Skip to content
[email protected]
Contact Me
©2026 Nabil Al-Kilany. All Rights Reserved.

A board can change its charter, its committees, its independence ratios and its risk appetite in a single meeting. It cannot change, in that meeting, the rule that decides whether any of them get used.

Posted At:

A corridor outside a glass-walled boardroom in Riyadh; the board sits behind the glass, out of focus, while one figure seen from behind walks away toward the lifts with a folder under his arm.

On 16 September the GCC Board Directors Institute staged a debate on the motion “This House believes the board receives the truth it deserves.” The panel was sitting directors of listed companies and a group chief executive from the healthcare sector, arguing the case as it should be against the case as it is in Saudi Arabia. The room voted twice. Before the debate, 93% supported the motion. After it, 67% did, and the undecided share had grown. The Institute did not publish the poll; the figures are the ones shown in the room, which I watched. Nobody had produced new evidence in the intervening hour. What had changed was that the room had been asked to think about the filter between a company and its board. Afterwards I compared notes with Annette Bak Kirby, who led McKinsey’s leadership and culture practice, Aberkyn, in the Middle East and now coaches boards through INSEAD Executive Education. Her count, from the boards she has advised, was that more than seven in ten were blind to that filter until it bit them. That conversation is the reason for this article, and for its claim: the item a board spends least time on is the one that decides whether the rest of its governance is used.

In one sitting, a board adopts a risk appetite statement, a whistleblowing policy and a related-party policy. Three resolutions, three votes, no dissent recorded. Eighteen months later the audit committee first hears about the problem from the regulator.

Nothing failed on paper. The policies existed, the committee had met, the charter said what a charter is supposed to say. What failed was unwritten: what happens, in that company, to the person who carries bad news upward. Edgar Schein separates the written layer of an organisation, which he calls espoused beliefs and values, from the layer that governs behaviour, which he calls basic underlying assumptions. A governance strategy is written in the first. A company runs on the second. The first article in this series argued that where ownership is concentrated, the controller selects the monitor. The monitor is only as independent as the room allows.

Schein's three levels of culture read from a boardroom: artefacts (charters, committees, policies, the board pack) are changed by resolution in one meeting; espoused beliefs and values (the values statement, the code of conduct, the risk appetite) are where the governance strategy is written; basic underlying assumptions (what it is safe to say, do and ignore) are where the company runs, on its own clock.

Saudi Arabia compressed that gap into a decade, moving a generation of family and founder-led firms onto listed-company governance through the Main Market and Nomu faster than most markets have managed, and every one of them adopted the framework before the culture it landed in had time to move with it. The evidence below is American, British and European; no study I can find measures the two together for Saudi companies.

What the board is allowed to know

A board’s information is filtered before it arrives, and the filter is cultural. The independent directors of Wells Fargo published their investigation in April 2017, after 100 interviews and more than 35 million documents, and located the root cause in a “distortion of the Community Bank’s sales culture and performance management system” and in a decentralised structure that “gave too much autonomy to the Community Bank’s senior leadership”. The board received summaries describing the problem as contained. Wells Fargo had the policies. The finding was the culture.

Boeing’s 737 MAX shows the same filter from the other side. The House Committee on Transportation and Infrastructure published its final report in September 2020 under five themes, one of them “culture of concealment”, finding that Boeing withheld information from the FAA, its customers and the pilots, and concealed the very existence of MCAS from them. Notice what the report does not say. It does not say the certification paperwork was missing.

Where culture has been measured, it predicts. Guiso, Sapienza and Zingales, publishing in the Journal of Financial Economics in 2015, found that proclaimed values appear irrelevant to performance while integrity as perceived by employees goes with stronger performance. The values on the website are the governance strategy. The employee survey is the culture. Only one of the two predicts anything.

Culture turns incentives into behaviour the design never anticipated

Governance sets the target and the control. Culture decides how the target gets reached. Wells Fargo’s cross-sell strategy was unremarkable as written; a bank selling more products to the customers it already has is a strategy a board can approve. The report cites the CFPB order’s figure of 1,534,280 possibly unauthorised deposit accounts, opened by employees keeping their jobs. The Department of Justice and the SEC settled with the bank in February 2020 for USD 3 billion over conduct running from 2002 to 2016.

