Corporate Governance, Accountability and Ethical Culture

Introduction

Corporate social responsibility (CSR) cannot be sustained by public statements, charitable projects or a code of conduct alone. It depends on the way an organisation is governed: who has authority, who is answerable for decisions, how risks are monitored, how misconduct is reported, and whether leaders reward responsible behaviour as well as financial performance.

Corporate governance is the system through which organisations are directed, controlled and held accountable. It includes the relationships among shareholders, the board of directors, executives, employees, regulators, customers, communities and other stakeholders. Corporate ethics concerns the principles used to judge conduct as right, fair, honest and responsible. Ethical culture is the shared pattern of values, expectations and behaviours that influences how people act when rules do not provide a complete answer.

A well-governed organisation does not assume that good intentions will prevent misconduct. It creates structures, processes and incentives that make responsible conduct more likely, detect problems earlier and ensure that people are held accountable. Governance therefore connects CSR commitments with everyday organisational decisions.

Learning Objectives

By the end of this chapter, you should be able to:

1. Explain the relationship between corporate governance, accountability and ethical culture.
2. Distinguish the responsibilities of the board, senior management, internal control functions and employees.
3. Describe the purpose and limitations of codes of conduct and compliance systems.
4. Explain how speak-up mechanisms, investigations and non-retaliation policies support accountability.
5. Assess the effect of leadership behaviour, incentives and organisational controls on ethical conduct.
6. Apply governance and ethical-culture principles to a practical organisational case.

1. Corporate Governance and Accountability

1.1 Meaning and purpose

Corporate governance is the framework of authority, oversight and control used to direct an organisation. It determines:

• who makes significant decisions;
• whose interests decision-makers must consider;
• how performance is evaluated;
• how risks are identified and controlled;
• how information reaches those with oversight responsibilities; and
• what happens when standards are breached.

Accountability is the obligation to explain decisions, accept responsibility for outcomes and face appropriate consequences. It has at least three dimensions:

Accountability differs from blame. A mature accountability system seeks to understand whether an outcome resulted from individual misconduct, poor supervision, unrealistic targets, defective systems or a combination of factors. It distinguishes honest error from negligence, reckless behaviour and deliberate wrongdoing. This distinction encourages learning without allowing serious misconduct to be excused as a “mistake”.

1.2 Stakeholder and agency perspectives

The agency perspective focuses on the relationship between owners or principals and managers or agents. Managers may possess more information than owners and may have personal interests that differ from those of the organisation. Governance mechanisms such as independent directors, audits, disclosure and performance monitoring reduce the risk that authority will be misused.

The stakeholder perspective takes a broader view. Organisations affect employees, suppliers, customers, communities, governments and the natural environment, not only shareholders. Under this perspective, governance should consider the rights, interests and legitimate expectations of affected stakeholders. CSR becomes part of core governance rather than an optional public-relations activity.

These perspectives are not necessarily incompatible. Effective governance protects investors while also recognising that long-term organisational success depends on trust, lawful conduct, safe products, fair employment and responsible environmental practices.

1.3 The board of directors

The board is responsible for stewardship and oversight rather than managing every operational decision. Its duties vary by legal system, but commonly include:

• approving organisational purpose, strategy and major policies;
• appointing, supporting and evaluating the chief executive;
• overseeing material financial, legal, operational, social and environmental risks;
• ensuring the reliability of financial and non-financial reporting;
• monitoring the effectiveness of internal controls;
• overseeing ethical culture and conduct risks;
• protecting the integrity of investigations and speak-up arrangements; and
• considering whether executive incentives encourage responsible long-term performance.

The board must receive information that is timely, accurate and sufficiently independent. A board that receives only positive summaries cannot exercise meaningful oversight. It should ask questions about adverse trends, unresolved complaints, regulatory findings, employee concerns, supplier conditions and areas where performance targets may create pressure to compromise standards.

Board committees can support oversight. An audit committee may monitor financial reporting, internal audit and controls. A risk committee may review enterprise risks. A remuneration committee may assess pay structures. A nominations or governance committee may consider board composition, succession and director effectiveness. Committees assist the board but do not remove the board’s collective responsibility.

