Kirk Hanson is a senior fellow of the Markkula Center for Applied Ethics at Santa Clara University and former executive director of the Center, and a pioneer of business ethics.

In this discussion with Martin Reeves, he discusses his new book, Rotten: Why Corporate Misconduct Continues and What to Do about It, co-authored with Marc Epstein, published in October 2020.

I want to kick off with the motivation for the book. Kirk, is ethics back on the agenda or in your own mind, are you just writing about a perennial topic here?

I think there’s a bit of both. Part of it is that Marc Epstein, my co-author and I, have worked in this field for now almost 50 years. Both of us began in the early seventies working with companies and discussing the topic of ethics. I was one of the first faculty members in that field nationally when I started teaching in 1978 at the Stanford Business School. From that standpoint, it’s a topic we’ve dealt with, both Marc and I, for many years. We want to give our perspectives on it at this point, how it’s changed.

On the other hand, it was our perception that there was a coming crisis in our confidence in corporations’ ability to manage ethics. Our sense was that there was a continuing series of scandals, despite all of the effort that’s been made over the last 40 or 50 years to control business ethics and misconduct in organizations. We wanted to address that. I’ll add a third motivation, which is that the Business Roundtable has kicked off this re-assessment by its statement in late 2019 that companies ought to take into account the impact of their operations on all of their stakeholders. Working that through, knowing what that means, and seeing whether companies deliver on that commitment is a very important topic at this moment in time.

I think every era has its Enron or its Madoff scandals, but you state that you think it’s getting worse or getting to be more important in some way. What’s changing in the world that’s triggering that, do you think?

It’s hard to measure whether there’s more corporate misconduct, certainly, the incidents of misconduct appear to be doing more damage. Perhaps that’s simply the scale of modern business or the reach of corporate behavior and the number of people that it affects. Perhaps it’s media coverage, which is more acute in looking at corporate behavior. Nonetheless, there’s a sense in our minds that this problem, number one, has not gone away. At least in terms of the damage being done to people, whether it’s from something like the Boeing 737 errors to Wells Fargo’s sales scandal, which created millions of fake accounts, there are real impacts that should cause us concern about corporate behavior even more than in the past.

Let’s dive into the substance of your book a little bit. You have a picture of a rotten apple on the cover. You have a very graphic analogy for dealing with malfeasance at different scales. You talk about bad apples, bad barrels, and bad orchards as being different types of problems of different degrees of magnitude. Could you explain that to us a little bit?

Sure. The initial challenge, of course, is to explain why there’s misconduct in the first place. Why are companies seemingly unable to hold back on engaging in a series of frauds and scandals and incidents of misconduct? We’ve often heard the bad apple, bad barrel analogy, but we wanted to use that to understand how that represents two different kinds of ethical problems in companies. Bad barrels is referring to the culture of the organization. Bad apples refers to bad individuals. To some extent, we’re willing to grant that bad individuals will always be with us. There’ll always be a few bad apples who will cause the company trouble by engaging in theft or engaging in fraud. A company can do somewhat better to screen them out at the beginning, to uncover those individuals as rapidly as possible and then to sever them from the organization.

The bad barrel is the concept of corporate culture has been the focus of corporate ethics programs over the last 30–35 years. Sadly, those have been quite unsuccessful in creating cultures that really repress misconduct. We wanted to understand more about that. What we have added here is the concept of the bad orchard. In other words, you have a bad apple, a bad barrel, and sometimes companies operate in environments where ethical behavior is very difficult. Obviously, societies that tolerate corruption or kleptocracies create very difficult environments. What we realized was that there was a whole genre of scandals that seem to arise from being in a difficult environment and not managing it well. We call those problems bad orchard problems. We think that helps understand that there are three different kinds of strategies needed to deal with the broad phenomenon of misconduct.

You give a lot of detail on what those strategies are, but in broad brush strokes, what are the strategies for dealing with problems, those three levels, bad apples, bad barrels, and bad orchards?

Sure. On the bad apple problem, every organization’s got bad actors of one kind or another, whether it’s the Roman Catholic church trying to deal with sex abuse amongst priests, or whether it’s government, which has individuals who exploit their positions in government for personal advantage. Companies have the problem as well. The challenge is to identify those people to whatever extent you can at the point of entry so that you don’t hire them. The questions about the integrity of the individuals you’re hiring, even of chief executives, is very often not asked, or problems in that individual’s past are overlooked if they’re perceived to be particularly strong on profitability, cost-cutting, and so on. We urge a more holistic look at, a tougher look at, people at the point of hiring — but also then the creation of systems in which you identify very rapidly behaviors that are frustrating the corporation’s commitment to act ethically. Systems where there is real trust in the organization’s commitment to ethics hopefully will lead employees to blow the whistle internally and alert management to the fact that their boss or their coworker is engaging in questionable practices.

And are there additional strategies on top of that for dealing with the cultural problems, the more systemic problems of bad barrels?

