This is the final article in a four-part series examining key topics in corporate governance for boards in 2026. Part 1 focused on AI and cybersecurity governance; Part 2 looked at board accountability; Part 3 examined regulatory compliance and risk management. The goal of this series is help boards understand, with practical guidance, how to turn challenges into value drivers.

Culture, ethics, and talent have become core board priorities, not soft HR topics. Regulators, enforcement agencies, and investors view corporate culture and human capital management as indicators of overall governance quality and as key levers for preventing misconduct. Public companies face growing disclosure expectations around human capital, while whistleblower regimes and retaliation verdicts highlight the costs of failing to foster a speak-up environment. Similar pressures apply to private companies, including PE- and VC-backed portfolio companies and privately held businesses with HNWI investors, where governance missteps can rapidly erode value, trigger disputes, or derail exit plans. Boards can turn these pressures into opportunities to increase enterprise value by actively assessing culture and emphasizing ethical behavior across the company. Boards that proactively shape culture, ethics, and talent create stronger teams, lower diligence friction, and premium valuations that sophisticated buyers will pay.

Culture as an Early Warning System for Misconduct and Fraud

Why Culture Oversight Is Strategic

U.S. Department of Justice (DOJ)’s March 2026 Department-wide Corporate Enforcement Policy (CEP) expressly treats corporate culture as central to evaluating the effectiveness of compliance programs and charging/resolution decisions. The CEP instructs prosecutors to consider whether a company’s culture encourages ethical conduct, whether senior leaders demonstrate commitment to compliance, and whether there are incentives for lawful behavior and disincentives for misconduct—principles carried forward from prior ECCP guidance. The CEP applies to all companies facing federal scrutiny.

At the same time, whistleblower and retaliation cases under Sarbanes-Oxley (SOX) and Dodd-Frank underscore the financial and reputational risks of inadequate speak-up and anti-retaliation frameworks. Recent verdicts in SOX whistleblower cases have produced multimillion-dollar awards, with no cap on compensatory damages in many contexts. Federal agencies including the Department of Labor administer and enforce numerous sector-specific whistleblower protections covering securities, safety, transportation, and environmental statutes.

Boards must also understand and incorporate state and local frameworks. These can differ greatly based on where the company is based and where it has operations. For example, private-sector employers in Texas are subject to anti-retaliation provisions in the Texas Commission on Human Rights Act (Texas Labor Code Chapter 21), which prohibits retaliation for opposing or reporting discrimination or participating in investigations. Meanwhile, New York has dramatically expanded private-sector whistleblower protections under Labor Law Section 740, broadening the definition of “employee” to include former employees and certain independent contractors, expanding the scope of protected activity, and lengthening the statute of limitations. Amended Section 740 now protects workers who reasonably believe that an employer’s activity or policy violates any law, rule, or regulation or poses a substantial and specific danger to public health or safety, and it provides remedies such as back pay, front pay in lieu of reinstatement, reinstatement, injunctive relief, civil penalties up to $10,000, and punitive damages for willful violations.

Boards should confirm that policies, trainings, investigation practices, and job postings align with the protections of relevant state and local laws, and that board reporting captures requirements across both federal and state/local regimes.

Tools and Data the Board Should See

DOJ guidance emphasizes that “paper programs” are insufficient and that prosecutors will consider whether data and metrics drive continuous improvement. Boards can strengthen culture oversight by asking management for aggregated, anonymized reports on whistleblower and complaint channels, including timing from report to resolution and remedial actions taken; metrics on training completion and effectiveness, especially in high-risk functions; and periodic “culture assessments” or third-party reviews in high-risk regions or units. These metrics provide accessible reporting to the Board, are tied directly to DOJ guidance, and can be useful evidence of good faith efforts in any subsequent enforcement action. For private and PE-backed companies, sponsors increasingly expect boards to monitor culture indicators because DOJ and other regulators apply the same principles regardless of public listing status, and culture weaknesses can materially impact exit valuations and transaction risk.