1.4 Management responsibilities

Senior management translates governance expectations into operating practice. Management responsibilities include:

• implementing approved policies and controls;
• allocating sufficient people, money and expertise to ethics and compliance;
• communicating expectations clearly;
• identifying and escalating risks;
• ensuring that employees receive relevant training;
• investigating credible concerns fairly and promptly;
• correcting control failures; and
• reporting honestly to the board.

Middle managers are especially important. Employees often judge the organisation’s true values by observing their immediate supervisor, not by reading a corporate policy. A manager who praises safety but privately pressures staff to bypass safety procedures sends a stronger message than any formal statement.

1.5 The three lines of responsibility

A useful model divides risk and control responsibilities into three lines:

1. First line—operational management: owns risks and operates controls in daily work.
2. Second line—risk, compliance and specialist functions: develops frameworks, advises the business, monitors implementation and challenges decisions.
3. Third line—internal audit: provides independent assurance about governance, risk management and controls.

The model is not a substitute for accountability. Compliance cannot “own” every ethical risk on behalf of managers, and internal audit cannot guarantee that misconduct will never occur. Operational leaders remain responsible for the activities they control.

Figure: The board and management establish expectations, while operational, specialist and assurance functions support accountable conduct.

2. Ethical Culture

2.1 What ethical culture means

Ethical culture is the set of shared assumptions and practices that shapes how people interpret and respond to ethical issues. It is visible in both formal and informal systems. Formal elements include policies, training, reporting channels and disciplinary procedures. Informal elements include stories about past incidents, peer expectations, managerial reactions and the behaviour rewarded in practice.

A strong ethical culture does not mean that employees agree on every moral question. It means that the organisation has credible standards, encourages questions, treats people fairly, responds to concerns and aligns rewards with stated values.

Culture can be assessed through several indicators:

• whether employees feel safe raising concerns;
• whether leaders admit mistakes and disclose bad news;
• whether targets are achievable without misconduct;
• whether disciplinary standards are applied consistently;
• whether promotions reflect integrity as well as results;
• whether vulnerable stakeholders are considered in decisions; and
• whether control weaknesses are corrected rather than concealed.

2.2 Leadership tone and behavioural example

“Tone at the top” refers to the messages conveyed by senior leaders. It includes speeches, policies and strategic priorities, but conduct is usually more influential than words. Leaders establish culture when they:

• refuse business obtained through bribery or deception;
• protect employees who raise good-faith concerns;
• disclose conflicts of interest;
• accept scrutiny from the board and regulators;
• correct their own errors; and
• make responsible decisions even when short-term results suffer.

Tone at the middle is equally significant. Supervisors allocate work, interpret targets and decide how to respond to problems. An ethical culture therefore requires leadership development and accountability at all managerial levels.

2.3 Psychological safety and ethical voice

Employees are more likely to report concerns when they believe that speaking up will lead to fair treatment rather than humiliation, retaliation or career damage. Psychological safety does not mean that every opinion is accepted without evidence. It means that people can raise questions, challenge decisions and report possible misconduct without unreasonable interpersonal risk.

A “speak-up” culture is broader than a whistleblowing hotline. It includes ordinary conversations with supervisors, ombuds services, human-resources channels, compliance officers and confidential reporting systems. Organisations should provide multiple routes because a single channel may be inaccessible or mistrusted.

3. Codes of Conduct and Ethical Decision-Making

3.1 Purpose of a code

A code of conduct expresses the organisation’s principles and gives practical guidance on expected behaviour. Typical subjects include conflicts of interest, bribery and corruption, gifts and hospitality, discrimination and harassment, confidentiality, data protection, competition law, human rights, use of company assets, financial integrity, health and safety, environmental responsibility and reporting concerns.

An effective code should be:

• written in clear language;
• relevant to actual organisational risks;
• available to employees and appropriate third parties;
• supported by examples and decision tools;
• translated where necessary;
• reinforced through training and management practice; and
• linked to fair investigation and disciplinary processes.

A code is not a complete ethics programme. It cannot anticipate every situation, and employees may comply formally while finding ways around its purpose. For this reason, principles such as honesty, fairness, respect and responsibility should accompany specific rules.