The bad barrel problem is how you create a system within the organization. It’s a system which is both formal and informal. A formal system involves identifying a mission statement, a commitment to a purpose for the corporation, a commitment to embody that in strategies of the organization and then to create a culture whereby employees believe that the company wants ethical behavior. Sadly, in many companies, you have a lot of skepticism about corporate ethics efforts and the feeling that the company just doesn’t want me to get caught, but wants me to do whatever’s necessary to achieve profitability.

The bad orchard involves a set of strategies that hopefully encourage a company to push back against the kind of culture that sometimes exists within some countries and industries. For example in the airframe industry there has been a culture of payoffs to government individuals who influence aircraft purchases or to individuals who are senior in the organizations acquiring aircraft. You’ve had individuals in multiple companies caught over the last 20 years in repeated incidents of bribery and misbehavior. You’ve got to understand that, and you’ve got to put in place preventative measures. I think companies too often think that simply penalizing one or two individuals today will stop the problem in the future. It simply doesn’t.

When I started in business, we talked about business ethics as a discipline, but somehow I have the impression that over time, we’re talking more about things like purpose statements, ESG reports, philanthropy, CSR initiatives. If a company is doing all of those things well, do they have the ethics agenda covered, or is there something missing from the CSR mix?

I think companies have confused ethics and the ethics agenda with two other phenomena. One is the compliance agenda. Our primary critique of corporate ethics programs is they may have started as ethics programs, but they’ve migrated very strongly towards compliance. We joke that the Ethics Officers Association, the professional society of Corporate Ethics Officers, changed its name a number of years back to be the Ethics and Compliance Officers Association. The percentage of lawyers in the organization has ballooned.

Can you please elaborate the difference a little bit? Is the difference that compliance is the avoidance of malfeasance, whereas ethics is about producing desirable states and outcomes? Or, would you define the difference in some other way?

I think ethics is often subtle and compliance deals with very bright line black and white rules. A compliance program would focus on the legal requirements either through law, regulation, or expectations that are defined very clearly by governmental bodies. Sometimes, they’re defined by the company. Don’t steal from the company. Don’t misrepresent your position. Those can be bright line kinds of rules. Ethics is very often about more subtle issues. How far do you push the sales process? How far do you stretch some of the internal rules that a company establishes? Ethics is about a much broader range of issues. Not everything can be legislated or captured in a regulation, and we still rely on businesses to follow a set of ethical norms.

Ethics is a much broader concept and is not reduced to a few legal standards, but companies have struggled with making it something more than compliance. It’s awkward, companies don’t know what ethical values to use, how to balance the many things that must be balanced when you’re making an ethical choice. They’re much more comfortable with a black and white rule, a bright line rule that can be defined by their lawyers and enforced by an internal compliance system. That’s the main difference. If you reduce ethics to compliance, you give an inevitable and unfortunate message that what you want is compliance with the law, not the achievement of any kind of ethical commitment or ethical value.

You said there was a second source of confusion. What’s that?

The second source of confusion is corporate social responsibility, and this ties to the Business Roundtable’s experience over the last year. Many companies equate ethics with CSR, or corporate social responsibility. CSR is generally how the company does some things for the community or for the society parallel to their activity in the marketplace. Not from the substance of their activity in the marketplace. Any company can claim to have done something for society through its environmental controls, even if they’re inadequate. A company can claim it’s created some CSR impact through its philanthropy. In the wake of the George Floyd murder, many companies pointed to their philanthropy to black organizations and to other organizations that have advocated for people of color. That’s okay, but that’s not ethics in the company’s operations. What’s important within the company is how the company deals with the concerns of black Americans in employment and promotion to the senior ranks, and any implications of racial prejudice in the company’s operations, like redlining.

Many companies publish annual reports, what they call ‘ethics reports’, but are really CSR reports that tell all the good things they’ve done in the community. This has been apparent with the Business Roundtable statement a little over a year ago that companies ought to pay attention to all of their stakeholders. Companies have tried to show that they’re adhering to the Business Roundtable statement by pointing to the CSR oriented activities that they’ve undertaken, but they are incidental to the kind of serious work of balancing a corporate purpose, which is both economic and social, which we think is at the heart of corporate ethics and the key to heading off misconduct.

I’m going to ask you about innovation or novelty in the ethical field. At least at a superficial level, we have some new issues to deal with — things like algorithmic integrity, algorithmic fairness, data privacy, and so on. Are these superficially new or essentially new problems which require new approaches do you think?

I think these issues are certainly new, particularly AI, the use of complicated algorithms that can at their worst simply embody our biases rather than create some kind of independent and more defensible type of decision model. I think they’re new because we are turning over to technology some of the decisions that we’ve made in person in the past, and so companies have to get that right. It is also the reality that companies have to be concerned with operating within an electronic environment that itself has become a bad orchard. I think one of the failures of Equifax, for example, with its huge loss of data a few years ago was that they didn’t anticipate how tough the environment had become, how aggressive the hackers are, and how hostile the orchard they operate in has become. They let down their guard and didn’t prepare to defend adequately the privacy of the data that they held.

