How much corporate wrongdoing is committed by major American corporations?

If you look at publically available data on law enforcement against corporations, you would get the sense that corporate crime and wrongdoing in America is rare.

You might estimate based on this public data that each major American corporation engages in substantiated misconduct maybe once every four years and four months or so. 

But what if you had a chance to peek behind the corporate curtain and look at wrongdoing reported inside the corporation? 

Harvard Business School Professor Eugene Soltes did get that chance. His findings were published in the Journal of Financial Crime under the headline The Frequency of Corporate Misconduct: Public Enforcement versus Private Reality.

What did he find?

More than two instances of internally substantiated misconduct per week per firm.

Not once every four years and four months, but once every three days or 121 times a year. Or more than 500 times every four years and four months instead of just once during that time period.

“Corporate misconduct undermines confidence in business and erodes public trust,” Soltes writes. “Perceptions about the frequency of misconduct – among the public, academics, and even regulators – have largely been formed by examining enforcement statistics, which rely on the detection and sanctioning of the misconduct.” 

“By examining confidential firm records describing misconduct within organizations, I show that public enforcement statistics significantly underestimate the amount of serious malfeasance that arises within firms. Through analyzing records for several large multinational firms, I find that there are, on average, more than two instances of internally substantiated financial misconduct per week per firm.”

“I show that misconduct is considerably more common – by several orders of magnitude – than indicated in any publicly accessible data on corporate offending,” Soltes writes. 

“The likelihood that a firm would be criminally sanctioned by the Department of Justice or face a civil enforcement action for accounting matters by the Securities and Exchange Commission is 0.5 per cent and 1.1 per cent, in a given year. Such sanctions are severe and expectedly rather infrequent because of both resource constraints within regulatory and enforcement agencies and the legal hurdles for making such cases.” 

“A more expansive way of examining potential misconduct from public records is to analyze lawsuits brought against firms for securities violations. Notably, while bringing such suits is not constrained by resources such as the SEC or DOJ, some of these suits represent frivolous matters. Lawsuit records indicate that a publicly traded firm has a nearly 5 per cent likelihood of facing an allegation of misconduct in a particular year. A still more expansive way of assessing the frequency of corporate misconduct through public data is by analyzing all regulatory violations that can arise from sanctions by any federal agency. Through this broad analysis, per cent of firms face such violations in a given year. Put together, this public enforcement data suggest that corporate misconduct is an uncommon phenomenon, with many – in fact, the vast majority – of these firms rarely facing sanctions for malfeasance in any given year.”

“A considerably different picture of corporate misconduct emerges by examining the frequency of misconduct within organizations. Using data from three Fortune 500 companies –none of which faced recent criminal or serious civil sanctions – I show that misconduct is a ubiquitous phenomenon. These three firms have a substantiated violation every three days per firm on average. As an indication that the rates of offending from these sample firms are representative of publicly traded firms more broadly, I provide aggregated data from the largest corporate hotline provider about the number of substantiated claims. Within these statistics, the median number of violations would indicate 124 cases of corporate malfeasance per year. Thus, internal records suggest that a case of corporate misconduct arises nearly every three days per company on average.” 

“In contrast, a back of the envelope estimate, even based on the most inclusive public database (i.e. all regulatory violations), would indicate an act of corporate misconduct occurs every 1,586 days per company on average.”

Soltes concludes that “the vast majority of corporate offending – even in serious financial matters such as reporting fraud or bribery – is not publicly detected, sanctioned or reported.”

“Investigations that rely on public enforcement databases to draw inferences should appreciate that while such records do indicate conduct that was detected and sanctioned by regulators and enforcement agencies, such records cannot identify which firms do – or do not – engage in misconduct,” he writes. “As a result, such statistics are not appropriate for some research questions that focus on identifying misconduct.”

Soltes said he got access to data from the three multinational corporations “as part of a benchmarking exercise.” 

“The organizations were kind enough to allow me to utilize the data for academic purposes under a non disclosure agreement,” Soltes said.

“Corporate compliance programs monitor for potential violations within firms,” Soltes wrote. “Many of these allegations are brought to senior management attention through firms’ integrity hotlines, but others are conveyed internally via legal, compliance or human resources departments. These records are viewed as highly confidential. Specifically, in many instances, they are deemed privileged files –  subject to attorney–client confidentiality.” 

“While firms may have incentives to disclose violations to regulators, in many instances firm leaders choose not to disclose these offenses to regulators. As a result, internal investigation records offer a more comprehensive measure of the alleged misconduct taking place within firms, as compared to the public enforcement statistics.

In the article, Soltes presents data on the average number of violations in 2017 for three publicly traded, multinational firms that have an average of approximately 96,000 employees.

“According to their own records, these firms detected an average of 18 cases of bribery and 16 cases of fraud (financial reporting and accounting) in 2017,” he reports. “Beyond this, on average they detected 94 other cases of corporate misconduct (e.g. environmental violations, worker rights abuse and supply chain violations) for a total of 128 instances per firm.”

“To help put these numbers in perspective, none of these three firms appeared in any of the Department of Justice, Securities and Exchange Commission or securities fraud records in 2017. The average number of violations for these three firms in Violation Tracker (a public database produced by Good Jobs First) in 2017 is two.” 

“Thus, the sample firms’ own measures of the incidence of corporate misconduct is 64 times that described in even the most expansive public database.”

“To provide a sense of the generalizability of the average statistics from these three firms, I compare the incidence of misconduct to those compiled by the largest hotline provider, NAVEX . NAVEX provides statistics on the number of incidents reported through hotlines for 5,779 firms. They find that firms received 1.4 reports per 100 employees, implying 1,344 reports per year for a firm of 96,000 employees. These allegations involve a wide variety of matters including auditing deficiencies, harassment, workplace safety and misappropriation of assets.” 

“Of the total, 18.5 per cent of the allegations would constitute corporate misconduct (e.g. financial fraud, bribery and environmental violations), thus resulting in 249 allegations of corporate misconduct per year.” 

‘However, not all of these allegations are substantiated violations. After receiving an allegation, companies investigate the claim to ascertain whether the claim has merit. In 2017, 50 per cent of the allegations were substantiated in the NAVEX data. Thus, a firm with 96,000 employees would have approximately 124 corporate misconduct violations per year according to these data. Although this hotline estimate excludes other ways that investigations can begin (e.g. internal reporting through a manager), the estimated rate of offending from the NAVEX data (124 cases) is very similar to the actual number of instances (n = 128) in the sample firm data, providing additional confidence that these internal data comport with a representative view of how often such violations are internally detected.”