00:00:00
Two missed calls from Germany, saying "Hello, is this Pav Gill? We understand
00:00:03
you're being told to go to Jakarta. Don't go, you won't come back." And I
00:00:07
was anonymous until a year after the company crashed. If you look at leadership, then it's part of
00:00:13
leadership's responsibility to take responsibility for this kind of whistleblowing process and approach.
00:00:20
>> don't [music] deal with this, things are going to get messy. Welcome to Grit in the Boardroom, the
00:00:27
podcast that takes you behind closed doors to unpack the pivotal decisions that shaped organizations for better or
00:00:34
worse. I'm Erica Elias and Norris, and each week I sit down with a senior leader who
00:00:40
stood at the edge of a defining moment, a crisis, a turning point, a challenge where the stakes were high and the
00:00:47
outcomes uncertain. These are the conversations you won't find in annual reports. Honest,
00:00:54
strategic, and grounded in lived experience. Because governance isn't about theory.
00:01:01
It's about pressure, people, and making the call. My guest today is Pav Gill, former
00:01:07
fintech general counsel and the whistleblower behind Wirecard's 24 billion euro fraud.
00:01:13
Pav's decision to speak up sparked global investigations, regulatory reform, and a spotlight on the blind
00:01:21
spots in corporate oversight. Before all that, he trained as a magic circle lawyer, tried his hand at food
00:01:28
criticism, and once thought about becoming a rapper. These days, he's a coffee obsessive, a
00:01:34
keynote speaker on ethics and leadership, and the founder of Confide, a platform created to fix compliance
00:01:40
failures he witnessed first-hand. Welcome to Grit in the Boardroom, Pav. It's great to have you from Singapore
00:01:47
today. Let's get into it. >> Thank you. It's great to be here. So, to
00:01:51
get into the questions, what key moment from your experience best demonstrates the critical need for transparency and
00:01:59
accountability. That's a that's a tough start, I think. You know, as general counsel in Wirecard
00:02:07
at least in the Wirecard case where I was head of legal for APAC, the critical moment would probably be seeing how
00:02:13
everyone reacted to a whistleblowing case or you know, what they were doing which was mostly containment strategies
00:02:20
versus wanting to deal with the issue and fix it, right? To get to the bottom of it. So, I think that's that was the
00:02:27
turning point for the company and I would say most companies in these kinds of situations. It's always you know,
00:02:34
what I what I like to say it's not always about receiving reports, but it's
00:02:38
what happens after you receive the reports that really determines the fate of the company and also of the person
00:02:44
who raises those reports. Yeah, so it's very much based on culture I guess of
00:02:48
the organization and how that all plays out. Yeah, but there's also a tendency
00:02:52
to blame tone from the top. That's always a very convenient excuse that managers like to use. Oh, the tone from
00:02:59
the top sucks and what can we do? But my response is like you can do a lot of things. You know, just because something
00:03:05
is bad upwards, that doesn't mean you do the same thing. You could always create
00:03:09
a subculture, your own culture that's positive with your peers or with your subordinates and then it's up to you to
00:03:14
manage upwards, right? So, we can't always be relying on cultural issues per se while they exist
00:03:21
obviously. We shouldn't hide behind them as a way to not act in the appropriate
00:03:26
way. Yes, do you think that when it comes to the Wirecard whistleblowing that you
00:03:34
did, do you think that it made a difference you being based outside of Germany with regards to how
00:03:44
like your experience of what happened in terms of actually physically what happened, but
00:03:49
also what conversations took place and the the level of I don't know impact it had on the
00:03:56
organization. I think from a personal safety standpoint, yes, that's being in
00:04:01
Singapore is always probably one of the safest places you can be cuz nothing exciting really happens here from a
00:04:08
crime perspective in terms of physical danger. Um but if I was in neighboring countries, uh if I was in anywhere else,
00:04:15
you know, even the US or um Europe, I think that would be a very different consideration.
00:04:21
Um but from a whistleblowing standpoint, I think it's also important to remember
00:04:25
that Wirecard was a case of two kinds of whistleblowing. There was an internal whistleblower that
00:04:30
came to me. So, in my role, I managed that. I did the investigation. And then how I became the whistleblower
00:04:37
uh when I left the company. So, it was internal whistleblowing that I managed and then I, the manager, becoming the
00:04:43
external whistleblower. Um and it's also key to remember that I was anonymous all
00:04:48
the way until a year after the company crashed. So, that's where I think that was also
00:04:54
added protection because most whistleblowing cases, most people who speak up and they get exposed in the
00:04:59
process, that's where things go downhill for them um as individuals. Hm. Do you think that being being
00:05:06
anonymized, obviously, that has some benefits, of course, in the process. Do you think that it can lead
00:05:13
maybe to people blowing the whistle on things if they know they're going to be
00:05:16
protected because no one's going to ever know it was them, that that leads people
00:05:19
to uh questions or raise concerns that otherwise they they wouldn't feel bold
00:05:25
enough to do? Or do you think that that's what you need as a whistleblower to be able to feel that protection in
00:05:29
order to be able to have those type of open conversations and know that there is no comeback?
