Non-financial misconduct — harassment, bullying, discrimination, abuse of authority — can undermine an organization's culture, reputation and legal standing. Host Andrew Good invites Skadden colleagues to share insights based on their experience with corporate compliance and regulatory matters. Bora Rawcliffe, based in Abu Dhabi, explains how companies have historically treated workplace misconduct as a quiet HR matter — and why that approach is no longer adequate. Vanessa McGoldrick, based in London, details how the U.K.'s Financial Conduct Authority has updated its rules to formally treat serious misconduct as a regulatory concern. Tune in for the panel’s practical guidance on whistleblower procedures, employment law considerations and building a culture where misconduct is deterred before it escalates.

Connect and Learn More

☑️ Bora Rawcliffe | LinkedIn

☑️ Vanessa McGoldrick | LinkedIn

☑️ Andrew Good | LinkedIn

☑️ Skadden | LinkedIn | X | Facebook

☑️ Subscribe Apple Podcasts | Spotify | Amazon Music

“An Ounce of Prevention” is presented by Skadden, Arps, Slate, Meagher & Flom LLP and Affiliates. This podcast is provided for educational and informational purposes only and is not intended and should not be construed as legal advice. This podcast is considered advertising under applicable state laws.

Welcome to An Ounce of Prevention, a podcast from Skadden's White Collar Defense and Investigations Group that explores critical issues shaping the landscape of corporate compliance and enforcement around the globe. Join us for in depth analysis and practical insights to help you navigate the complexities of corporate accountability.

Hi, and welcome to An Ounce of Prevention, a podcast series presented by the White Collar Defense and Investigations Team at Skadden. This podcast brings you regular analysis of key compliance and white collar crime trends, important industry news and developments, as well as insights from the leading practitioners in the field. My name's Andrew Good, and I'm a partner here on the Skadden White Collar Team in London.

The topic for today's episode is non-financial misconduct, which sometimes accompanies financial fraud offenses, but other times can be a standalone basis for an investigation. In this episode, we'll discuss the risks associated with non-financial misconduct, as well as best practices for deterring conduct like that and some practical tips for investigating it. To help us understand the impact of non-financial misconduct and to discuss some of the investigation best practices in the space, I'm joined by two of my colleagues today, Bora Rawcliffe and Vanessa McGoldrick.

Bora is a partner in our Abu Dhabi office. Bora regularly represents companies and individuals around the world, in government facing and internal investigations, in corporate compliance matters and on transactional due diligence related to corruption, financial crimes, and non-financial misconduct. Vanessa is a counsel on our team here in London, and advises clients on a broad range of cross-border regulatory, criminal, and civil investigations, and financial and non-financial matters. Bora, welcome to the Ounce of Prevention Podcast, and Vanessa, welcome back.

Thanks, Andrew. Thanks for having me.

Thanks, Andrew. Great to be back on.

Well, thanks for joining me today. Bora, why don't we start with the basics. How would you define non-financial misconduct?

Well, when we talk about non-financial misconduct, we're really talking about behavior by individuals, employees, management, senior leadership, at an organization, whether that's a corporation, a bank, a law firm, a regulated entity, whatever it might be. Conduct that doesn't directly involve things like fraud, market manipulation, money laundering, insider trading, all the traditional financial crimes that we typically would think of as being subject to internal or regulatory investigations. Instead, I think of non-financial misconduct as covering a whole range of personal and interpersonal conduct related to the workplace, and generally misconduct that we think of as falling below the standards or values of an organization or what regulators would expect, generally what we would expect from a person in the workplace.

I think there's a distinction to be made between purely HR interpersonal type issues, and the types of workplace misconduct we're going to talk about today. So really, what I'm thinking about are things like harassment, bullying, sexual misconduct, discrimination, creating a toxic or a hostile work environment, retaliation, either in that sort of hostile work environment context or because somebody has raised other concerns or red flags internally. And just conduct that really reflects on a person's fitness. Do we think that this person behaving in this way in the workplace, particularly if they're in a high accountability, high visibility role, management, executives? Do we think that they should be holding this particular role if this is their conduct in their workplace?

