. Governance safeguards include board oversight of sustainability claims, documented data ownership, independent assurance where appropriate, and disclosure of negative as well as positive results.

4. Compliance, Risk Management and Internal Control

Compliance

Compliance is the process of identifying applicable obligations and ensuring that the organisation meets them. Obligations may arise from legislation, regulations, licences, contracts, industry standards and internal policies. A mature compliance programme includes:

1. identifying obligations;
2. assigning ownership;
3. assessing compliance risks;
4. designing procedures and controls;
5. training relevant personnel;
6. monitoring and testing performance;
7. reporting breaches; and
8. correcting weaknesses and preventing recurrence.

Compliance is necessary but not sufficient. Conduct can be legal and still be unethical—for example, exploiting a vulnerable customer through complex but technically lawful terms.

Risk management

Risk is the possibility that uncertainty will affect objectives. Organisations commonly assess risks by considering likelihood and impact. A simple qualitative risk matrix may classify risks as low, medium or high, but such classifications are judgmental and should not create false precision.

The board should define risk appetite: the amount and type of risk the organisation is willing to accept in pursuit of its objectives. Management then identifies risks, selects responses and monitors changes. Typical responses are to avoid, reduce, transfer or accept a risk.

Internal control

Internal controls are policies, procedures and practices designed to provide reasonable—not absolute—assurance that objectives will be achieved. They commonly support:

• effectiveness and efficiency of operations;
• reliability of reporting; and
• compliance with laws and policies.

Examples include segregation of duties, approval limits, reconciliations, access controls, physical safeguards, inventory counts, exception reports and independent reviews.

Segregation of duties reduces the risk that one person can initiate, approve, record and conceal a transaction. In a small organisation, complete separation may be impractical; compensating controls such as owner review, rotating responsibilities and independent reconciliations may be used.

Controls have limitations. Collusion can defeat segregation, senior managers may override controls, poorly designed technology may automate errors, and excessive controls may slow legitimate activity. Effective control design therefore balances risk, cost and operational practicality.

5. Codes of Conduct and Ethical Decision-Making

A code of conduct expresses the standards expected of directors, employees and sometimes business partners. It should address conflicts of interest, gifts and hospitality, fair dealing, confidential information, human rights, harassment, data protection, accurate records, use of organisational assets, political activity and reporting concerns.

A code is effective only when it is integrated into organisational life. This requires:

• visible leadership endorsement;
• practical examples rather than vague slogans;
• training tailored to job responsibilities;
• accessible advice channels;
• consistent investigation and discipline;
• protection against retaliation; and
• periodic review based on incidents and emerging risks.

An ethical decision process can help employees respond to difficult situations:

1. Identify the facts and affected stakeholders.
2. Identify applicable law, policy and professional duties.
3. Consider possible harms, benefits and conflicts of interest.
4. Ask whether the decision could be explained publicly.
5. Seek advice or escalate where uncertainty remains.
6. Document the reasoning and decision.
7. Review the outcome and learn from it.

This process does not replace moral judgment. It encourages reflection beyond the question, “Can we do this?” toward, “Should we do this, and can we justify it fairly?”

6. Anti-Corruption and Whistleblowing

Corruption involves the misuse of entrusted power for private or improper advantage. It includes bribery, kickbacks, facilitation payments, extortion, fraud, nepotism and certain forms of influence trading. Corruption can occur through employees, agents, suppliers, consultants or joint-venture partners.

A proportionate anti-corruption programme should include:

• a public zero-tolerance commitment;
• corruption risk assessment by country, sector and transaction;
• due diligence on intermediaries and business partners;
• approval and recording of gifts, hospitality and donations;
• controls over charitable and political contributions;
• accurate books and records;
• segregation of duties and payment controls;
• training for high-risk personnel;
• confidential reporting channels;
• investigation and disciplinary procedures; and
• monitoring, testing and continuous improvement.

“Facilitation payments” are small unofficial payments intended to speed routine government action. Organisations should prohibit them where possible and provide procedures for handling threats to health or safety. The exact legal position differs across jurisdictions, so organisations operating internationally require local legal advice and a consistent global standard.