00:05:36
Yeah, anonymity is key because the biggest fear is always being exposed and retaliated against. And it doesn't need
00:05:43
to be serious issues, right? It could be if you're a engineer in a data team, I
00:05:47
mean doing dealing with data stuff. Um, you're being forced to release code. You
00:05:51
know the code's going to have a negative impact on customers, but then your boss
00:05:55
is telling you you're overreacting and then you got KPIs and OKRs and all these
00:05:59
things over your head. But, you know, internal audit may want to know what's
00:06:02
going on because that's a business risk. It's operational risk as well. So, how
00:06:06
do you even just flag those kinds of things without being targeted? Um, I think that's where people would like
00:06:12
some form of anonymity and protection. Uh, because to them it's like, "Look,
00:06:16
this is an issue. Can we just have someone deal with it, right? Without us getting in trouble." And it sounds so
00:06:22
simple and trivial, but, you know, when it comes to bonuses, when it comes to performance reviews,
00:06:28
uh, people trying to look good upwards and sideways, whatever, uh, that's where
00:06:32
these things actually suddenly become an issue. And as a whistleblower myself, you know, I have people coming to me
00:06:37
every every 2 weeks, I would say, on average, um, as whistleblowers. And what I've
00:06:42
noticed is in the last 3 years, ever since I came out publicly, not a single one of these
00:06:48
individuals is a junior member of staff. They are all very senior people. And the
00:06:53
question is, why? And from what I've seen is because when you're in a senior
00:06:58
position, you have more access to information, you're more experienced. And then when suddenly you start raising
00:07:03
these things, you didn't expect your peers or whoever's above you to react in
00:07:08
that way. And then you suddenly feel like a deer in the headlights. And then it's like, what do you do? Now
00:07:14
everyone's looking at me thinking I'm not a I'm not a team player. He knows
00:07:17
this thing. How do we manage him and stuff like that, right? So, I think that's
00:07:22
that's what I've seen happening so far. Yeah, do you think that then, if you
00:07:26
look at leadership, then it's part of leadership's responsibility to take
00:07:30
responsibility for this kind of whistleblowing process and approach because if you're saying that they are
00:07:38
essentially the the senior people in the organization, they're the people with
00:07:42
maybe some more power, some more control. They're the people that can actually make a difference, can make a
00:07:46
change. They need to own this, right? And they need to look at it from a standpoint of
00:07:53
um as far as they can, stepping back and actually just saying, "Is it possible
00:07:59
that this could actually be the case?" rather than dismissing things very quickly. We kind of hear quite a bit of
00:08:04
that with regards to scandals that then come out afterwards of well, there were lots of people saying things, but nobody
00:08:09
actually listened or nobody understood. Is that something that you've experienced? Yeah, so I think the main
00:08:15
issue is that the the knee-jerk response, the initial response, um is to ask who is this person and why are
00:08:22
they raising this issue? Why they reporting it, right? So when motive is the at the forefront of your question,
00:08:29
your Q&A, then question number one, then you know, things I That's That's just the wrong start.
00:08:35
The real start should be okay, person someone has reported, um let's look at
00:08:40
the report and see that if we don't act based on this report, would that be a
00:08:44
material adverse impact on the business? So I think that's where the focus should
00:08:48
be, not on trying to identify who's reporting and why they're reporting. We
00:08:51
could always assess these motives later on. Um you know, at the end of the day, if
00:08:55
you're a business leader, do you really care what why this person is telling you
00:08:59
something bad's happening in the company if the bad things are really happening,
00:09:04
right? Like um you know, don't look at who's lighting the match, right? But look at and ignore
00:09:09
the fire. That's what I always try to say. Um so So I think if we change that mindset
00:09:15
from a leadership perspective, then things will be much better. And then you go to the second part of the problem,
00:09:19
which is containment. So a lot of business leaders, based on functions, you have HR
00:09:24
uh trying to manage these issues and people which means trying to make the problem
00:09:29
go away, trying to get them not to deal with it. And then you have legal who's
00:09:33
looking at like, is this a legal risk? And then you have com saying we should get ahead of this issue before anyone
00:09:38
else. So, I think it all becomes a containment strategy versus what is this issue? Let's get to the root cause of
00:09:44
it. Let's fix it and make sure it doesn't happen again. Yeah, which comes down to integrity,
00:09:49
right? Integrity of the organization externally and also the integrity of those leaders that are within it.
00:09:55
Yeah, exactly. Um it's it's a very process-driven problem, I would say. Uh you know, there's a lot
00:10:02
of focus on process. There's a lot of illusion uh in in terms of structures and tick boxes. But, no one actually I
00:10:09
don't know how many companies really deep dive and go into lessons learned and how we can prevent these issues
00:10:15
um other than just say, "Okay, this thing is dealt with. Great. Let's move
00:10:18
forward on to the next one." So, one of the things I always like to ask business leaders who deal with
00:10:24
whistleblowing cases and I'm like, "Okay, you've been told that Oh Oh, even boards, right? Let's
00:10:29
talk about boards in that sense. So, boards are told like we have three whistleblowing cases. They were dealt
00:10:34
with." And then every month there's three whistleblowing cases that were
00:10:36
dealt with. But then, what's the meaning of dealt with? It was resolved? Okay,
00:10:40
sure. But I think one useful exercise board members can do or anyone could do is actually go find out who which I
00:10:47
mean, who reported it if that person has been disclosed. Sit with that person. Ask them how their
00:10:52
experience was. Like, how did you find the whole reporting experience? Are you satisfied with the outcome? Are you
00:10:56
satisfied with how things were? I think that's where you get some real insights
00:11:01
as to the the process and what it really means instead of just relying on outcomes, right? Like, yeah, dealt with
00:11:07
and and so on. Mm. And I've experienced situations where whistleblowing reports have been
00:11:14
put to the board and the board have been super happy that there's been nothing on
00:11:19
them. But the reality of that isn't necessary that everybody should just kick back and you know, take a holiday.
00:11:25
The reality is that people perhaps are fearful of raising concerns or complaints. And actually, it isn't a
00:11:32
fact that there aren't any, it's the fact that they're not being heard. And
00:11:36
Yeah. you are one of those people that the kind of had that kind of courage to kind of speak up in that moment. So, can
00:11:43
you go into a little bit of detail of what the situation was and when you realized something wasn't right?