3.2 A practical ethical decision process

When facing a difficult decision, an employee or manager can ask:

1. What are the relevant facts, and what information is missing?
2. Who may be affected, including people without decision-making power?
3. Which laws, policies, contractual duties and professional standards apply?
4. Are there conflicts of interest or hidden incentives?
5. Would the decision remain acceptable if disclosed publicly?
6. Is the decision fair and consistent with the organisation’s stated values?
7. What alternatives reduce harm or improve stakeholder outcomes?
8. Who should be consulted or informed before proceeding?

This process is not a legal opinion and does not replace specialist advice. It helps identify issues early and prevents the common error of treating legality as the only ethical test.

4. Compliance Systems and Internal Controls

4.1 From rules to risk-based compliance

Compliance means meeting applicable laws, regulations, contractual obligations and internal standards. A mature compliance system is risk-based. It directs greater attention to areas where the likelihood and impact of misconduct are higher, rather than applying identical procedures to every activity.

A basic compliance cycle consists of:

1. identifying legal, ethical and operational obligations;
2. assessing risks and vulnerable processes;
3. designing preventive and detective controls;
4. communicating requirements and training relevant people;
5. monitoring performance and incidents;
6. investigating deviations; and
7. improving controls and reporting results to oversight bodies.

4.2 Preventive, detective and corrective controls

Segregation of duties is a fundamental control. For example, the person who creates a supplier should not be the sole person who approves payment to that supplier. Controls must be proportionate: excessive controls can slow legitimate work and encourage employees to bypass systems, while weak controls create opportunities for abuse.

4.3 Compliance limitations

Compliance systems can fail through poor design, inadequate resources, false documentation, collusion, management override or excessive reliance on checklists. A person may complete training and still behave unethically if targets, peer norms and leadership signals point in another direction. Compliance is therefore necessary but not sufficient for ethical culture.

5. Speak-Up Mechanisms, Investigations and Remediation

5.1 Designing speak-up channels

A credible speak-up system should provide:

• more than one reporting route;
• confidentiality where legally and practically possible;
• anonymous reporting where appropriate;
• clear information about what happens after a report;
• trained and independent case handlers;
• protection against retaliation;
• timely acknowledgement and updates; and
• records that protect privacy and support trend analysis.

Accessibility matters. Channels should be usable by employees with disabilities, contractors, temporary workers and relevant supply-chain personnel. Reports should be assessed using consistent criteria, with urgent risks escalated immediately.

5.2 Investigation principles

Investigations should be fair, proportionate, impartial and evidence-based. Investigators should define the allegation, preserve relevant records, identify witnesses, manage conflicts of interest and maintain confidentiality as far as possible. The subject of an allegation should have an appropriate opportunity to respond. Confidentiality should not be promised absolutely if disclosure is required by law or necessary for a fair process.

The result should be documented, and the organisation should distinguish substantiated findings from unproven allegations. A finding of no breach does not necessarily mean that the reporting employee acted improperly; good-faith reports may be mistaken.

5.3 Retaliation and remediation

Retaliation may include dismissal, demotion, exclusion, threats, undesirable assignments or subtle career penalties. Anti-retaliation protection must apply to people who report concerns, participate in investigations or refuse to engage in wrongdoing. Monitoring after a report may be necessary, especially when the reporter and subject remain in the same team.

Remediation should address both individual and systemic causes. Possible actions include returning withheld pay, correcting records, compensating affected parties, disciplining responsible individuals, changing targets, redesigning approval processes and communicating lessons without revealing confidential information.

6. Incentives, Performance and Ethical Risk

Incentives influence behaviour, particularly when employees face pressure, ambiguity or competing priorities. A bonus plan based solely on sales volume may encourage mis-selling, concealment of complaints or inappropriate treatment of customers. A production target that ignores safety may encourage unsafe shortcuts.

Responsible incentive design should:

• combine financial and non-financial measures;
• include quality, safety, customer, people and compliance indicators;
• use controls against manipulation of metrics;
• allow adjustment for misconduct or serious control failures;
• recognise ethical leadership and cooperation; and
• avoid rewarding outcomes achieved through unacceptable methods.