So obviously, I think this type of misconduct can really hurt trust, morale, and beyond the internal aspects of it, can naturally hurt a company's reputation. It can also bring on legal risks, whether it's regulators that are scrutinizing what's happening because they think it's a sign of a bigger governance issue, or if it's civil litigation and employment related lawsuits that come out of it.

Thanks for that overview, Bora. And obviously operating in our space, we spend a lot of our time looking at things that would fall into the financial misconduct category. Given that focus and focus of companies on their compliance programs looking at affirmative legal requirements, do you think some companies can fall short on their responsibilities with respect to looking into and investigating non-financial misconduct?

Yeah, I think that's a good question. I mean, I think historically, a lot of organizations and regulators frankly treated this kind of behavior as maybe purely an HR issue, something to handle internally and quietly, or maybe hope that it'll go away, without necessarily involving the legal team or involving external lawyers to look at something with that outside perspective. And I think there's really been significant shift in recent years. Maybe in part, we all read the newspapers, we see the reporting on this type of conduct, we'll talk about the regulatory focus on this. But I think particularly in financial services, other regulated industries and also from our experience, I mean, really across the board with our clients in different sectors and geographies, I think organizations are recognizing that non-financial misconduct is also relevant to some of the aspects of culture and governance and individual accountability, but also the legal and reputational risks. And in some ways, I think that's similar to the other things you're talking about, like the more traditional financial misconduct.

There's rightfully a lot of focus on the financial traditional types of misconduct we would be called to investigate, because really high risks, they're easy to quantify, there's immediate tangible sort of impacts to the bottom line to legal liability, personal liability. So, we've built a lot of policies and controls and things around that to try and prevent purely financial misconduct. Like financial statements undergo audits and reviews and we have lots of processes in place to catch financial discrepancies, and we use AI to find where there might be red flags in the compliance program, etc.

And I think non-financial misconduct can be sometimes more subtle or harder to identify, sometimes harder to investigate and maybe also harder to escalate and to investigate at the right time. But we increasingly see clients worrying about workplace misconduct issues and really wanting to address those in a timely and prompt manner.

I think if someone is behaving badly in the workplace and how they treat people and the type of culture that they're building within their teams, that also tells you something about their judgment, about their integrity. Maybe their sort of fitness to perform in the position that they're in, in a position of trust and authority in many cases.

Thanks. Obviously a fair amount in there and I think maybe helpful just to talk a little bit about some of the types of things that our clients have come across or may come across in the future, obviously not going into any specifics.

Yeah, sure. I think, look, the most obvious issues are where there's allegations of sexual harassment and sexual misconduct, quite serious allegations. Again, we see these in the headlines. We see how where there's cases of senior executives, high level employees at major organizations accused of inappropriate conduct, and the impact that that has on obviously the individuals, the organization as a whole.

We're also often called to investigate workplace conduct issues like bullying, intimidation, discrimination. And often these things, sometimes they don't come up in isolation. They come up and, I don't know, take a situation where you have a senior leader that's screaming at employees and throwing things and making inappropriate comments or jokes that are discriminatory or really not aligned with the organization's values, and generally creates an environment where people don't feel comfortable to do their job, don't feel safe to do their job, but also like to be productive or to speak up or to raise concerns in the face of that kind of a culture or leadership. So there's obviously, I think, significant harm there to the organization and to the people. And this kind of stuff I think can cause a lot of heartburn for the board, senior leadership, the ultimate parent company, investors. And so more broadly, I think culture but also the operation.