00:11:49
I think it's when I found out that the general counsel didn't know what was
00:11:53
going on. And I was always told that she was aware. And then, so one fine day when I called
00:11:59
her because the whistleblower was going It was getting increasingly irrational. And you know, she wanted to go to the
00:12:05
police, the the law enforcement agencies, the regulators, and all these things. And that's where I had to pick
00:12:10
up the phone and call the GC and say, "Look, if we don't deal with this,
00:12:13
things are going to get messy." And she had no idea what I was talking about. But she said, "It's okay, just
00:12:18
send me everything you have and we'll deal with it." So, [snorts] I did. I
00:12:21
sent her whatever I had and she which was a law firm report, a preliminary report with like 20 offenses in there
00:12:27
um potentially being committed by certain individuals. She ran to the board and she said, "Do you know what's
00:12:32
happening?" Um and they said, "No, but let's now take over the investigation." The problem
00:12:38
with that is that some of them were mentioned within the whistleblowing reports and the information we came came
00:12:45
across. And that's where you get into a situation which is also pretty typical,
00:12:50
which is you have persons of interest trying to um deal with these issues, right? You can't
00:12:55
investigate yourself. And that's also a practical problem because what happens, for example, if
00:13:01
the very person that you are uh reporting about is one of the whistleblowing case managers? Or it's
00:13:07
the person's department, right? What if HR's in charge of whistleblowing, but
00:13:11
the complaint is about the CHRO? Like that's a clear conflict. How do you get out of that situation? Um
00:13:19
So, these are things I think if not managed properly, like in the Wirecard case,
00:13:23
uh that's where things just go downhill. There's often you know, often a tendency to want to
00:13:29
protect the company from external knowledge of events. But, in the desire to do so, you tend to not
00:13:40
deal with the real problem again, and you try to just like make it go away and hope that it doesn't go outside. But,
00:13:47
then not dealing with the problem is when you create angry, isolated, disgruntled people
00:13:51
who then realize the only option is now to go outside to take the company to make sure something's done,
00:13:58
basically. And and so, it's kind of like a ironic, paradoxical situation, and I
00:14:03
don't understand why people are still behaving that way. I would think that if
00:14:08
you're a business leader, you want more reports because even if the reports are
00:14:12
trivial, that's fine. At least you know that people trust the system enough to
00:14:15
raise things which they find which might be trivial in the first place. So, don't
00:14:20
hide behind like zero reports and be proud of it. You know, I always like to say
00:14:25
there's a difference between having a culture of silence, which is people just
00:14:29
are quiet like in Asia. They just like to do their work, go back. And then the other culture of silence, which is the
00:14:35
real disease, which is people are fearful of speaking up because they know what's going to happen to them if they
00:14:41
do so. And where where do you think people get that thought process of what's going to
00:14:47
happen to them, you know, if they do so, as you said. So, where where do people get
00:14:53
where do they get their ideas from of what the consequences might be of something that maybe has never happened
00:14:57
in an organization? Well, it's definitely I would say precedent driven. So, they
00:15:04
would have seen or heard like, "Oh, do you know last time when this guy tried
00:15:08
to raise this issue, he suffered some horrible consequences, whether he was fired or he was let go or something
00:15:14
else, right?" So, I think that kind of that's where fear comes in because of the horror
00:15:20
stories of what happened to those that tried to speak. Um And and that goes straight to culture as
00:15:26
well. So, if truth tellers, if people trying to raise concerns are punished instead of being rewarded, then that's
00:15:34
where you've got a very negative culture in the company. Mhm. Absolutely. And if people
00:15:42
fear, not necessarily even fear the consequences, but fear speaking up because they don't know if it's worth
00:15:48
saying something, um they think that there might be something that's going to
00:15:53
happen as a result of it or something that isn't happening as a result of something, but they don't want to be
00:15:59
that person. I think particularly in British culture, it's very much of the view that, you know, stiff upper lip.
00:16:06
Everybody just carries on as they are. Obviously, that that's broad brush terms, but you know, kind of go, "Well,
00:16:12
it's kind of okay. I'm not that worried about it. It's not going to affect me."
00:16:16
What is it that made you feel that you couldn't just stand by and just let this
00:16:21
happen? Because when I was in the company, they had the way they came after me because
00:16:27
of what I knew, uh that was bad in itself. Like, they really went all the way. So, they did it in staged in a
00:16:34
staged fashion. So, the first way is obviously the board got involved. And they told me to stand down. I was then
00:16:40
isolated out of the investigation. Um I they [clears throat] they then coordinated with the local director in
00:16:46
Singapore telling him to make my life um Make sure like I know who's the boss,
00:16:52
right? Basically. So, he would come, he would shout, he would say, "Don't think
00:16:56
I don't know what you've been doing the last few months. If you know what's good
00:16:58
for you, you'll play ball." And this is also weird because like if you're a
00:17:02
director, and I was telling him this. I was like, "I don't understand what's wrong with
00:17:06
you because I'm really trying to protect you. You're director of seven companies
00:17:10
in in this region. If anything goes wrong, you're in trouble, too. Right? You're you're you're not just an
00:17:15
employee, but you're also a director the same time. So, I didn't understand why he didn't
00:17:20
understand. Uh by the end of the day, he didn't care. So, he would shout, scream,
00:17:24
um and then when that didn't work, they created a HR case against me. Uh so, that was like 3 months long of an
00:17:32
investigation. So, now I'm being investigated for something I clearly didn't do. And then when that failed,
00:17:38
they tried to send me on a one-way business trip to Jakarta, uh where one of the key suspects was from. And he
00:17:45
That key suspect was very fond of boasting that he's married into a drug-dealing family. And now the same
00:17:50
guy wants to send me to Jakarta on a business trip. And the way he phrased it was also very dodgy. He's like, uh
00:17:57
whether you go in 2 weeks, 2 days, or 2 months, you have to go. But you've nothing to worry about because you know
00:18:02
who my father-in-law is, right? And then during that same week, I had um two missed calls from Germany saying,
00:18:09
"Hello, is this Pav Gill? We understand you're being told to go to Jakarta.
00:18:13
Don't go, you won't come back." And they put the phone down. So, clearly they
00:18:16
were they had then accelerated it to uh trying to take me out. And that's when I
00:18:20
resigned because I actually I was forced to resign because I didn't want to go on that
00:18:24
business trip. So, the company was like super happy because after 4 months, they've got a legitimate business reason
00:18:29
to get rid of me. And I did. So, I left, right? I left the company, and they still didn't stop. You know, they were
00:18:35
sending people to follow me and my mom. They were creating fake interviews where
00:18:39
the interviewer uh in that friendly company would only ask me why I left Wirecard. And what they were again
00:18:45
trying to make me do is breach an NDA or leave a confidentiality aspect. So, they
00:18:50
could sue me and stuff. So, that's where I had, you know, we had enough of this
00:18:53
whole nonsense, and we said, "Let's um do something about it instead of just
00:18:58
being a sitting duck, right?" So, that's what actually caused Wirecard's
00:19:02
downfall. And at the end of the day, if you look back, it could it was completely avoidable.
