Strategic Integrity: Measuring Corporate Risk Hotspots
Harvard Business School professor Eugene Saltis outlines a data-driven framework for identifying integrity gaps. Learn how to move beyond one-size-fits-all compliance to targeted risk mitigation using simple survey metrics and geographic analysis.
The Measurement Gap in Corporate Integrity
Corporate scandals are rarely the result of malicious intent by isolated individuals; they stem from systemic oversight failures where leaders overlook conflicts of interest or aggressive sales practices. Eugene Saltis, an associate professor at Harvard Business School, argues that traditional compliance programs fail because they treat integrity as a static cultural value rather than a measurable operational variable. The core strategic shift required is moving from a one-size-fits-all approach to a data-driven model that identifies specific "hotspots" of risk within the organization.
Identifying Hotspots Through Data
Saltis proposes a simple, three-question survey to map integrity risks: Have you seen questionable conduct? Did you report it? If not, why? This tool reveals the "iceberg" of unreported misconduct, often driven by employees' fear of harming colleagues rather than fear of retaliation. By analyzing this data across different geographies and functions, leaders can pinpoint where behavioral norms diverge from corporate policy. For instance, practices considered acceptable in one region may violate regulations in another, creating significant regulatory exposure.
Strategic Resource Allocation
Once hotspots are identified, companies must reallocate resources strategically. Instead of distributing generic online training to all employees, firms should invest in high-impact in-person training for high-risk subgroups. Additionally, monitoring efforts, such as expense report audits, should be concentrated in these specific areas. This targeted approach is more cost-effective than broad-based surveillance and addresses the root causes of misconduct, which often include unclear policies or outdated procedures rather than inherent employee malice.
Normalizing and Containing Risk
Data from Fortune 100 companies indicates that substantiated violations occur on average once every three days. This frequency is normal for large organizations. The goal of leadership is not to eliminate all misconduct, which is impossible, but to ensure that issues remain small and are resolved internally before they escalate. Ignoring these "embers" leads to fires; proactive treatment prevents reputational damage and financial penalties. By treating integrity as a manageable operational risk, leaders can protect both the firm and their employees from severe consequences.
Key insights
-
Integrity risks are heterogeneous and concentrated in specific geographic or functional areas rather than distributed uniformly across the firm. One-size-fits-all compliance training fails to address these localized behavioral pressures.
Impact: Targeted resource allocation to high-risk areas significantly reduces the likelihood of regulatory violations and improves the return on compliance investments.
-
Employees often fail to report misconduct not due to fear of retaliation, but out of concern for the personal consequences faced by their colleagues. This social barrier creates a blind spot in traditional whistleblowing mechanisms.
Impact: Understanding this psychological barrier allows leaders to design reporting mechanisms that mitigate social friction, increasing the volume of actionable intelligence.
-
Substantiated internal violations occur in all large firms, averaging once every three days in Fortune 100 companies. The distinction between successful and failed firms lies in the speed and effectiveness of internal containment.
Impact: Normalizing the frequency of minor violations shifts leadership focus from zero-tolerance rhetoric to rapid detection and resolution, preventing minor issues from becoming systemic failures.
-
Regulatory environments and ethical norms vary significantly by geography. Practices that are legal or customary in one region may constitute criminal misconduct in another, creating complex compliance challenges for multinational firms.
Impact: Firms must localize their compliance policies and training to reflect regional legal realities, reducing the risk of inadvertent violations due to cultural or regulatory misalignment.
-
The "ignorance is bliss" approach to compliance is a high-risk strategy. Proactively identifying and addressing minor integrity issues prevents them from escalating into major regulatory fines or criminal prosecutions.
Impact: Proactive intervention reduces the financial and reputational costs associated with public scandals and legal proceedings, protecting shareholder value.
Action items
-
Implement a three-question integrity survey across random samples of employees in different geographies and functions to identify reporting gaps and risk hotspots.
Impact: This low-cost diagnostic tool provides actionable data on where misconduct is likely occurring but not being reported, enabling targeted intervention.
-
Reallocate compliance training budgets to provide in-person training for identified high-risk subgroups rather than distributing generic online modules to all employees.
Impact: In-person training is more effective for behavior change in high-pressure environments, maximizing the impact of limited compliance resources.
-
Concentrate monitoring and audit resources, such as expense report reviews, on the specific geographic or functional areas identified as high-risk by the survey data.
Impact: Targeted monitoring increases the detection rate of misconduct in critical areas without imposing excessive burden on the entire workforce.
-
Review and update global compliance policies to ensure they reflect local regulatory requirements and actual employee behaviors in each operating region.
Impact: Aligning policies with local realities reduces inadvertent violations and clarifies expectations for employees working in diverse regulatory environments.
-
Establish a rapid-response protocol for internal violations that focuses on containment and root-cause analysis rather than punitive measures alone.
Impact: Rapid containment prevents minor issues from escalating into major regulatory or reputational crises, protecting the firm's long-term stability.
Quotes
“The problem is measurement. You can't manage a process if you don't measure it.”
“In reality, every company of any size has some amount of misconduct.”
“Corporate malfeasance is a lot like a bug, getting a sore throat, which you can try to ignore.”