Volkswagen shows what happens when a target cannot be reported as impossible. In January 2017 the company agreed to plead guilty to three felony counts and to pay USD 2.8 billion in criminal and USD 1.5 billion in civil penalties, with six executives indicted and an independent compliance monitor imposed for at least three years. The Department of Justice has published no finding on Volkswagen’s culture, and the internal Jones Day report was never released. The claim that an engineering culture made the impossible target unreportable is commentary, and I mark it as such.

The fraud data points the same way when it is read carefully. In the ACFE’s 2024 global study, the median occupational fraud loss was USD 145,000 and 43% of frauds were detected by tips, more than three times the next method, with 52% of those tips from employees. The most common control weakness was the absence of internal controls at 32%, ahead of override of existing controls at 19% and lack of management review at 18%. Poor tone at the top was named in 8% of cases and 19% of owner or executive frauds. Those numbers indict two things at once, controls that were missing and cultures in which people did not speak. Only the first is purchasable by resolution.

Primary internal control weakness in 1,921 fraud cases, ACFE 2024: lack of internal controls 32%, override of existing controls 19%, lack of management review 18%, poor tone at the top 8% overall and 19% when the perpetrator is an owner or executive. Tips detected 43% of frauds, 52% of them from employees.

The governance strategy can build the culture that defeats it

Tightening governance changes culture. Popadak, who now publishes as Jillian Grennan, tracked firms as shareholder governance strengthened and found that they moved toward results orientation and away from customer focus, integrity and collaboration. Sales, profitability and payout improved first. Intangibles then deteriorated, and firm value declined 1.4% through what she calls the corporate culture channel. The governance reform was real, and so was the culture it produced.

The corporate culture channel as a loop: shareholder governance tightens; results orientation rises while customer focus, integrity and collaboration fall; sales, profitability and payout improve first; intangibles then deteriorate and firm value falls 1.4%, which feeds back into the case for tighter governance. Popadak, working paper, 2014.

The same research prices culture in the other direction. Edmans, in the Journal of Financial Economics in 2011, found that a portfolio of the “100 Best Companies to Work For” earned an annual four-factor alpha of 3.5% from 1984 to 2009, and 2.1% above industry benchmarks. Sørensen, in Administrative Science Quarterly in 2002, found that strong cultures deliver reliable performance in stable environments and lose that advantage when the environment turns volatile. The culture that made a founder successful is the culture that resists the board when the market moves.

Fahlenbrach, Prilmeier and Stulz, in the Journal of Finance in 2012, found that a bank’s 1998 stock performance predicted its 2007-08 performance and its probability of failure, and that the relationship survived a change of chief executive. The authors explain it as a persistent business model, with short-term funding, balance-sheet gearing and growth doing the work. Calling it risk culture is my gloss, and I flag it as one.

What the literature cannot do is settle cause. Most of it is associational: survey measures of culture share a method with the performance they are tested against, and the case studies are selected on failure, so they say nothing about the base rate. The strongest designs, Fahlenbrach’s persistence across a decade and the text-based measure Li, Mai, Shen and Yan built from 209,480 earnings-call transcripts, narrow the gap without closing it. Read the argument as strong evidence of mechanism, weak evidence of magnitude.

The executives themselves are not the obstacle. Graham, Grennan, Harvey and Rajgopal, in the Journal of Financial Economics in 2022, surveyed 1,348 North American executives: 92% agreed that improving culture would increase firm value, and 84% said their own company needed to improve its culture. Almost everyone believes culture is worth money, almost everyone believes theirs needs work, and almost nobody’s board pack carries a measurement.

The boardroom has a culture too

The room at the top is a group, and groups carry cultures. Forbes and Milliken, in the Academy of Management Review in 1999, described boards as strategic decision-making groups whose output depends on three processes: effort norms, cognitive conflict, and the use of members’ knowledge and skills. All three are cultural. A board that never tests the executive’s number, or receives the pack too late to read it, has a low effort norm whatever its charter says.

The GCC Board Directors Institute’s 2025 Board Effectiveness Review, drawn from 193 respondents and 14 interviews across the region, found that 67% of directors said all members actively participate and 63% said members were well prepared. The interviews qualified it: the role of the chair, or of a few influential voices, can shape outcomes disproportionately, and it is the chair’s responsibility to empower all members. The same review found that only 32% of boards have a formal director lifecycle process. A board recruited through relationships carries the culture of those relationships.