Ethics and Responsible Technology, Especially AI

Beyond Compliance: Ethical Use as a Governance Issue

Emerging federal and state guidance on AI in employment and other high‑stakes decisions reinforces that ethics and compliance are intertwined. U.S. Equal Employment Opportunity Commission (EEOC) technical guidance explains how Title VII applies to AI-based hiring and promotion tools, warning that employers may be liable for disparate impact discrimination arising from algorithmic systems used in selection decisions. Employers are responsible even for what their third-party vendors do, making board oversight even more important.

Meanwhile, broader AI regimes such as the EU AI Act (discussed in Article 3) impose documentation, transparency, and risk-management obligations on high-risk AI systems, with significant penalties for non-compliance. These developments underscore that ethical and compliant AI deployment is a serious board-level concern.

Boards should expect management to incorporate AI governance into broader compliance and ethics frameworks to ensure consistency with relevant AI regimes and DOJ (and other regulatory) expectations for risk-based, continuously improved programs. Boards should also ensure that AI and automated systems use is identified where it materially affects individuals (hiring, promotion, termination, pricing, credit, eligibility for services, safety) and ensure that those uses comply with EEOC guidance and applicable nondiscrimination laws. In addition, boards should oversee the performance of periodic disparate-impact and bias testing for AI-driven employment and customer-facing decisions, including documentation of results of the testing and remediation efforts that can include adjusting or suspending tools that cannot be justified as job‑related and consistent with business necessity.

This is another area where close attention must be paid to state and local laws, For example, Texas is emerging as an early mover on AI governance in the workplace. The Texas Responsible AI Governance Act creates a framework that regulates “high‑risk” AI systems used in consequential decisions, including hiring, compensation, promotion, discipline, and termination. Under this framework, employers are prohibited from deploying AI systems with the intent to discriminate against protected classes under federal or Texas law and are expected to adopt policies, procedures, and training governing the use of covered AI tools. As another example, New York City Local Law 144, the Automated Employment Decision Tool (AEDT) or “Bias Audit” Law, regulates use of certain AI-enabled employment decision tools in hiring and promotion for positions located in NYC. Employers and employment agencies may not use covered AEDTs unless an independent bias audit has been conducted within the previous year, a summary of the audit is made publicly available, and candidates and employees receive at least ten business days’ advance notice of the tool’s use and the characteristics it evaluates.

Boards need to tailor their requests to management based on the specific state and local laws/regulations. Additional requirements might include, depending on the state, inventorying AI-enabled tools that are used in Texas employment decisions, classifying which tools fall within state “high-risk” or AEDT definitions, coordinating with broader discrimination, privacy, and cybersecurity programs, as well as with federal EEOC guidance, and implementing implement written policies that describe permissible uses, decision logic (at a level appropriate for governance), data inputs, approval workflows, and training obligations for managers using AI tools. Boards should also receive regular reports from management about compliance with state and local AI requirements so that boards can make appropriate governance decisions for the business.

Governance Structures for Ethical Technology

Companies that get AI ethics right don't just avoid fines: they attract top talent, win vendor partnerships, and clear diligence faster. Ethical AI governance is becoming table stakes for growth-stage companies seeking Series B/C funding or strategic exits. For private and growth-stage companies, boards can support a right-sized approach that leverages external expertise and focuses on the highest impact use cases, while still aligning with emerging federal, state, and local enforcement expectations in this space. Practical governance options include leveraging an existing committee, such as audit, risk, or technology, to oversee AI ethics and technology risk. The committee’s mandate can be expanded to include applicable civil rights, privacy, and AI regulations, including state and local requirements. The board can designate an internal owner (e.g., Chief Ethics & Compliance Officer, the Chief Privacy Officer, or an AI Governance Lead) of AI risk assessments, regulatory developments, and remediation or hire a fractional outside expert. This individual should periodically report to the board on her mandate. The Board, with management, should maintain inventories of high-risk AI systems, including documentation that aligns with EU AI Act expectations where relevant (risk management, data governance, human oversight, and monitoring).

