Integrity risk in private equity: beyond box-ticking | Rupert Evill, Ethics Insight | Ep. 91
Rupert Evill is the founder of Ethics Insight, and in this episode, we discuss why due diligence should look forwards as well as backward, how AI can magnify box-ticking rather than improve judgement, and what fraud, speak-up systems and cultural signals can tell investors about portfolio risk.
Here’s a few top points to remember:
- Integrity risk is highly contextual. Two businesses in the same sector and geography can have radically different exposures depending on how they operate, who they deal with and where value is created.
- Policies are not the same as controls. An impressive ESG data room can provide false reassurance if policies are poorly understood, badly implemented or irrelevant to the actual business.
- Investment itself changes the risk profile. Growth capital, new markets, decentralisation, management changes and aggressive targets can create risks that did not exist before the deal.
- Culture produces early-warning signals. Speak-up data, staff turnover, absenteeism, losses and frontline feedback can reveal problems long before they develop into major scandals.
- Materiality matters more than completeness. Investors should prioritise the small number of integrity risks capable of genuinely derailing a business rather than attempting to satisfy every possible framework.
What does integrity risk mean for private equity investors?
Profit is an extraordinarily powerful signal of value creation, but it is not a flawless one. A company can make money while externalising costs, exploiting an information advantage or taking risks whose consequences will only become apparent years later.
Rupert prefers the term integrity to business ethics. For him, the practical question is not whether a company conforms to an abstract moral code, but whether the decisions it makes, the incentives it creates and the consequences that follow are consistent with the long-term interests of the business and its stakeholders.
That makes integrity a business and investment issue rather than a corporate virtue statement. The most effective interventions, Rupert argues, are often those aligned with enlightened self-interest. A business that depends heavily on customer loyalty, employee knowledge, regulatory permission or supplier relationships has a direct commercial reason to protect those relationships.
Why do context, controls and culture matter?
Rupert distills the assessment of integrity risk to three broad areas: context, controls and culture.
Context begins with deceptively simple questions. What does the company do? How does it do it? Where does it operate? Who does it deal with?
Those answers determine what controls are proportionate and what kind of culture the organisation needs.
Why can ESG box-ticking distract from real risk?
One of the sharpest examples in the conversation comes from a circular economy company with several investors, each requiring different ESG disclosures.
Its complaint was simple: “I spend half my time filling out ESG forms. I don’t have time to manage risk.”
Rupert believes the proliferation of frameworks can encourage investors and portfolio companies to confuse the presence of documentation with evidence that risks are actually being managed.
AI may intensify that problem.
An investor can generate a vast due diligence questionnaire. A portfolio company can use AI to produce the policies needed to answer it. Consultants can then use AI to review the resulting wall of documentation.
The process becomes faster and larger without necessarily becoming more informative.
The distinction Rupert draws is between having and doing. A company can possess every conceivable policy and framework. If people do not understand them, the controls are inappropriate to the business or they are not reflected in day-to-day behaviour, they provide little protection.
Why should due diligence look forwards as well as backwards?
Traditional due diligence is predominantly retrospective. Investors look for historic misconduct, litigation, regulatory problems, questionable transactions and other skeletons in the cupboard.
Rupert argues that investors also need to ask a different question:
What happens to the risk profile if this investment actually succeeds?
Putting capital into a company changes it.
The investment may finance international expansion, new manufacturing capacity, acquisitions or rapid hiring. Decision-making may become decentralised. The founder may surrender control. New management may arrive. Targets become more ambitious. The company becomes more visible to regulators, competitors and criminals.
A business that has operated successfully in one environment can therefore encounter entirely new integrity risks as a direct consequence of executing the investment thesis.
For private markets investors, this makes forward-looking integrity due diligence particularly relevant. The objective is not simply to decide whether the company is acceptable today, but to anticipate the pressures created by the value-creation plan.
Why does speak-up culture matter to investors?
Rupert spent much of his earlier career investigating fraud and misconduct. One lesson from that experience is that serious problems do not necessarily begin with people setting out to behave badly.
More often, people come under pressure, make a poor decision and then compound it.
That makes the ability to raise a concern early extremely valuable.
Rupert therefore sees speak-up and whistleblowing systems as a practical early-warning mechanism, not simply a compliance requirement.
A credible system needs more than an anonymous inbox. Employees and external stakeholders need to know where they can raise concerns, trust that the people receiving them are sufficiently independent and understand what will happen afterwards.
The mechanics also need to fit the organisation. A QR code on a physical site might work for construction or retail employees who rarely sit at a laptop. A professional services organisation may require something completely different.
Can private equity owners change culture after investment?
Rupert believes culture can be influenced, particularly in growth-stage companies where organisational behaviours have not yet become deeply entrenched.
Independent oversight matters. In a larger company that might mean a trusted individual on the audit and risk committee who is visibly capable of dealing with sensitive concerns.
Communication matters too. Rather than relying on a compulsory annual ethics seminar, Rupert advocates two-way discussions where employees can talk about actual risks: what have they seen elsewhere, could it happen here, what might prevent it and what would make people comfortable raising a concern?