And I guess another category of workplace misconduct we also see is around abuse of authority or abuse of position type issues. It could be a senior person using their influence to get favorable treatment for themselves or to get favorable treatment for somebody else that they like within the organization or nepotism, maybe personal conflicts of interest. We see that come up all the time, where there's either a conflict of interest or there's misuse of company resources, whether there's like physical resources or human resources, just in ways where there's improper personal benefit. So again, it's like maybe that's not strictly financial fraud, but it's still something we might consider like a serious breach of trust.

And then I think across these different types of cases that I think would be recognizable as I talk about them, there are some common patterns that we see. As I say, we do tend to see some of this conduct, at least when it rises to the level that we're being engaged on behalf of a special committee of the board or something like that. We tend to see that in many cases, the misconduct wasn't really a secret. Maybe things had been bubbling up or happening or being reported in different places from different employees over time, or things were known internally but maybe there was failures in how they were escalated, or maybe failures as I mentioned before, in how an employee's ability or willingness to speak up. So, I think the last thing I'll say there, I think, is like that aspect of people being afraid to speak up and concern around retaliation. I think that's very common aspect of these investigations as well, especially where we have these allegations of toxic work environment.

So sometimes in our investigations we see things happening in small ways, like taking away a promotion, excluding somebody from meetings, negative performance reviews where before it was only positive performance reviews. So, all of those, I think combined with some of the other aspects I was just talking about, I think often can add up to some of these broader workplace issues.

Yeah. I think it's really important to think about how these issues may play out in other investigations and how the interaction comes up there. Oftentimes I've found doing some of our more traditional investigations, we just come across issues like this that need to be addressed in the same process as going through the investigations. And the complexity that this can bring up under those circumstances is quite interesting, dealing with evidence from different sources, dealing with people coming forward with additional concerns when you're looking at something strictly financial. It is an interesting area to look at.

Vanessa, turning slightly to the UK, I think there's been some news recently around this space and maybe you could talk a little bit about how it's developing.

Sure, thanks Andrew. So, all of the implications and consequences that Bora's just walked through and the type of conduct, they're all applicable in the UK and in the matters we're advising clients on in the UK. There have been a number of high profile cases involving non-financial misconduct recently, and there certainly has been this drive towards accountability for behavior that whilst not directly involving financial wrongdoing, can nonetheless undermine market integrity in public trust, with a particular focus around the regulated sector.

There was an example, a head of a UK hedge fund that was accused of multiple instances of inappropriate conduct towards female employees, including sexual harassment and assault. After the internal investigation, the executive committee of the fund issued a written warning to that individual, in which he had to agree to comply with certain conditions, including his interaction with staff would always be in a professional manner and in line with the company's policies and procedures.

A short while afterwards, the UK Financial Conduct Authority, the FCA, began investigating the individual's conduct. And actually during that investigation, he removed members of the executive committee and appointed himself as the sole member, and the FCA saw this as an attempt to obstruct the firm's disciplinary processes and prioritize his own individual personal interests. And ultimately, this resulted in the FCA living a fine against the individual of over 1.8 million, and significantly he was banned from the financial services industry for lack of integrity. So, that's quite a stark kind of example of something that's happened in the UK recently.

And so in parallel to that, has UK and are regulators in the UK looking at this specifically? Have there been rule updates or anything along those lines?

Yes, there have been, Andrew. So the FCA has updated its rules to make it clear that serious misconduct such as bullying, harassment, and violence are matters of regulatory concern.

So in July last year, the FCA published a consultation paper in relation to non-financial misconduct, and this paper introduced a change to the FCA's code of conduct. And so, it will expand the scope of the rules and formalize non-financial misconduct as a regulatory issue, and this rule change is going to come into force in September of this year. This rule change proposal was followed by guidance from the FCA, which was published in December of last year on how serious non-financial misconduct will be assessed under the code of conduct and its fit and proper regime. And this was really important, and the guidance emphasized that the code of conduct will generally be engaged where there's serious non-financial misconduct. And also evidence is a breach of individual conduct roles and notably failures to act with integrity, due skill, care, and diligence.

