My knees start to shake uncontrollably. It’s been only one minute that he has mumbled incoherent nothingness, but I already know that it’s going really bad. Luckily the meeting room table is covering my shakes of terror. But then he — the big boss — is asked another question by the auditor and doesn’t answer it at all. I mean his mouth is moving and words are coming out, they just don’t make any kind of sense. Some of you will know the situation. Certification audits — management systems — CEO interview. The auditor is supposed to check clause 5.1 Leadership and Commitment — top management takes accountability for the effectiveness of the management system. Yeah, well for that he should have a fricking clue what it’s about, which based on his responses he is obviously not. And that after being briefed before. Which I know isn’t the point but we all do it. And then the auditor gives his verdict, my knees freeze and then I’m shocked even more. “OK, all fine. We are done here.” Wait, what? Turns out that little scene is a pretty good place to start talking about ethics.

The Board Room Version: Clause 5.1 (leadership & commitment) is the key to any management system – the rest of the standard builds on it, yet it’s the one requirement that rarely gets audited with rigor. Commitment isn’t what is said in the room – it’s what an organization actually rewards. Morality is what you claim to follow. Ethics is stepping back and asking why this is important and how to resolve value conflicts. Most companies never get past the first one. MacIntyre’s diagnosis: we still use the words but we have lost the framework that lets us settle that argument. The manager has become a modern archetype: claims neutral technical position while quietly deciding, without any moral reasoning, what the right thing to do is. That is not the absence of a moral stance. That is a moral stance that never had to defend itself. Clause 5.1 asks a moral question –  do you take responsibility for this system – dressed as technical requirement. That disguise is exactly why it’s so easy to fake. Ethics isn’t a decorative statement on a wall. It’s the ongoing, uncomfortable work of examining whether your stated rules still hold up — and most organizations are built to avoid ever doing that work.

The Leadership and Commitment clause is not unique to ISO management systems standards. You find the same requirements in many safety, security, sustainability and quality standards. Somewhere in there you will find a reference that the whole thing has to come from the top and get full support from leaders. That came about because the systems were viewed as specialist topics, but authors of these standards realized that leadership needs to set the tone otherwise the whole rest of the standard is pretty much useless. If leadership does not support implementation, provide resources and walk the talk, why should the rest of the organization care? The problem is that it is rarely checked thoroughly. It’s often like a courtesy visit between auditor and CEO and no matter what the old man says, he gets a passing grade.

The interesting thing is that this is not just a technical point in a standard. This is fundamental in how companies deal with values. See, if the big boss does not declare this to be important it does not count in businesses and all the rest of the clauses build on that commitment. Because standards are like… Ha, got you, we will get to that later. But seriously this one is really important for what we do in companies, why and how, the means and ends. And it has to do with the topic of this essay, the big word, too big for most of us to get our heads around it: Ethics, specifically business ethics, you know the thing that every Hollywood movie about corporate life tells you is treated like shit.

As usual we need to go back a bit, but not too far, just the early 1900s and my favorite lawyer turned economist and sociologist Max Weber. He analyzed where what we today would call work ethics actually came from. You know the whole work hard and no pain, no gain thinking. Don’t be shocked but a good part of it comes from religion, early Protestantism to be exact. Now, religion was always a strange topic for me, I try to approach it Bernard Shaw style, meaning I don’t believe it but I try to really understand it. See, in protestantism, especially Calvinism, people were taught that they could not be certain whether God would give them salvation. There was no direct way to earn salvation through confession and absolution or participating in any other ritual. That made them of course quite anxious. So they tried to show that they were good people through disciplined and orderly and productive lives. So work became more than a way to make money. It became a moral test. And since there is no end to this — as in the end of a specific ritual — there was no moment when you could say, “I have done enough good.” So the test became a permanent one.