00:19:08
Right? They could have just said, "Look, it's not working out. Why don't you just
00:19:11
go on gardening leave, we'll pay your salary until you get another job, and everyone's happy. But, because they had
00:19:18
that arrogance and that desire, uh probably fueled by 20 years of successful fraudulent behavior, you
00:19:25
know, I think that's where that resulted in their downfall eventually. Mhm. You are very balanced with your
00:19:33
responses for the fact that you have had kind of threats to your own life as a result of
00:19:41
these issues in the whistleblowing. You seem to take everything in your stride. How did you feel at the time? Well, I
00:19:49
was really upset, to say the least, because, you know, on top of >> bit of an underestimation, Pav, yes?
00:19:56
>> [laughter] >> Uh and um as a lawyer, you're kind of super restrained as to what you can say,
00:20:01
what you can do, what you can reveal, even about why you're being treated as
00:20:05
that way, right? So, you're like in a super isolated state even within the company. Like, everyone knows that the
00:20:11
company's punishing you for for reasons, but >> [clears throat] >> they know also it's maybe because you
00:20:17
came across something, but you can't share it. So, you've got nobody to confide in, basically.
00:20:22
>> [snorts] >> Even when you leave the company, you can't, because you don't want like, you
00:20:25
know, whatever word goes back to them, then that gives them ammunition as well. So, it's a very So, this is something I
00:20:31
think whistleblowers go through as well, um that isolation [clears throat] and not knowing who to trust, uh who will
00:20:37
look after them, who will actually deal with the situation, and not them. So, yeah, I mean, I was really upset. And of
00:20:44
course, if a company tries to kill you, then all uh legal privilege and all these other
00:20:50
lovely rules get thrown out the window, right? And then you decide, okay, why don't I repay the favor, and
00:20:56
just expose them for who they are. It's very difficult situation, because then
00:21:00
you That is when you start weighing things like, okay, should I go to law enforcement? Should I go to regulators?
00:21:05
Should I go to the media? Um and each one of them have the pros and cons. Like of course people would say
00:21:10
like look you should have just gone to the authorities, but the problem is when you go to authorities you expose who you
00:21:15
are. And then they can just file the report away and maybe not look at it for the next several years, but in the
00:21:20
meantime you're still getting hammered. So and then people think like okay then
00:21:24
go to the media, right? But the media is the same thing. It's like reporters
00:21:28
probably get hundreds of emails every week at least of people trying to tell them to report something. How do you
00:21:35
know that someone's going to take your report seriously, right? So again like all these things are very
00:21:41
difficult external avenues. But the minute you trigger like a public angle like the FT
00:21:49
for example who we went to, I think then that's it for the company like it's
00:21:52
unnecessary PR battles, legal battles, stock price damage and all kinds of firefighting.
00:21:58
I suppose as soon as you become known to a certain extent you become slightly more protected. Um to a certain
00:22:06
extent you become slightly more exposed because then everybody knows that you are kind of the person that raised that.
00:22:15
Did you in this process or or anyone in your family, did you feel scared? No, I was still anonymous, right? Until a year
00:22:21
after the company crashed. But of course the company suspected it was me or maybe two three other people.
00:22:29
Uh they actually engaged a intelligence agent kind of like corporate intelligence firm. Uh they paid them two
00:22:35
300 grand in euros to try to figure out who the whistleblower was. And out of the two
00:22:41
possibilities that they had which was me and another guy, they said it was the other guy which I still find pretty
00:22:45
funny. Um So you know they they did try to find out, but I think the strategy is also
00:22:51
like if the company's fighting fires globally and because of the FT reports and stuff like that and regulatory
00:22:56
scrutiny now everyone's looking at them, I think then they have less of I mean they're more distracted dealing
00:23:02
with those issues and then hopefully leaving you alone. Um Yeah, so that was also one of the
00:23:08
drivers. Like distract the company, have them fight those fires, have other people now start looking at them and
00:23:14
investigating, and hopefully exposing the truth in the process. Mhm. And when you had those phone calls to
00:23:23
say don't you go to Jakarta because you won't come back, would you say that that's one of the
00:23:27
defining kind of moments of your life? I mean, the defining moment was probably the HR case
00:23:35
because that goes to the core of who you are, especially as a man. Um you know, it's such a lazy and I mean,
00:23:44
it's literally a low blow, right? Like what? Once you falsely get tainted with
00:23:48
these things, then you you you it really upsets you as a person. Um and it sends you into a different kind
00:23:55
of spiral. But, um What sort of things were you accused of falsely? They had hired like
00:24:03
a female staff to work under me for a brief period, and then when I realized that staff was actually not
00:24:10
doing her work, but trying to figure out what is my investigation about. That's when I tried to fire this person,
00:24:16
and that's where this person ran to that same director in Singapore. And said that he's firing me because
00:24:23
he I I mean, he's trying to fire me because I rejected his advances and that
00:24:27
kind of nonsense, right? So, that became like a 3-month long investigation, which
00:24:31
as you can imagine is just ridiculous. Um but, that was one of the strategies that
00:24:37
they used because they I mean, they couldn't attack the work. That failed. Shouting and screaming failed as as
00:24:43
well. So, I think they really just tried everything. They just threw the whole kitchen sink to see what works. And the
00:24:49
desperation then led them to the whole Jakarta thing. Um and when that failed, I think everyone and they said you got
00:24:56
to resign. I think that's where everyone kind of like thought that's the end of
00:25:00
the whole thing. Wow, they really did, like you say, pull every every strategy out to to try and avoid this coming out.
00:25:10
Yeah. Whistleblowers aren't always seen as heroes, right? And from your perspective, what differentiates those
00:25:18
genuine whistleblowers, like you, from those harmful manipulation? I think it's just motive, right? Cuz
00:25:27
um genuine whistleblowers don't become whistleblowers by design, I would say.
