Tone at the Top Is What the Board Tolerates, Not What It Says

Most boards believe they set the tone through what they say: the code of conduct, the zero-tolerance statement in the annual report, the town hall. Employees take their cue from something else. They watch what gets rewarded, what gets waved through and what happens to people who break the rules or point out that someone else has.

That is why tone at the top is best understood as a set of observable decisions, not a message. And because they are observable, they can be tested.

Why codes of conduct do not set the tone

A code of conduct tells people what the company says it values. It does not tell them what the company will do when a valued salesperson inflates a distributor claim, or when a plant head who hits every target turns out to have a family interest in a key supplier.

People learn the real rules from those moments. In investigation interviews, the familiar explanation is rarely ignorance of policy. It is some version of "this is how it is done here", which usually means someone senior once saw it happen and did nothing.

The ACFE's Occupational Fraud 2026: A Report to the Nations puts numbers on why the senior end matters: the median loss in schemes by owners and executives was USD 475,000, more than nine times the USD 50,000 median for employees. Senior people also control the information that others rely on to spot problems.

Four places where the real tone is set

What gets paid

Incentive plans are the most powerful policy document in a company, and they are rarely reviewed through a fraud lens. A quarterly volume target with no quality gate invites channel stuffing. A procurement saving target with no check on vendor quality invites shortcuts in vendor due diligence. A collections bonus invites restructured invoices that hide bad debts.

Pressure and rationalisation are two of the three legs of the fraud triangle. A badly designed plan supplies both.

What gets approved as an exception

Every control has an override. The question is how often it is used, by whom and why. A company where senior people routinely approve exceptions to credit limits, delegation of authority or three-way match has told everyone that internal controls are for junior staff.

What happens to people who speak up

If the last whistleblower was identified, sidelined or quietly managed out, everyone knows. No amount of communication about the vigil mechanism will undo that. Conversely, a visible, fair outcome for a well-founded complaint does more for reporting than any poster.

How senior misconduct is handled

The hardest test is the top performer or the long-serving promoter loyalist. If misconduct by a junior employee leads to dismissal while the same conduct by a senior one leads to a "word" and a transfer, the organisation has learned its real code.

What good looks like: a tone test for the board

Boards and audit committees can ask for evidence, once a year, on each of the four points:

1. Incentives. Which plans pay on volume or savings without a quality gate? Do plans include malus and clawback? Were the top 5% of payouts reviewed for anomalies before payment?
2. Exceptions. How many policy exceptions were approved in the year, by whom, in which processes? Which approvers account for most of them?
3. Speak-up outcomes. How many concerns were raised, how many substantiated, how long did they take, and was any reporter subjected to adverse action within 12 months?
4. Consistency. For substantiated cases, what action was taken, broken down by seniority? Were any senior cases closed without a documented decision?
5. Perception. What do anonymous survey responses say to specific questions such as "If I reported misconduct by my manager, I believe I would be protected"?

None of this needs a new framework. It needs someone to compile the data and an audit committee willing to look at it without the management team explaining it away in the room.

Common mistakes

• Treating tone as communication. Messages from the chair are necessary but they are the least credible evidence of culture.
• Exempting top performers. The cost of losing a star is visible; the cost of keeping one who broke the rules is spread across everyone who watched.
• Reviewing incentives only for cost. Remuneration committees look at affordability and retention. Few ask what behaviour the plan will produce under pressure.
• Measuring hotline volume alone. A low number can mean a clean company or a frightened one. Outcomes and reporter treatment tell you which.
• Leaving it to HR. Culture evidence belongs on the audit committee agenda, alongside the fraud risk assessment, because that is where it will be needed when something goes wrong.

The legal backdrop

Indian law does not use the phrase "tone at the top", but it holds directors to the outcomes. Under the Companies Act 2013, directors of listed companies confirm in the directors' responsibility statement that internal financial controls are adequate and operating effectively (s. 134(5)(e)). The audit committee evaluates internal financial controls and risk management systems (s. 177(4)). Independent directors must ascertain that the vigil mechanism is adequate and functional and that people who use it are not prejudiced (Schedule IV).

Under the Prevention of Corruption Act 1988 as amended in 2018, a commercial organisation's defence to the corporate offence in s. 9 rests on adequate procedures. A programme that senior management visibly ignores is unlikely to look adequate to anyone.

Where we can help

When a board wants an independent read on culture before something goes wrong, or an independent investigation when something has, our fraud and whistleblower investigation team works directly for the audit committee. For appointments to senior roles, senior management due diligence checks the track record before the tone is set by someone new. Speak to us in confidence.