Boards set the boundaries
In our companion article, Why culture problems often survive remediation, we argued that problems persist when the decisions and conditions that sustain them remain in force. Boards sit at the centre of those conditions. They approve the strategy, risk appetite and boundaries within which management pursues commercial goals, and they oversee whether those boundaries hold.
Three governance questions follow. What does the board treat as non-negotiable? Can it see when that is being traded away, or is that a blind spot? And when it can see, does it act, or turn a blind eye?
What gets traded, and what should not
Deciding what is non-negotiable starts with recognising trade-offs. Every organisation has limited time, money and people, so pushing hard for one result often means getting less of another, and operations research gives us useful language for this.
The objective is the main thing an organisation is set up to achieve. Other goals are added as weighted objectives: factors that consider how the primary objective was achieved and count for something in the scorecard, such as values, quality, or people leadership. A weighted objective can be traded, so when a senior leader beats their revenue target but scores less strongly on values, revenue often wins.
A constraint works differently: it is a line every decision must stay within. A plane that fails its pre-flight safety checks does not fly, whatever the delay costs. An organisation's constraints are its non-negotiables, and revenue is pursued inside them rather than traded against them.
Compliance: a line on paper, a weight in practice
Regulatory compliance should be the clearest constraint of all, yet organisations often balance it against revenue, cost and customer experience. The trade-off usually shows first in resourcing: compliance capability funded to what remains once commercial targets are set, and consequently applied less reliably in front-line teams under pressure.
The record shows where that leads. The Bergin inquiry found Crown's conduct had facilitated money laundering, and the Bell review found The Star had also facilitated money laundering and fallen short of legal and ethical standards. CBA and Westpac paid what were, at the time, record penalties for anti-money laundering failures, including reporting failures. In our view, compliance in each case was a hard line on paper but an elastic weighting in practice.
Constraints that hold, and how a board tests them
In safety-critical work, the job halts when a check fails, whatever the schedule. In professional services, an unresolved independence conflict stops the engagement, whatever the fee. Both constraints are built into process and backed even when they cost money.
KPMG Australia's ethics review, commissioned after a whistleblower matter, found that the firm's independence processes were among its most mature. The same discipline did not extend to ethics more broadly. In our reading, ethics beyond independence sat in KPMG's scorecard as a weighted objective: the review found examples of ethical considerations prevailing, but also recorded a widespread view that financial results almost always decided the outcome.
A board can test whether its own constraints hold. The test is whether they ever cost anything. A constraint that holds back a commercial result has a cost, which in optimisation terms is its shadow price: the extra return the organisation would earn by relaxing the line a little.
A boundary that has never held anything back has never been tested. The board should therefore ask management for the evidence: how often has compliance or ethics changed a commercial decision, such as a deal declined, a launch delayed or a target missed, and were the people who made those calls supported when it cost money? Without that evidence, the board has limited assurance that its non-negotiables hold in practice.
The governing layer: leaders' choices and the board's blind spot
Whether a boundary holds also depends on the people at the top. The governing layer is a subculture of its own, and often the least observed part of the organisational system, because detection and containment are built for the general population. Senior leaders take risks and make decisions, and their personal choices carry further than anyone else's, because at their level a choice acts as a decision for everyone below. When a senior leader bends a rule to win work or meet a target, the people watching learn where the line really sits.
KPMG shows what happens when that line moves at the top. Confidential client information was misused more than once, across different clients, including by senior people. KPMG has acknowledged that information about one client was shared with a team bidding to audit that client's competitor. The ethics review found genuine uncertainty about where the line sat, and that some people rationalised crossing it.
The mechanisms for detecting such conduct at the top were weak. Concerns about senior leaders passed through channels those leaders influenced, and the pay and progression of some board members were influenced by the executives they oversaw. Concerns about speaking up, retaliation and accountability reached the executive and the board repeatedly between 2022 and 2026, yet board reports counted cases and there is little evidence of action on the conditions behind them.
That points to both a blind spot in what the governing layer could see and a gap in what it did with what it saw.
Assessing the top within the organisational system
How boards are assessed can reinforce that blind spot. Board effectiveness is usually assessed in isolation, through an annual self-assessment or a periodic external review of the board and its committees. That misses how its decisions shape, and are shaped by, the organisational system around it: the targets it approves, the capacity it funds, the incentives it sets and the signals it receives.
Directors may assume internal audit covers this layer. The IIA's Organizational Behavior Topical Requirement, effective from December 2026, includes governance, but it treats the board as the overseer of employee behaviour: it tests whether oversight arrangements exist, not how the board's own decisions shape the organisational system and the pressures exerted through it.
In our experience, internal audit is often authorised to act only within the entity's operational boundaries, so governance assessment stops at frameworks. The interactions between parent and subsidiary boards also sit out of reach.
Closing these gaps means assessing boards and executive teams as subcultures of their own. That starts with their decisions: sampling material decisions where commercial and compliance objectives conflicted (what was consciously or unconsciously traded, and how those trade-offs were resolved), tracing how the board responded to recurring signals, and linking those decisions to the targets, capacity and incentives that followed. It extends to the norms behind those decisions: how challenge and dissent are handled, and how leaders' authority to take risks, combined with accountability for results, shapes the signals employees receive.
Three questions for the board
- Is our compliance capability funded to what our obligations require, or to what remains once commercial targets are set? And could we show it operates as reliably in front-line teams under pressure as it does in head office? If not, compliance is being balanced, not upheld.
- Which concerns have reached us more than once, and what have we changed in our decisions and in the organisational system as a result?
- Who independently assesses how our decisions shape the organisational system, with access to the evidence, and what would they see that we do not?
What holds at the top
Boards set the boundaries for everyone else's choices. Whether those boundaries hold depends on two things: whether legal obligations and minimum ethical standards operate as constraints rather than weights, and whether anyone independent of senior leaders would notice and act if they were traded away. A boundary the board cannot see being crossed, or does not act on when it is, is a weight, not a constraint.