When it comes to building more effective and principled organizations, one big barrier is that “ethical culture” sounds fluffy and amorphous, while regulatory requirements are clear and specific. It’s temptingly easy to focus on processes and rules and to delegate their enforcement to compliance and HR teams rather than ask uncomfortable questions about how leadership, oversight, norms, and decision-making need to evolve. Enacting meaningful change takes time and effort. It’s so much easier—and quicker—to degrade a culture than to build a better one.

According to influential scholar Edgar H. Schein, culture is “the way we do things around here.” Culture comprises formal systems and processes as well as “work climate”- the set of informal behavioural norms and values in an organization. A good corporate culture needs purpose as well as profit, role models as well as rules, followers as well as leaders, participation as well as direction, and incentives as well as prohibitions. This has always been true, but heightened transparency makes it easier to peer into the inner workings of today’s organizations. Barely a week passes without news of the latest botched redundancy, contentious town hall meeting, slack channel drama, or management misstep.7 We’re all armchair culture auditors now.

Companies can no longer rely on the timeworn expectation that internal matters will be kept confidential. But reduced control of information is just one dimension of how porous and contested organizational boundaries have become. The shift to intangible value registers in where and when we work, how we lead and manage, how we set and implement strategy, and how we exert influence and are influenced in return.

As the Economist wrote in 2020: “CEOs’ mechanism for exercising control over their vast enterprises is failing, and where and why firms operate is in flux. . . . [T]he boundaries of the firm, and the CEO’s authority, are blurring. Uber’s 4m drivers are not employees and neither are the millions of workers in Apple’s supply chain, but they are mission-critical. . . . Factories and offices have billions of sensors pumping sensitive information to suppliers and customers. Middle-managers talk business on social media.”

So far, we’ve been talking about how to deal with shifting suppositions about the role of business in society. The impact of these shifts on internal culture is just as significant— and we’re no less confused about what to do next. Even as the boundaries around companies blur and dissolve, we find it hard to let go of metaphors that describe an organization as an inert barrel: all we need to do to keep it healthy is remove the bad apples. Let’s start by exploring where these ideas come from, why they persist, and why we need to move on.

Bad Apples and Rotten Barrels
When ethics scandals hit the headlines, we tend to be served comforting explanations that the problems stem from a few “bad apples,” who will now be swiftly separated from the good ones. In his 2016 Senate testimony, then-CEO John Stumpf emphasized that Wells Fargo’s problems reflected the activities of a mere 1 percent of its workforce.9 Martin Winterkorn, then chairman of Volkswagen Group’s board of management, initially dismissed the manipulation of emissions data at VW in a video statement as “the terrible mistakes of a few people,” whom he did not identify, before resigning in “shock” that misconduct had occurred on a grand scale. This argument is simple and seductive. It conveniently absolves leaders

of personal responsibility for wrongdoing on their watch. And it suggests that CEOs need only find and remove malignant employees— a straightforward task they can delegate while focusing on more important activities. These appealing arguments are buttressed by a legal system bent on finding and punishing a wrongful mind.

The bad-apple idiom originated in the Middle Ages to explain how rot spreads in organizations. In Geoffrey Chaucer’s The Cook’s Tale, an apprentice chef is fired before his unsavory behavior can infect everyone else. Benjamin Franklin warned that rotten apples would spoil their companions, and the metaphor became commonplace in nineteenth-century sermons. A century later, though, its meaning morphed 180 degrees. We now talk about bad apples as shorthand to suggest that expelling a few scapegoats is all it takes to build and preserve a healthy organization. The present-day interpretation is much more than a metaphor. It illustrates how the legal system frames the challenge of business ethics as a matter of individual cognition rather than social conditions. Commercial law is strongly inclined to view business ethics as a principal-agent problem. The law sees the corporation as a precious,

if fragile, type of fictional person: the “corporate principal.” Like a real person, the corporate principal has rights, goals, and a legal identity. Like a deity, it relies on human agents—employees—to fulfil its goals.

That directors and employees have a fiduciary duty to protect the value of the corporate principal at (almost) all costs is an article of faith in corporate life. Since the US Federal Sentencing Guidelines were introduced in the early 1990s, the government has heavily incentivized companies to police themselves. Realistically, enterprises cannot eliminate the risk that the human beings they employ will break the law. But if the government agrees that a company has made its best effort to thwart wrongdoing, the bad apples it coughs up will face legal penalties; the corporation will not. Consequently, corporate ethics efforts have historically emphasized protecting the corporate principal from rogue employees. (The principal has no values or conscience and is motivated solely by economic self-interest.) Compliance units exist to find and remove rule breakers before their behavior can threaten corporate value. This approach implies that the first imperative of an ethical organization is to keep out bad people, and the second is to make the costs of wrongdoing outweigh any of its benefits. While this is challenging work to execute, the approach is straightforward. Companies impose policies and rules, mandate training to enforce

them, listen to employees who speak up, and investigate wrongdoing. (Before we proceed, let me be clear: without a compliance function that has authority, and without meaningful sanctions for wrongdoing, you won’t get far. Policies, rules, training, speaking up, and investigating wrongdoing are all critically important elements of an ethical culture.)

My concern about how all this plays out is twofold. One issue is that these foundational efforts suck up the vast majority of the energy and discussion, even though they can, at best, be necessary but insufficient. The second concern is that compliance programs are often designed to deflect regulators while paying little attention to how rules and processes impact human cognition and behavior. Dicta and deterrents are far less effective at influencing us than we like to imagine; incentives and norms are far more potent than we think. We’ve known this for a long time. A groundbreaking article by Lynn Paine in 1994 laid out why instilling ethics requires holistic effort, not a rules-based process. Pointing out that a punitive stance toward legal compliance can backfire, she emphasized that managers should be held responsible for the values and aspirations—and staff conduct—on their watch.

Let’s look at the bigger picture. What do we miss when we view the cause of business ethics problems narrowly, through the lens of bad apples that threaten the value of the precious corporate principal? This lens gives us a simple, clear, and ultimately unhelpful picture of how organizations become unethical. It prevents us from focusing on how structures, processes, and norms impact human behavior. It encourages us to see organizations as black boxes or inert containers that exist only to safeguard their self-interest in the narrowest terms. And it suggests we can wall companies off from huge social shifts on issues of inclusion, impact, and values. By reimagining organizations as the open social systems they are, we can start to comprehend and resolve our emerging challenges.