Almost every conduct scandal of the last decade arrived at the board the same way. Late. By the time it reached the agenda it was already a remediation program, a regulator’s letter, or a media story. Yet in nearly every case, the signals had been present in the organisation for months or years. They simply never made the journey up to the board.

Conduct risk is not hard to govern because it is invisible. It is hard to govern because the path from where it shows up to where the board sits is full of filters.

Why the signals get filtered out

Conduct problems first appear as small, deniable things. A spike in complaints in one team. A sales incentive that rewards the wrong behaviour. A manager whose results are excellent and whose attrition is worse. Each one is explainable on its own. Each one is reported, if at all, in a different system, to a different function, in a different language.

By the time these reach the board, they have been summarised, aggregated and reassured into a single green line on a culture slide. The texture that would have told the story is gone. The board is not hiding from conduct risk. The reporting chain is quietly smoothing it away.

Where to actually look

Directors who govern conduct well stop relying on the curated culture report and start looking at the places where pressure shows up first.

WHERE CONDUCT RISK SURFACES BEFORE IT REACHES THE BOARD

• Incentive design: what behaviour does our pay structure actually reward, regardless of what the values poster says?

• Complaints and whistleblower data: is it rising, where, and does it ever reach the board unfiltered

• Attrition by team: which high-performing units are quietly bleeding people, and why?

• The gap between stated values and lived experience in engagement data, especially where the two diverge sharply.

• How bad news travels: when something goes wrong, does it reach the board fast, or get managed first?

That last one is the tell. In a healthy culture, bad news moves up quickly because people trust that raising it is safe. In an unhealthy one, it moves sideways and down, getting handled before it reaches anyone accountable. A board that only ever hears good news is not in a low-risk organisation. It is in a poorly wired one.

Conduct shows up in unexpected places

Conduct risk does not stay in the conduct box. Consider payday super, which from 1 July 2026 requires employers to pay superannuation at the same time as wages. It looks like a payroll process. It is also a conduct indicator. An organisation that routinely lags on its obligations to its own staff is telling the board something about how it treats commitments when no one is watching. The same logic runs through unpaid entitlements, contractor treatment and the quiet corners where short-term pressure meets long-term obligation.

The board’s job

The board cannot manage culture from the room. It can refuse to be managed by the reporting. That means asking for the unsmoothed data, paying attention to where bad news travels, and treating a suspiciously clean culture report as a question rather than an answer. Conduct risk hides in the gap between what the organisation says about itself and what its numbers quietly show. The board’s task is to keep looking in that gap.