Subscribe
Menu
a black rectangular object with white light beams coming out of it

Institutional integrity: from compliance to culture

Embedding values in every aspect of your business – from culture and incentives to leadership and communication – helps foster transparency and trust. This approach not only reduces risk but also strengthens reputation and supports long-term success.

Institutional Integrity

Culture

Incentives

Accountability

Communication

Leadership

Dynamics

Operations

Institutional Integrity

Welcome to Mishcon's institutional integrity hub which explores the forces that shape true integrity, drawing on insight from across the firm and leading external specialists. Together, we examine how organisations can build trust, strengthen reputation and support long-term success.

Select each topic from the diagram to build a holistic picture of what an organisation needs to demonstrate in order to truly earn the title of ‘Institutional Integrity’.

What does integrity look like in practice?

Many organisations have strong policies, controls and governance frameworks. Do you know whether:

  • your organisation would withstand regulatory, legal or public scrutiny during a crisis?
  • leadership behaviours reinforce organisational values?
  • incentives are driving the right outcomes?

How Mishcon de Reya can help

Mishcon de Reya can help board members, in-house counsel, risk, compliance and HR professionals to answer these questions and embed values into every aspect of your business. We can support you with:

Understanding the opportunities to enhance your institutional integrity

We deliver bespoke risk and governance reviews that identify gaps across policies, controls, behaviours and supply chains, while testing how effectively frameworks operate and risk information flows across your organisation. Our tailored advice can strengthen your institutional integrity by having clear recommendations that mitigate the gaps, support decision-making and withstand scrutiny.

Training and development

We offer bespoke training sessions tailored to the needs of your business. These are integrated with your policies to enhance awareness and ensure adherence to best practices.

Speak to our team

Organisational culture

Embedding compliance through culture

Leadership compliance (or lack of it) will directly impact on the culture of an organisation. In organisations where leaders ignore legal and ethical obligations, the culture is often damaged, resulting in negative behaviour trickling down the organisation.

With the expansion of corporate liability through failure to prevent  ("FTP") offences ongoing, and with recent high-profile public inquiries in mind, businesses will (or should be) increasingly considering the role that organisational culture plays in allowing, or preventing, criminal offences from being committed by persons associated with it. To limit legal risk, it is essential that organisations implement a positive culture that is integrated into every part of their business.

Since the implementation of the failure to prevent bribery offence in 2011, and the publication of the corresponding "adequate procedures" guidance, organisations have been aware of the importance of "top-level commitment" in setting the anti-bribery agenda. 

Principle 2 of the guidance states that "The top-level management of a commercial organisation (be it a board of directors, the owners or any other equivalent body or person) are committed to preventing bribery by persons associated with it. They foster a culture within the organisation in which bribery is never acceptable." The recently published FTP fraud guidance contains similar wording, noting that an organisation's board, partners, and senior management should "foster a culture within the organisation in which fraud is never acceptable and should reject profit based on, or assisted by, fraud." In a similar vein, corporates commit an offence if they fail to prevent criminal facilitation of tax evasion and also have a legal duty to prevent sexual harassment of their employees.

Increasingly, therefore, the onus is on businesses to demonstrate that they foster a culture that discourages misconduct and does not allow them to simply blame any misconduct that does occur on a few "bad apples".  

Incentives, rewards and institutional dishonesty: the role of UK SOx, malus and clawback

Poorly designed incentives can undermine ethical intentions and foster institutional dishonesty.

As English law expands corporate liability for failing to prevent offences, organisations are under increasing pressure to demonstrate a culture that actively discourages misconduct. While policies and leadership commitment are important, the structure of incentive and reward programmes – such as performance metrics, targets, compensation, and recognition – plays a critical role.

Incentives: shaping behaviour

Incentive schemes are intended to motivate employees and drive performance. However, if rewards are too closely linked to financial outcomes, or if ethical behaviour is not valued, employees may feel pressured to bend rules to meet targets. This risk is particularly acute in environments where success is measured solely by profit, rather than by the manner in which results are achieved.

The UK’s approach to corporate governance is evolving, with the anticipated UK SOx regime (modelled on the US Sarbanes-Oxley Act) placing greater emphasis on robust internal controls and accountability. UK SOx will require directors to attest to the effectiveness of financial controls, making it more difficult for organisations to ignore the cultural impact of their incentive structures.

Communication and information flow

Communicating in a crisis

How organisations communicate about, or in response to, a crisis situation can add another layer of risk – potentially deepening or extending the crisis. Honesty is not just about integrity, it is a strategic safeguard. By prioritising fact-based messaging, resisting the temptation to 'spin' reality, and maintaining discipline around the flow of statements and information, businesses can manage crises with confidence, without exacerbating reputational harm.

Desperate to get ahead of, or even try to kill a negative story, businesses can be tempted to rush or to be over-ambitious in how they respond, making claims that cannot be substantiated or later turn out to be wrong, exaggerating the positives or seeking to minimise or downplay the impact. Communications that are (or are considered to be) dishonest – whether by being evasive or including outright lies – can spark a backlash and further alienate employees, customers, and other key stakeholders and regulators.

Businesses and leaders need to ensure they have all the information they need in a crisis to make sound decisions, including information which is not communicated beyond those who need to know it. Prior thought must be given to how crisis teams and responses are set up to ensure that information flows are robust, both internally and externally, to protect sensitive data and to preserve legal privilege. Whether or not the crisis is triggered by internal or external events, including leaked or hacked data, it is crucial to consider who has ongoing access to sensitive data, and to have robust policies and protocols in place to respond to breaches of confidentiality, to control employees' use of social media, and to isolate and mitigate leaks.

Accountability

When preventative measures fail

Discussions around corporate criminal liability and defences to the "failure to prevent" offences often focus on preventative measures, including internal communications and training. But what if those measures fail? Where misconduct is identified, accountability is a fundamental piece of the puzzle, as a deterrent to future misconduct by persons associated with the business.

Those responsible for compliance will be well aware of the importance of fostering a culture that discourages misconduct, but no policies and procedures are bullet proof, and the detection, investigation and response to delinquency is equally important. If, following a robust, independent investigation, it is found that internal policies have been breached, a proportionate and considered response is essential. It is incumbent upon businesses not to scapegoat individuals, particularly where the failings appear to be systemic or a result of wider management issues, but where there has been deliberate misconduct or dishonesty on the part of an individual or group of individuals, a robust response will be warranted.