OK, but that is not us anymore, even if you were raised Protestant — which I was. Right, over time the religious belief faded, but the habit remained and it even crossed religious borders. Modern organizations — not just companies, but also schools, for example — used the habit, the discipline, the efficiency, the idea of constant work even after the spiritual purpose had long disappeared. That’s what Weber called the iron cage: Following a system of work and discipline that was once filled with religious meaning, but now often feels empty.

But that vacuum was actually filled with what we see today. And for that analysis we can look at Robert Jackall’s “Moral Mazes: The World of Corporate Managers”. And as a good sociologist he combined historical analysis and empirical study. Let’s start with the historical one. He continues where Weber left us and explains the first instance when official moral authority and modern business logic diverged but still used the same language. The Puritans in New England in the mid 1600s split into a city-based merchant group and the land-based Covenant guardians. The latter still very much saw the colony as a religious community bounded by the belief in God. Their economic activity had to remain subordinate to the religious mission. In city centers such as Boston, another class developed. Much more focused on the booming trade business they started to operate more on a modern economic logic — you know, prices according to supply and demand, doing business with the outside world. They didn’t scream forget God and praise capitalism, they still used their Puritan words but used it to describe commercial success as evidence of God’s blessing and their diligent work.

This has carried over into today’s corporate life which is a constant test of whether you are considered a good, reliable and promotable person. And since your beliefs cannot be tested or observed, it has become about what you say, the loyalty you show, what you deliver, the way you behave towards your superiors. So eventually the vacuum mentioned before has been replaced by the boss. The boss replaced god — but unlike God, the boss follows no fixed commandments and gets replaced every other year.

Furthermore this constant proving your worth is something that eventually found its way into the activity of auditing. Audits are nothing else than a recurring check of what you did, but also a test of what kind of person or for companies what kind of an organization you are. At least that last bit is my interpretation, so don’t complain to Jackall on this.

OK, this is much, I know. Let’s follow Jackall a bit further and leave the Puritans for now. He looks at corporate hierarchy and discovers that it is working also a bit like feudal loyalty systems. Your boss and the lord of the castle have similar roles. He protects you when something goes wrong, gives you access to resources, promotes you and covers you against criticism from the king — sorry, his superior. In return you provide him with information, defend his position and do not challenge him or go over his head. Yeah, well that’s how it works, you might say. True, but the crucial point here is what gets lost. This is behavior that only respects the chain of loyalty; factual truth or moral correctness gets dropped.

So authority is not about an abstract institution, it’s about a personal relationship with your immediate boss. So it is less about loyalty to a company or system much more to a person.

See Jackall actually studied companies — interviewed managers and observed cases. So he is not just grasping these things out of thin air. He has this one case where something really bad happened in a company. The employee who discovered it, tells his boss about it. But the boss refuses to act. The employee then reports it directly to his boss’s superior. Top management has officially praised the openness, integrity and escalation. But the employee mainly gets to experience the informal reaction. He is not promoted anymore and eventually gets under so much pressure that he has to leave the company. The reasoning of management is that the employee has shown he cannot be trusted to work within the loyalty structure.

Another interesting area is information and command flow. Superiors tend to be vague in their commands downwards. Instructions are rarely concrete, especially if it’s uncomfortable actions, like firing people. Jackall even found instances where top management only had to make a side comment on overstaffing and middle management reacted with widespread layoffs. More common are cases when top management gives general instructions and leave the execution to their subordinates. Of course if the outcome of an action is successful, management will take it as an example of their leadership success.

Bad news filtering is another important phenomenon and it connects to the aforementioned example. What happens in companies is that problems that are usually discovered by workers get reported, the supervisor then calls it manageable, middle management describes the situation as a temporary difficulty and once it gets to management the project is still on track. This is due to every level in the hierarchy protecting himself, the people above and below. So negative information gets softened so it cannot reflect badly on anybody.

All of these examples have the same goal. They are used to maintain plausible deniability up and down the chain.