Annette Bak Kirby put the paradox to me in writing the next morning: a board will not ask for development in an area it has not yet seen needs its attention, so the work of improving how a board talks to itself lives, in her phrase, in the blind angle of the boardroom. Boards that concede they are not using their collective potential still look for the remedy in governance and policy, when the larger uplift is the human shift inside the room. The Board Value Index published by Board Intelligence in June 2026, from more than 400 directors, chief executives and finance chiefs in the UK, US, Nordics and Middle East, gives the cost: 86% said board processes had contributed to a delayed, rushed or poor decision in the previous six months, and only 37% saw their board as essential to value creation. Neither figure is about a missing policy.

The Institute of Risk Management’s risk culture guidance, which the board directorship programme behind this series puts in front of directors, closes with ten questions a board should ask itself. Two carry this article. How does the organisation respond to bad news? How does it reward appropriate risk-taking? Ask both in a boardroom and watch what happens before anyone answers, because the pause is the data.

The Saudi position

Saudi regulation is not the constraint. The Capital Market Authority’s Corporate Governance Regulations, renumbered by the January 2023 amendment, place the professional conduct policy in Article 83 and require the board to establish a policy for professional conduct and ethical values. Culture runs through the same text: the board must be aware of the culture of risk management, executive management must build a culture of ethical values, and the chairman must encourage constructive criticism (Articles 21, 25, 26 and 68). The Companies Law of 2022 supplies the machinery underneath. No article can require that the policy is believed.

The loyalty objection comes first in a family firm: that culture means loyalty, and that talk of culture is a way of diluting it. Loyalty and honesty upward are not competitors. The version of loyalty that treats bad news as betrayal is the one that costs a board its information, and the founder sets the price of the first piece of bad news ever brought to him.

In a founder-led firm the founder is the culture. A company trained for a decade to route around a board it did not have will route around the board it now has. The Saudi extrapolation is low confidence, stated once. The mechanism travels even where the measurement does not.

Sequence, not slogans

Measure the culture before redesigning the governance, not after. The instruments are unglamorous. An employee-perceived integrity measure, on the Guiso and colleagues design. The Financial Reporting Council’s 2016 report, which holds that a healthy culture both protects and generates value and that boards should oversee strategy and culture together, setting, monitoring and being prepared to act. The IRM’s ten questions. An exit-interview read. And the cheapest diagnostic of the lot: find out what happened to the last three people who carried bad news upward, and whether they were promoted, ignored or managed out. Then change the governance.

I sit inside a listed-company framework and pay the full tax willingly. What I have learned is which part of it works. It is the part the culture had already agreed to. Everything else is a document until the room decides otherwise.