So the guidance sets out this non-exhaustive framework to help firms assess whether the behavior breaches the regulatory threshold. And it also highlights that the non-financial misconduct needs to be considered as part of the overall fit and proper assessment for senior management of regulated firms. So, this means that companies that are regulated by the FCA are expected to prepare by updating their conduct and disciplinary rules, aligning with HR and compliance and legal functions, and also stress testing their process ahead of this increased supervisory scrutiny.

It's also important to note that the FCA's approach now applies to a wide range of regulated firms and it's not just covering banks, for example. It covers anyone who is subject to the FCA's code of conduct. And the FCA's goal is to promote this healthy, inclusive workplace culture. It really highlights the importance of the fact that regulated companies can't ignore non-financial misconduct or treat it as a lesser priority now. The FCA is clearly expecting clear policies, strong leadership, and real accountability when it comes to tackling these types of issues.

I should just note as well, there are a few limitations around the proposed new rules, such as the conduct being excluded if it only relates to part of the firm's business that does not carry on regulated activities. So again, it's creating somewhat of a challenge for companies to try and review how their systems and structures are within an organization and looking at what is regulated and not regulated, and therefore caught by this conduct rule change.

These issues by their very nature are often very difficult and sensitive to investigate, and when they arise, it can be very difficult for companies to address those. Bora, in your experience, are there any things that companies can do to prepare themselves or when they're put on notice that there may be a potential issue that they need to look at?

Yeah, that's a good question. And I think you framed that in the right way, Andrew, because I do think having these types of investigations in mind, which they will come up, it helps to be prepared in some key aspects, I think. Because when you get allegations, especially the types of serious allegations we've been talking about, it's really important to act quickly. You want to assess the credibility and substance of those allegations and proceed with your investigation.

So I do think from our experience, there's a few things that companies can do on the front end and we also normally will be involved in helping them with. I think the main thing is thinking about how you will collect and preserve evidence. Maybe that sounds quite obvious, but as with all internal investigations, I think just getting in there, preserving evidence, and having a path for how you're going to collect and review that evidence is really a critical first step in non-financial misconduct.

And when we're talking about these types of cases like harassment and toxic workplace allegations, we all know that most likely that the critical evidence there is going to be in messages, it's going to be in places like WhatsApp, Signal, SMS messages, or on internal communication channels like Teams or Slack or whatever a company might be using. And I flag those because whether they're the internal authorized channels or ephemeral messages and stuff, I mean, the key issue there is if there is a retention period in place, it's a shorter retention period. If employees are using ephemeral messaging apps to communicate, like Signal or auto deletion functions on WhatsApp, we've had many investigations where we have found evidence that things were intentionally deleted or ephemeral messaging apps were intentionally set to delete within very short time periods. It is important when you get these serious allegations, as I say, to ask to act quickly so that you are able to preserve that evidence.

But on the front end, you also need to be clear about, well, what are your data policies? What are your privacy notices that your employees receive? Depending on the jurisdiction, that's really important. It takes time to figure that out. If you've gotten serious allegations and you know that you potentially have an evidence preservation issue on your hands, there's not a lot of time to retain local counsel, get an opinion on local data protection and privacy issues. You want to know that stuff on the front end, and you want to know what your process is going to be.

So for example, you'll want to know if in a jurisdiction that you operate in where your employees maybe use personal devices, but they use those personal devices, including for workplace related communications. What is your process for that? Do you have policies for being able to access that data and preserve that data? Are employees required to preserve that data and retain it, even if there isn't like a legal hold that's sent out? So, I think those are really important questions. Obviously we deal with them in our government facing investigations a lot and we know that for regulators, it's really important that companies have in place those policies. From a practical perspective in these non-financial misconduct cases, you really need to be able to gather that so that you can have a way to look at both sides of what you might be hearing from a whistleblower, a subject of the allegations, other witnesses that you're interviewing. So I think that's a key important aspect of it.