A similar phenomenon is that of target setting. People in companies have to regularly commit on a number they will have to deliver — like a budget number or a performance indicator. Problem is that this commitment does not mean a moral dedication to a factual number but an agreement that came out of a discussion or process. It’s basically a deal. And in this discussion all participants will pad the numbers or try to make them work in their own interests — senior management wants an ambitious number — lower management wants a survivable number. Both sides know assumptions are being adjusted. Everyone later presents the result as a firm commitment. So the organization publicly treats the number as hard fact, even though insiders know it emerged from political negotiation. To be clear if the negotiations of targets would be open and clear to everybody it would not be dishonest. The dishonesty starts the moment the negotiated number gets presented as an honest forecast rather than a political compromise.

And this is the moment when we have to bring out the big gun again. The German philosopher Immanuel Kant’s moral test asks whether you could universalize your behaviour — that is, whether you could will everyone to act as you do. Yes, I’m using Kant before I’ve properly introduced him, bear with me, definitions come in a minute. Now if all the parties quietly build reserves and interests into the numbers and do not treat the number as an honest forecast, nobody would treat these commitments as reliable, as anything but a fake. The process would only work if people assume such promises to be sincere and factual. This practice eventually hurts all those who still believe that commitments to numbers are sincere. They draw the short straw. And that is Kant’s actual point: a lying promise only works on the shoulders of the ones who make promises that are still trusted.

Now I promised you that this was about ethics and that means we need to agree on what this actually means. And permit me to keep this relatively simple and spare you any long philosophical discussion on terminology. Because it is not the same as morals or morality which is a set of rules, duties and values people claim to follow — “I do not lie” — “I treat people fairly”. We also call this first-order stated content. It is what it is, plain and simple. Ethics is when we take one step back from the rules — also called second-order reflection. It examines and justifies morals — why is it important not to lie or what do we do when value conflicts. So if you would have to lie to protect your friend from being murdered. You lie, right? Well go and discuss that with Kant. Now there is also something called moral reasoning and that means reasoning about what one should do because it is right, not only because it is useful. So not “what will benefit me?” or “what is safe?” but “what is right, even when it costs me?”. For hardcore Kantians like myself these questions are not in the same ballpark. Only the last is the true moral reasoning, the others do not count as an argument.

OK, this is complicated enough, you might think. Sorry, for this discussion I have to add one and it comes from the philosopher Alasdair MacIntyre: Emotivism. His argument is that in our society today we still use moral words — like justice and duty and rights and responsibility — but what we have lost is the philosophical framework that once allowed people to justify the meaning of these words. What we miss is the language to justify justice, so to speak. As a side note Kantians would say that every rational person has equal moral worth and must never be treated merely as a tool for someone else. From there, a Kantian would derive a demand for equal respect and consistently applicable rules. With Aristotle it would be something like justice is part of human flourishing and a well-ordered community and with the Utilitarians it would be justice is justified by its consequence for overall well-being. Sorry to the philosophy crowd for the ridiculous compression of the three schools.

Problem is that we miss those frameworks today according to MacIntyre. We still reason, sort of, but with fragments — which means we often lack the shared standard to actually settle an argument. Or only like some philosophical dummies: “This is unjust.” — “No, it isn’t” — “Well, I strongly disapprove.” That is not a discussion or a reasoning, it is just two people stating their preferences or feelings. And MacIntyre sees this as a main reason we have such big issues with ethical questions today.

One of the places this shows up most clearly is in a figure we all recognize: the manager. For him the manager is one of the three modern archetypes — alongside the aesthete and the therapist. The manager claims neutral technical efficiency — nothing personal, it’s just business. But with that he actually hides a moral stance about the ends — what his actions result in or the goals. These ends are treated as already decided, as a predetermined fact — increase profit, reduce costs, hit the target. Of course this is not true. It is his implied moral point that these are the right goals. Although — just to make that clear — he never reasoned them. There was never a discussion on these goals, not even with himself. He fooled himself in believing that he had no choice.