Jurisdictional Operations

Operating internationally has always brought unique opportunities. The entrepreneurial streak that brings businesses across borders yields the most reward when it is accompanied by a sensitivity of how and why each jurisdiction is different. Political turmoil and economic frailties bring to light challenges that businesses face in trying to thrive internationally despite the increasingly fragmented regulatory, political, and cultural landscape.

Having disparate internal standards across corporate entities operating in different jurisdictions can create governance gaps or heighten legal and reputational exposure. Internal stakeholders expect clarity in management expectations of them, and external stakeholders expect reputational protection regardless of where in the world businesses place their client-facing or back-end operations.

Harmonising operational standards makes controls more efficient to implement and monitor – and, as regulatory compliance is expensive, may emerge as a critical strategic win. Whether it is ensuring consistent procurement practices and fair employment treatment across factories worldwide, or a clear escalation framework before agreeing to contracts that deviate from the "norm" –  no one business line is an island and instead must ensure group standards are kept regardless of location. But institutional integrity need not mean absolute harmonisation which may also risk local regulatory issues. There will always be room for tailor-made solutions in particular countries.

Governance mechanisms

Organisations that proactively engage with their people (and with other stakeholders) to continuously gauge their cultural health are likely to develop a positive organisational culture and embed their core values. Several governance mechanisms can work together to discourage misconduct and promote a positive culture:

Company policies and procedures

Putting in place anti-fraud, anti-corruption and whistleblowing policies, codes of conduct and ethical guidelines, with consistent consequences for violations. These provide for clear parameters and expectations. If these values are reinforced by regular communications from senior leadership, they should become embedded in the fabric of the business. 

Training and communication

Ensuring relevant personnel are aware of policies and receive regular, scenario-based training on real ethical dilemmas. These can be across a range of areas, including ethics, risk, and compliance. These can be backed by disciplinary sanctions for non-compliance to underpin the organisation's culture and actively discourage misconduct.

Monitoring and risk assessment

Regular monitoring and periodic review of procedures and compliance, as well as of the nature and extent of exposure to potential offences. Companies can use surveys, focus groups and behavioural indicators to assess the culture. It is only through living and breathing its core values that those values become embedded into the culture of an organisation.

Governance structure

Having audit, ethics and compliance committees, compliance officers and clear reporting lines and accountability promotes integrity. Creating genuine psychological safety for employees to raise concerns without fear of retaliation is the core of a healthy organisational culture. These structures also provide continuous oversight and a uniformity of approach. 

Due diligence

Conducting due diligence on associated persons, reviewing contracts, monitoring staff well-being, and conducting due diligence in relation to mergers or acquisitions.

Proportionality

Fraud detection and prevention procedures should be proportionate to the identified risk and the nature, scale and complexity of the organisation's activities.

The most effective approach combines both cultural (such as leadership modelling ethical behaviour) and procedural (such as policies and procedures) elements. A genuine culture of compliance provides evidence that procedures are more than just "paper policies". Courts and regulators will examine whether policies are embedded in the organisation's culture and actually influence behaviour.

Assessing culture beyond compliance

A question for many organisations will no doubt be how it can measure or assess the nebulous concept of its "culture". However, the relatively limited number of prosecutions for failure to prevent bribery, and the fact that the failure to prevent fraud offence is, as yet, untested, mean that organisations have little to draw on by way of practical examples.

The primary defence available if wrongdoing is unearthed is demonstrating that the organisation had "adequate/reasonable procedures" in place to prevent the relevant offence. However, even if an organisation follows the guidance to the letter and satisfies itself (as best it can) that it would be able to rely on the "adequate/reasonable procedures" defence if wrongdoing were unearthed, this will not necessarily mean that its efforts have been effective and that, as an organisation, it is culturally sound. Indeed, the fact of wrongdoing having occurred tends to suggest otherwise.

The question of how to properly evaluate organisational culture may, therefore, be something that senior management has to wrangle with as the scope of potential criminal liability expands. Whilst leadership will set the tone, feedback from employees is likely to be critical to inform management whether efforts to instil a positive corporate culture have been successful, providing reassurance that, should an issue arise, the corporate will not be found criminally liable. This will also facilitate an early warning system that allows the organisation to address issues before they become a legal risk.

a person walking in a hallway

How Mishcon de Reya can help

Compliance audits can help assess organisational culture by testing whether policies, controls and expected behaviours are embedded in practice, providing insight into emerging legal, regulatory and reputational risks.

Discuss your compliance audits needs

Hear from our guest experts

Ben Johnson BRG
Ben Johnson BRG Ben is the Managing Director and Head of Forensic Investigations in EMEA at BRG, with 20 years’ experience of conducting investigations into fraud, audit failing, anti-bribery and corruption.

The importance of culture

It is something of a cliché, but in my experience of investigating fraud and corruption over the last 25 years, a robust workplace culture is critical in reducing the risk of both. Culture has a heavy bearing on the conduct of staff.

Most, if not all, firms pay lip service to this principle, but culture is much more than a set of policies and warm words from the Chair. However, all too often I see instances where the relevant boxes on checklists for culture are ticked but the reality on the ground in the business is different.

It is very easy for the c-suite to believe skin-deep messaging regarding their culture in corporate literature and policy documents without properly testing how this aligns with reality.

Read more

Some years ago, I worked on the fallout from the collapse of Anglo Irish Bank, which involved significant financial misstatements and resulted in several criminal prosecutions of bank executives. However, the Bank’s executives seemed to genuinely believe it had a high-integrity culture. The 2007 annual report proudly stated that:

We operate to the highest ethical and governance standards as we aspire to be a model corporate citizen. For this reason we invest heavily in the development and training of our staff, as well as maintaining the highest levels of integrity in our relationships with our stakeholders.

No doubt similar statements can be found in the annual reports of other companies subject to accounting scandals (Carillion comes to mind). All executives want to believe that their culture incentivises good conduct and compliance which can make it difficult for a realistic assessment to be made.