Whistleblowing systems enable people to report suspected wrongdoing. A credible system provides multiple channels, confidentiality where legally possible, protection from retaliation, impartial investigation and feedback. A high number of reports does not necessarily indicate poor ethics; it may indicate that employees trust the system. Conversely, very few reports may reflect fear or lack of awareness.

7. Leadership and Ethical Culture

Ethical culture is the shared understanding of what behaviour is expected, rewarded and tolerated. It is expressed through everyday decisions, not only formal policies. Leaders influence culture through the “tone at the top,” but supervisors also create a “mood in the middle” that strongly affects employee conduct.

Leaders shape culture by:

• modelling honesty and respect;
• admitting mistakes and correcting them;
• rewarding responsible long-term performance;
• refusing to excuse misconduct by high performers;
• allocating resources to controls and training;
• inviting challenge and diverse perspectives;
• responding promptly to concerns; and
• aligning stated values with incentives and promotion decisions.

A company may publish integrity as a core value while rewarding sales staff solely for volume. Employees will reasonably infer that results matter more than methods. Ethical culture therefore depends on consistency among values, systems, incentives and consequences.

Measuring culture

Culture cannot be measured by a single indicator. Useful evidence may include employee surveys, speak-up rates, investigation outcomes, staff turnover, audit findings, customer complaints, control breaches, training quality and patterns in promotion or remuneration. Quantitative measures should be interpreted with qualitative evidence and context.

8. Technology, Data and Contemporary Governance Issues

Digital systems create new governance responsibilities. Boards and managers must consider cybersecurity, data privacy, algorithmic bias, automated decision-making, third-party technology providers and the reliability of artificial intelligence outputs.

AI systems may reproduce biased data, generate inaccurate explanations or make decisions that are difficult to challenge. Governance responses include clearly assigning accountability, documenting system purpose and limitations, testing for bias and performance, controlling access to data, maintaining human review for high-impact decisions, and monitoring systems after deployment. Delegating a decision to an algorithm does not remove organisational responsibility.

Other contemporary issues include climate-related risk, modern slavery in supply chains, platform-worker rights, political polarisation, tax responsibility and the credibility of sustainability reporting. These issues require boards to understand non-financial risks rather than treating them as peripheral communications matters.

Applied Case: Meridian Components Ltd. (Illustrative)

Background

Meridian Components Ltd. is a fictional medium-sized manufacturer supplying parts to large industrial customers. It has grown rapidly through overseas distributors. Its code of conduct prohibits bribery, but the compliance function consists of one part-time officer. Sales managers are rewarded almost entirely for quarterly revenue.

Problem

An internal audit identifies unusually large “consultancy fees” paid to a distributor in a high-risk market. The distributor refuses to explain the services provided. At the same time, employees report that managers discourage questions because missing quarterly targets may affect bonuses. The board is informed only after a major customer asks about the payments.

Analysis

The problem is not limited to one suspicious payment. Governance weaknesses include inadequate board information, weak third-party due diligence, poor incentive design, insufficient segregation of duties and a culture that discourages escalation. The code exists, but implementation is ineffective.

The board should first protect evidence, prevent further improper payments and obtain independent legal and investigative advice. Management should suspend or review the intermediary relationship according to due process, examine related transactions and preserve non-retaliation protections for reporting employees.

Approach and solution

Meridian adopts a risk-based improvement plan:

1. The audit committee commissions an independent investigation and reports findings to the board.
2. The company conducts enhanced due diligence on distributors, including beneficial ownership, qualifications and payment terms.
3. High-risk payments require documented business justification and dual approval.
4. Sales incentives are redesigned to include compliance, customer satisfaction and sustainable performance.
5. Employees receive scenario-based training and access to confidential reporting channels.
6. Internal audit tests controls quarterly and reports unresolved issues directly to the audit committee.
7. The board reviews the code of conduct and publishes a clear anti-retaliation commitment.
8. Where law permits and requires, the company cooperates with authorities and takes proportionate disciplinary action.

