What HP Should Have Done

By Kirk O. Hanson

The Hewlett-Packard debacle last week was eye-opening, not only to junkies of boardroom drama, but to students of business ethics and crisis management. If Pattie Dunn, HP's board chair, had deliberately set out to create a case for debate in business schools, she couldn't have done any better!

Here is a "cheat sheet" of the critical decisions -- the ethical turning points -- in this amazing story:

1. Should the chair inform the board it is being investigated for leaks? Knowing that is was likely only one board member was leaking to the press, Pattie Dunn either did or did not have an obligation to inform the board she was about to undertake an investigation and how it was to be conducted. I believe she did have such an obligation, out of respect for the innocent board members and their rights.

2. How do you pick an outside investigator and what guidance do you give him or her? Every company hopes its vendors, contract manufacturers, or business partners follow its standards and values. Today, companies are increasingly being held accountable for what happens in its supply chain, for example. How explicit should HP be in giving direction to its outside investigators? I believe HP had an obligation to pick an investigator with a reputation for respecting the rights of those investigated, and the obligation to give explicit direction that the outside firm should follow HP values or the "HP Way."

3. Should ethics or legality be the standard for how an investigation is conducted? Investigative methods are evolving quickly. While companies have increasing responsibility to investigate employee or even board misbehavior; they are also facing a legal landscape which is changing rapidly. The American public is clearly worried deeply about the privacy of its financial, websearch, and, yes, telephone records. Should HP be guided by what they and their lawyers believe is legal - or by some sometimes ambiguous standard of what is "ethical?" I believe HP has long been committed to acting "ethically," not just legally, and they would give up a major portion of their reputation by choosing legality as the standard.

4. What should you do when a report to the board was based on private telephone records? We know only about Tom Perkins reaction when the board was presented with the report fingering George Keyworth as the leaker. He slammed down the cover of his briefcase and immediately resigned from the board. What should the other board members have done? I believe every member of the board should have been concerned that the report was based on private phone records, and recognized this was an ethical problem. That could have enabled the HP board to have moved quickly to clean up its own mess before Perkins forced its hand several months later.

5. How candid should you be while the facts behind a scandal are being examined? It was clear from the beginning that HP knew more than it was telling the public or the press. For example, it knew the name of the outside investigator, what guidance was actually given to the investigator, and how the investigator went about his work.

6. Do you apologize for what happened? Who should apologize and to whom? At what point in the emergence of a scandal does a company apologize for what happened? How much "blame" does the company admit? I believe HP was a bit slow apologizing to board members and the employees for the invasion of private phone records. To say one was "appalled" at the methods used falls short of an apology. The board chair and the management spokesperson should have apologized early and often - to the board members and to the employees.

7. Should anyone be punished? One of the fundamental ethical turning points is whether anyone is held accountable and whether the punishment fits the crime. You hope that any penalty communicates an unambiguous message about the values of the company and its commitment to accountability. I fear HP gave at best a mixed signal. Apparently the board concluded Pattie Dunn did something wrong, but it was unclear what, and why stepping down only in January and then remaining on the board was the appropriate punishment.

8. Should you explain in detail what has been done to prevent a similar incident in the future? Should HP explain to its employees and to the public exactly what steps have now been taken to prevent a recurrence? I believe it must do this to satisfy the anxiety of employees that their phone records could be examined next, and to relieve the worry of HP customers that the data HP keeps on them might be used against them.

9. Should you also purloin the phone records of reporters? Sorry, the answer to this one is so obvious that you get no credit for saying "No, they should not." This merely insured that negative media attention would follow!

Above all, I believe past scandals - including the tragic poisonings of Tylenol buyers 25 years ago, and the spate of corporate scandals which began with Enron in 2002 - have established a clear standard for the management of ethical scandals and other corporate crises. The four principles are a) tell everything you know as you learn it, b) apologize early and often; c) punish those who are guilty, and d) state clearly what the company has done to make another such incident unlikely. Unfortunately, the HP board stumbled on several of these fundamental principles.

Kirk O. Hanson is executive director of the Markkula Center for Applied Ethics. A version of this articles originally appeared in BusinessWeek Online, Sept. 18, 2006.