And then the other thing to think about on the front end is also company's procedures, are with respect to investigations in the first place, particularly around whistleblowers. So, what is the company's process for the intake of the whistleblower complaints, assessing those, and triaging them? And then, do we have procedures in place for how quickly we respond to a whistleblower, how we engage with them, how we engage with them in different types of investigations? Just to make sure that again, that's not something you're figuring out as you go, but that your investigations team and your external counsel are on board and can hit the ground running and handle that process. Both in like legal compliance, there's jurisdictions where you do need to respond to a whistleblower within a certain amount of time. You do need to involve them in certain ways with even reviewing your findings, etc. So, you want to know all of those obligations on the front end.

And Vanessa, is there an overlay of employment law in this sorts of investigation?

Yes, certainly, Andrew. I mean, it's really important to, as Bora's just touched on around local jurisdiction considerations, but specifically when we're looking at employment issues in these types of non-financial misconduct investigations. Often, we can see that it might be appropriate or potentially appropriate to put employees on leave or suspension whilst the investigation is carried out. But before you can take that decision, you need to consult and we regularly consult with our employment colleagues on what actions are permitted under relevant laws to ensure that the employment law issues are being handled appropriately so you don't trip yourself up with employment claims that can arise at the same time as the investigation that you're trying to conduct. And similarly, along the same lines, if the alleged conduct is really particularly grievous and it might result in the termination of an employee, often getting employment counselor early on can help again the company prepare on the front end and handle any necessary terminations once internal investigations concluded, and then proceed with the employment proceedings that can follow on.

Andrew, turning back to you, what other things do we help clients consider in these types of non-financial misconduct investigations?

Yeah, this space is a difficult and obviously a sensitive space to work in. Allegations need to be taken seriously. They need to be investigated in a timely manner, but also they need to be handled in a sensitive way.

In a lot of instances, non-financial misconduct can involve a series of contradictory narratives. You'll hear one set of things from one group, and another group may provide you a contradictory narrative. It's important to be consistent for companies when approaching these investigations and working through these narratives. It needs to be done carefully. Information needs to be verified as much as possible with documentary evidence. It's important that folks that are identified as potential victims are put in a place where they feel that the company is listening to them and they're being heard.

It's also the case that people who are accused of wrongdoing deserve to have the facts reviewed in a thorough and an objective way to figure out whether there actually has been misconduct. And these types of issues are ones that are emotional and difficult, emotions run high. It's really important to be careful and tactful as outside counsel when you're involved in these issues. It's also important that to the extent there are ancillary issues that are raised during the course of these investigations, they are provided adequate attention that is commensurate with the seriousness of those allegations.

And finally, companies as they're working through these issues, should keep in mind that there may be a point at which the conduct identified or the issues identified rise to the level at which they need to consider disclosure obligations, obligations to either engage with regulators or other authorities, if that's deemed necessary.

With all that in mind, it is a sensitive space, and one where if it's possible, we try to urge clients to think about, how do you help create a culture where this is less likely to occur or less likely to linger in the event that issues do start to arise? Vanessa, do you have any thoughts on what companies may be able to do to deter non-financial misconduct in the workplace?

So I think a good starting point is to make sure that your company's got well communicated and documented policies that specifically address non-financial misconduct. And so, the policies themselves shouldn't only define what constitutes a non-financial misconduct, but it should also set out the clear procedures for reporting, investigating, and resolving the incidents to ensure that all the investigations conducted in this space are carefully and thoughtfully documented. And by having that and having a whistleblower reporting hotline and those types of policies and processes in place, should these types of issues arise, then a company can move quickly to consider and review and investigate and resolve an issue that has been raised in accordance with the policies.