We see this also in rogue trading cases where the nascent rogue trader notices that the people who really earn the respect of peers and superiors (and big bonuses) are those making the most money, even if - or particularly when - they ride roughshod over controls to do so.

Another cultural problem I often see in corporate fraud cases is the culture within the finance team. Problems can arise when the culture of the finance team is subservient to the business and it is seen as their job to help the business report better performance rather than objectively reporting actual performance. When it comes to CFOs, it is important to have someone robust in place who will be able to withstand inappropriate pressure to report better results.

It is therefore vital that organisations thoroughly test and understand the culture on the ground in their business and not assume that the admirable wording of their policies will automatically filter through to the behaviour of staff.

 

Key contacts

Mark Kaye
Mark Kaye, Partner, Mishcon de Reya Mark is an expert in complex transactions and cross-border advisory work, with a particular focus on organisational culture, governance, and ethical compliance.
Celia Marr - Mishcon de Reya
Celia Marr, Managing Associate, Mishcon de Reya Celia specialises in acting for individuals and corporates in relation to criminal and regulatory investigations and prosecutions.
Christia Malaktou
Christia Malaktou, Managing Associate, Mishcon de Reya Christia is a specialist in mergers, acquisitions and corporate reorganisations, with expertise in embedding robust governance, compliance and ethical culture within organisations.

FAQs

How does organisational culture affect liability under failure to prevent offences?

As failure to prevent offences expand, organisations must demonstrate a culture that discourages misconduct. Regulators and courts will not accept explanations that wrongdoing was caused by isolated “bad apples” if culture enabled it.

What does "top-level commitment" mean in practice for compliance?

Top‑level commitment requires boards and senior management to actively foster a culture in which bribery, fraud, tax evasion facilitation and sexual harassment are never acceptable, not merely to endorse policies on paper.

What governance mechanisms help embed a culture of compliance?

Effective mechanisms include clear policies, regular training, monitoring and risk assessment, robust governance structures, due diligence, proportionate controls, and genuine psychological safety for raising concerns.

How organisations assess whether their culture is genuinely effective?

Even where adequate procedures exist, the occurrence of wrongdoing may indicate cultural weakness. Employee feedback, surveys and behavioural indicators are critical in assessing whether values are truly embedded and in providing early warning of legal risk.

 

Compliance audits can help assess organisational culture by testing whether policies, controls and expected behaviours are embedded in practice, providing insight into emerging legal, regulatory and reputational risks.

Book now

Best practice for incentive programmes

To ensure incentives support a healthy culture, organisations should:

Align incentives with values

Performance metrics should reflect not only financial outcomes but also adherence to ethical standards and legal obligations. Recognising employees for managing risks or upholding codes of conduct signals that integrity is valued.

Balanced scorecards

Incorporating financial, operational, and ethical dimensions into performance assessments prevents any single metric from dominating, reducing pressure to compromise standards.

Implement malus and clawback policies

Contracts and reward schemes should include clear malus and clawback provisions, communicated to staff. Remuneration committees must use these powers effectively, and investors increasingly expect sanctions for serious failures, even in supervisory roles.

Strengthen internal controls (UK SOx)

Regular reviews and testing of internal controls over financial reporting and incentive schemes, with board-level oversight, are essential. Audits and compliance committees can identify and address misaligned rewards before they become legal risks.

Transparent recognition systems

Recognition programmes should be transparent and based on clear criteria. Celebrating ethical behaviour and whistleblowing, not just sales or cost savings, helps embed a culture of openness and accountability.

Employee feedback

Anonymous surveys, focus groups, and open forums provide valuable insights into how incentive programmes are perceived and whether they drive the right behaviours.

Checks, balances, and oversight

Internal systems and controls, such as compliance committees and independent audits, are vital for monitoring the impact of incentives. The UK SOx regime will require directors to take personal responsibility for the effectiveness of these controls, increasing accountability. Properly implemented malus and clawback provisions deter misconduct and provide a means to address issues if they arise, demonstrating to regulators, investors, and the public that the organisation takes its responsibilities seriously.

Mandatory training on ethics, risk, and compliance, supported by disciplinary sanctions for non-compliance, should be integral to corporate culture. Linking remuneration and promotion to visible ethical commitment is increasingly common, especially in regulated sectors.

Malus and clawback: accountability mechanisms

Malus and clawback provisions are increasingly used to address misconduct linked to incentives:

  • Malus allows organisations to reduce or cancel unvested bonuses or awards before they are paid, if misconduct or risk management failures are identified.
  • Clawback enables the recovery of bonuses or awards already paid, typically in cases of fraud, dishonesty, or material mis-statement.

These mechanisms reinforce that rewards are conditional on ethical behaviour and compliance, and provide boards with practical tools to respond to wrongdoing, underlining the importance of integrity at all levels.

interior staircase abstract

Remuneration and incentives – setting the right tone

Unregulated firms can learn valuable lessons from the remuneration rules applied to financial services firms by the FCA and PRA. While these regulations are not mandatory outside the sector, their underlying principles are highly relevant for any organisation aiming to foster integrity and reduce risk through effective incentive design.

Key principles from Financial Services Regulation

The FCA and PRA frameworks are based on the idea that "what you reward shapes what people do". Decades of experience shows that poorly designed incentives can drive misconduct, create conflicts of interest, and harm both customers and firms.

Unregulated firms should examine whether their own incentive structures, even for junior staff, might unintentionally encourage undesirable behaviours. For example, rewarding sales staff solely on volume can lead to overselling, while measuring customer service only on call times may result in rushed, ineffective support.

Practical steps for all staff levels

  • Balanced scorecards: Adopt performance measures that reward both quality and quantity. For instance, including accuracy and safety metrics for warehouse staff helps protect customers and employees.
  • Conduct measures: Recognise and reward ethical behaviour and collaboration, not just results. This reinforces organisational values.
  • Avoid cliff-edge incentives: Structures where small differences in performance lead to disproportionate rewards can encourage gaming and short-termism. Graduated incentives are fairer and promote sustainable performance.
  • Deferral and clawback: While more common for senior roles in regulated firms, the principle that rewards should reflect long-term outcomes can be applied more broadly. Simple measures like probationary periods before bonuses vest can help align interests.
  • Business benefits: Adopting these principles is not about adding bureaucracy, but about sending clear signals through pay and recognition. When incentives align with organisational values and long-term goals, firms reduce operational risk, improve customer outcomes, and embed integrity into everyday decision-making.