Outcome

The investigation finds that some consultancy services were fictitious and that two managers ignored warning signs. Meridian terminates the relationship, strengthens controls and corrects inaccurate records. The company also discovers that its previous “zero incidents” statistic reflected under-reporting rather than a clean culture. After implementation, reports increase initially, but investigations become faster and repeat control failures decline.

Learning points

• A code without resources, incentives and enforcement is largely symbolic.
• Third parties can create serious corruption exposure.
• Board oversight depends on timely and candid information.
• Incentives communicate ethical priorities more powerfully than slogans.
• Increased reporting may be evidence of improved trust, not deteriorating ethics.

Challenges and Limitations

Governance systems face several recurring challenges. First, independence may be weakened by personal relationships, dominant founders or excessive director tenure. Second, information asymmetry can prevent boards from seeing operational realities. Third, compliance may become a “tick-box” exercise focused on documents rather than behaviour. Fourth, global operations create differences in law, culture and enforcement. Fifth, stakeholder interests may conflict: a decision that protects jobs may increase environmental harm, while a rapid environmental transition may impose short-term costs on vulnerable workers.

Governance cannot eliminate all risk or guarantee ethical outcomes. It must instead create conditions for informed judgment, early detection, challenge and responsible response. Directors and managers must remain alert to unintended consequences and revise systems when evidence shows that they are failing.

Best-Practice Principles

An organisation seeking stronger governance should:

1. define purpose, responsibilities and delegated authority clearly;
2. maintain a board with appropriate competence, independence and diversity;
3. provide directors with accurate, timely and balanced information;
4. integrate financial, operational, social and environmental risks;
5. connect remuneration with sustainable and ethical performance;
6. maintain effective internal controls and independent assurance;
7. make the code of conduct practical and enforceable;
8. protect people who raise concerns in good faith;
9. investigate allegations impartially and act consistently; and
10. review governance arrangements as the organisation and its risks change.

Chapter Summary

Corporate governance is the framework through which an organisation is directed, controlled and held accountable. The board sets purpose, strategy, oversight and risk expectations, while management implements strategy and maintains operational controls. Committees, internal audit, compliance and external assurance strengthen challenge and reliability but do not remove the board’s ultimate responsibility.

Accountability requires assigned duties, authority, evidence and consequences. Transparency supports informed stakeholder judgment, but disclosures must be accurate, balanced and appropriately protected. Compliance identifies and manages legal and policy obligations; internal controls provide reasonable assurance over operations, reporting and compliance. Codes of conduct establish expected behaviour, while anti-corruption programmes address bribery, third-party risks, inaccurate records and improper influence.

Ethical culture is created through consistent leadership, incentives, supervision and responses to misconduct. Whistleblowing systems, training and independent investigation help employees raise concerns. Contemporary governance also includes cybersecurity, privacy, AI, climate risk, supply-chain responsibility and credible sustainability reporting. Effective governance is not a static set of documents: it is a continuing organisational practice of responsible decision-making, challenge, learning and accountability.

Key Terms

Corporate governance: The system by which an organisation is directed, controlled and held accountable.

Accountability: The obligation to explain decisions, accept responsibility and face consequences.

Board of directors: The body responsible for organisational direction and oversight.

Executive director: A director involved in the organisation’s daily management.

Non-executive director: A director who is not part of routine management.

Independent director: A director able to exercise objective judgment without material conflicting interests.

Audit committee: A board committee overseeing reporting, audit and internal control.

Compliance: Conformity with applicable laws, regulations, contracts and policies.

Risk appetite: The amount and type of risk an organisation is willing to accept.

Internal control: A process providing reasonable assurance over operations, reporting and compliance.

Segregation of duties: Dividing transaction responsibilities to reduce error or fraud.

Code of conduct: A statement of expected ethical and professional behaviour.

Conflict of interest: A situation in which personal interests could improperly influence official duties.

Corruption: Misuse of entrusted power for improper or private advantage.

Whistleblowing: Reporting suspected wrongdoing through an organisational or external channel.

Ethical culture: Shared expectations about acceptable conduct and the behaviour rewarded or tolerated.

Transparency: Timely, understandable and reliable disclosure of relevant information.

Greenwashing: Misleading communication about environmental or social performance.