That’s an interesting point, actually. Let me expand on that a little. In a sense, you’re saying the environment is more complex. There’s the behavior of the companies, the bad apples, the bad barrels, the bad orchards, but then we have the context into which those behaviors are playing. I imagine that one new type of ethical dilemma is the calculation around taking a stand on something. If a CEO takes a stand on an ethical issue, this can be a good thing if they pick the right issue and they can make a difference. On the other hand, it plays into a political environment where there’s almost bound to be some backlash against any position. Is that part of your thesis, how to deal with these new types of issues?

I think it is. That dilemma, which has long faced companies — whether to support integration and the 1950s integration efforts in many local communities, or whether to support early environmental controls, local attempts to clean up the environment — have always been around. They are more acute today because of employee pressure, and efforts urging of companies to adopt a purpose which embodies values beyond simply making money. As soon as you give yourself that challenge of defining values beyond making money, you get to things like advocating for people of color, advocating for climate change — which I believe is the existential issue for our generation. That brings you into conflict with many of the political forces in the country.

I just look at how companies have responded to the George Floyd and other incidents last summer. They ranged from companies that took very strong stands and even got engaged in attempts to do police reform, to advocate for people of color more broadly. Other companies simply said, “Yes, we’re committed to diversity,” then held back from saying anything more. It’s clear there’s a difference of values and a difference of the degree to which those companies actually believe in and hold those values regarding racial justice.

One of the most intriguing parts of your book from my reading is that you offer a quantitative approach, sort of an audit framework or scoring a company’s ethical health. Could you tell us a little bit about how that is possible?

Yes. My co-author Marc Epstein is a professor of accounting. Way back in the 1970s, Marc was the first person to use the term social audit, and he developed some techniques, which he’s refined over the years. He wrote a book called Counting What Counts, advocating for ways of measuring social impact. We embodied in our book a number of things he and I had worked on to refine the concept of social auditing. We developed three instruments that are presented in the book. One is a ‘look back’ measuring corporate ethical performance. One is a ‘look forward’ measuring the risk that a company is going to have an ethical failure in the future. Then, the third instrument we’ve called the Sin-Dex — a bit impishly. — It’s a way of evaluating frauds and scandals and incidents of misconduct to determine how serious they are, presented on a ten point scale.

We use both the measure of what damage is done — if a General Motors failure to label a part correctly, an unethical action by one of their middle managers results in 124 minimum deaths of motorists, that’s a very severe serious issue. A second measure is of intention. Sometimes managers don’t intend the bad outcomes that result, but in other cases, there is a deliberate decision at the top or at a senior level to look the other way, to put human life at risk, or even to deliberately engage in the behavior that causes the problem.

If you have a sense of how serious an incident has been, that’ll help you measure your past ethical performance. It will also help you predict the future risk or ethical risk that this company faces. Such a measure can be useful to investors who want to predict when a company is going to get in trouble and how much it might cost, or to employees or potential employees that don’t want to go to work for a company that is likely to cause them anguish and reputational risk in the future.

Let me ask you maybe one of the most difficult ethical questions — which is our responsibility for our common environment and global climate change. We have I believe a fairly complete scientific understanding of the problem, of possible actions to remedy the problem and lots of individual commitments to stand for the cause. Nevertheless, we’re going backwards, we’re not actually decelerating anticipated global warming. What’s the ethical problem here, do you think? Is it some sort of collective action problem? How does your framework shine a light on the bottleneck?

Yes. Well, I think you’re right to pinpoint this as a collective action problem. Unless we get a collective effort to address climate change, to reduce the amount of CO2 in the environment, we’re simply not going to head off the kind of dislocations and real human tragedy that’s going to come from climate change. Companies are a major part of the total environment, the political environment, the economic environment, and unless there’s leadership coming from companies, there’s very little hope of political leadership being able to put together the kind of coalition necessary. That’s even without the need, obviously, to engage a truly global coalition involving all the major economies of the world.

Companies have got to take a leadership role right now. There’s much criticism of fossil fuel companies, oil and gas companies, coal companies. There are signs even there of a growing awareness of the tragedy that’s coming. My hope is that there’ll be more leadership and more cooperation, more support for political leaders, getting back into the Paris Accord, using the Paris Accord as a pressure to get compliance to standards across nations. Without business leadership, there’s no hope, I think, of heading off the kind of increases in ambient world temperature that we fear, but at the same time, just business leadership is not going to be enough. There’s got to be a political will and good leadership. I think, unfortunately, the head in the sand attitude of both political and business leaders in recent years has set a bad precedent. I think we’ve got to reverse the understanding of what real leaders in business and in politics need to do right now.

Well, thank you, Kirk. This has been fascinating.

Thank you very much, Martin. I appreciate being with you.