How Mishcon de Reya can help

Our experts help organisations design, review and strengthen remuneration frameworks, incentive arrangements and training programmes to ensure they support institutional integrity. If you would like to discuss how we can support your organisation, book a free 15 minute session. 

Get in touch

Hear from our guest experts

Peter van Veen
Peter van Veen Peter is an expert on business integrity. He is the Director of Corporate Governance at the ICAEW, and he previously ran the business integrity programme at Transparency International UK.

Rewards and incentives: how they shape culture and ethical behaviour

Incentives and rewards play a key part in shaping the organisation’s culture. When designed well, they encourage both ethical behaviour and good business results whilst at the same time discouraging unethical behaviour.

Seven key elements of a well-designed incentives and rewards programme:

  1. Incentives at the top shape the organisation's culture. Tone from the top is important in setting the right culture and so is setting the CEO’s incentives and rewards. The CEO’s incentive structure will set the risk appetite, urgency and what is seen as optional rather than essential for the whole organisation.
  2. Balance long-term vs short-term incentives. Incentives shape the company’s risk appetite and this in turn can impact the company’s culture and values. For example, focusing primarily on hitting quarterly financial targets could encourage excessive risk-taking that leads to unethical and unsustainable business practices.
  3. Incentives should not be focused purely on financial results, but rather a range of soft and hard targets that encourage ethical and long term, sustainable business practices. However, companies should be careful to not create a checklist approach to ethical business metrics that can be gamed to gain a bonus or deliberately manipulated to withhold one.
  4. Set achievable targets. If targets are set that are very hard to achieve, don’t be surprised if unethical or even illegal behaviour takes place to try to achieve these targets, such as cutting corners, paying bribes to win contracts or artificially inflating numbers.
  5. Do not reward outcomes over and above the means to achieve them. It is important to celebrate wins, but not wins at any cost. How results are achieved should be an equally important part of the reward and incentive structure. Consider metrics around cross-functional collaboration, customer satisfaction, quality and employee and customer trust.
  6. Ensure staff are not rewarded or promoted if they have deliberately breached the company’s values or code of conduct. Nothing is more corrosive to a company’s culture than a perception that there is a rule for a select few and another for everyone else. Bullying, sexual harassment, bribery or expenses fraud should never be tolerated, and certainly not seen to be rewarded, no matter how senior or successful a dealmaker the employee is.
  7. Ethical behaviour should be rewarded. Those that walk away from a deal because a bribe was demanded should not miss out on their bonus if they don’t make their targets as a result. Those who speak up with the company’s best interests at heart should also be celebrated and rewarded. Create a culture that encourages staff to speak up, seek help if in doubt, and for their managers to encourage and welcome these conversations.

Key contacts

Lizz Hunter
Liz Hunter, Partner (non-lawyer), Mishcon de Reya Liz is a leading expert in equity incentives and employee reward, advising organisations on designing and managing share plans and incentive structures that align with ethical, tax and governance best practice.
Guy Wilkes - Mishcon de Reya
Guy Wilkes, Partner, Mishcon de Reya Guy is a leading specialist in financial services regulation and investigations, advising on high-profile regulatory disputes, compliance, and enforcement matters across the financial and professional services sectors.

FAQs

How can incentive and reward structures contribute to misconduct?

Poorly designed incentives, particularly those focused narrowly on financial outcomes, can pressure employees to bend rules or prioritise results over how they are achieved, undermining ethical intentions and fostering institutional dishonesty.

Why do incentives matter for corporate liability and regulatory risk

Why do incentives matter for corporate liability and regulatory risk?

As corporate liability expands under English law, organisations must demonstrate a culture that discourages misconduct. Incentive structures are a key indicator of whether ethical behaviour and legal compliance are genuinely embedded in practice.

What is the role of UK SOx in incentive design and accountability?

The anticipated UK SOx regime will require directors to attest to the effectiveness of internal financial controls, increasing scrutiny of how incentive schemes operate and making it harder to ignore their cultural and behavioural impact.

How should organisations use malus and clawback to address misconduct?

Malus and clawback provisions allow organisations to reduce or recover bonuses where misconduct, fraud or serious failures occur, reinforcing that rewards are conditional on ethical behaviour and providing boards with practical accountability tools.

What does good practice look like for aligning incentives with ethical behaviour?

Good practice includes using balanced scorecards, recognising ethical conduct and risk management, avoiding cliff‑edge incentives, strengthening internal controls, and ensuring transparency, oversight and employee feedback in how rewards operate.

 

Book a free 15 minute session with our experts

Our experts help organisations design, review and strengthen remuneration frameworks, incentive arrangements and training programmes to ensure they support institutional integrity. If you would like to discuss how we can support your organisation, book a free 15 minute session.

Book now

Here are the golden rules:

Crisis communications should be grounded in truth, not aspirations or assumptions, particularly where there are ongoing investigations. Messaging designed to reassure stakeholders, not based on concrete facts, creates hostages to fortune. If later disproved or contradicted, these statements can lead to accusations of a cover-up, eroding trust and compounding reputational damage.

Sound decision-making is predicated on solid information. Communication may be staged, but not stretched. Prioritise getting to the facts and taking advice, rather than rushing to respond substantively. Communicate timelines for further updates and emphasise that accuracy takes precedence over speed. This signals authority, that the business is in control and acting responsibly rather than making knee-jerk decisions and statements.

Implement, test and train senior leaders on detailed crisis playbooks and procedures, including protocols for managing communications and information that clarify: who will speak for the business; how to approve statements; how to communicate with key stakeholders such as employees, customers, regulators and journalists; and who to liaise with both internally (such as legal and compliance teams) and externally, such as specialist counsel and PR advisers.

Whistleblowing

Employees know right from wrong, but workplace misconduct often goes unreported. This isn’t just a legal and regulatory risk - it can damage reputation, retention, sustainability and profits. So, how can employers make it easier for staff to speak up?

Start by understanding the reluctant whistleblower.