Assurance: Independent or objective evaluation that increases confidence in information or controls.

Stakeholder: A person or group affected by, or able to affect, an organisation.

Review Questions

5 Short Answer Questions

1. What is meant by corporate governance?
2. State four responsibilities of a board of directors.
3. Why is segregation of duties used as an internal control?
4. What is the purpose of a code of conduct?
5. Identify three features of an effective whistleblowing system.

5 Long Answer Questions

1. Explain the relationship between corporate governance, CSR, compliance and business ethics.
2. Compare the responsibilities of the board, chief executive and internal audit function.
3. Discuss how transparency can improve accountability while still requiring limits to protect legitimate confidentiality.
4. Explain the components of a risk-based anti-corruption programme.
5. Analyse how leadership behaviour, incentives and disciplinary practices shape ethical culture.

3 Analytical / Application Questions

1. A company has excellent written policies but employees rarely report misconduct. Analyse possible causes and recommend improvements.
2. A senior manager claims that a technically legal business practice cannot be unethical. Use the ethical decision process in this chapter to evaluate the claim.
3. Design a governance response for an organisation introducing an AI system that makes high-impact decisions about customers or employees. Identify responsibilities, controls, reporting and assurance requirements.

Multiple Choice Questions with Answers

Question 1

Which responsibility belongs primarily to the board of directors?

A. Processing every routine customer transaction

B. Approving strategy and overseeing significant risks

C. Preparing every employee’s weekly schedule

D. Performing all operational purchasing

Correct Answer: B. Approving strategy and overseeing significant risks

Question 2

What is the main purpose of segregation of duties?

A. To ensure one employee controls an entire transaction

B. To eliminate the need for management supervision

C. To reduce the opportunity for error or fraud by dividing responsibilities

D. To transfer all accountability to external auditors

Correct Answer: C. To reduce the opportunity for error or fraud by dividing responsibilities

Question 3

Which statement best describes compliance?

A. It is conformity with applicable obligations and policies

B. It guarantees that every decision is morally correct

C. It replaces the need for internal controls

D. It applies only to financial reporting

Correct Answer: A. It is conformity with applicable obligations and policies

Question 4

Which feature most strengthens a whistleblowing system?

A. Automatic punishment before investigation

B. Confidential channels and protection against retaliation

C. Limiting reports to senior sales staff

D. Publishing the reporter’s identity immediately

Correct Answer: B. Confidential channels and protection against retaliation

Question 5

What is a major governance risk when executive remuneration is based only on quarterly sales?

A. It may encourage short-term or unethical behaviour

B. It guarantees balanced stakeholder decisions

C. It removes all conflicts of interest

D. It makes internal controls unnecessary

Correct Answer: A. It may encourage short-term or unethical behaviour

Question 6

Which action is an anti-corruption control?

A. Allowing undocumented cash payments

B. Avoiding due diligence on intermediaries

C. Maintaining accurate books and records

D. Rewarding employees who conceal breaches

Correct Answer: C. Maintaining accurate books and records

Question 7

What does transparency require?

A. Publishing every confidential document

B. Providing relevant, accurate and understandable information

C. Reporting only favourable performance

D. Replacing independent assurance

Correct Answer: B. Providing relevant, accurate and understandable information

Question 8

Which situation best illustrates an ethical culture problem?

A. Employees receive practical training and can seek advice

B. Managers admit mistakes and correct them

C. High performers are excused from rules that apply to others

D. Concerns are investigated impartially

Correct Answer: C. High performers are excused from rules that apply to others

Question 9

Why does delegating a decision to an AI system not remove organisational responsibility?

A. AI systems never require monitoring

B. The organisation remains responsible for system design, use and impacts

C. AI automatically satisfies all legal requirements

D. Only software developers are accountable

Correct Answer: B. The organisation remains responsible for system design, use and impacts

Question 10

What does risk appetite describe?

A. The total number of employees in an organisation

B. The amount and type of risk an organisation is willing to accept

C. The value of all assets recorded in the accounts

D. The number of policies in a code of conduct

Correct Answer: B. The amount and type of risk an organisation is willing to accept