We have all been there – suddenly finding ourselves working for an “ethically compromised” leader. Days seem like weeks. Weeks feel like years. Sometimes we carry the scars with us for the remainder of our careers. While toxic leaders at any level can damage morale, performance, and careers, the consequences become far more severe when that individual occupies the CEO’s office. An toxic CEO can reshape an organization’s culture, weaken its governance, and place its reputation and long-term success at risk. It is one of the most significant enterprise risks that boards and executives seldom discuss openly.

Every organization talks about risk. Credit risk, cyber risk, market risk, operational risk. Boards often charge entire committees with oversight of these categories. Yet the most inconvenient and dangerous risk in any organization can sit in the corner office, and almost nobody discusses it directly.

I call this person an ethically compromised CEO. It’s a gentler term for what most employees would call a toxic CEO. The label doesn’t matter. The damage does.

The toxic CEO isn’t usually a criminal. Most never steal money outright or break an obvious law. Instead, they bend rules, punish dissent, reward loyalty over competence, and treat governance as an obstacle rather than a safeguard. They create an organization that looks healthy on paper while rotting from the inside.

How a Toxic CEO Gains Power

Toxic CEOs rarely arrive announcing themselves as toxic. They arrive as confident, decisive leaders who deliver results. Boards often hire CEOs for performance first and character second, and performance is easy to measure while character is not.

These leaders often share a pattern. They set aggressive targets and hit them, sometimes through means nobody examines too closely. They build loyal inner circles who owe their positions to the CEO and defend that CEO by instinct. They manage upward brilliantly, telling the board exactly what it wants to hear while managing downward through fear.

Boards often mistake charisma and short-term results for strong leadership. By the time cracks appear, the CEO already controls the information, the personnel, and the board’s confidence.

How They Stay There

Once in power, the toxic CEO protects that power methodically. They control the flow of information to the board, filtering bad news and amplifying good news. They surround themselves with executives who won’t challenge them and remove those who, often quietly, through reorganizations or performance narratives that obscure the real reason.

They also learn to use fear as a management tool. Employees who raise concerns (including chief audit executives) get labeled as not team players. Whistleblowers face retaliation dressed up as coincidence. Over time, people stop raising their hands and silence becomes the norm. The silence is often misconstrued as support.

Financial results can be the great concealer. As long as the numbers look good, boards hesitate to scrutinize the person producing them. Nobody wants to be the director who fired the CEO delivering record earnings, even at the cost of ethics or culture.

Why Boards and Executives Look the Other Way

Board members are rarely naive. The frequently know something is wrong long before they act, if they act at all. Several forces keep them quiet.

Social dynamics play a large role. Directors often have personal relationships with the CEO, sometimes going back years. Confronting a toxic CEO means confronting a peer, and few people relish that conversation.

Fear of disruption matters too. Boards worry that removing a high-performing CEO will spook investors, employees, or customers. They convince themselves that the devil they know is safer than the uncertainty of change.

Executives face a more personal calculation. Speaking up against the CEO can end a career. Many decide that protecting their position matters more than confronting a boss who controls their compensation and their future references. This is not weakness. It’s a rational response to an irrational environment, and it explains why so many capable people stay silent.

The Inevitable Damage

Every toxic CEO eventually damages the organization they lead. The timeline varies, but the consequences don’t.

Culture erodes first. Employees watch how the CEO treats people and learn what actually gets rewarded, regardless of what the values statement says. If loyalty beats integrity, employees adjust their behavior to match. If results excuse bad conduct, employees learn that ends justify the means. The CEO doesn’t need to write a memo about this. Culture forms through observed behavior, not stated policy.

Talent leaves next. The best people, those with options elsewhere, tend to leave first. They have the market value to walk away from a toxic environment. What remains is a workforce increasingly selected for tolerance of dysfunction rather than talent.

Risk accumulates quietly during this period. Controls weaken because nobody wants to enforce them against a powerful CEO. Compliance functions get starved of resources. Internal audit findings get watered down or buried in committee. Then a triggering event arrives, a lawsuit, a whistleblower complaint, a regulatory inquiry, and years of accumulated risk surface all at once.

The organization that looked strong for so long collapses faster than anyone expected, because the strength was never structural. It rested on the CEO’s ability to control the narrative. Once that control breaks, everything hidden underneath comes out at the same time.

Advice for Internal Auditors

Internal auditors sit in a uniquely difficult position when the CEO is the source of the risk. Here is how I recommend approaching it.

• Document everything with precision and objectivity. Write findings based on evidence, not opinion. A well-documented paper trail protects you and outlasts any single leader’s tenure.
• Use your reporting line to the audit committee. It’s part of your job to escalate issues the CEO would rather bury. Exercise that access regularly, not just when a crisis forces your hand.
• Focus on facts, not character. Frame findings around specific control failures or governance gaps rather than personal judgments. This keeps your work defensible and harder to dismiss as personal conflict.
• Track patterns across audits, not just single incidents. One weak control looks like an isolated gap. Five weak controls tied to the same executive behavior tell a different story.
• Protect your independence above your comfort. A CEO who pressures you to eliminate or soften a finding is handing you evidence of the very risk you’re auditing.
• Know your escalation path before you need it. Confirm you can reach the audit committee chair directly, without going through the CEO first, before a crisis forces you to test it.

A toxic CEO can silence a room, but they cannot rewrite the evidence internal audit puts on paper. That ‘paper trail’ is often the only thing standing between a boardroom that finally sees the truth and an organization that finds out too late.

A CAE should never forget that integrity isn’t an option. I have seen too many CAEs who found themselves in legal trouble (or even jail) because they were complicit or unwilling to challenge illegal behavior in the organizations they serve.