Fear of retaliation, worries about confidentiality, and practical barriers like unclear reporting channels all play a part.

Employers need to tackle two main areas:

Practical Steps

  • Accessible Reporting: Internal systems must be easy to use and well understood. Clear policies should spell out how to raise concerns and what happens next.
  • Training that sticks: Written policies aren’t enough. Employees should know the rules and get regular, engaging training - think step-by-step videos, not dry presentations.
  • Multiple channels: Make reporting simple and flexible, with options to suit different needs.
  • Support and feedback: Trained staff should handle disclosures, and employees should know where to find extra help. Keep systems under review and improve them based on feedback.

Culture

  • Walk the talk: Consistency matters. If leaders don’t follow through, trust collapses.
  • Leadership sets the tone: A clear, genuine message from the top - emphasising the importance of raising concerns and zero tolerance for retaliation - can make all the difference.
  • Respond constructively: How leaders handle mistakes shapes the environment. Support and learning, not blame, encourage openness.
  • Recognise and reward: Celebrate those who speak up and show how their actions lead to real change. This proves that concerns are taken seriously and encourages others to follow suit.

How Mishcon de Reya can help

We offer crisis planning and management services to test how businesses handle a sudden reputational attack. We also advise on all aspects of whistleblowing, and our training can ensure you have what you need in place.

Get in touch

Hear from our guest experts

Sybille Raphael
Sybille Raphael, Joint Chief Executive, Protect Sybille is a leading whistleblowing specialist with deep legal and practical expertise, advising employers, regulators and whistleblowers, driving UK legal reform, and helping organisations strengthen their speak up culture.
Find out more

What is the recipe for a ‘speak up – listen up’ culture?

Whistleblowing is the best 'sniff test'; it’s free, fast, and prevents the whole batch from going bad. According to the Association of Certified Fraud Examiners, it is much more effective than the next best methods (internal audit) to detect fraud. It’s key to deterrence, accountability, compliance, but also to retention, engagement and innovation. Staff who believe their voice matters are more creative. Employees who feel heard are more loyal – more productivity, less conflict, what’s not to like?

The problem is that problems are… problematic! Mishaps, flaws or criticism are rarely popular. And no one comes to work to be courageous. If we want people to speak up, we have to create the conditions for trust. Whistleblowing is not easy. ‘Surely it’s someone else’s job?’ ‘No-one else seems bothered about this, maybe I got the wrong end of the stick?’ ‘I don’t want to kill the golden goose and/or be shot at.’ ‘No-one will believe me anyway or they won’t care - what’s the point?’

How do you create trust? My 3 favourite top tips are:

Prioritise the carrot...

Positive beats negative. Ditch 'wrongdoing' and 'retaliation' – go for impactful cheerful case studies with a happy ending. They’re the most effective at encouraging whistleblowing.  Everyone likes a 'Near-Miss' success story.

... the stick keeps the kitchen running…

Organisations without a Board-level Whistleblowers’ Champion are missing a key lever for accountability and culture. They are the norm in financial services but not (yet) elsewhere. Having a named responsible Non-Executive Director focuses discussions – you need a challenger to ensure a firm’s framework and culture are fit for purpose.

.... the recipe seasons in the middle

Many whistleblowers don’t use reporting lines; they just go to their manager. This is where reports vanish, escalate, or become HR problems. Middle managers are the most frequent point of breakdown - and often the least supported. Train your Sous Chefs; they are the salt that brings out the best in the rest of the team. And don't mistake a quiet kitchen for a clean one.

Kate Brader
Kate Brader, Senior Managing Director, FTI consulting Kate is a crisis communication and crisis management specialist with deep expertise and experience in managing high profile live incidents.
Find out more

Crises are rarely isolated events. They are fast-moving, interconnected, and almost always represent a fundamental challenge to reputation. A cyber incident may begin life as a technical failure, or a regulatory issue as a compliance matter, but both can very quickly become questions of trust, leadership, and accountability, if not managed effectively.

When a crisis hits, the initial response sets the tone. Speed of course matters, but in my experience substance is what makes the real difference. An initial holding statement that acknowledges the issue, expresses empathy, and outlines immediate next steps is far more powerful than silence. For this to be effective, the response must reflect both authenticity and honesty.

Preparation is also key. Organisations should develop practical crisis communications playbooks that clearly define roles and responsibilities, escalation pathways and decision-making authority. These should be tested through crisis simulations and exercises, ensuring disciplined coordination and instilling institutional confidence to handle crises. Organisations that do this best are those that understand the importance of internal alignment – where legal, operational, and communications functions are not working at cross-purposes.

In a world of digital amplification and intense scrutiny, the narrative during a crisis event will move with or without you. Recent research on corporate reputation has shown that the space between what organisations say and what they do has narrowed sharply. Employees, regulators, policymakers, investors and activists are quicker off the mark than ever, propelled by social media and AI, and increasingly treat public statements not as signals of intent or ambition, but as commitments. 

You only get one chance to shape that first impression of the organisation’s response to a crisis. Those that protect their reputation most effectively during moments of crisis are those that prepare rigorously and then respond with clarity, empathy, and confident leadership when it matters most.

FAQs

How can organisations prevent information leaks and protect sensitive data during a crisis?

Strong internal information flows, clear decision-making structures and robust protocols for handling confidential data—including social media controls and breach response processes—are essential.

How can organisations ensure their crisis communications are accurate and trusted?

Start by confirming that every statement is grounded in verified facts. Boards should avoid assumptions, speculation or overconfident reassurance. Fact based messaging reduces the risk of later contradictions, accusations of dishonesty and additional reputational harm.

What practical steps improve whistleblowing systems?

Accessible reporting channels, clear policies, engaging training, and well supported staff handling disclosures all make speaking up easier and more effective.

How can employers build a genuine speak up, listen up culture?

Leaders must set the tone, respond constructively to concerns and recognise those who speak up. Consistency and trust underpin a culture where employees feel heard.

 

Do you have any questions?

Want to find out more about our crisis simulations or whistleblowing services? Or have other questions about institutional integrity? To help you benefit from our specialist expertise, we are offering you a free 15 minute online session, where you can discuss with one of our team any follow-up questions you may have about the content.

