Handling Executive Misconduct as a Crisis

Executive misconduct is a crisis in which the person who would normally make the decisions may be the problem. That is what makes it different. Handle it with your crisis management process, an independent investigation, and decision rights that sit with people who don’t report to the person accused. Treat it as a routine HR file or a public relations problem and you’ll lose the time you have.

Your company’s reputation is tied to its leaders. Their conduct is your risk.

Most executive misconduct falls into two categories every company should plan for. The first is financial: fraud, misuse of company funds or assets, bribery, and pressure to inflate results. The second is personal conduct: sexual harassment, abuse, and retaliation against the people who report it.

Why Executive Misconduct Is a Different Kind of Crisis

A crisis is a crisis. The way you collaborate, decide, communicate, and escalate doesn’t change with the type of incident, and executive misconduct belongs in the same corporate crisis management process as a cyberattack or a plant fire.

What changes is who owns it. In most crises, the executives make the strategic calls and the crisis team runs the response. In a misconduct case, general counsel and HR own the substance. When the subject is the CEO or the chair, the board owns it.

It also changes who leads. As I said on the podcast in 2022: “In a case of corporate malfeasance, you’re going to need an unassailable and neutral crisis leader who’s outside your C-suite.” Everyone who reports to the accused has a conflict, whether they feel it or not. Some are loyal. Some are afraid. Some control the information the investigation needs.

Two Executive Misconduct Cases and What They Teach

The financial case: Wells Fargo. In September 2016, the Consumer Financial Protection Bureau fined Wells Fargo $100 million after employees, pushed by sales targets, opened what the bank’s own analysis put at more than two million accounts that customers may not have authorized. With penalties to the Office of the Comptroller of the Currency (OCC) and the City and County of Los Angeles, the total came to $185 million. The bank said it had fired about 5,300 employees.

CEO John Stumpf retired a little over a month later, without severance, after forfeiting about $41 million in unvested stock. In April 2017, a report by the board’s independent directors led the bank to claw back about $28 million more. In January 2020, the OCC fined Stumpf $17.5 million and barred him from banking for his role in the sales practices misconduct.

The lesson is the sequence. The front line paid first. Accountability at the top arrived over the next three and a half years, in pieces, and every piece was a new headline.

The conduct case: Fox News. In July 2016, former anchor Gretchen Carlson sued Fox News chairman and CEO Roger Ailes for sexual harassment and retaliation. Ailes denied the allegations. The parent company, 21st Century Fox, hired an outside law firm to investigate, and Ailes resigned about two weeks after the suit was filed. Other women at the network came forward with similar allegations. In September, the company settled with Carlson for a reported $20 million and issued a public apology.

The lesson here is independence. The parent company didn’t ask the accused executive’s own organization to investigate him. It brought in outside counsel, and it acted on what that investigation found.

Decide Who Decides Before You Need To

Decision rights are the part of the crisis plan most organizations never write down for this scenario. Settle these questions in advance, in a short misconduct annex to your crisis plan:

• Who receives the report? Reports about senior executives should go to someone outside their reporting line: general counsel, the head of HR, an ethics hotline, or the audit committee.
• Who decides to investigate, and who investigates? Never anyone who reports to the subject.
• Who decides on administrative leave or interim leadership? If the subject is the CEO, this is the board’s call, and you need a succession plan that names who steps in.
• Who speaks? Never the subject, and never someone in the subject’s reporting chain.
• Who notifies regulators, lenders, and investors? Counsel decides what must be disclosed and when.

If you’ve built your crisis management team with an incident leader and a responsible executive, decide now who fills the responsible executive role when the responsible executive is the problem.

Run an Independent Investigation

Before founding Bryghtpath, I spent 21 years in corporate security at Target, and I was part of many sexual harassment investigations as an investigator and security leader alongside HR and employee relations. The investigations that held up had the same things in common. I walked through them on Managing Uncertainty, Episode 119, building on the Society for Human Resource Management’s (SHRM) practices:

1. Start with an investigative plan. Who will investigate, what evidence to collect, and who to interview.
2. Use a neutral investigator. For a senior executive, that often means outside counsel. “An outside counsel in this situation does not have a stake in the game.”
3. Follow the evidence. Gather what supports the complaint and what negates it. Review past complaints for patterns, and look at the culture around the person, not just the person.
4. Document everything. Every interview, every decision, and who made it.
5. Decide on the facts. Did the conduct violate policy? The investigator recommends; the decision-maker acts.

When the subject is the CEO, the chair, or an executive director, outside counsel is usually the right call. It takes the investigation away from other leaders, and in some cases the board, who all have a stake in the outcome. The board then acts on a report built on evidence instead of spin.

Run the process in a trauma-informed way, with empathy for the people who came forward. And watch for the most common failure: protecting someone for who they are rather than what they did. That’s how one allegation becomes the next crisis.

Communicate What You’re Doing, Not What You’ve Concluded

Silence reads as protection. A premature defense of the executive reads worse. The middle path is to say what you’re doing: we received a report, we take it seriously, we’ve engaged an independent investigator, and we’ll act on what it finds.

• Tell employees first, or at least at the same time as the public. Give managers talking points. Your people will hear it somewhere; it should be from you.
• Write holding statements now. You can draft the misconduct statement before you ever need it. The facts change; the structure doesn’t.
• Map every audience. Board, employees, investors, regulators, customers, and partners each need something different. Our post on communicating with stakeholders during a crisis covers how.
• Never attack the person who reported. Retaliation, or anything that looks like it, turns a misconduct story into a cover-up story.
• Listen. News and social media move these stories fast. Monitor what’s being said so you respond to what people actually believe.

This is the work our crisis communications team does with executives and boards: messaging, spokesperson preparation, and the call on what to say and when.

The Board’s Role in Executive Misconduct

In most crises, the board’s job is to support management, not run the response. I covered that line on Episode 310: governance and oversight, strategic alignment, and stakeholder assurance, with management running the operation.

Executive misconduct is the exception. When the subject is the CEO, the board is management’s only check. It commissions the independent investigation, usually through its independent directors. It decides on leave, interim leadership, and compensation, including clawbacks. And it approves what the company says about all of it.

Boards that have never practiced this make the same mistakes under pressure: they wait for the CEO’s own team to report, or they jump into operational decisions that aren’t theirs. Our guide to board resilience covers what the board does in a crisis, and what it doesn’t.

How to Reduce the Risk of Executive Misconduct

You can’t eliminate the risk. You can make it smaller and make the response faster.

1. Screen candidates. Executives terminated for misconduct often land another senior role somewhere else. Do the reference and background work, within the law. Hiring someone with a known pattern invites the same crisis and signals that the behavior is acceptable.
2. Set the standard in writing. Have executives read and sign the code of conduct every year. The message should be plain: our reputation is tied to you, so your personal actions aren’t only yours. They reflect on all of us.
3. Hold executives to the same standard as everyone else. Misconduct gets overlooked at the top because burying it looks cheaper. It isn’t. Respond to an executive the way you’d respond to anyone else, and say so.
4. Give people a safe way to report. An independent channel, a promise of no retaliation, and a track record that proves it.
5. Exercise it. Put an executive misconduct scenario in a tabletop exercise with your executives and board. It’s the scenario they least want to discuss, which is exactly why it belongs on the table.

Your reputation is tied to your leaders. Decide now who acts when one of them is the problem.

Keep Going

A few ways to go deeper if this was useful.

• Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Crisis Management.
• Build the framework first. Our crisis management services write decision rights down, including who leads when the subject is one of your executives.
• Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
• Talk to us. Set up a call to think through your crisis program with us.