Same goes for the difference between internal goods and external goods. In a practice — auditing or leadership or medicine — there are internal goods, accessible only by actually doing the thing and getting good at it: finding a system working, making sound judgement, curing a sick person. External goods — money, reputation, power — are different. They are not necessarily evil, but you can get those from all kinds of activities. Problem is that especially in companies there is the tendency to concentrate on external goods and therefore shape the practice around getting these and forgetting what the internal good is. In an audit for example there is always the conflict between independent verification — the internal good — and keeping the client, earning fees and such — the external good. Classical conflict of interest.

This is where we get a bit more into craftsmanship. The internal goods are not just one thing but come out of a tradition, a long-running argument about what actually works in any practice. Take quality management for example. You have Shewhart developing statistical control and variations. Deming expanding this into management, systems and responsibility. Then come all the quality thinkers who added customer focus and process thinking and continuous improvement. Eventually ISO turns part of it into a formal standard. This is a rich tradition. Lots of opinions and discussions have made it into a treasure chest of internal good — or better, a long argument over what works best across generations. The danger is obvious that once it becomes a fixed standard and is never changed that tradition cannot grow anymore. And secondly if the focus is on the external good — passing the certification for that standard, the internal goods get forgotten.

Extending this a bit — and I’m sure organizational psychologists have a proper name for this already — I just call these decorative and practiced virtues. Decorative virtues are things that the organization says it values. On the other hand practiced virtues are the things that it actually supports. So to take certification as an example. Internal good is the auditor truthfully assessing whether leadership is effective. External good is the certification company actually keeping the client. The decorative virtue would then be that the auditing company displays commitment and integrity during the audit. Whereas the practiced virtue is revealed by what the audit company’s incentive structure actually rewards — auditors who avoid conflict, keep clients happy, don’t cause trouble — regardless of what the company’s stated values claim.

Now this is all very high and mighty stuff. Does this really matter in everyday corporate life? Agree, I sometimes have that feeling too. We work for our boss, not our company, because he can fire us. Targets are often political stuff that don’t reflect reality and seem to be the result of =RAND(). And yeah we seem to have lost the ability to talk about morals or ethics or reason any of it. And when it comes to values and the tradition of our craft, well, profit is just more important, everybody knows that. Does that mean we have just become a bunch of business cynics?

Actually it is more normal than that, less cynical and flashy. Best case study for this is Diane Vaughan’s study of the Space Shuttle “Challenger” accident in 1986 and what happened at NASA and its subcontractors before the launch. What happened technically is not disputed: a seal in one of the booster rockets failed to hold because of low temperature, and hot gas escaped where it shouldn’t have. This kind of seal erosion had been seen before, and its seriousness had been debated inside NASA and the responsible subcontractor many times, including on the evening before the launch. But the Challenger launch went ahead and 73 seconds after launch the vehicle broke apart, killing all seven crew members. Now there were numerous hearings and investigations done on the decision to launch. These as well as the media and the public all came to the conclusion that it must have been managers, responsible people making a bad, an immoral call. Keep the schedule, avoid additional costs, launch although there was a known risk of failure. There is even a famous conversation that took place in one of the meetings — an internal one of the subcontractor company — before the launch. One senior manager confronted the engineering head who had opposed the launch: “Take off your engineering hat and put on your management hat.” See, clear immoral corporate behavior.

Problem is that was not the issue. Vaughan studied the case in great detail and eventually found no smoking gun, no violation of internal rules that would explain it. No bad guy manager. They largely conformed to the internal rules. Problem was that what counted as acceptable had quietly shifted.

