When five former News of the World employees, including editor Andy Coulson, were found guilty in a series of UK trials concerning phone hacking of celebrities and public figures, the fallout and finger-pointing stretched far and wide. But few commentators have yet asked, let alone been able to begin answering, possibly the most pertinent question: how can a corporate culture become so skewed?

Of course, not everyone who worked at News International (now News UK) was involved in criminal activity, but neither is the company a freakish outlier. As the woes of everyone from GSK in China to investment banks [in London] demonstrate, when groups of individuals or entire departments get together and “go rogue”, ignoring corporate values and safeguards, the result can be disastrous.

Broadly speaking, culture is the glue that binds staff to their employer and guides their actions when hard-and-fast rules are ambiguous, insufficient or absent. When it doesn’t work, you’ve got a problem. “Things get ingrained in a culture at every level, from how you pay people, how you promote people, how you recognise them,” says Norman Pickavance, former HR director of Morrisons. “People do what they think their leaders will value. So even if you’re not explicitly telling someone to hack voicemails, or ignore health and safety, they’ll cut those corners anyway, especially if someone else is doing it too.”

Nobody can police an entire organisation, particularly across geographies and divisions. “The problem is, the person at the top can’t possibly keep their eye on the entire workforce,” says Eugene Burke, chief scientific officer at advisory company CEB. “You can push values and encourage people to behave in a certain way, but if values are not linked to behaviour and you’re not walking the walk, they won’t have any impact.

The broader implications of a failing culture can be tragic. Burke points to the Deep Water Horizon oil rig disaster in the Gulf of Mexico in 2010, in which 11 people died and marine life suffered irreparably. Cost-cutting decisions and an insufficient safety system across owner BP and its suppliers were blamed. An investigation revealed there was a “failure to appreciate risk” until events became inevitable.

Burke argues that in this case, managers failed to set the tone for appropriate behaviour. “The key opportunity to communicate the risk of doing something to employees will be through their managers,” he says. “They are the ones that reinforce the right behaviour. The manager is the model.” This goes right to the top – a senior director who merely receives a slap on the wrist for fiddling their expenses is not setting an example to junior staff. As Vanessa Robinson, head of research at the CIPD, says: “The tone of an organisation’s culture should be clearly set from the top. If you see someone above you lacking integrity, how are you likely to respond?”

The result of cultural shortcomings isn’t always criminality or malfeasance. Often, incompetence and confusion can be every bit as damaging – and the road to recovery just as harrowing.

While HR departments are integral to scoping out values and giving examples of the types of behaviour welcomed by an organisation, too often they aren’t the first port of call if things do go wrong. When a rogue employee is up to no good in an organisation, it will typically be their direct line manager who hears about it first, and how they react can prevent wrongdoing becoming culturally embedded.

“Poor behaviour can creep up on HR,” suggests Guy Ellis, managing director of consulting company Courageous Workplaces. “A manager could be turning a blind eye [to misconduct] and then it becomes a question of ‘how do we deal with this when historically nothing has been done?’” For HR, being visible, building trust with managers and helping them set boundaries and discuss issues can prevent this happening.

Even when values are visibly displayed, if it’s not made clear what behaviour is expected of them, staff may still think it’s acceptable to step over the line. According to Tracey Groves, a partner in the forensic services team at PwC, a “desirable culture” will have a number of hallmarks, including clear opportunities for staff to speak up about ethical issues, a whistleblowing policy that’s used as a consultation tool, and a values-based code of conduct.

“From an HR perspective, these desired behaviours need to be built into performance management frameworks and measured,” she says. “If it doesn’t get measured, it has no credibility. It’s about how you build it into what you do, rather than bolting it on.” HR’s role is to act as a catalyst for business units to look after these issues for themselves, adds Groves. “They can provide the tools and levers, then the business units make it their own. They become accountable. You can’t delegate ethical behaviour or culture.”

This article was originally published on the Chartered Institute of Personnel and Development’s (CIPD) blog. AHRI members can access an information sheet on the link between HR and culture on the AHRI:ASSIST section of the website.