The regulators themselves are also increasingly focused on whether the policies themselves effectively address non-financial misconduct. Companies are expected to demonstrate that they're not just paper policies, but they're actively enforced and embedded in day-to-day operations. So companies should look at making sure that they've got effective, interactive training programs for employees, and that there's this real tone from the top so the people throughout the organization and those at the senior executive level are behaving in a way that is consistent with those policies, so that tone and culture and appropriate behavior can feed down throughout the organization.

Bora, any thoughts on transitioning from the written word on a policy to implementation?

Yeah. I mean, I think Vanessa hit the nail on the head there with leadership and tone from the top. I think that really plays a critical role in how culture will be defined. Having examples of good behavior will get more good behavior. And conversely, having examples of how the policies are interpreted and enforced and monitored also is helpful to set the tone.

I think it's not just board members, senior executives, management at all levels I think needs the right training and the right frame of mind and culture, I think, to try to develop and champion a culture where misconduct is not tolerated. And also having management at all levels and people who are seen as leaders within organization really trained on how to model appropriate behavior internally. And also how to support those that come forward with issues, making sure that incidents or potential issues are dealt with promptly, aren't left to fester or don't arise and then are either ignored or not addressed properly and then they pop up again in different ways.

I think sometimes the types of misconduct we're talking about in the workplace can start small, and if you have a strong culture, if you have a strong HR function and a strong training function, that covers all the aspects that Vanessa was talking about. And if those functions are appropriately resourced and really tuned into the organization, which can be easier said than done, of course. Particularly, let's say you're dealing with large global business units spread out across different business lines and geographies, of course there's a lot of nuance there and a lot of challenge from an organizational perspective. But I think that those baseline points of having the right policies and procedures, having the right teams in place looking after those types of policies and procedures can really help appropriately escalate things, appropriately investigate things, and set the tone for the culture in the organization.

I think what we see clients doing sometimes is also taking proactive steps, like conducting a proactive culture audit. Maybe that can be triggered by different things. It could be a purely proactive exercise of wanting to know how the culture functions in a certain unit or a particular team. Sometimes we see it in response either to specific concerns that are raised, but also to certain events that might happen, like a new acquisition, or a new team coming on board, or a new team being integrated within another team. So it's quite common, I think, for our clients to also engage in those culture audits proactively and try to set in place processes that will support that team or that unit or geography. And there's lots of things that can be done there in terms of prevention and setting the right culture, including providing people with coaching and resources to be able to handle some of these workplace issues before they become something that escalates.

That makes sense. And like many pieces of a compliance program, these are living programs and they develop and react as information's learned and as experience comes to light. Vanessa, are regulators expecting companies to be able to demonstrate that as they're looking at reaction to financial misconduct?

Thanks, Andrew. I mean, the FCA is certainly expecting companies to be able to evidence the effectiveness of their approach to misconduct, and this is always in the UK with regulated companies and they've got to consider against the backdrop of their Principle 11 reporting obligations of being open and transparent with the FCA. And so from an FCA perspective, they're wanting companies that they regulate to track incidents and outcomes, look at trends, and use data to inform and make sure that there's continuous improvement in the compliance processes that are in place.

As a result of all of that, the companies and the advice we've been giving to clients is, they need to be prepared to show the FCA how they've responded, how they've addressed and considered misconduct issues that have been raised. What lessons has that company learnt from going through an internal investigation or regulatory investigation? And what steps have they then taken to ensure that there's no recurrence or that there's actually been an improvement and a change in, for example, the culture of the organization?

Yeah, that documentation is a theme that we have throughout the topics we've covered with this podcast.

I think that wraps up the discussion for today. Thank you both for taking the time to join us. And for the listeners, we hope you can join us next time, but in the meantime, stay vigilant, stay compliant, and come back for the next episode where we'll be discussing another key topic shaping our industry. Until then, bye, and thank you.

Thank you for joining us for today's episode of An Ounce of Prevention. If you like what you're hearing, be sure to subscribe in your favorite podcast app so you don't miss any future conversations. Additional information about Skadden can be found at skadden.com.