The Space Shuttle program had been under cost and time pressure ever since it was founded in 1972. A gap between declared commitment and actual resources provided from the beginning. This created a culture of constant friction between safety and time- and resource-pressure. This might explain the normalization of deviance as Vaughan called it. What she observed was a pattern of issues — like the material weakness that led to the accident — being reported, it then was officially acknowledged, reviewed based on internal standards, often it then got officially accepted — let’s call it the first normalization — then there was a shuttle launch, nothing happened and the success becomes evidence for the next cycle. Call that the second one, if you like — Vaughan doesn’t number it that way, but the pattern repeats. Repeat this enough times and a lot of issues just disappear into normality, because each time there is no catastrophe, no bad case, the organization is not just confirmed in the belief that the individual issue was acceptable, but the pattern, the modus operandi is reconfirmed. This is not the only mechanism she found at NASA, but it was the most fundamental. Others were a concept of inverted burden of proof — it had to be proven that something was unsafe, not that it was safe —, redundancy was seen as an excuse to keep flying, not as a warning that the design itself was failing and there was something that has been often identified as an issue in organizations experiencing major accidents: structural secrecy. In these cases information flow is set up in a way that it only exists in fragments and the whole picture is lost. In Chernov & Sornette there are more examples of this. It can be unintentional/structural as in the case of NASA or deliberate as an active concealment strategy.

For Vaughan the issues causing the Challenger accident were organizational and cultural. And it links to internal good and external good. If the launch was the default outcome of safety processes and documentation, the internal good was forgotten. The moral intention of it was dropped.

I have to add two points here because I think they are important lessons for common business practices. First regarding audits: It is crucial in my opinion as an auditor to find and analyze the failure instances in organizations. What does an organization do when a safety system fails, what does it do when it produces bad quality. If and only if an organization can react and adapt to the negative case, it has the system and the culture that it needs. Perfection does not exist, the important thing is can you admit and react to failure. The second which becomes apparent at this example is also the connection back to ethics. It is about risk management and specifically the scales used in assessing risk and risk-appetite in an organization. I often have argued for more intensive and continuous revisions of these parameters in companies. Because this is not just a number game but a practical application of ethical discussion within companies. Do we accept injuries in our activities, do we accept emissions, if yes to what degree and why?

As we started with standards and certifications we will also close with it and Lawrence Busch’s analysis in “Standards: Recipes for Reality”. He describes it best already in the title: Standards are not just a description of reality, they help to shape it, they are an instruction. And more importantly for our discussion: they may look all neutral and fact-based but actually carry social values. They are a fusion of the technical and the ethical. And the clause 5.1 is the perfect example of it. Top management takes accountability for the effectiveness of the management system sounds technical but is in fact the question: Do you believe in this stuff and do you practice it. It is a question of commitment in a moral sense.

Why do standards hide this? Part is the history of standards. They do come from a fairly technical background. In short: a lot of craftsmanship rules made their way into modern standards. So we still find standards for weld seams and similar things. No moral reasoning in them. The other reason is that standards tend to want to project the appearance of checkable category and try to hide anything that is not easily provable. Busch describes the whole phenomenon as commensurability. For a standard to be workable it needs standardization — well, stating the obvious — that makes it comparable. Because in order to compare things they have to be first made comparable, put into the same category, so to speak. That is what a standard does. And comparability is needed in order to allow a ranking, a judgement, eventually a certification. Because that is the other key characteristic of standards. The verification and the checking and the certification. We saw that before that certifications are external good — again this is not evil but it diverts from the internal good. I am certified on an environmental standard is not the same thing as I am green. And even worse when the external good, the certification overshadows the internal good. When companies start to chase certificates and not the real goal of a standard. The “are we doing it well” becomes the “can we pass the audit”. And this is, every practitioner in the field would agree, too often the case.

Let me add some points to Busch’s analysis: This danger of standard corruption is worse with the methodical type — as in a quality management standard — compared to pure technical ones. Clause 5.1 for example can be corrupted without changing any number or backdating any document. The way it is audited today in most cases the CEO just needs to do a good acting job. This is something that needs to change. Factual proof of commitment can be resource allocation, follow up on action items from a review meeting — not perfect but better.

