The buck stops at the board

High-level compliance and control failures, whatever the specific cause, are ultimately a board’s responsibility. Saying the “directors didn’t know” is no excuse
By Richard Leblanc

If the CEO of SNC-Lavalin allegedly overrode his own CFO and breached the company’s code of ethics in authorizing $56 million of questionable payments to undisclosed agents that the federal Canadian police are now investigating, did the board of directors of SNC-Lavalin have a role to play?

If RBC, as alleged by a U.S. regulator, made “material false statements” in connection with non-arm’s length trades, did the board of directors of RBC have a role to play?

The answer is “Yes” in these and similar cases. Speaking generally, as all allegations have yet to be proven, it is not credible to argue—as some do—that boards do not have a determinative role to play in compliance and reputational failure, or that directors did not know. A board is the only body that has the legal authority and power to control management and designate all compliance and control systems. It alone acts or fails to act. A board is paid to take all reasonable steps consistent with best practices, to ensure that it does know.

More regulations now, such as the UK Bribery Act, and the SEC Whistleblower program, are aimed to hold directors responsible and accountable if they fail to direct proper anti-corruption and whistleblowing systems. The SEC rule, which took effect last summer, enables employees to report wrongdoing directly to the regulator, thereby completely bypassing toxic work cultures where whistleblowing is neither independent nor anonymous. This legislation is putting the heat on boards and senior management, or at least it should be.

Earlier this year, the Ontario Securities Commission released a scathing report about governance, risk management, internal control and auditing failures in companies operating in emerging markets. The payments in SNC-Lavalin allegedly involve ties to Libya.

In SNC-Lavalin’s case, how could anomalous payments of this magnitude and internal controls be allegedly manually overridden, as is being reported, and not receive explicit board or committee approval? Where was the board? SNC’s own internal report revealed a shocking lack of disclosure of contracting parties and improper documentation and passwords. The board chair, Gwyn Morgan, said that while the board does not believe the money was used to bribe or has wound up in Libya, the board wasn’t “able to really determine the use of those payments.”

If so, this is a massive governance and internal control failure. It is impossible for fraud, bribery or ethical breaches to occur in a vacuum. Employees know. But corporate whistleblowing systems, overall, suffer from defects that include lack of anonymity, lack of independence, lack of communication and training, lack of incentive, and lack of a proper investigation. In the U.S., according to the 2011 National Business Ethics Survey, retaliation against employee whistleblowers last year rose to more than one in five employees. Such defects are exactly what the SEC rule is designed to address.

Whistleblowing defects are all faults of a board. If the board is getting its information only from management, this is a red flag. Management may not even possess accurate knowledge. In any event, a prudent board should seek independent assurance over anti-fraud and whistleblowing procedures. And “independence” does not mean the company auditor or legal counsel who assess their own or their firm’s work, nor any firm who does, has done, or seeks to do work for company management.

Directors and boards themselves also need to step up. This includes appointing international directors, understanding corrupt business practices, receiving third party assurance and disconfirming information (including culture surveys), and using alerts and social media.

Previously, both SNC-Lavalin and RBC received recognition for their good governance. The allegations show the perils of rating boards solely on tick-the-box systems rather than methodical internal reviews.

The question therefore, is, could this happen on other boards of directors? If you are a director on a board and cannot reasonably answer “No,” to this question, perhaps you should consider some of the above recommendations.

Richard Leblanc is an associate professor, governance, law & ethics, at York University’s Faculty of Liberal Arts and Professional Studies and a member of the Ontario Bar. E-mail:


Print Friendly
This entry was posted in Views and tagged , , , , , , , , . Bookmark the permalink.

Comments are closed.