00:25:33
They often just are raising concerns hoping someone can deal with those things, um funnily in the interest of the
00:25:39
company, because they think like look this person's trying to do bad stuff. Uh
00:25:43
if the company doesn't deal with it, the company's going to be in issues, right? Or someone's trying to
00:25:48
profit off uh some kind of wrongdoing by maybe pocketing funds and all those things or bribery bribery and stuff like
00:25:54
that. So they're just really trying to just like raise an issue, but then they
00:25:57
often find themselves as you know like what else like me as a subject of investigation or harassment and all
00:26:03
these other things uh and intimidation. So I think they then become this weird uh in this weird state where they don't
00:26:11
understand why things are working in an upside down way, which is why like when,
00:26:15
you know, the Sky documentary uh Wirecard a Billion Euro Lie, which was the only one I'm in and the day it was
00:26:21
released, um which is a year after Wirecard crisis, I came publicly. I came out publicly on the same day. So the
00:26:28
opening lines in that movie uh is what I said. It reminded me of Macbeth, which is fair is foul and foul
00:26:35
is fair, because that's exactly what whistleblowers find themselves in that situation, right? Where everything
00:26:40
that's fair is deemed as foul and whatever is foul, which is what these people what the company's doing is
00:26:45
deemed as fair. So very upside down situation. I think blackmail on the other hand are people that
00:26:51
build leverage against a company. And these could be like compliance officers who are senior going in any
00:26:57
company. I mean, no company is perfect, right? Especially in like gray spaces like crypto or fintech and stuff like
00:27:03
that. So, you know, you have people that just build leverage by finding slowly documenting all these flaws against to
00:27:11
to to get themselves in a position of not being able to be fired or getting a payout. Cuz you can be like a compliance
00:27:17
person just building all this leverage and one day you're you're in a fireable
00:27:20
position or someone wants for performance reasons wants to get rid of you and you're like,
00:27:25
"Oh, you really want to get rid of me? Do you know all the material I have?"
00:27:29
And if you don't pay me out, I'm going to go to the SEC who will, right? So,
00:27:33
it's I think that's where it but and it's a real thing. Companies deal with this all the time. It's not
00:27:40
novel. And you often see it. So, for for example, in my company like Confide Platform, we've had clients where
00:27:46
when there's going to be a layoff situation, suddenly there's a whole influx of ethics complaints.
00:27:53
And the reason why that's happening is because in certain jurisdictions, if that's raised as a complaint, a minimum
00:27:59
of 3 months needs to be given for that investigation. So, the employees are actually using that to buy time.
00:28:04
Um so, obviously on one hand, I empathize because, you know, no one wants to be fired and sometimes people
00:28:10
are desperate. But then falsely accusing people for these kinds of HR stuff stuff
00:28:18
I mean stuff has a very bad consequence and it doesn't it's not a good look at all. So
00:28:23
again, like how does a company navigate this thing? How does it document patterns and and trends
00:28:29
and bulletproof itself in the process is are some really important questions cuz
00:28:34
no not all whistleblowers are heroes, right? But again, that doesn't mean you don't
00:28:39
deal with the report. Yeah, absolutely. What do you think board should be doing to assess whether
00:28:45
the the kind of credibility of those whistleblowers and to be fair to them. Well, boards should be looking at
00:28:53
reports in terms of what happened, who dealt with it, how was it dealt with, and what the outcome was, and also
00:29:00
specifically unresolved cases. I think those are the real red flags and questions boards should be asking.
00:29:07
There's a big tendency to just hide behind stats, which I think is an issue, and there's
00:29:13
also For example, from a general Say the general counsel is a case manager, and the general counsel is reporting up
00:29:21
to the board saying, you know, there are X number of issues, some of these are very controversial,
00:29:28
and then the board is asking the question, "What happened?" I think this
00:29:31
is where things get messy because oftentimes if the dotted line actually gets exercised,
00:29:37
which is very rare, right? >> [snorts] >> That's where the person finds themselves
00:29:41
in a very difficult situation because if the dotted line is exercised and the GC is now going to tell the board that,
00:29:49
"Look, the CEO is actually the subject of the report, and I'm having a very
00:29:53
difficult time dealing with this." Then now 100% you're in the firing line
00:29:59
with the CEO, or he's going to hate you for life, and he's going to say, "Why
00:30:03
were you insubordinate? How could you do this to me? How could you have, you know, overstepped the boundaries and
00:30:08
stuff like that?" So, I think that's where these issues are. And also from a
00:30:11
general counsel perspective, you know the dotted line exists, but the question is, does the board even know that? Or
00:30:16
even if they knew it, are they exercising that, right? So, there's just a lot of these things which board can
00:30:21
boards can do. Even from a whistleblowing perspective, yes, a whistleblowing process exists. Have you
00:30:26
pen tested it? Have you actually tried to send in a report? Have you spoken to any of the, you know,
00:30:33
anonymous or whatever people? So, yeah, I mean, there's just a lot of things boards can do, but I don't know
00:30:39
if they do them. Yeah, but things to think about, I guess. Who, when you had those conversations,
00:30:46
was in the room? And how did they react to what was unfolding? Who Who did you speak to initially, and then what
00:30:54
happened thereafter? It was always following protocol. So, when the whistle internal whistleblower came to
00:31:00
me, my job was to protect that person. So, I until today never revealed who it was. You know, I get it was a female
00:31:07
staff on the finance team. I called her Bobby uh so couldn't be identified. And
00:31:12
my job was to protect this person all the way, right? Keep her safe, keep her anonymous, and then deal with the
00:31:16
investigation um and coordinate it. So, who was involved in the investigation straight away was the Deputy General
00:31:23
Counsel, eventually the General Counsel, and then it went to the board level. The
00:31:26
board wanted to do it themselves because clearly, you know, one of the person the main guy
00:31:31
that wanted to investigate and take over everything is Jan Marsalek, who's the
00:31:36
CEO uh who was the CEO and is now the most wanted man in Europe, you know, former
00:31:42
Russian spy for the last 20 years. He's been keeping himself very busy with the
00:31:45
Bulgarian spying uh that was in the in the press in the UK a couple of months ago.
