# Strategic Integrity: Measuring Corporate Risk Hotspots

**Podcast:** HBR On Leadership
**Published:** 2026-01-28

## Transcript

Welcome to HBR on Leadership.
These episodes are case studies and conversations with the world's top business and management experts, hand selected to help you unlock the best in those around you.
I'm HBR senior editor and producer Amanda Kirsey.
When companies face scandals, fines, or public backlash, it's rarely because the people involved set out to do something wrong.
More often, leaders overlook conflicts of interest or aggressive sales practices, or they quietly encourage that sort of everyday misconduct.
That is, until the consequences become impossible to ignore.
But there are also all kinds of smaller white-collar crimes that happen every day.
Today's guest researches these so-called integrity gaps, and he has practical tools for managers to flag potential issues quickly and prevent them from becoming big problems.
Eugene Saltis is an associate professor at Harvard Business School.
He's the author of the HBR article, Where is Your Company Most Prone to Lapses in Integrity?
He also wrote the book Why They Do It, Inside the Mind of the White Collar Criminal.
Eugene, thanks for coming on the show.
So I have here my notes that you went to prison for white collar crime.
Is that right?
That's that's almost correct, but there's an important distinction.
I went there to visit people who engage in white-collar crime.
Okay, you researched white-collar criminals, and a place to go find them is basically in prison.
That's that's uh the the easiest place to look for for known offenders.
Yeah.
What's that like going into these places?
It was pretty intimidating the first time.
Uh it's it's exactly what I think the stereotype is.
It's cold, it's dark, it's noisy, and it's dirty.
It's really unpleasant, even in the minimum and medium security prisons, which I know oftentimes get characterized as these kind of clu club fed.
Um, they're really not pleasant.
I left after two hours.
Uh and I also was in the quote, comfortable, generally the uh attorney's room, uh, which I can assure you i is anything but comfortable.
So, who did you talk to and what did you find out?
So I I spoke to uh for the book, nearly fifty people who engaged in white collar crime, from people whose cases are uh front page headlines, people from from Enron, uh, WorldCom, uh Bernie Madoff, to other people's cases from well-respected firms like McKinsey, uh KPMG, whose who's maybe cases are not quite as as well known, but were really extraordinary leaders, extraordinary people running the firm that that made a series uh of mistakes that had these remarkable consequences.
Yeah, those first ones are known because they brought down companies, right?
And the later ones hurt reputation, they hurt with fines, but um maybe lesser known because they didn't lead to calamitous collapse of a company.
Right.
I mean, in many ways, the the question that fascinates me, haunts me in some ways, is is how pretty remarkable people who are otherwise smart, thoughtful, intelligent, great dads, um, end up engaging in this behavior after a decade or two decades of successfully running a firm, being a leader within an organization.
We're talking about otherwise, I would say normal uh leaders, uh, you know, type A personalities that want to be successful.
Uh they want to be so successful, in fact, and that's not just because they want to make money, but they want to see their firms and their colleagues succeed.
Uh they end up engaging in these uh harmful acts.
Aaron Powell That kind of defeats the notion of bad apples, right?
That they're bad people from the start, bad people through and through, and um that companies can't do anything about it.
Maybe this is too simplistic, but is it more the tree than the the apple?
Psychologists for decades have have really studied the difference between the individual and their surrounding circumstances.
The circumstances uh are incredibly, incredibly important.
Uh when we start thinking about the pressure, uh, I focus a lot on the distance of the consequences to the manager, him or herself.
So if we think about the the consequences for most white collar misconduct, it's psychologically and and physically distant from the manager.
So at the time he's engaging in some type of corporate malefeasis, it doesn't actually feel so harmful.
It's only quarters or years down the road that it might become evident.
Uh and that makes it much easier to proceed with these consequential actions without necessarily appreciating those those ramifications at the time.
Yeah, and it's also not just those actions down the road, but if you have a culture that allows that kind of stuff to happen, it can be collective damage from a group of individuals or many individuals.
Exactly.
And also things are changing over time.
Um so in the U.S., let's think of some big things that are are often prosecuted.
Uh foreign corrupt uh practices act, bribery.
But bribery uh in in Germany was not only uh legal, but actually tax deductible up until 1999.
So I mean, this is a a new, in some sense, ruler institution that's been created.
Uh or another case that's particularly pertinent right now in the United States, um, I mean, if you do business with uh with Iran as an American firm, there's some very, very serious consequences, both for individuals and the organization.
But in other parts of the world, both in Europe and in Asia, Iran's a perfectly fine country to do business with.
And if anything, it's trying to find loopholes to continue doing business with them under the current sanctions.
Um part of these things represent changes in the regulatory environment.
Some of this might even be political.