Organisations may use malus or clawback arrangements where lawful and appropriately designed. A malus reduces an unpaid award; a clawback recovers an award already paid. Such mechanisms should be transparent and consistent with employment law and contractual rights.

Performance management should assess both what was achieved and how it was achieved. However, ethical indicators must not become superficial targets. If employees learn that reporting more incidents lowers their performance rating, incident numbers may fall because reporting has been discouraged rather than because conduct has improved.

7. Accountability in Practice: An Illustrative Case

Background

Northbridge Components, a fictional manufacturing company, supplied parts to several major customers. Its code prohibited bribery, falsification of records and retaliation against reporters. The sales division had an aggressive annual-growth target, and bonuses were based primarily on revenue and new contracts.

Problem

A regional sales manager learned that an intermediary was offering “special facilitation services” to obtain a public-sector contract. The manager raised the issue with a senior executive, who replied that competitors were using similar methods and that losing the contract would threaten jobs. The manager then reported the matter through the confidential hotline.

Two weeks later, the manager was removed from a major account and told that the change reflected “a lack of commercial commitment”. Other employees began to believe that the hotline was unsafe. At the same time, internal audit identified unusually high consulting fees and incomplete records relating to the intermediary.

Analysis

The case reveals several governance failures:

• The board had approved the anti-bribery policy but received no regular information about high-risk intermediaries.
• Management created pressure through revenue-only incentives.
• The executive’s response suggested that commercial success could override ethical requirements.
• The reporting system existed formally but did not protect the reporter in practice.
• Procurement and finance controls did not sufficiently examine the intermediary’s services and fees.

The issue was not only the possible bribery. It was also a culture problem involving leadership tone, incentive design, weak escalation and possible retaliation.

Approach and solution

The audit committee commissioned an independent investigation. The intermediary relationship and payments were suspended pending review. The investigation examined emails, contracts, payment records, approval documents and interviews. The sales manager’s reassignment was reviewed separately to avoid a conflict of interest.

The company then:

1. prohibited the payment and reported the relevant facts to authorities where required;
2. protected the reporter and reviewed whether retaliation had occurred;
3. disciplined individuals who knowingly bypassed controls;
4. revised intermediary due diligence and approval requirements;
5. changed bonuses to include compliance, customer and quality measures;
6. required board reporting on high-risk third parties and substantiated concerns; and
7. trained managers to respond appropriately to ethical questions.

Outcome

The investigation found that the intermediary had not provided credible evidence of legitimate services and that payment approvals were incomplete. The company cancelled the arrangement, strengthened controls and adjusted executive performance measures. In the following year, reported concerns increased, which management initially viewed negatively. The board interpreted the increase more carefully: it indicated greater willingness to speak up, although the organisation continued monitoring whether reports were resolved fairly.

Learning points

A code cannot protect an organisation if leadership signals that targets matter more than principles. Speak-up systems require non-retaliation in practice, not merely in policy. Incentives must recognise responsible methods as well as results. Finally, boards should examine patterns across complaints, investigations, turnover, bonuses and control exceptions rather than reviewing each issue in isolation.

8. Governance, Technology and Contemporary Developments

Technology can support ethical governance through secure case-management systems, access logs, transaction monitoring, supplier screening and analysis of repeated complaints. Data analytics may identify unusual payments, conflicts of interest or patterns of control override.

However, technology introduces risks. Automated monitoring may produce false positives, overlook misconduct that is not represented in historical data or intrude on privacy. Artificial intelligence used in recruitment, fraud detection or employee monitoring may reproduce bias or make decisions that are difficult to explain. Organisations should establish clear purposes, lawful processing, human review, access controls, retention limits and appeal mechanisms.

A dashboard is useful only when its measures are meaningful. Boards should ask how indicators are defined, what is excluded, whether trends are comparable and whether employees may manipulate the measure. Useful indicators may include training completion, substantiated cases, time to resolve cases, repeat incidents, control exceptions, retaliation allegations, employee survey results and remediation status. No single indicator proves that culture is strong.

Contemporary governance also places greater emphasis on supply-chain responsibility, human rights due diligence, climate-related risk, cybersecurity, data ethics and stakeholder transparency. These subjects should be integrated into enterprise risk management rather than assigned entirely to a CSR department.