Get in touch

Key contacts

Emma Woollcott
Emma Woollcott, Partner and Head of Reputation Protection and Crisis Management, Mishcon de Reya A trusted crisis communications expert, combining deep experience in defamation, privacy and emergency injunctions with a practical, holistic approach to managing and mitigating reputational risk.
Jennifer Millins
Jennifer Millins, Partner Jennifer is a Partner in the Employment department, specialising in complex discrimination and whistleblowing claims, High Court injunctions, workplace investigations and partnership disputes.

Responding with integrity

Effective accountability requires a comprehensive approach to tracing responsibility. Investigations must identify not just the immediate wrongdoers, but also those who enabled or ignored the misconduct, whether through wilful blindness or inadequate oversight. This includes examining the role of supervisors, compliance officers, and senior management who may have failed in their duty to prevent, detect, or address misconduct. There can be no safe havens in accountability processes. A robust approach to accountability would see senior executives and board members subject to the same scrutiny as junior staff. Shielding those at the top from consequences sends the wrong message and perpetuates a culture of impunity, undermining the credibility of the entire accountability framework.

The appropriate corporate response to the identification of individual misconduct will, of course, vary enormously. It could involve any combination of a corporate self-report, employment consequences for the individual(s) involved, litigation or an independent internal investigation. It should certainly result in a review of existing policies and procedures, to ascertain "what went wrong" with the business asking tough questions about how controls failed and why. This learning from failure must lead to tangible changes in systems and processes, not just cosmetic tweaks to existing procedures. Whilst it will never be possible to completely exclude the possibility of future misconduct, the "bad apple" defence will wear thin where misconduct is repeated.

Corporate conduct is increasingly scrutinised, and stakeholders now expect organisations to demonstrate how they uphold strong governance and responsible culture. While not every issue involves wrongdoing, maintaining confidence requires a clear framework for how concerns are identified, assessed and addressed. Thoughtful transparency - calibrated differently for internal and external audiences - helps organisations show that they take their responsibilities seriously and that they have robust processes for managing risk. This approach strengthens trust, supports long‑term resilience and signals a commitment to high standards without inviting unnecessary exposure.

Why internal accountability mechanisms can no longer be optional

Recent reports by Which? and Unearthed have highlighted widespread misleading environmental claims, with the majority of products surveyed failing to meet the UK Green Claims Code principles. These findings expose a systemic lack of clear accountability mechanisms within organisations, which, when combined with under-resourced enforcement, has allowed greenwashing to become routine practice rather than isolated misconduct.

However, the regulatory landscape is shifting. The Digital Markets, Competition and Consumers Act 2024 (DMCCA), effective from 1 April 2025, empowers the Competition and Markets Authority (CMA) to directly fine companies up to 10% of global turnover for breaches of consumer law, including misleading environmental claims. This marks a significant increase in the potential financial consequences for organisations, making robust internal accountability mechanisms essential.

Further, the introduction of the failure to prevent fraud (FTPF) offence under the Economic Crime and Corporate Transparency Act 2023 (ECCTA), effective from 1 September 2025, means that greenwashing now carries the risk of criminal prosecution, not just regulatory sanction. The only defence available to organisations is to demonstrate that they have adequate and reasonable fraud prevention procedures in place. This fundamentally changes the risk calculus for companies, requiring them to prioritise the establishment of effective controls and verification processes to mitigate greenwashing risks.

Organisations must now ensure that legal and compliance teams work closely with sustainability, marketing, communications, and investor relations departments. This cross-functional collaboration is necessary to develop and implement robust procedures that ensure all environmental claims are clear, accurate, and evidence-based. Accountability mechanisms should include regular audits of claims, comprehensive staff training, and clear reporting lines for the escalation of concerns.

How Mishcon de Reya can help

From internal investigations to post-incident reviews, we help organisations respond with integrity when issues arise. We also offer advice on how to avoid greenwashing risks in your own business.

Get in touch

Hear from our guest experts

Stephen Peters
Stephen Peters, Partner and Head of Investigations, BDO LLP Stephen is a forensic accountant and ICAEW Fellow with 20 years’ experience leading complex, multi jurisdictional financial investigations and acting as an expert witness in major court and arbitration proceedings.
Find out more

Misconduct, misreporting and the chain of accountability

FraudTrack research indicates that where there is dishonesty or misconduct in organisations, it commonly involves financial misstatement, misuse or misappropriation of assets. When investigating allegations, it is important to ascertain whether it is an innocent error, through mistake or inexperience, or whether it was deliberate.

For those matters where dishonesty is at the root, it can generally be attributed to:

  • a ‘lone wolf’ individual;
  • management and the board directing others; or
  • management or the board ignoring warning signs of dishonesty or misconduct.

This raises the question of who is responsible and, ultimately, who is accountable; based on our experience there is often a clear distinction between misreporting and misappropriation of assets.

When misreporting is found to be deliberate and dishonest, an individual may be directly responsible, but accountability often extends beyond those who falsified figures. Management pressure to achieve specific targets or report particular outcomes is the driver, whether through direct instruction, actual or perceived pressure or the result of an environment they created. This may manifest itself through financial incentives and performance targets set without proper safeguards. Where this is the case, management including executive board members, must also be held accountable.

Read more

In cases involving misappropriation, we often observe multiple missed warning signs, including unanswered requests for information or clarification, inaccurate or incomplete reporting, a pattern of recurring ‘errors’ or excuses and other unusual behaviours attributed to overwork, pressure or personal circumstances. In some instances, this reflects a conscious or unconscious decision to turn a blind eye or to tolerate poor behaviours, sometimes exacerbated by personal relationships or a reluctance to challenge from within. From an investigative perspective it can be difficult to attribute accountability in these circumstances as there is often a collective failure driven by organisational culture.

It is also a telling reflection on an organisation’s culture and attitude towards fraud where investigations that confirm dishonesty do not result in an analysis of the root causes, including the part played by failure of systems, behaviours or culture and the implementation of actions designed to prevent recurrence. 

