Red Flags, Right Questions, Rapid Response
The Board’s Role in Managing Misconduct
-
August 04, 2026
-
Misconduct rarely announces itself with a dramatic revelation. It builds gradually, with red flags missed, explained away or buried before the board is made aware of the issue. By the time it reaches the boardroom as a fully formed crisis, early intervention is no longer an option. The directors who manage misconduct risk most effectively do not wait for certainty. They recognise signals early, ask the right questions and act before isolated issues become systemic failures.
What Counts As Misconduct — and Why It Matters to Boards?
Misconduct extends beyond fraud and regulatory breaches. It also includes broader governance, culture and control failures that result in harm to customers, employees, markets and the organisation.
Increased regulatory activity, directors’ personal liability and growing public scrutiny have put conduct, culture and control effectiveness firmly on the board agenda. Directors are increasingly expected to oversee not only financial outcomes, but also the systems, behaviours and governance practices that influence them.
Effective oversight depends on boards having early visibility of red flags through rigorous reporting and by asking the right questions before issues escalate into a crisis.
The Governance Patterns Behind Misconduct: What To Look for and What To Ask
Misconduct is rarely the result of a single failure. It typically follows recognisable patterns – warning signs that, taken together, point to deeper governance weaknesses. The table below sets out five common failure patterns, the red flags associated with each and questions directors should be asking to uncover and address these issues early.
| Governance Failure Pattern | Red Flags | Questions Directors Should Ask |
|---|---|---|
| Weak escalation of issues | Issues identified but not effectively escalated; delayed board visibility | — When was this identified? — Is this an isolated failure or a systemic issue? |
| Delayed response to warning signs | Issues recur despite remediation efforts | — Why does this issue keep recurring? — Did we test the fix? — Are we addressing root cause(s) or symptoms? |
| Over-reliance on management assurance | Confidence not supported by independent evidence | — What evidence supports this position? — What independent assurance have we obtained? |
| Fragmented risk management | Risks considered or reported in silos; recurring issues not connected | — What themes are emerging across the business? — Who is responsible for connecting risk information across business units? |
| Misaligned incentives | Performance pressures outweigh risk or customer outcomes | — What behaviours are we rewarding? — Are incentives aligned with our values and risk appetite? — How would our customers or regulators view the behaviours we are incentivising? |
These patterns are not mutually exclusive. In practice, they often appear in combination, and it is the accumulation of signals across multiple areas that should prompt the greatest concern.
From Red Flags to Action
Where concerns emerge, directors have a responsibility to act on signals, not wait for certainty. Red flags and recurring issues may not confirm misconduct, but they warrant scrutiny and a structured response. Where concerns emerge, directors should:
- Treat recurring issues across reporting cycles as potential indicators of a broader systemic issue.
- Seek additional information and challenge management’s assessment.
- Consider whether independent review or investigation is warranted.
- Address gaps in reporting, escalation, risk ownership, governance arrangements or controls where identified.
When Misconduct Is Confirmed: Act Fast, Take Control
Speed, independence and control are critical to effective response. When misconduct is confirmed, boards must move quickly and deliberately to contain the issue and address its root causes.
Boards should:
- Establish the facts and secure evidence.
- Commission an independent investigation, where appropriate.
- Understand root causes and determine whether the issue is isolated or systemic.
- Ensure remediation addresses underlying governance, culture and control weaknesses.
- Be proactive in communication with regulators. Once fully investigated, maintain timely, accurate and consistent communication with, customers, employees and other stakeholders.
Strategic communications is an integral part of governance and should be planned before a crisis occurs. Boards should ensure crisis protocols are clearly defined, regularly tested and compliant with regulatory obligations.
The Bottom Line on Misconduct
Misconduct risk demands proactive board oversight. Effective boards connect signals early, challenge information rigorously and act decisively when patterns emerge. They look for recurring themes across time, business units and risk types. They also test the completeness and independence of associated assurance. If misconduct is suspected, they encourage management to escalate issues and move quickly if misconduct is confirmed. The boards who get this right are defined by how well they prevent, manage and recover from crises.
Related Insights
Related Information
Published
August 04, 2026
Key Contacts