That creates a much more useful flow of information from the frontline to management.
For private equity owners, this is important because the people closest to customers, suppliers, factories and operating processes may see emerging problems long before the CEO or board does.
What should a CIO monitor across a portfolio?
There is no universal integrity dashboard.
For a people-intensive business, relevant indicators might include staff turnover, absenteeism, speak-up reports, employee feedback, unexplained losses or other behavioural signals.
For a supply-chain-heavy company, different indicators may matter: delays, losses, exceptions, lead times or recurring problems with individual suppliers.
Rupert describes a Japanese organisation that began investigating corruption concerns across several subsidiaries and eventually broadened its diagnostic far beyond conventional compliance measures. The principle resembles a broken-windows approach to organisational risk. Small signs of tolerated bad conduct can indicate deeper cultural problems. If poor behaviour becomes normalised at one level, more serious problems become easier to rationalise elsewhere.
For an investor, the objective is therefore not to collect every available datapoint. It is to identify which indicators provide an early warning that something material is changing.
Is corruption really an emerging-markets problem?
Rupert spent more than a decade working across Asia and has operated in more than 80 countries. His answer is: same same, but different.
Corruption and coercion may be more visible in some emerging markets. In mature economies, influence can operate through more sophisticated institutional, commercial and political structures.
That distinction matters from an investment perspective because integrity risk overlaps with political and regulatory risk.
A business model that depends heavily on regulatory arbitrage, unusually favourable relationships or a particular political environment may appear highly profitable today but prove fragile when an administration or regulator changes.
Rupert’s preference is therefore to back businesses capable of succeeding despite a difficult institutional environment rather than businesses whose economics depend upon exploiting it.
What does fraud tell investors about integrity risk?
Fraud occupies a surprisingly large part of the conversation.
Rupert argues that many businesses devote significant resources to policies covering bribery, money laundering, human rights and other high-profile risks while paying comparatively little attention to everyday fraud.
Yet fraud can involve employees as well as external criminals. It can arise from misrepresentation, theft, collusion, conflicts of interest or the interaction between an insider under pressure and an external counterparty.
This again makes context important. The fraud risks facing a founder-led software company will look very different from those facing a pharmaceutical manufacturer, a construction company or a business with a complex international supply chain.
The objective should be to identify the fraud scenarios that are genuinely plausible for that particular company and build proportionate controls around them.
Does impact investing need more risk discipline?
Rupert is particularly sceptical of the assumption that an organisation operating in an environmentally or socially positive sector is inherently lower risk.
Good intentions do not remove commercial pressure, fraud, weak controls or poor management.
In some cases they may create complacency.
He argues that investors with experience in highly regulated or operationally difficult industries can sometimes bring valuable discipline into impact sectors precisely because they are accustomed to thinking about downside scenarios, incentives and bad actors.
This also complicates simple labels around what constitutes a “good” or “bad” investment. Defence, energy, agriculture and infrastructure all involve trade-offs that can look very different depending on geography and circumstance.
The investor still has to understand what the business actually does.
What is the bigger lesson for private markets investors?
The recurring message throughout the episode is materiality over theatre.
Investors do not need another 500-question questionnaire if only a handful of issues can genuinely derail the investment.
They need to understand the company’s context, identify those material exposures, put proportionate controls around them and create a culture capable of revealing when something is going wrong.
Rupert ends with a similar principle for companies trying to generate positive impact.
Rather than attempting to satisfy every framework and advertise virtue across dozens of categories, an organisation may achieve more by identifying something genuinely material to its business, committing to it and seeing it through.
That is a much more demanding version of ethics than putting another policy in the data room.
About Rupert Evill
Rupert Evill is the Founder of Ethics Insight. He brings 25 years of frontline experience across more than 80 countries, spanning investigations, intelligence, political risk, due diligence, crisis response, integrity risk and human rights.
Rupert is a Certified Fraud Examiner and author of Bootstrapping Ethics. His postgraduate study covers communication, behaviour and credibility analysis, alongside Cambridge training in business sustainability.
His advisory roles include the Association of Corporate Investigators, the Human Behaviour and Performance Institute and the ACFE examination review council.
Related Fund Shack conversations
- Systematic culture change. The playbook
- Avoiding moral hazard in private markets
- How Advent International creates value
- Private equity in Africa. A conversation with Stephane Bacquaert
Watch the full episode for Rupert Evill’s discussion with Ross Butler on integrity risk, fraud, culture and what private markets investors should really be looking for during due diligence
About Ross Butler
Ross Butler is the host of Fund Shack and the author of Invest Line A Barbarian: Share in the Spoils of a Private Markets Revolution.
He has spent more than 25 years working across private capital as a journalist, policy adviser and consultant. His previous roles include Editor of Real Deals, Secretary of the EVCA Professional Standards Committee and Director of the Listed Private Capital Association.
Connect on LinkedIn
Amazon LINK
Follow Fund Shack