In summary, when an investigation identifies dishonesty or misconduct, it is essential that the organisation not only holds those directly involved accountable, whether through disciplinary measures, civil legal action or criminal prosecution, but also ensures that wider accountability is applied at the appropriate level. It is important that no-one is perceived to have avoided responsibility for either engaging in or encouraging inappropriate behaviour or ignoring it. A failure to hold leadership accountable for setting the tone at the top is both revealing and potentially damaging to organisational culture and trust and may result in regulatory action or adverse impacts on share price.

 

FAQs

What should organisations do when compliance policies and training fail to prevent misconduct?

Organisations should be accountable by ensuring prompt detection, independent investigation and a proportionate response to breaches, reinforcing deterrence and institutional integrity.

Why are internal accountability mechanisms now critical under new regulatory and criminal regimes?

New laws, including the DMCCA and the failure to prevent fraud offence, significantly increase financial and criminal exposure—making robust accountability, controls and verification processes essential to any defence.

How can organisations demonstrate genuine accountability and rebuild trust after misconduct?

Carefully managed transparency—internally and externally—acknowledging failings and remedial action helps rebuild stakeholder trust, deters future wrongdoing and evidences a commitment to ethical conduct.

 

Do you have any questions?

Want to find out more about our investigations or greenwashing services? Or have other questions about institutional integrity? To help you benefit from our specialist expertise, we are offering you a free 15 minute online session, where you can discuss with one of our team any follow-up questions you may have about the content.

Get in touch

Key contacts

Emily Wright
Emily Wright, Managing Associate in the White Collar Crime & Investigations Group, Mishcon de Reya Emily has experience of high profile investigations involving the Serious Fraud Office, National Crime Agency and HMRC and has also acted for clients being interviewed as part of investigations carried out by the police, the FCA and FRC.
Dan Gray
Dan Gray, Sustainable Business Knowledge Lead, Mishcon de Reya Bringing almost 20 years' experience as a sustainability writer and consultant, Dan is part of the Mishcon Purpose team in the Impact department, where he acts as the firm's Sustainable Business Knowledge Lead.

Integrity doesn't stop at the border

Most large and medium-sized companies operating in the UK today rely on extensive, global supply chains. Some of those supply chains will be vertically integrated through overseas subsidiaries. Others will be made up of third-party suppliers. 

More than ever, UK companies are expected to take responsibility for events occurring "upstream" in their supply chains.  Be it allegations of bribery and corruption, modern slavery, or environmental pollution: reputational harm – and potential legal liability – don't stop at the border.

Rising litigation risk

English courts have been increasingly open to hearing claims against UK parent companies brought by communities allegedly impacted by their supply chains.

For example, the largest group action in English legal history has targeted the British-Australian mining company BHP for the damage caused by the catastrophic collapse of a dam operated by its Brazilian subsidiary. In another recent high profile case, Dyson opted to settle a claim brought by migrant workers for alleged abuses suffered in two Malaysian factories operated by third-party suppliers.

Such cases signal that, where companies exercise a high degree of control over their supply chains, they may, under certain circumstances, incur legal liability for the actions of their suppliers, regardless of whether they are formal subsidiaries.

Due diligence and disclosure obligations

At the same time, supply chain due diligence and disclosure obligations are expanding and hardening, with consequences of non-compliance including financial penalties, reputational damage, and potential civil liability.

In the EU, the Corporate Sustainability Due Diligence Directive, the Deforestation Free Products Regulation (EUDR), the Forced Labour Products Regulation, and the Corporate Sustainability Reporting Directive have established an interconnected framework, requires companies not only identify, prevent and address adverse impacts across their value chains, but also substantiate and publicly disclose these efforts.

In the UK, the Government is also considering adopting new supply chain due diligence measures. These include proposals for reforming the Modern Slavery regime, finally implementing UK regulations equivalent to the EUDR, and could yet include the introduction of mandatory due diligence obligations, which is under consideration as part of a wider review into responsible business conduct. Additionally, the recently finalised UK Sustainability Reporting Standards are set to add to mandatory disclosures required of large and listed companies.  

Implications for institutional integrity

Taken together, these forces mean that institutional integrity increasingly depends on reimagining supplier relationships across jurisdictional borders.  Treating suppliers as purely transactional third parties, while imposing requirements and passively expecting compliance, is no longer sufficient.

Effective risk management now requires partnership‑based governance built around collaboration, shared incentives, transparency and root‑cause remediation. Without this shift, companies will face growing legal, reputational and strategic exposure as accountability moves to the top end of the value chain.

Using cross-border dispute resolution to facilitate institutional integrity

The way an organisation chooses to resolve disputes, including the dispute resolution framework it adopts in its contracts, is a key factor in its approach to institutional integrity as it demonstrates how they intend to exercise power when relationships come under strain. Cross-border operations can expose parties to unpredictable legal environments and the mechanisms they choose to resolve their disputes signal how seriously they signal their commitment to decisions grounded in the rule of law. This can provide parties with confidence that any disputes will be handled fairly and to agreed rules.

The first consideration is governing law, which underpins everything else. A widely respected and commercially sophisticated legal system (English law being a common example) provides predictability, an extensive body of case law, and delivers confidence for parties across jurisdictions.

The next choice for parties is whether disputes should be determined in litigation, before national courts, or in arbitration. Where confidentiality or the wide international enforceability of decisions is necessary, then arbitration under the rules of an established institution such as the ICC or LCIA, seated in a jurisdiction that upholds arbitral integrity, will frequently be preferable.  However, where transparency and the ability to join non-contracting parties (such as an ultimate beneficial owner) is needed, then neutral and respected courts, such as the courts of England and Wales, offer real advantages.

The adoption of clear house negotiating positions on governing law and forum for the resolution of disputes, with full reasoning, is vital to ensuring coherent decision making across the business in line with the organisational values.  However, organisations must also build in flexibility, recognising that transacting in high-risk jurisdictions or with certain counterparties may require a different analysis.

Whatever approach is adopted, parties should ensure that the same dispute resolution framework is applied consistently across each individual transaction.  Any inconsistency risks expensive jurisdictional disputes, which will inevitably result in delay and, potentially, a multiplicity of conflicting decisions.

It can be all too easy to leave the negotiation of dispute resolution provisions to the end of negotiations – they are not called “midnight clauses” for nothing.  However, the consequences of a poorly drafted or mismatched clause will be felt long after drafting. Building time into the negotiation process to consider these provisions carefully is time well spent to maintain institutional integrity.