Sources

  • Schein, E. and Schein, P., Organizational Culture and Leadership, 5th ed., Wiley (Jossey-Bass), 2017, ch. 2; the labels “espoused beliefs and values” and “basic underlying assumptions”. ISBN 978-1-119-21204-1.
  • Capital Market Authority (Saudi Arabia), Corporate Governance Regulations, issued by Resolution 8-16-2017 (13 February 2017), amended by Resolution 8-5-2023 (18 January 2023); Article 83 (professional conduct policy; Article 85 in the 2017 numbering), Articles 21, 25(13), 26 and 68(11). https://cma.gov.sa/en/RulesRegulations/Regulations/Documents/CorporateGovernanceRegulations1.pdf
  • Companies Law, Royal Decree M/132, 2022, and its Implementing Regulations.
  • Independent Directors of the Board of Wells Fargo & Company, Sales Practices Investigation Report, 10 April 2017; counsel Shearman & Sterling; 100 interviews and more than 35 million documents; CFPB order figure of 1,534,280 possibly unauthorised deposit accounts (fn 7). https://lowellmilkeninstitute.law.ucla.edu/wp-content/uploads/2018/01/WF-Board-Report.pdf
  • US House Committee on Transportation and Infrastructure (Majority Staff), Final Committee Report: The Design, Development & Certification of the Boeing 737 MAX, September 2020, 238 pp.; Theme 3, “Culture of Concealment”. https://democrats-transportation.house.gov/imo/media/doc/2020.09.15%20FINAL%20737%20MAX%20Report%20for%20Public%20Release.pdf
  • Guiso, L., Sapienza, P. and Zingales, L., “The value of corporate culture,” Journal of Financial Economics, 117(1), 2015, pp. 60-76. DOI 10.1016/j.jfineco.2014.05.010.
  • US Department of Justice, “Volkswagen AG Agrees to Plead Guilty and Pay $4.3 Billion in Criminal and Civil Penalties; Six Volkswagen Executives and Employees are Indicted,” 11 January 2017; plea accepted 21 April 2017 (E.D. Mich. 16-CR-20394). USD 2.8bn criminal and USD 1.5bn civil; three felony counts; independent compliance monitor. https://www.justice.gov/archives/opa/pr/volkswagen-ag-agrees-plead-guilty-and-pay-43-billion-criminal-and-civil-penalties-six
  • ACFE, Occupational Fraud 2024: A Report to the Nations, released 20 March 2024; 1,921 cases, 138 countries. Median loss USD 145,000; 43% detected by tips; 52% of tips from employees; control weaknesses: lack of internal controls 32%, override of existing controls 19%, lack of management review 18%; poor tone at the top 8% overall and 19% for owner or executive fraud. https://www.acfe.com/-/media/files/acfe/pdfs/rttn/2024/2024-report-to-the-nations.pdf
  • Popadak, J. (now publishing as Jillian Grennan), “A Corporate Culture Channel: How Increased Shareholder Governance Reduces Firm Value,” working paper, Wharton; SSRN 2345384 (DOI 10.2139/ssrn.2345384); open PDF dated 15 January 2014. Unpublished. https://www.anderson.ucla.edu/documents/areas/fac/finance/Popadak_A%20Corporate%20Culture%20Channel_1.15.14.pdf
  • Edmans, A., “Does the stock market fully value intangibles? Employee satisfaction and equity prices,” Journal of Financial Economics, 101(3), 2011, pp. 621-640. DOI 10.1016/j.jfineco.2011.03.021.
  • Sørensen, J., “The Strength of Corporate Culture and the Reliability of Firm Performance,” Administrative Science Quarterly, 47(1), 2002, pp. 70-91. DOI 10.2307/3094891.
  • Fahlenbrach, R., Prilmeier, R. and Stulz, R., “This Time Is the Same: Using Bank Performance in 1998 to Explain Bank Performance during the Recent Financial Crisis,” Journal of Finance, 67(6), December 2012, pp. 2139-2185. DOI 10.1111/j.1540-6261.2012.01783.x.
  • Li, K., Mai, F., Shen, R. and Yan, X., “Measuring Corporate Culture Using Machine Learning,” Review of Financial Studies, 34(7), 2021, pp. 3265-3315. DOI 10.1093/rfs/hhaa079.
  • Graham, J., Grennan, J., Harvey, C. and Rajgopal, S., “Corporate culture: Evidence from the field,” Journal of Financial Economics, 146(2), November 2022, pp. 552-593. DOI 10.1016/j.jfineco.2022.07.008.
  • Forbes, D. and Milliken, F., “Cognition and Corporate Governance: Understanding Boards of Directors as Strategic Decision-Making Groups,” Academy of Management Review, 24(3), 1999, pp. 489-505. DOI 10.5465/amr.1999.2202133.
  • GCC Board Directors Institute with Heidrick & Struggles, Board Effectiveness Review 2025 (9th ed.), November 2025, 49 pp.; 193 respondents and 14 interviews. https://gccbdi.org/sites/default/files/2025-11/GCC%20BDI%20Board%20Effectiveness%20Report%202025%20-%20ENG_LRes.pdf
  • Board Intelligence, The Board Value Index, Summer 2026 Global Edition, published 11 June 2026; more than 400 non-executive directors, CEOs and CFOs at companies over £50 million turnover in the UK, US, Nordics and Middle East. 86% report a delayed, rushed or poor decision in the past six months attributed to board processes; 37% see the board as essential to value creation. https://www.boardintelligence.com/board-value-index-report-global-summer-2026
  • Institute of Risk Management, Risk Culture: Under the Microscope, October 2012; the A-B-C model, the sociability and solidarity model, the eight aspects, and the ten questions a board should ask itself. https://www.theirm.org/media/4703/risk_culture_a5_web15_oct_2012.pdf
  • Financial Reporting Council, Corporate Culture and the Role of Boards: Report of Observations, July 2016, 66 pp. https://media.frc.org.uk/documents/Corporate_Culture_and_the_Role_of_Boards_Report_of_Observations_interactive_PDF.pdf