9. Challenges and Limitations

Several challenges complicate the development of ethical culture:

• Cultural and legal diversity: multinational organisations must apply common principles while respecting local law and context.
• Conflicting stakeholder interests: a decision may benefit customers while imposing costs on employees or suppliers.
• Measurement difficulty: culture is partly intangible and cannot be reduced to training completion or hotline statistics.
• Information asymmetry: boards may receive filtered information and underestimate operational problems.
• Management override: senior individuals may bypass controls or intimidate those who challenge them.
• Fear and normalisation: repeated minor breaches can make serious misconduct appear normal.
• Resource constraints: small organisations may lack specialist compliance and investigation teams.
• Over-compliance: excessive rules may create administrative burden without improving judgement.

These limitations do not justify abandoning governance systems. They show why systems must combine rules, relationships, independent challenge, professional judgement and continual learning.

10. Best-Practice Principles

A practical governance programme should follow these principles:

1. Clarity: define responsibilities, authority and escalation routes.
2. Consistency: apply standards fairly regardless of rank or commercial importance.
3. Proportionality: match controls and investigations to the level of risk.
4. Independence: protect assurance, investigations and speak-up channels from conflicts of interest.
5. Transparency: provide honest information to the board and relevant stakeholders.
6. Capability: train people for realistic dilemmas, not only policy memorisation.
7. Alignment: connect strategy, incentives, leadership behaviour and controls.
8. Learning: use incidents and near misses to improve systems.
9. Respect: protect dignity, privacy and due process.
10. Long-term orientation: evaluate decisions by their effects on organisational trust and stakeholder welfare, not only immediate financial outcomes.

Chapter Summary

Corporate governance is the system through which an organisation is directed, controlled and held accountable. The board provides stewardship and oversight, while management implements policies, allocates resources and creates the conditions for responsible conduct. Operational managers own day-to-day risks; compliance and risk functions advise and challenge; internal audit provides independent assurance.

Ethical culture is created through the interaction of formal systems and informal behaviour. Codes of conduct clarify expectations, but they are effective only when supported by credible leadership, fair incentives, accessible speak-up channels, reliable investigations and meaningful consequences. Internal controls should prevent, detect and correct misconduct, while remaining proportionate to risk.

Accountability requires more than assigning blame. It requires clear responsibility, honest explanation, fair consequences and remediation of systemic causes. Boards should examine patterns in complaints, incentives, control failures and employee experience. Technology can improve monitoring and case management, but it must be governed for privacy, fairness, transparency and human oversight. Ultimately, an ethical culture exists when employees see that the organisation’s stated values are reflected in decisions, rewards and responses to bad news.

Key Terms

Corporate governance: The system by which an organisation is directed, controlled and held accountable.

Accountability: The obligation to explain decisions, accept responsibility and face appropriate consequences.

Board oversight: The board’s responsibility to supervise strategy, risk, reporting, leadership and organisational integrity.

Agency perspective: A view focusing on conflicts and information differences between owners and managers.

Stakeholder perspective: A view that governance should consider all materially affected groups, not only shareholders.

Ethical culture: Shared values, expectations and behaviours that influence ethical conduct.

Tone at the top: Ethical messages communicated by senior leaders through words and actions.

Tone at the middle: The ethical influence exercised by supervisors and middle managers.

Code of conduct: A document describing expected standards and prohibited behaviour.

Compliance: Conformity with applicable law, regulation, contracts and internal requirements.

Internal control: A process designed to manage risks and support reliable, lawful and responsible operations.

Segregation of duties: Dividing responsibilities so one person cannot control an entire risky transaction.

Speak-up mechanism: A channel through which concerns, questions or suspected misconduct can be raised.

Retaliation: Harmful treatment imposed because a person reported a concern or participated in an investigation.

Psychological safety: A climate in which people can raise concerns or challenge ideas without unreasonable fear.

Remediation: Action taken to repair harm, correct misconduct and prevent recurrence.

Malus: Reduction of an unpaid incentive because of adverse performance or misconduct.

Clawback: Recovery of compensation already paid under specified conditions.

Three lines model: A framework distinguishing operational management, risk and compliance support, and independent internal audit.

