Employee ethics: the personal risks of speaking up

Most writing on employee ethics is addressed to the company. This is addressed to you: the person who has been asked to do something, or has seen something, and now has to decide what to do about it while keeping a job you probably need.

That framing matters, because the advice changes. A company can afford to say "always speak up." You have to weigh what speaking up costs you, and you are the one who pays it.

What to take away

The moment it usually arrives

Almost nobody is asked to do something obviously wrong. What arrives instead is a request that is slightly off, delivered casually, by someone with authority over your work, with a reason attached and a deadline behind it.

Backdate this. Use last quarter's figure, it's basically the same. Don't put that in the email. Just approve it, I'll sort the paperwork after. She doesn't need to be on the call for this. Send them the version without the caveat.

The characteristic feeling is not moral alarm. It is mild social awkwardness: the sense that objecting would be tiresome and slightly insulting to the person asking. That feeling is doing most of the work, and recognizing it is the practical skill.

Buying yourself time

The single most useful move is not refusal. It is slowing the request down without turning it into a confrontation.

None of this is evasion. It is the ordinary skill of not being rushed into something you have not thought about.

When it is not borderline

Some things are not a judgment call: falsifying a record, concealing a safety fault, misstating a figure that goes to a customer, a regulator, or an investor. Here the calculation is different, because complying makes you a participant.

For a U.S. workplace safety concern, OSHA is a route to consider. Consumer deception or personal-information practices may involve the Federal Trade Commission, while financial and other regulated sectors may have a different regulator. There is no single reporting authority for every inaccurate customer statement or data concern, so check which agency covers the conduct.

Practical points, in the order they usually matter:

Write down what happened, today, and keep it somewhere that is yours. Date, who said what, who was present, what you did. Not a file on a company laptop you may lose access to at short notice. Contemporaneous notes are worth enormously more than a reconstruction six months later. Be careful about what you copy: taking company documents can create its own problems, and where the line falls depends on your contract and your jurisdiction. Note what a document said and where it is, rather than removing it, unless you have taken advice.

Do not do the thing while you work out what to do. The most common regret is participating once, on the reasoning that it was easier to raise afterwards. Afterwards, you are explaining your own conduct as well as theirs.

Work out who has an actual interest in fixing it. That is not always your manager, and it is often not the person whose team owns the problem. Compliance, legal, finance, internal audit, or an ombuds office may have an incentive to address a concern before it surfaces externally.

Get advice before you escalate, not after. Employment protections vary by country, sector, what you report, and who you report it to; protection can depend on following a specific route. In the United States, OSHA's Whistleblower Protection Program handles complaints under the Occupational Safety and Health Act and other federal whistleblower laws; Sarbanes-Oxley covers certain reports by employees of covered companies, Dodd-Frank has separate requirements for certain SEC-related reports, and the Whistleblower Protection Act covers federal employees. The Office of Special Counsel is a route for many federal-employee disclosures, while the EEOC handles retaliation tied to the laws it enforces against discrimination.

In the UK, the Public Interest Disclosure Act (PIDA) provides protection for qualifying disclosures made through specified routes, including to an employer or the appropriate prescribed person on the official prescribed persons list; conditions apply. Protect, a UK whistleblowing charity, offers a free advice line. OSHA's whistleblower-protection overview describes U.S. protections, not UK law. A lawyer or employment adviser can help determine whether you are covered and which route applies.

Assume it may become known that it was you. Anonymous channels are frequently not anonymous in practice, because the set of people who could have known is small. Decide as if your name will be attached, and if that is unacceptable, that changes which route you take rather than whether you act.

The personal risks of speaking up

The honest version, because the sanitized version gets people hurt.

An openly retaliatory firing is visible and legally exposed. Less visible actions can be harder to attribute, so the risk is not captured by focusing on dismissals alone.

People report other things instead. They are left off things, get a cooler manager, a worse project allocation, a review that is fine rather than strong, and a difficult reputation that follows them to the next internal move.

The proximate cause is rarely stated and often is not even a deliberate decision by anyone.

