First published in The Integrity Gap on 2026-10-01. Read the original on Substack.
Last week, I wrote this piece for the UK Sustainable Investment Forum.
If you don’t fancy a 3-4 minute read, here’s a summary:
-
Most frauds (and other economic crimes) require a ‘supply’ side. That doesn’t always mean someone internally willfully doing the wrong thing - the Arup case where a junior employee was duped by AI avatars of senior executives on a Teams call into transferring ~£20m to criminals demonstrates that exploitation works as well as connivance. To prevent that supply side we need to understand why we do things we should not (pressure, and rationalisation).
-
Understanding why requires us to look at a broad basket of behavioural data, much of which we may feel we already have. But beware. A lot of so-called employee data is crap - sh!t in sh!t out (e.g., badly drafted engagement surveys), or it’s doctored (how many exit interviews actually happen, and are recorded honestly and not downplayed as “a disgruntled employee”).
-
If we’re trying to assess behavioural risk, we might take a future-based approach and consider the 3Cs:
-
Context: What does the intended journey and destination look like? What will we do that hasn’t been done before? Who will we be dealing with?
-
Controls: Where will speed matter more than controls? Where might we grow faster than the systems around us? Where is oversight already challenging? Where are the having-doing gaps (stuff that got written but never properly implemented)?
-
Culture: What does decision-making and delegation look like? How do we communicate? Are we moving fast and breaking things? How do we gather feedback? How do we set strategy, goals, and incentives?
-