Second, Busch sees conflicting standards as an issue. Different standards have different stakeholders in mind, hence there can be contrary interests — Health & Safety vs. Quality vs. Environment. Take AC units in Europe. Bad because of higher energy consumption, good because it brings the heat in buildings down to a bearable level for employees. I think these conflicts are a good thing and to be expected. It requires us to have a discussion on values and this if done correctly is not just enabling us to find new solutions for problems but is also improving the application of standards.

This is also connected to my third point: standards do not just need a fixed revision machinery — as ISO standards, for example, already have — they also need to include more and more diverse stakeholder groups, in order to reopen the underlying moral and political assumptions of the standard. This would also better enable standards to develop and adapt to changes in society, economics and science.

My last point is to remember that standards and organizational structures — also similar to laws — do never replace individual reasoning. Standards can be many things, an instruction, a guide, a boundary for our activities, but eventually decisions are made within these limits and by individuals. And the moral reasoning has to always be done for each case by a person or a group and also on all levels.

What happens often in organizations is that at lower levels only the factual possibility is discussed. It’s called functional rationality — “How can a target be achieved?”. Substantive rationality — “Is this the right, sensible, worthy, ethical target?” — is only discussed at the top level. But even there the discussion is mostly thin. Main reason for that is probably that the top level is missing the detailed information only the lower levels would have but are not permitted to have such discussions. So the setup is a systemic trap.

But this is just a functional issue of ethics in business, the broader problem is not even apparent to most authors. It’s the fact that most moral reasoning in business and our modern society has been replaced by reflections on wants and needs. “What brings me something?” — “What is safe?” And that both on an individual and on an organizational level. “What is good for the company?” That means that ethics has been hollowed out and replaced by something that only psychology and sociology can name. MacIntyre sees this but in my opinion comes to the wrong conclusion. For him this was already caused by the stripping away of moral frameworks by the Enlightenment, when only reason was left. I do not agree. Kant has demonstrated that with reason alone you can have a very fruitful ethical discussion. But we can discuss that over a lager and a Guinness.

I know this has been a tough one to follow. Ethics was never an easy topic, it wasn’t meant to be. But eventually it is what gives our actions a reason, an end. Without it we only have means and tools and we ourselves end up being just that, a tool. And it is also not something complicated. Ethics is basically just reflection — Auseinandersetzung, really — with knowledge. Easy, right?

Well, I guess there is more to explore.

Are you a means and an end? LinkedIn

Don’t just take it from me, here is some good stuff to read:

Jackall, Robert. Moral Mazes: The World of Corporate Managers. Oxford University Press, 1988 (20th-anniversary edition with new closing essay, 2010).

MacIntyre, Alasdair. After Virtue: A Study in Moral Theory. University of Notre Dame Press, 1981.

Vaughan, Diane. The Challenger Launch Decision: Risky Technology, Culture, and Deviance at NASA. University of Chicago Press, 1996 (enlarged edition).

Busch, Lawrence. Standards: Recipes for Reality. MIT Press, 2011.

Porter, Theodore. Trust in Numbers: The Pursuit of Objectivity in Science and Public Life. Princeton University Press, 1995. One-sentence citation only.

Robison, Peter. Flying Blind: The 737 MAX Tragedy and the Fall of Boeing. Doubleday, 2021.

Chernov, Dmitry, and Didier Sornette. Man-Made Catastrophes and Risk Information Concealment: Case Studies of Major Disasters and Human Fallibility. Springer, 2016.

Farber, Henry S., Daniel Herbst, Ilyana Kuziemko, and Suresh Naidu. “Unions and Inequality over the Twentieth Century.” Quarterly Journal of Economics, 2021 (NBER Working Paper 24587).

OECD. OECD Principles of Corporate Governance. OECD Publishing, Paris, 1999.