Management override: Circumvention of established controls by a person with authority.

Review Questions

5 Short Answer Questions

1. What is the difference between responsibility, answerability and consequences?
2. Identify three important responsibilities of a board of directors.
3. Why is a code of conduct not sufficient by itself to create an ethical culture?
4. What is the purpose of segregation of duties?
5. Define retaliation and explain why it threatens speak-up systems.

5 Long Answer Questions

1. Explain how the agency and stakeholder perspectives contribute to an understanding of corporate governance.
2. Discuss the roles of the board, senior management, compliance functions and internal audit in ethical governance.
3. Explain how leadership behaviour and incentive systems can strengthen or weaken ethical culture.
4. Describe the design features of a credible speak-up and investigation system.
5. Evaluate the benefits and limitations of risk-based compliance systems.

3 Analytical / Application Questions

1. A company rewards regional managers solely for revenue growth, while customer complaints and safety incidents are increasing. Analyse the governance and ethical-culture risks, and recommend changes.
2. An employee reports suspected procurement fraud anonymously. The local manager asks colleagues to identify the reporter and dismisses the allegation without investigation. Assess the failures and propose an appropriate response.
3. Design a board dashboard for monitoring ethical culture. Select at least five indicators, explain their limitations and describe how the board should interpret them together.

Multiple Choice Questions with Answers

Question 1

Which statement best describes corporate governance?

A. A public-relations programme focused on charitable donations

B. The system through which an organisation is directed, controlled and held accountable

C. A legal department responsible for all organisational decisions

D. A financial method used only to calculate shareholder returns

Correct Answer: B. The system through which an organisation is directed, controlled and held accountable

Question 2

Which activity is primarily a board oversight responsibility?

A. Approving every employee’s daily task

B. Operating the organisation’s payroll system

C. Overseeing strategy, material risks and executive leadership

D. Conducting every operational investigation personally

Correct Answer: C. Overseeing strategy, material risks and executive leadership

Question 3

Which function represents the third line in the three lines model?

A. Operational management

B. Internal audit

C. Sales management

D. Human resources administration

Correct Answer: B. Internal audit

Question 4

Why are multiple speak-up channels valuable?

A. They guarantee that every allegation is true

B. They eliminate the need for investigations

C. They allow concerns to be raised through routes that employees may trust and access

D. They transfer accountability from managers to employees

Correct Answer: C. They allow concerns to be raised through routes that employees may trust and access

Question 5

Which is a preventive control?

A. A post-incident investigation

B. A regulatory fine

C. An approval limit before a payment is made

D. A review of historical complaints

Correct Answer: C. An approval limit before a payment is made

Question 6

What does ‘tone at the top’ primarily refer to?

A. The volume used in executive speeches

B. The ethical messages communicated by senior leaders through words and actions

C. The design of an organisation’s logo

D. The number of policies approved by the board

Correct Answer: B. The ethical messages communicated by senior leaders through words and actions

Question 7

Which incentive design is most likely to support ethical conduct?

A. Rewarding sales volume regardless of customer outcomes

B. Using only short-term financial targets

C. Combining results with quality, safety, customer and compliance measures

D. Paying bonuses only when employees avoid reporting incidents

Correct Answer: C. Combining results with quality, safety, customer and compliance measures

Question 8

Which statement about a good-faith report is correct?

A. It must be substantiated before protection applies

B. It may be mistaken and still deserve fair treatment and protection from retaliation

C. It should automatically result in disciplinary action against the subject

D. It can be ignored if the reporter is anonymous

Correct Answer: B. It may be mistaken and still deserve fair treatment and protection from retaliation

Question 9

What is management override?

A. An employee requesting clarification of a policy

B. An auditor independently testing a control

C. A senior person bypassing established controls

D. A board approving organisational strategy

Correct Answer: C. A senior person bypassing established controls

Question 10

Why should ethical-culture indicators be interpreted together?

A. No single indicator can prove that an organisation has a strong ethical culture

B. Indicators are useful only for financial reporting

C. Combining indicators removes the need for professional judgement

D. Boards are not permitted to review individual indicators

Correct Answer: A. No single indicator can prove that an organisation has a strong ethical culture