Talent, Succession, and the Changing Workforce

Generational Shifts, Human Capital Disclosures, and Hybrid Work

The SEC’s 2020 amendments to Regulation S-K introduced principles-based human capital disclosure under Item 101(c), requiring public companies to describe material human capital resources and measures (such as attraction, development, and retention) to the extent material to an understanding of the business. Human capital – people – matter for public and private companies. As investors increasingly scrutinize workforce strategy, culture, and retention, boards must treat human capital oversight as a core fiduciary responsibility rather than an operational detail.

Generational changes and hybrid work models complicate oversight. Younger workers often prioritize flexibility, development, and purpose, and “job hopping” is more common than in prior generations. At a high level, boards should monitor the alignment of the company’s talent strategy and workforce deployment with the company’s strategic plan, including digital and AI transformation objectives. Boards should focus on how the company is creating meaningful engagement and relationship building with its workforce and look at how hybrid and remote work structures affect collaboration, training, mentoring, and inclusion. On the risk front, boards need to ensure that policies are applied consistently to avoid employment and labor relations risks and pay attention to the metrics management uses to track attraction, development, and retention of key personnel.

State and local laws should be examined. Some are employer-friendly and some are employee-friendly, but all translate into human capital requirements that the board must oversee. Boards should confirm that harassment, discrimination, and retaliation policies are up-to-date, training is tailored to the jurisdictions in which the company has operations, and ensure that human capital reporting to the board addresses state and local risk areas.

Succession Planning and Board Composition

Regulatory and investor expectations increasingly link governance quality to robust succession planning and board refreshment. DOJ guidance also highlights the role of leadership in modeling compliance and ethical behavior, reinforcing the need for credible successors who embody the desired culture. For boards, this means that succession planning and board membership should be on the agenda. Boards should review CEO and C-suite succession plans regularly, including short-term and long-term contingencies, and integrate those plans into risk and strategy discussions. Boards must treat board succession with similar rigor, aligning director skills with strategic and regulatory needs (technology, risk, international markets, labor and employment, ESG).

For PE- and VC-backed companies, boards should ensure that key-person and succession planning are aligned with fund timelines, covenants, and investor expectations. Investor-nominated directors should be prepared to explain to LPs and co-investors how portfolio company boards approach human capital and succession, as these topics increasingly feature in due diligence and stewardship frameworks. Robust succession planning directly supports exit multiples. Buyers pay premiums for companies with “management continuity” baked in, while weak pipelines trigger earnouts, escrows, and key‑man insurance demands.

Speak-Up Culture, Psychological Safety, and Board Visibility

Statutory whistleblower regimes and recent verdicts reinforce that retaliation risk is a significant governance and financial exposure. SOX and Dodd-Frank provide overlapping but distinct remedies, including reinstatement, back pay (with double back pay under Dodd-Frank), and attorneys’ fees, as well as extended statutes of limitation in some cases. Large whistleblower verdicts have become more common, demonstrating juries’ willingness to punish perceived retaliation against internal reporters.

State laws add additional layers of protection and potential remedies for public employees and private-sector workers who report violations of law or discrimination. Courts’ strict application of procedural requirements under the Texas Whistleblower Act means boards of Texas public companies should ensure employees are informed of reporting channels and that the company has clear, timely response protocols that align with statutory notice and filing deadlines. In New York, amended Labor Law Section 740 significantly broadens private-sector whistleblower protections by expanding who is covered, what activities are protected, and what constitutes retaliatory action, and by adding remedies such as front pay, civil penalties, and punitive damages.