The costs are unevenly distributed, and pretending otherwise is dishonest. They fall hardest on people early in a career. Contractors and agency staff are exposed too. So are people whose right to remain in the country is tied to the job, and people who are the only earner.

Narrow professional communities, where everyone hires from everyone, add another layer of risk. If you are in one of those positions, taking that into account is not cowardice. It is a real feature of the decision.

What tends to reduce the cost:

The routine stuff

Serious cases are rare. Most employee ethics is a series of small decisions that nobody will ever investigate, and where the standard you apply is entirely your own.

The pattern across the whole table: the useful test is disclosure, not intention. Almost every small ethical failure at work shares one feature, the person did not want a particular someone to know. If you can identify who that someone is, you have identified the problem.

Two specific traps worth naming:

Conflicts of interest are about appearance as much as substance. You can be entirely fair while holding a personal interest in the outcome, and it will still be reasonable for others to doubt it. Disclosing and stepping back costs you very little. Not disclosing and being fair anyway costs you everything if it comes out later, because at that point nobody can distinguish your version from the other one.

Access is not authorization. If you can open a record, a database, a mailbox, or a customer file, that is a fact about permissions configuration, not a decision anyone made about you.

Looking up something you have no work reason to look at is the most common serious disciplinary matter in organizations that hold personal data, and it is usually logged.

Personal data handling is legally regulated in most places, with rules differing by jurisdiction and sector.

The Federal Trade Commission's business guide to protecting personal information sets out practical steps organizations can take to safeguard the personal information they hold.

Opening a record you have no business opening is separate from whether the system let you.

Complicity, gradually

The way ordinarily decent people end up in bad situations is not a single decision. It is a sequence in which each step is a small increment on the last, and the previous step has already been accepted.

You approve something slightly outside policy. Next month, a slightly larger version, and refusing now implies the first one was wrong. By the time the scale is obvious, you have a personal stake in the practice being fine.

Two defenses work against this:

When you are asked to be quiet

Confidentiality requests come in three kinds and the difference matters. Keeping a customer's data private is an obligation. Keeping a colleague's personal circumstances private is a courtesy you should honor. Keeping quiet about conduct that harms someone is not confidentiality; it is concealment wearing its clothes.

If asked to sign anything tied to a departure or complaint, do not sign that day and do not sign without advice.

In the United States, SEC Rule 21F-17 bars actions that impede individuals from communicating directly with SEC staff about possible securities-law violations, including through confidentiality agreements. Before signing, check confidentiality, release, non-disparagement, and cooperation clauses for any requirement to notify or get permission before contacting a regulator, and for a clear carve-out allowing lawful reports, cooperation with investigations, and any whistleblower-award rights provided by law. Other terms depend on the claim and jurisdiction; have a lawyer review the exact document.

Deciding to leave

Sometimes the honest conclusion is that the problem is the organization and it is not going to change.

Leaving is a legitimate answer, but it is worth being clear-eyed about two things. First, leaving quietly resolves your situation and nobody else's; the practice continues, and the next person inherits it. That is not a reason to stay, but it is a reason not to treat departure as having handled it.

Second, if you are leaving over something serious, get advice on what you can say and to whom before you resign, not after: your position is often stronger while you are still employed.

If you do stay, decide what you are staying for, and set a condition that would make you go. A stay with no condition attached becomes acceptance surprisingly quickly.

A short self-check

Related reading: leadership ethics covers what the people above you control and why they do not use it; codes of conduct covers the route your organization should have given you; ethical frameworks covers how to reason when two obligations conflict.

Common questions

Is it my problem if I only passed it on?

If your name would appear in an accurate account of what happened, it is your problem. That does not make you responsible for the decision, but it does make you responsible for what you did once you understood it.

Should I raise it anonymously?

Anonymity protects you and limits what can be done, because nobody can come back to you for the detail that makes a concern actionable. Where the matter is serious, take advice on what protection you have before choosing.

How much should I write down?

Dates, who said what, and what you did, in your own words, kept somewhere personal. Copying company documents is a different act with its own risks, and that one is worth advice before rather than after.