And that's what makes it really challenging for business leaders.
Yeah, that was one thing I found really interesting in your recent research and some of the studies that are going on in the field is this understanding that even in one company you can have a lot of uh variation in application of ethics or how ethical people are, depending on your geography and your the function you're in.
I think every leader likes to think of their firm as having one homogenous culture.
And certainly there's good reasons to try to be aiming toward that.
But when you start running an organization that is in not just dozens of states, but dozens of countries, and you have a hundred, thousand, ten thousand, hundred thousand plus employees, you're gonna have heterogeneity.
Uh EY has actually done some interesting work where they've actually interviewed managers about different kinds of aggressive conduct.
For example, paying paying to win a contract.
And if you look at some of their work, you'll see certain countries where you know 20 or 30% of managers will say, yeah, paying cash to win a contract, uh, if this helps my company avoid avoid a big mess, of course I would do it.
Uh in other countries, Switzerland and the United States, most managers at least will say no out loud.
Some will of course do that, but very few would actually say I would, I would actually do that because we know the consequences.
Is there an example you're thinking of from one of those prison visits where you see the geography or the function like a sales unit being so different from the culture of you know a different part of the company that it kind of flew under the radar?
Well, I think if we take one of the prominent examples uh relate to actually Enron, um Arthur Anderson, one of the you know, major professional services and and accounting firms, uh, there was clearly some, I think, challenges with how their branch in in Texas worked with Enron, but that didn't characterize, I don't think the whole firm or all its employees.
And it's actually one of the reasons why it was so, I think, heavily criticized when the government actually prosecuted uh the firm or actually even just started with an indictment that ended up leading to the kind of the the breakup, yeah.
The breakup of the firm.
Yeah.
Um it didn't characterize.
It wasn't, and I think what the hard part is any time a firm is criminally prosecuted, which is now happening with increasing frequency, that's not saying that the 10 or 50,000 employees are are criminals.
It's saying that that entity is actually what engaged in a criminal enterprise.
And I think that's challenging because that actually creates a lot of costs, both on the employees themselves, but also the shareholders.
There's a lot of externalities associated with these resolutions.
And so if you're running these companies and you have offices in lots of different cities in lots of different parts of the globe and you're in a lot of different jurisdictions, you kind of need to be on top of it.
Absolutely.
Um and also the world's becoming even more complicated because the regulation in one country is increasingly affecting businesses in others.
Uh GDPR in privacy, for example, in Europe is a really good example um where people in Europe have become very, very sensitive to to the privacy.
But how we in the US and for example let's say China, which have radically different views about how we would use client data, images of employees, I think have not only different kind of moral views on this, but also just different views about how we'd handle that data.
And so it's very easy for a a firm that maybe has a branch in in the US, in Europe and in China and you just normally are sharing client data or user data.
And historically that was perfectly fine could actually lead to reputational consequences in the US and a a huge fine in Europe.
And it's hard for people to maybe stay on top of all all these different changes because they they really are changing quite rapidly in in this kind of space.
Um as as we I think all know over the last couple of years, there are areas like uh harassment, discrimination, which may not actually tend to get it to the criminal realm for most firms, but I think repu the reputational damage is as or even greater than many of the the civil and criminal sanctions available to regulators.
Wow.
When you have such a disparate firm like that and you have you have a lot of variation in how employees meet standards, you're trying to reach a single standard.
I ideally.
Uh I uh that's the goal at least.
Um that that's hard.
Uh so many firms and leaders want to want to think that what what they say at the you know, the annual retreat or what's in the code of ethics or code of conduct is what every f employee is doing.
Um, but everyone comes from different backgrounds, that is from different firms which have different levels of what's considered okay around here.
And the question is, how do you understand what those differences in the culture are and how could they contribute to or potentially detract from integrity-related issues that expose the firm to reputational and regulatory risk?
So all of these companies have like compliance departments, right?
They have legal departments, they have systems in place, processes in place to root it out and minimize their exposure.
Is that not working or why isn't that enough?
Oh, the the problem is measurement.
Uh you can't manage a process if you don't measure it.
Uh and and so what my work has shown is that organizations need to spend time and resources figuring out what are they getting in return for the investment, whether it's a training exercise, uh, whether it's an investigations process, which is or if a senior management spending time with people in the field conveying what the firm is supposed to be doing.
What's that time actually generating?
You've identified a very simple survey that companies can implement to basically find out and get a sense of what might be going on and where problem areas are.
And I like it because it's just very, very simple.
It essentially asks three questions of managers or people around the company.
Number one, have you seen anything that's questionable, essentially?
Did you report it?
And if you didn't report it, why not?
Um, what do you learn by asking those questions?
It's a hot spot identifier, would be the simplest way to put it.