00:31:51
Um so, that was a person that actually wanted to deal with the investigation. So, where the real difficulty lies in
00:31:58
that from a practical standpoint is how do you tell such a powerful person in the company that you shouldn't be
00:32:06
investigating yourself because you're one of the or you shouldn't be investigating this case because you're
00:32:11
one of the persons of interest. Like, there's is no way to write an email that's not going to upset him. And
00:32:17
but you have to, right? Uh so, that's I think a defining moment, if you want to
00:32:22
call that, uh where yeah, I mean, it was really from that moment that things went downhill. And
00:32:28
had you had correspondence interactions before um with the CEO? Were you aware of the
00:32:35
characters that were likely to be assessing the whistleblowing? No, because Wirecard didn't even have a
00:32:43
whistleblowing channel. In fact, they put the whistleblowing channel in place in the middle of my investigation or
00:32:49
after I was being investigated and they called it a anonymous whistleblowing channel, but when I asked who this
00:32:57
channel actually went to, they said it went straight to Jan Marsalek, the COO. So,
00:33:03
they were actually trying to create a whistleblowing channel to fish out people that knew information and then
00:33:07
punish them. So, that was a crazy way to abuse a legitimate process, so to speak,
00:33:13
and use it as a fishing tool instead, which is quite scary if you think about it.
00:33:17
>> [snorts] >> Um So, yeah, I mean they there's just so many of these crazy
00:33:23
things that happened in those four months, I would say. Yeah, and do you do you think that if you were talking to
00:33:32
other whistleblowers, you say that people come and talk to you every other week you get someone that's been a
00:33:37
whistleblower or is a whistleblower or is thinking about whistleblowing and they're coming to kind of get your
00:33:42
advice and guidance on what you should do. Do you think that where do those people kind of come from with regards to
00:33:49
wanting to blow the whistle? Are they fearful? Are they defensive? Are they angry? What's what sorts of mindset are
00:33:58
people in when they kind of get to that sort of stage to contact you? Yeah, you never know because, you know, sometimes
00:34:06
someone just wants you to listen to them um or kind of confirm some of the things
00:34:11
that they're saying in terms of which direction to take. Uh are they overreacting or, you know,
00:34:17
and I always ask them to work backwards. So, that's usually my advice. What is it
00:34:21
that you want to achieve or what is it that you want as an outcome, right? Do you want to expose the company? Um
00:34:28
do you in external routes? Like, do you want to go to regulators? Do you want to
00:34:31
go to the police? Uh I mean the the media like what is it that you want? Or do you just want to
00:34:37
get a settlement and you want the company to just listen to you and settle you and just get out of there? Like what
00:34:41
is it you need to That is the biggest question because from then you can I mean once you identify that you can work
00:34:46
backwards. And you then kind of know what to do. But if you're just sitting there and
00:34:51
you're just wondering how to battle these things or how to navigate now because you don't
00:34:57
want to resign. You want to stay as you can but yet protect yourself within the company.
00:35:04
Then those are different discussions. Then you're talking about how you documenting everything. You know, it's
00:35:10
so tempting to send stuff to yourself to your personal email to do it on USB sticks and stuff. But these are the very
00:35:18
things that will kill you, right? Because right away you're committing crimes for example.
00:35:24
>> [snorts] >> And it's it's easy to feel that you have truth on your side that oh yeah, I know
00:35:28
my company's doing wrong stuff or so and so is doing wrong stuff. But then do you
00:35:32
have the resources and capability as an individual to prove that versus a company with that kind of resources. And
00:35:40
also if a company's like Wirecard and like many fraudulent companies, they're in the business of forging
00:35:46
documents. Then what makes you think they can't do the same against you? Saying yeah, this
00:35:51
is our person. He was involved. He was actually signing off on all these things and here's the proof, right? And you're
00:35:56
going there going like what in the world is this? I wasn't part of these documents. I never signed this thing.
00:36:02
Yeah, sure. Now it's he said she said. Now you know, so how are you going to prove
00:36:06
otherwise? So I think these are the real practical concerns and challenges and I
00:36:10
think it's also why it's so difficult because you know, you it's one against one against a
00:36:19
corporation. Some uh big big topics. Were there ever moments that you felt that you before you resigned, that you
00:36:29
shouldn't have started what what you kind of started, that kind of snowball effect? No, because, I mean, I was the
00:36:36
head of legal for Asia Pacific. That was my job. Right. So, it's uh I took real
00:36:42
pride in it in a way. Uh I actually thought there was just a few individuals, some bad eggs, and you
00:36:48
know, they were they were kind of duping the poor Germans uh from Asia, and you know, my job was
00:36:55
to try to identify these people um and get rid of them because they're spoiling Wirecard's good name. So, I
00:37:01
never in my wildest dreams thought that the fraud extended all the way to board level to that extent, that it was really
00:37:08
a criminal enterprise. Um so, I think that was why I was so driven to I mean, I didn't question what I was
00:37:16
doing, so to speak. And also, people uh people like to tell whistleblowers like,
00:37:20
"Oh, why didn't you just resign and find another job?" You know, that's a very as
00:37:25
a commonly asked question, I would say. Um The problem with that question is practically, it is not easy to just walk
00:37:33
into another job, especially the more senior you get. And I think fundamentally, the why should you do
00:37:39
that if you haven't done anything wrong? So, and in my case at Wirecard, you
00:37:43
know, the law firm that I was dealing with was saying, "Just don't resign because the
00:37:48
more that we are looking into the evidence, the more it's becoming super obvious. So, you at some point you'll be
00:37:53
validated. So, therefore, hang in there, like, you know, fight those fires, withstand them."
00:37:59
Um so, it's really it really was a case of a race against time. And I think at some
00:38:03
point the company after 4 months was getting more and more frustrated. Um and that's why they got
00:38:09
increasingly desperate to want to deal with me in the fastest and most painful way possible. And reflecting on other
00:38:15
scandals like 1MDB, what governance practices failed, and how could they have been prevented in
00:38:25
your view? I think for these kinds of, you know, scandals which are clearly powerful in terms of stakeholders that
00:38:33
are involved. Uh I mean 1MDB's case obviously it was there were government aspects in there.
