My initial reaction to the recent News of the World revelations was that the people at the top must take responsibility.  I took the view that senior management are ultimately responsible for the organisation’s culture and when there is a serious breach of ethics they should resign.

As mentioned in my last blog I have recently been going back to my roots and been carrying out some internal audit projects. Internal audit can be a means of finding improvements that add to the bottom line and also be used to see if risks are being effectively managed.

One risk that is a key concern to well known organisations is the risk of reputational damage. It often takes years to build a reputation but, as has been seen with the News of the World, reputations may be lost very quickly and the impact can be catastrophic.

The nature of reputational risk will vary according to the type of business. Even within the same industry there can be differences; arguably a newspaper with a reputation for cutting edge investigative journalism would have much greater pressures to find a scoop (and therefore potential for unethical behaviour) than your local freebie.

Hindsight is a wonderful thing; however I am wondering how the News of the World’s senior management approached the risk of unethical journalistic behaviour?  Without direct experience of the newspaper industry, the sort of things that spring to mind are:

  • Whether there was a culture of the end justifying the means no matter what?  I must admit I am not sure what the end was with some of the most recent revelations!
  • Conversely did the organisation apply a code of conduct?  (I note that the press complaints commission has an editorial code of conduct, which appears to have been breached).
  • Were steps taken to embed the code of conduct in into the organisation’s culture?  Say, through training or annual declarations of compliance to remind staff of the code or even audits to ensure compliance.
  • Was there a whistle blowing procedure where members of staff were able to report unethical behaviour without fear of retribution?

Not knowing about the hacking at the time may seem to be a lame excuse, although on reflection senior management cannot be expected to know everything that is going on.  However did the culture and processes, which I believe are the responsibility of senior management, provide a reasonable chance of them finding out? To me this an answered question.”