How Mishcon de Reya can help

From assessing supply chain integrity and due diligence to cross-border disputes and investigations, we can help boards, in-house legal teams and compliance professionals build operational frameworks that support institutional integrity across international operations.

Get in touch

Hear from our guest experts

Karis McLarty
Karis McLarty Managing Director in the Investigations, Diligence and Compliance practice, and Global Head of Corporate Compliance and Business Ethics Advisory at Kroll
View profile

For multinational organisations, maintaining institutional integrity requires striking the right balance between consistency and flexibility. While businesses need a clear global framework aligned with their strategic goals, risk appetite and values, they must also account for the legal, cultural and commercial realities of the jurisdictions in which they operate.

A smart global integrity program marries consistency and flexibility: precise rules to give employees and investors certainty, and discretionary, principles-based freedom for decision makers to respond quickly to opportunities and unanticipated risk.

Identifying, assessing, monitoring and managing risks arising from relationships with external parties is complex to get right at a time of (i) shifting but stringent liability sanctions regimes (ii) increased customs and trade requirements (iii) a rise in greenwashing legislation holding companies accountable for the claims they make (iv) “responsibility creep” from direct supply chain to inclusion of a wider consideration of affected communities.

As more companies digitalise, the suite of data protection and governance legislation that requires knowledge of the supply chain of data collection and processing is also critical. However, we still see companies that have separated data, software and hardware procurement from their primary procurement function and procurement policies.

Recommendations
  • Global controls should cover extraterritorial legal frameworks: bribery, fraud, sanctions, forced labour, retaliation, data protection, books and records, conflicts of interest, environmental harm and access to remedy.
  • Local teams may vary implementation within approval limits set globally. The key here is to train decision-makers to make local decisions aligned with the company’s overall risk appetite.
  • Map the value chain based on inherent risk, not spending alone: Consider geography, labour model, commodity, public-sector touchpoints, data processing, subcontracting, use of recruitment agents and the severity of potential harm.
  • Ensure lifecycle diligence: Any review of supplier activity does not end with signing the contract. It must be dynamic and monitored. Screen beneficial ownership, sanctions, politically exposed persons, adverse media and human rights or environmental indicators at onboarding, renewal and when a risk event occurs.
  • Build contractual leverage: Use information and audit rights, flow-down clauses, remediation plans, suspension and termination rights and a duty to notify material allegations. Preserve disclosures to regulators and law enforcement from confidentiality restrictions.
  • Ensure channels of communication are open: Supplier relationship managers must escalate issues that may affect wider liability as soon as they become aware of them. Worker interviews and local-language grievance channels often reveal risks that supplier questionnaires miss. Communities and activists can give useful context.
  • Escalate exceptions: Set approval thresholds for high-risk agents, deviations from standard clauses, unusual payments, government contacts and unresolved audit findings. The procurement function of any multinational must work with assurance functions to identify, understand and address supply chain risks.
  • Test effectiveness: Track repeat findings, overdue remediation, grievance resolution quality, recruitment-fee repayment, audit recurrence and pathways from red flag to decision - not only training completion and policy attestations.

 

FAQs

How can multinational organisations maintain consistent governance and compliance standards across different jurisdictions?

As organisations expand internationally, differing legal, regulatory and cultural requirements can create governance gaps and increase legal and reputational risk. Effective institutional integrity requires a consistent global framework, clear escalation processes and local implementation that aligns with the organisation's overall risk appetite and values.

What supply chain due diligence and ESG disclosure obligations apply to international businesses?

Companies operating across multiple jurisdictions face expanding obligations relating to supply chain transparency, sustainability reporting, modern slavery, forced labour, environmental impacts and human rights. Businesses must identify, assess, monitor and disclose risks across their value chains while demonstrating effective governance and compliance controls.

What should organisations consider when choosing governing law, litigation or arbitration for cross-border disputes?

Dispute resolution provisions are a critical component of institutional integrity. Businesses should establish clear policies on governing law, jurisdiction and arbitration to ensure consistency, predictability and enforceability across international operations. Well-designed dispute resolution frameworks can reduce legal uncertainty and support fair, transparent decision-making when disputes arise.

 

Do you have any questions?

Want to find out more about supply chain due diligence, or cross border disputes? Or do you have other questions about institutional integrity?

To help you benefit from our specialist expertise, we are offering you a free 15 minute online session, where you can discuss with one of our team any follow-up questions you may have about the content.

Get in touch

Key contacts

Laurence Doering
Laurence Doering, Managing Associate Laurence is a Managing Associate in the Mishcon Purpose team. He acts in disputes related to the environment, climate change and human rights, and provides strategic Environmental, Social and Governance (ESG) advice to clients.
Dan Gray
Dan Gray, Sustainable Business Knowledge Lead Bringing almost 20 years' experience as a sustainability writer and consultant, Dan is part of the Mishcon Purpose team in the Impact department, where he acts as the firm's Sustainable Business Knowledge Lead.
Daniel Ng
Daniel Ng, Managing Associate Daniel is a Managing Associate in the Dispute Resolution department. His practice focuses on international arbitration work across a range of sectors including energy and infrastructure, commodities trading, construction, and shareholder disputes.
Leah Alpern-Waterman
Leah Alpren‑Waterman, Legal Director, Knowledge Lawyer Leah Alpren-Waterman is a Legal Director, Knowledge Lawyer in the Dispute Resolution department, focussing on Commercial Litigation, Insurance and International Arbitration.

Leadership

Lorem ipsum dolor sit amet consectetur adipisicing elit. Molestias inventore qui fugiat ipsa quaerat. Aspernatur alias ratione inventore deserunt eum molestias quod, dolor rem neque rerum veritatis quis labore placeat.

Dynamics

Dolor ipsam delectus neque, tempore qui amet earum, quis, optio maiores possimus minima reprehenderit quam consequuntur blanditiis vero eveniet est suscipit ipsa non maxime aut. Dolorem beatae at debitis tempora.

How can we help you?
Help

How can we help you?

Subscribe: I'd like to keep in touch

If your enquiry is urgent please call +44 20 3321 7000

I'm a client

I'm looking for advice

Something else