00:38:39
Uh in Wirecard's case I wouldn't say it's too dissimilar. I'm not saying
00:38:42
Germany was involved in the fraud per se, but clearly the BaFin for example uh as a regulator was trading Wirecard
00:38:50
stock until the very last day. So and refusing to investigate the company, right? And on top of that
00:38:56
instead they were investigating the FT. And on day one of the FT's article that
00:39:00
came out, they said this is not a Wirecard problem. This is a short selling problem with rogue journalists
00:39:05
involved and all that stuff down the line. And they also were so protectionist that they even banned
00:39:09
short selling on Wirecard stock for like 3 months. So clearly the company was being
00:39:15
protected within institutions in Germany. They also like 1MDB had auditors uh from big big four for example
00:39:24
um that were very deferential to to these uh to the client. Um so I think those are similar
00:39:32
parallels. Um and you know, this this Wirecard um had powerful people on their supervisory
00:39:40
board as well. You had sons of prime ministers in neighboring countries on the board. Um
00:39:46
1MDB clearly had, you know, direct government officials there uh in that scandal. But what's the most
00:39:53
interesting connection between the two I would say is that my mom actually went to Clare Brown who was the journalist
00:40:00
that exposed um initially started writing about 1MDB. So Clare Rewcastle Brown was a journalist.
00:40:06
So my mom somehow made friends with her. Um and it was Clare that actually said,
00:40:11
"Look, uh I know the Financial Times has been working on this case for the last 5
00:40:15
years and getting nowhere. So I'll let me put you in touch with them. So, finally there is that
00:40:21
1MDB connection between me and and the Wirecard case as well. What do you think could all those early
00:40:30
warning signs that leaders should be thinking about but they're often ignored? I mean, there are just so many.
00:40:37
Uh >> [sighs and gasps] >> early warning signs could be ex- hyper growth that doesn't really make sense.
00:40:45
Um especially if you compare it to industry peers. For example, why is this particular company doing so well?
00:40:52
Especially if they don't have like a super exceptional mind-blowing product.
00:40:55
Right. That was the case in Wirecard, for example. It always like to pride itself as a fintech company. I always
00:41:00
used to laugh when they said that because the tech was horrible. You had companies like Alipay and and all these
00:41:06
other firms that were doing way better tech. Um but yet it was getting it was so powerful. It's like the PayPal of
00:41:12
Europe. Why is that Why is that? So, similar similar you have hyper growth companies. Recently we saw it in
00:41:19
Indonesia with a startup called eFishery. Um just blew up was a scandal. So, that's
00:41:26
the biggest red flag. Also, I would say practically extremely powerful influential founders
00:41:32
uh could also be a red flag because, you know, they are able to dominate shout um
00:41:39
kind of coax influence the the the checks and balances. Like even if you are if they're dealing with say like
00:41:45
an audit firm, right? Could be like, "Okay, you don't want to deal with my
00:41:48
company? That's okay. I'll go to another audit firm that would." So, putting that
00:41:51
kind of pressure, that kind of thing, I think that's also a red flag in its own
00:41:56
way. Which is ironic because um I don't want that red flag to be in my company now, for example.
00:42:03
I don't want what I just said to work against me. But uh yeah, and also I think number of
00:42:09
resignations. If the turnover is so high, the question is really like what's going on, right?
00:42:15
Why is it that people keep leaving your company? Um, and is it is it restricted to a specific
00:42:22
departments? I think that's also something to look at. Yeah, so I would say there's just so many, uh,
00:42:28
red flags that one could come up with. Uh, but at the end of the day it's it
00:42:33
goes back to board level, right? Are they really looking into this? Are they really asking the right questions? Um,
00:42:39
are they conducting their own kind of, uh, Q&A and audits and checks into these things?
00:42:45
Um, you know, really going be behind the reporting, asking those tough questions,
00:42:50
which is easier said than done because, you know, I also have board members coming
00:42:55
to me like NEDs and stuff, uh, non-independent direct I mean, independent directors, non-executive
00:43:01
directors and all that saying, "Look, >> [sighs] >> it's, uh, difficult being one. And and
00:43:07
funnily what they say is also a red flag now based on their experiences is they don't want to join boards if the
00:43:14
existing board members have been there for like many years." Because that is a red flag, uh,
00:43:21
especially if they are coming in trying to be like this independent, um, you know, non-executive director. Uh,
00:43:29
how do you then get into that back and not be seen as the new troublemaker? I think these are, uh, things that people
00:43:36
should, um, just look into. >> Do you think that the role of non-executive director has its benefit?
00:43:42
You kind of talk about, um, about that particular role and new new NEDs coming in.
00:43:50
Obviously, the whole point of it is to bring external perspective in, but if if they
00:43:57
are in any way silenced or felt like they have to be silenced, obviously they have the exit option of not not staying
00:44:05
in that organization anymore. But how how do you think that that supports kind of the whistleblowing process and the
00:44:13
opportunity for some of these things to maybe be heard by somebody that isn't
00:44:16
conflicted by the ex- the internal workings because sometimes things that go wrong can just even if they don't
00:44:23
directly relate to the CEO or the CFO, they're operational challenges that just
00:44:28
say that something hasn't been managed right. So, even if it just casts shadow
00:44:33
on their abilities to lead. Um even if it's nothing they've actually done
00:44:37
wrong. So, non-exec directors, do you Yeah, do you feel that they have value and what value do they add and how do
00:44:43
they Well, do what they do? Yeah, I mean if they're truly independent, then sure,
00:44:47
right? Um a lot of times that's also questionable because you have NEDs that know the directors
00:44:56
uh that already are there. They're like kind of like golfing buddies or whatever, right? Um and then you have
00:45:01
those that are very happy with just being NEDs because this is just another income stream.