Boards should probe reporting channels, retaliation investigations and remediation, incorporation of employee feedback into risk assessments, and methods of reaching workers. Accessible reporting channels, such as a hotline, online tools, an ombudsperson, and alternative contacts, are key DOJ and SEC expectations. States have specific posting and notice requirements. Investigation management and discipline for misconduct and supervisory failures should align with DOJ guidance. Themes from employee engagement surveys, exit interviews, and town halls should be escalated to the board and factored into the risk identification and assessment process. For companies with significant remote or frontline workforces, boards should ask how the company reaches employees who may be less connected to corporate communications or more vulnerable to retaliation, including contractors and workers at third-party sites.

Practical Roadmap for Boards

Speak‑up rates, ethics closure times, leadership pipeline strength become investor differentiators. PE sponsors and strategic buyers increasingly use cultural health scores to price risk and justify premiums, turning governance from a cost to a competitive advantage. To bring culture, ethics, and talent oversight to the same level of maturity as financial and strategic oversight, boards can follow a staged approach that is consistent with DOJ, SEC, EEOC, state/local, and labor law expectations.

Phase 1: Diagnose (Months 1-3)

1. Request a consolidated briefing from management on culture, ethics, and talent metrics: turnover, engagement, whistleblower activity, investigations, disciplinary outcomes, and succession status.

2. Review board committee charters to confirm where culture, ethics, human capital, and technology risk reside and whether committee mandates reflect current regulatory expectations.

3. Assess whether the board has sufficient expertise in compliance, human capital, labor/employment, and technology, and identify gaps in light of federal, state, local, international, and sector-specific guidance.

Phase 2: Framework and Ownership (Months 3-6)

1. Clarify which board committee(s) lead oversight of culture, ethics, talent, and AI ethics, and update committee charters and board calendars accordingly.

2. Ask management to propose an integrated “culture and conduct” framework that ties values to incentives, discipline, training, and reporting mechanisms in a manner consistent with DOJ’s expectations for effective compliance programs and state retaliation statutes.

3. Ensure that AI and algorithmic decision-making are incorporated into this framework, with reference to EEOC technical assistance and state AI governance requirements where applicable (e.g., TRAIGA and NYC Local Law 144).

Phase 3: Implementation and Integration (Months 6-12)

1. Establish regular board reporting on culture and human capital, using a concise dashboard that can be used to support SEC human capital disclosure and risk factor narratives if applicable.

2. Incorporate culture and ethics into board strategy reviews, M&A approvals, and major investment decisions, consistent with DOJ’s focus on risk-based resource allocation.

3. Align executive compensation and promotion decisions with ethical and compliance expectations, including clawback provisions where appropriate, in line with DOJ policy emphasizing incentives and sanctions within compensation systems.

Phase 4: Review and Continuous Improvement (Ongoing)

1. Periodically benchmark culture, ethics, and human capital practices against peer companies and evolving regulatory and investor expectations, including updates to DOJ, SEC, EEOC, state, and local laws.

2. Conduct independent reviews of culture and human capital risk in high-risk regions or business units, documenting remediation plans and board oversight.

3. Revisit C-Suite and board succession, board composition, and committee structures annually to ensure expertise and governance arrangements keep pace with technological, regulatory, and workforce changes.

4. Publicize (internally and externally) the board’s role in the ethical oversight of the company.

Conclusion: From Risk Mitigation to Value Creation

Investors and regulators view culture, ethics, and talent through a risk lens—indicators of potential liabilities, litigation, and diligence red flags. But boards that see the opportunity build better businesses: stronger teams that execute strategy, ethical cultures that attract premium partners, and leadership pipelines that clear exit hurdles with minimal friction.

Paired with AI/cyber governance (Part 1), board accountability (Part 2), and regulatory compliance (Part 3), human‑capital oversight completes the 2026 governance series. Companies that integrate these four pillars don't just manage risk; they command higher valuations, smoother financings, and cleaner exits. The board’s job is to make that integration happen.