Boards regularly receive reports on culture: survey results, hotline activity, training completion, investigations, discipline, and corrective measures. Those reports are useful, but they often leave directors with the harder question: how does the board know whether the organization has addressed its failures? That question becomes urgent after a significant cultural failure involving discrimination, harassment, retaliation, bullying, safety, or other issues that raise questions about values, leadership, and systemic risk. The board’s responsibility is not to manage the investigation or design remediation. It is to oversee whether management learned from the failure, reduced recurrence risk, and developed objective evidence that the culture is healthier than before.

Boards Oversee Organizations, Not Just Compliance

Boards do not typically own investigations; management and counsel do. Nor should boards routinely manage remediation projects. Their role is oversight, ensuring that management responds appropriately and strengthens culture to reduce future risk. Compliance asks whether the organization has policies, controls, training, reporting channels, and investigation protocols. Culture asks whether people believe those systems matter, leaders reinforce them, employees trust reporting, misconduct is addressed consistently, and stated values affect day-to-day behavior.

Treat the Patient While You Diagnose the Disease

A common misconception is that organizations should postpone corrective action until after the investigation. Good physicians do not delay treatment while pursuing a diagnosis; they stabilize the patient while identifying the disease. Organizations should do the same. One workstream examines what happened and who was responsible. In parallel, another examines why it happened and identifies prudent measures to reduce ongoing risk. Safeguards should preserve investigative integrity and legal privilege, but governance should not require unnecessary delay. Interim steps may include reinforcing non-retaliation expectations, strengthening reporting options, increasing supervision, communicating resources, separating individuals where necessary, or clarifying leadership responsibilities. Those actions need not prejudge the investigation; they show the organization is reducing risk while facts are developed.

Add Root Cause, Not Just Accountability

Investigations often focus on what happened, who was involved, and whether policies or laws were violated. That is essential. But boards should also expect management to ask why the issue occurred and why existing systems did not prevent, detect, or escalate it sooner. Root cause analysis rarely identifies a single cause. Failures often arise from weak supervision, unclear accountability, inconsistent discipline, fear of retaliation, ineffective training, leadership tolerance, fragmented reporting, poor escalation, or a disconnect between stated values and lived experience. The board need not conduct the analysis, but it should ask whether management performed one at the right depth. A superficial conclusion, such as isolated misconduct, may be true but incomplete.

From Activities to Outcomes

Boards often receive reports describing completed activities: revised policies, enhanced training, new reporting channels, oversight committees, leadership communications, and updated procedures. Those are necessary milestones, but not proof that culture improved. Training attendance does not show that employees learned, believed, or applied it. A revised reporting policy does not show that employees feel safe reporting concerns. The board’s focus should shift from implementation to outcomes: whether employees understand the changes, trust reporting, see consistent manager responses, and observe leadership behavior aligned with stated values.

The Assurance Question

Directors should ask a deceptively simple question: how do we know the corrective actions are working? The answer rarely comes from one metric. It comes from objective evidence, including interviews, surveys, complaint trends, governance reviews, targeted testing, disciplinary consistency, read-across analyses, listening sessions, manager accountability reviews, and other indicators that show whether recurrence risk has been materially reduced. Testing should be practical, risk-based, and focused on whether corrective actions address root causes. If fear of retaliation was a contributor, management should test whether employees know how to report retaliation, managers understand their obligations, concerns are escalated promptly, and employees believe the organization will protect them. In higher-risk situations, the board may ask whether independent validation is warranted.

Read-Across: Could This Happen Elsewhere?

Boards should ask whether the organization considered read-across risk. A failure in one business unit, campus, department, region, or function may reveal vulnerabilities elsewhere. The point is not to assume the problem is everywhere. The point is to avoid treating a visible incident as isolated without asking whether similar conditions exist elsewhere. This analysis is especially important when root causes involve leadership behavior, reporting confidence, inconsistent discipline, weak supervision, or decentralized decisions. The board should ask how management determined the scope of remediation. It may be narrow, broad, or phased, but it should reflect reasoned risk assessment rather than convenience or optimism.

Not an Admission, But an Opportunity to Improve Culture

Organizations sometimes hesitate to strengthen controls, reporting mechanisms, training, or oversight because those actions may later be portrayed as admissions of wrongdoing. Legal advice on communications remains essential. Yet continuous improvement is a hallmark of responsible governance. An organization can dispute allegations, defend litigation, protect privilege, and still improve its systems. Boards should encourage management to frame remediation accurately: the organization takes concerns seriously, is examining what happened, is protecting process integrity, and is strengthening systems where doing so will reduce risk and reinforce values.

Five Oversight Questions

Directors should consider asking:

• How are management and counsel investigating both what happened and why it happened?
• What interim actions can prudently reduce risk while the investigation continues?
• What evidence suggests that corrective actions are influencing behavior rather than merely changing procedures?
• How will management demonstrate that improvements are sustainable?
• When should the board conclude, not assume, that cultural remediation has been successful?

Conclusion

The board’s work is not finished when an investigation report is completed or a remediation plan is approved. Those events mark the transition from understanding the problem to overseeing meaningful change. Directors need not become investigators, compliance officers, or auditors. They should insist on objective evidence that the organization has learned from failure, reduced future risk, and strengthened its culture. That means asking whether management understood root causes, took prudent interim action, tested whether the fix worked, considered read-across risk, and developed a credible basis for concluding that the organization is healthier than before. That is the next frontier of board oversight: not merely asking whether the organization responded, but whether it improved.

Disclaimer: The views expressed in this article are those of the author and do not necessarily reflect the views of StoneTurn Group, LLP, Province, LLC, or any of their respective affiliates. This article is provided for informational purposes only and does not constitute legal, financial, governance, or other professional advice.