00:45:06
It's like, "Yeah, great. I'm the NED. Like you guys just tell me what's going
00:45:09
on. All good. I get my uh salary and stuff." Um Um so, if you are actually a NED that
00:45:17
wants to do what's right, I think yes, you would definitely have a powerful um
00:45:23
ability to influence processes. For example, whistleblowing. If you say, "Look, any whistleblowing cases that the
00:45:29
company is operationally managing, I want to be able to question those cases and and resolutions." Right? "I want to
00:45:36
have uh I want to have the ability to actually question and see what was going on in those things. I don't want to be
00:45:42
blocked out from the process because my job, if you really want me to be a check
00:45:46
and balance, is to be a check and balance." Uh and if there's nothing to hide, then
00:45:50
what's the issue, right? I think I think that would be a powerful strategy. Um
00:45:58
Yeah, but it's it's again like very theoretical. It's very difficult to be
00:46:02
in that situation because you get all kinds of pushback. And also, I think operationally from from teams within
00:46:09
company within the companies, the different departments, they don't want to be There's always that fear that we
00:46:14
don't want to look bad to the board. We don't want the board to be asking too
00:46:17
many questions. We want to always present a positive picture upwards because otherwise we get into all kinds
00:46:23
of issues. Um and then every There's so many heads involved that it would have to also answer those
00:46:30
questions. And And again, funnily, would it cascade down to whoever made that negative-sounding report? Uh why did you
00:46:37
do this? Why did you have to phrase it that way? Um so, I think these are So, if you're a good NED, I think you could
00:46:43
also sniff those out um by actually putting in the effort and following your gut feel.
00:46:52
I think a lot of these things do come down to gut feel. And I've heard it said
00:46:55
many times on TV documentaries and others that it when it just doesn't feel right, you need to do something.
00:47:03
Is that Is that kind of where you where you kind of got to of like this cannot continue?
00:47:09
Yeah. I mean, the biggest question, I guess, that it comes down to for directors, for example, is
00:47:17
would you be Would you be able to stand behind your decision if this blew up in the papers tomorrow?
00:47:23
Right? So, I think that's that's a great guiding factor and question to ask. Um
00:47:29
And I frankly, like every department head, whether it's legal or compliance,
00:47:34
should be asking themselves in control functions as well, like that question. What happens if something blows up? Can
00:47:39
you stand behind in this thing that you've signed off on? Uh you know, one of the things I like to
00:47:45
say to people in legal legal and compliance, especially internal audit as well, is that especially if you're in a
00:47:52
startup uh particularly, and And got a very um very you know what do you call that?
00:48:03
Uh >> [snorts] >> very crazy eccentric CEO. Right? If anything goes wrong in the business,
00:48:08
which didn't which seemed weird to begin with and it exploded, uh the CEO can
00:48:14
always leave the company and say that it was a crazy idea, it didn't work out.
00:48:19
So, what key governance changes would you recommend to ensure boards are more resilient and ethical? I think the only
00:48:28
way to force these things through, being honest, is if the penalties for not doing the jobs are increased and made
00:48:36
harsher. And currently, I think that's not happening. Um even in multi-billion dollar frauds
00:48:42
in several countries, you know, directors just get away with it uh like a slap on the wrist. Even when it's
00:48:48
proven that they kind of like were negligent in not asking the right questions or whatever it. So, I think if
00:48:53
the penalties, the uh liabilities are actually increased, I think that is the most effective way to
00:48:59
force people to do their jobs better. Yeah, absolutely. And all the all the tools like uh the software that you have
00:49:06
created, Confide, that you believe should be standardized? Yeah, I think every every uh company, obviously I'll
00:49:14
say this, but every company should be using Confide platform. Uh and the reason why is because
00:49:20
you know, it's the single source of truth, which currently doesn't exist in
00:49:23
any company. So, in most companies, if you ask them did some if something bad happens, do you have one place to find
00:49:30
out how it started, who dealt with it, and what happened at the end? The answer is probably no. You may have different
00:49:35
softwares doing different things, different meetings, Jira tickets, Slack conversations. It's not consolidated,
00:49:41
the audit trail is missing, it's messy. Um and Confide platform solves virtually
00:49:46
all these issues because everything's in one place and you can't modify try You
00:49:50
can't change the logs, you can't run to the IT team and delete stuff. So, if
00:49:54
you're a board member and you put this in place, it's great because you actually if you do demand access to it
00:50:00
or at least some kind of limited access to see what's going on, yeah, then it's
00:50:03
great. It's the most powerful check and balance from a software perspective that could
00:50:08
exist. And you have one source of the truth essentially. Yes. If listeners could adopt one kind of
00:50:16
governance practice to strengthen ethical decision-making, what would you suggest? Well, I think before
00:50:23
every every significant decision, you know, the question needs to be asked, "What
00:50:27
would someone need to believe for this to go wrong?" Because if you can't, you know, you
00:50:33
can't steel man the opposition side of that argument, then you don't understand
00:50:37
the decision well enough to make it, right? Cuz as I posted on LinkedIn today, like most governance disasters
00:50:43
happen when intelligent people convince themselves that they can't be wrong. So,
00:50:47
you know, asking that question kind of forces intellectual humility into rooms full of successful people who aren't
00:50:54
used to being wrong. So, I would say that's what I would do. So, it's it's
00:50:59
very much I suppose about speaking truth to power. Yeah. Well, thank you very much Pav for
00:51:06
sharing, you know, the truths behind the headlines and for helping boards to understand what real accountability
00:51:15
looks like. It's been great speaking to you today. Thank you. Thank you for having me.
00:51:20
That's it for this episode of Grit in the Boardroom. Thanks to Pav for sharing
00:51:24
his story with honesty and insight, and thank you for listening. If you found this conversation valuable,
00:51:30
please follow the show and share it with someone who leads through complexity. Until next time, stay thoughtful, stay
00:51:38
brave, and stay in the room. I think as a result of the conversations I had with Pav, it's really given me an
00:51:48
opportunity to reflect on what needs to be better, what needs to change, and some things need to stay the same.
00:51:57
Particularly in the UK setting of of governance. I think that with whistleblowing it's so important to make
00:52:04
sure that whoever is the person that those reports go to, they are able to act with objectivity.
00:52:11
Because otherwise those discussions and conversations and that person's brave
00:52:17
bravery of coming forward [music] is completely wasted. And I think for those organizations that find themselves faced
00:52:23
with problems, challenges, whistleblowing, they need to see this as an opportunity for change, reflection,
00:52:31
and perhaps improvement. And to adopt that sort of approach >> [music] >> and
00:52:37
the organization will be stronger as a result of it. Mhm.