Um some firms they'll have in investigation, they'll have a whistleblowing hotline, but they don't see a lot of movement there.
They might have a call here, a call there.
The question is, what's below that iceberg that they're not seeing?
And what you're trying to do with the survey is say, where are there areas where there might be emerging issues occurring and we just don't know about it?
And this is not saying that the firm is is not a great firm or there's even concerns necessarily about like retaliation, but it's the fact that uh I've actually found in some of these uh results that people don't want to see their colleagues get fired.
And so they're not speaking up, not because they can't identify it, and not because they're not really willing to because they're concerned about it, but because they're concerned about the outcome.
And so this is a way of trying to get ahead of those issues before they ideally hit the or unideally hit the headlines.
The statistics in here were pr pretty interesting.
Um workers are more likely to report a theft of company property or accounting irregularities.
The number goes down for people reporting things like inappropriate gift giving or conflicts of interest, but even you know, theft, like less than half the people would report something like that.
So in a way, this this data is showing you that you know it's normal that not everybody's gonna report everything.
But if it's higher than some standards, I mean you get a you get a sense from these numbers then like where problems are or people are under or over reporting something.
Exactly.
And what you want to do is run this across, not to every employee necessarily, but a random group in different areas, different geographic, different divisions to see where these numbers are higher or lower, because a lot of firms right now approach their integrity ethics compliance programs as kind of a one-size-fit-all.
We give everyone in the organization the same kinds of training, the same kind of leadership by example.
But really in practice, there are going to be certain areas that are hot spots.
And wouldn't it be nice to identify those and then place more resources there?
That's what every we do in every other operation of the firm, every other part of the firm.
But oddly enough, we we haven't started really doing this in the integrity and compliance space.
Yeah, that's interesting.
Like if a if one of your stores has low sales compared to everybody else, you go there and figure out what's going on, or if one is very successful, you go there and figure out what's going on, and it's the same thing with with ethics essentially.
It should be.
And I would say right now the only time really we see that occurring is after there's an issue.
So after there's a bribery incident in Country X, you see a whole pile more training, a whole pile more uh new management, different incentives put into place.
But wouldn't you like to do that before you pay the Hue regulatory fine, you're on the front page of the news?
And a simple survey like this is trying to help managers get there with without having to really invest a whole lot to help identify these issues.
Right.
And and this goes back we're not trying to identify bad people, bad managers.
We're going to understand where there are maybe hot spots because it's simply the pressures of the business line are are different.
And something we can help figure out how to get ahead of that to help the managers employees help themselves stay out of the headlines.
So if you know about or have worked with companies that have used this survey um can you give some examples of of things that they found or ways that they took action um because they identified something they wouldn't otherwise have been able to discover?
Generally what I've seen firms doing is saying let's actually customize the kind of training and also kinds of monitoring slash surveillance that we're going to apply.
So for example, you know, in in-person training is by and large always going to be more effective than than kind of the generic online training.
And so most firms can't spend the money to do in-person training to everyone across the world.
So what do you do?
You you basically go into in-person training to your most senior people, you do online training for everyone else.
Maybe you actually should invest in that in-person training, not just for the senior leadership, but actually, actually throughout the organization, but in very specific parts of the organization.
Some subdivision within some geographic area, we can help identify that.
Um, also sometimes a lot of these things like training and codes, uh preventive things uh unfortunately are not enough.
There are areas where sometimes you need to invest more in thinking in terms of uh the monitoring for that type of group.
So looking at the expense reports, doing additional due diligence.
Again, that's very costly.
And as most people say about compliance, that that can be a burden on employees.
So you don't want to roll that out against everyone, but maybe for a subgroup of an area that you see as a hotspot, a high risk area, it's worth doing that because uh whatever maybe small additional costs that'll impose upon that small area will be much less than having the entire firm uh have some regulatory issue because regulatory issues, fines, criminal sanctions aren't against some subunit.
Uh the DOJ doesn't rep say this subdivision within this country is what engaged in fraud.
The headline in the Wall Street Journals will be company X engaged in fraud.
Right.
And that's what's so devastating.
Yeah.
Does that mean that investors maybe have the wrong impression of companies when something like this happens?
Um, how often is it just uh, you know, a part of the company versus bad leadership, bad stuff happening from the top?
So in our recent project, uh I actually wanted to say what's the difference between the public perceptions of how often fraud occurs and what are what's reality?
Right.
So I I I first took all publicly traded firms, looked how often do they face one of these regulatory sanctions from the department of Justice or SEC?
And what you find it it's less than uh on the civil side, less than five percent a year.
So it's pretty infrequent.
Jump inside the company.
So I took data from three Fortune 100 companies, so notably large companies, and looked at when they internally found a substantiated violation of of fraud, bribery, something that at least if a prosecutor was sitting there could at least theoretically charge the company with criminal conduct.
How often did those occur?
I actually found it occurred once every three days on average.
And so while the public I think has this perception that there's kind of good and bad companies, some that engage in fraud and some that don't, in reality, every company of any size has some amount of misconduct.
And what management's job is is to make sure that in a large company, that misconduct is occurring maybe once every three days and not three times per day, and that the size of the fraud is not tens of thousands, hundreds of thousands of millions of dollars, but ends up being small in material amounts that they can manage uh internally.
Yeah, these aren't big fires, but you're just you're trying to put out find the coals and the the embers and and put them out wherever they pop up.
Aaron Powell And the idea is how how can you make sure that they're still only embers?
I mean, the survey is trying to say one way to get ahead of that.
Um unfortunately, I think a lot of the world still operates on the ignorance's bliss approach.
And this is in part from kind of the legal community that you you you don't want to make a turn something that is embers into a fire yourself.
By talking about it.
Exactly.
And so sometimes you think, well, we we we address this by dealing with it internally.
Um and you know, not making a big fuss over it that gets out publicly.
The analogy I often like to make is is corporate malfeasance is a lot like uh a bug, uh getting a sore throat, which you can try to ignore.
Um, but what will happen is it'll generally grow and get worse unless you seek treatment.
And that's a little like malfeasance.
If you play the ignorance is bliss approach, there's a chance it might go away on its own accord.
You don't need to quote go to the doctor.
But but that's rare.
And oftentimes you need to seek the right treatment.
Uh, and and that's what the survey is trying to do is trying to figure out what kind of treatment do you need?
What what aisle do you need to go down to figure out how how to get rid of that bug as quickly as possible?
What do you do?
I mean, in-person training is one thing, right?
But if something's going on that you have to stop, and maybe you just didn't know about it and didn't discover it before as a company leader, and now you know, how do you deal with it?
Do you punish it?
Do you eradicate it?
Do you fire people?
Do you retrain them and give them an amnesty?
Like what are the tools to to address it once you do find that?
So the question is, what's the root cause for this misconduct?
And so sometimes there's intentional people have incentives that they're trying to get ahead.
Sometimes though, it's something as simple as a the policy or process wasn't clear.
People thought they were doing their job adequately well and they were bringing in what their prior firm practices were, but it turns out their prior firm practices are either not appropriate anymore or not how we're we do things around here.
Right.
And so you actually need to create that policy and make it clear to people.
Um, you need to help them, help themselves with creating easy ways to also follow that policy.
Almost every firm where I start talking with them about their compliance program will note that they have this elaborate book of firm policies, but really a lot of those are outdated.
Some of them they haven't had a chance to put in because it requires so much coordination between different groups of people that you only really learn after a couple months what the actual policies really are.
And when they mean really are, it means the ones that you're punished for breaking and the ones that you're supposed to implicitly do.
Um it's as Marvin Bauer uh described cultures, the way we do things around here.
Um and that's hard in this integrity policy space.
And in the end, in the end, you're trying to avoid reputational damage, you're trying to avoid financial damage through fines uh from regulatory authorities, and you're also trying to stay out of prison yourself.
Exactly.
The best way I like to think of this, the why do we do all this stuff is that you know I spent a lot of time teaching in the classroom, working with companies, talking about their compliance programs.
And what I've learned is that knowing where I'm in there in a classroom or working with them on a training exercise or or speaking with their their colleagues, do they ever think they wouldn't be involved in anything that we would describe as corporate malfeases?
But but the data suggests otherwise that in the long run, there are very smart people who are thoughtful, great, great parents, great spouses, who are going to engage in conduct that that has these kinds of consequences that are serious, not just paying a fine, but can lead to prison.
And so what I hope we can do with tools like this is help people get maybe one step ahead to not just help their firms, but to really help themselves.
Speaking with HBR Ideacast host Kurt Nickish.
Eugene's the author of the book Why They Do It, Inside the Mind of the White Collar Criminal.
HBR on Leadership will be back next Wednesday with another hand-picked conversation from Harvard Business Review.
If this episode helped you, share it with your friends and colleagues, and follow the show on Apple Podcasts, Spotify, or wherever you listen to podcasts.
While you're there, consider leaving us a review.
And when you're ready for more podcasts, articles, case studies, books, and videos with the world's top business and management experts, find it all at HBR.org.
This episode was produced by Mary Dew and me, Amanda Kersey.
On leadership's team includes Maureen Hoke, Rob Eckhart, Erica Truxler, Ramsey Cabazz, Ann Bartholomew, and Nicole Smith.
Music is by Coma Media.