# Employee misconduct and company reputation

Employee misconduct and company reputation: the four tests outsiders apply, a response sequence, and what to say about the person and what to leave out.

---


Employee misconduct damages a company's reputation to the degree that outsiders decide the conduct was the company's own: that it fit the job, that someone knew, that nothing stopped it, or that it has happened before. The employee's act is the event. What the company does in the following days is the part that settles whether the story stays about a person or becomes a story about the firm.

Most advice on this subject is written for a human resources team (how to investigate, how to discipline) or for a press office (how to word a statement). Both matter, and neither covers what a customer, a candidate or a journalist does an hour after a post goes viral: they search the company name, then the employee's name beside it, and read whatever is first. Employee conduct reaches reputation through that search page and through the answers AI assistants build from it.

This guide is for owners, managers and in-house teams who need a working method before, during and after a case. It gives the four tests outsiders apply, a table of six kinds of conduct, a response sequence that protects the people involved, the search side of the problem, and an invented worked example. Nothing here helps hide accurate, lawful, public-interest information about wrongdoing: a company that tries becomes the second story. Nothing here is employment-law advice, and the few legal points quoted were read from the named official pages for this guide.

<div class="box"><b>The short version</b>
<ul><li>Outsiders ask four questions: was it part of the job, did anyone know, how fast and how fairly did the company act, and has it happened before. Your response is judged against those four, not against the employee's behavior alone.</li><li>Separate the fact of the conduct, the process you are running and the person. Say the first two in public. Keep the third private unless the law, a regulator or a victim's safety requires otherwise.</li><li>Act on the people first and the page second. Investigate with someone uninvolved, protect the person who raised the matter, and publish what changed.</li><li>Check the company-name search page and two or three AI assistants on a fixed schedule, and fix errors at their source. Accurate coverage that names the employee will not be removed by you, and trying makes it worse.</li></ul></div>

## Employee misconduct reaches the company through attribution

Outsiders hold a company responsible for an employee's conduct according to how much it looks like the company's doing, and that judgment is made in minutes from very little information. Researchers who study crisis communication call this attribution of responsibility. Situational crisis communication theory is the best-known framework built on this idea: it holds that the reputational threat of a crisis depends on how much responsibility the public assigns, with the organization's crisis history and earlier reputation shaping the effect. The primary papers could not be read for this guide, so treat the theory as a way of framing the problem, not as a source for any figure.

You do not need the theory to use the idea. Every reader of a story about an employee is quietly answering one question: is this a bad person in a good company, or a bad company that employed a person? The facts of the incident are only part of the evidence. The rest is what the company visibly does next, and whether the answer to the question changes when new facts arrive.

Two consequences follow. First, silence is read as an answer, and so is a statement that defends the person before anything is known. Second, a company can carry real responsibility for conduct it did not commit, because a pattern that went unchecked is the company's own failure. Treat the case as two stories: what the employee did, and what the company knew and did about it. The second is the one you control.

## Four tests outsiders apply to the company

Outsiders do not apply a legal test. They apply four informal ones, and each can be answered with documents you hold.

**Capacity.** Was the person acting as the company when it happened: in uniform, on a company account, in a client meeting, using a company title? The closer the conduct sits to the role, the more it belongs to the firm. An off-duty act with no link to work, in which the employer is mentioned only because someone looked up where the person works, belongs to the firm much less.

**Knowledge.** Did anyone senior know, or have the means to know? A prior complaint, an ignored message, a warning that went nowhere: these turn a one-person story into a company story faster than the original conduct does.

**Response.** How quickly and how fairly did the company act once it knew? Speed means the matter was taken in hand, not that a verdict was reached in a day. Fairness means the person under investigation and the person who complained were both treated properly.

**Pattern.** Is this the first case or the third? Reviews on employer sites, old news items and former staff posts make a pattern visible without any help from the company. If a pattern exists, it will be found. Better that your own account of what changed is on the page when it is.

<div class="tablewrap"><table><thead><tr><th>Test</th><th>Question outsiders ask</th><th>Evidence you can hold</th><th>Weakest answer</th></tr></thead><tbody>
<tr><td><strong>Capacity</strong></td><td>Was this the company acting?</td><td>Role description, access logs, account ownership</td><td>"He does not represent us" when the title is on the profile</td></tr>
<tr><td><strong>Knowledge</strong></td><td>Who knew, and when?</td><td>Complaint log, dated emails, manager notes</td><td>A claim of surprise that records contradict</td></tr>
<tr><td><strong>Response</strong></td><td>What did you do, and how fast?</td><td>A timeline from first report to first action</td><td>Acting only after the press called</td></tr>
<tr><td><strong>Pattern</strong></td><td>Has it happened before?</td><td>Prior cases, policy changes, training records</td><td>"An isolated incident" with no check behind it</td></tr>
</tbody></table></div>

## Six kinds of conduct, and what each one needs first

The kind of conduct decides who is watching, which clock runs and which mistake is most likely. The table covers six kinds. Real cases often combine two, and the mixed case should be handled under the more serious row.

<div class="tablewrap"><table><thead><tr><th>Kind of conduct</th><th>How it reaches outsiders</th><th>What they want to see</th><th>Common mistake</th></tr></thead><tbody>
<tr><td><strong>Customer-facing behavior</strong> (rudeness, discrimination, mishandling a customer)</td><td>Video, screenshot, review, social post by the customer</td><td>Contact with the customer, and a stated standard</td><td>Replying to the post before the customer has been contacted</td></tr>
<tr><td><strong>Conduct toward colleagues</strong> (harassment, bullying)</td><td>Former staff, employer review sites, a journalist</td><td>An independent process and protection for the complainant</td><td>Treating the complainant as the problem</td></tr>
<tr><td><strong>Fraud, theft or abuse of client money</strong></td><td>Regulator, client, auditor, court record</td><td>Containment, notification and cooperation</td><td>A private fix that skips the people owed notice</td></tr>
<tr><td><strong>Misuse of data or confidential information</strong></td><td>Affected customers, a regulator, a leak</td><td>What was exposed and what was done about it</td><td>A statement before the scope is known</td></tr>
<tr><td><strong>Personal posts that mention the employer</strong> (offensive or political content)</td><td>A pile-on that tags the company</td><td>A clear, proportionate standard applied evenly</td><td>A dismissal announced in an hour, or a shrug</td></tr>
<tr><td><strong>Undisclosed promotion or fake reviews by staff</strong></td><td>Review platforms, a consumer complaint, a regulator</td><td>The posts removed or disclosed, and a policy</td><td>Denying it, then finding it was staff</td></tr>
</tbody></table></div>

## Legal liability and reputation run on different clocks

An employer can be legally responsible for an employee's act in some situations and not in others, and public judgment does not follow the same line. A company can be legally clear and reputationally exposed, or the reverse.

The UK Equality Act 2010 shows how wide the legal idea can be. <a href="https://www.legislation.gov.uk/ukpga/2010/15/section/109">Section 109</a> says anything done by a person in the course of their employment must be treated as also done by the employer, and that it does not matter whether it was done with the employer's knowledge or approval. The same section gives a defence where the employer shows it took all reasonable steps to prevent the employee from doing that thing or anything of that description. The section is about that Act, not about all employee conduct, and it shows how prevention before the event can be part of the legal picture as well as the reputational one. Other countries and other laws draw the line differently.

For your purposes the pattern has two uses. The first is a reminder that policies, training and a working complaint route are not paperwork: they are the evidence of "reasonable steps" in a legal setting and the evidence for the knowledge and pattern tests in a public one. The second is a boundary. Whether your company is liable in your country, for this act, is a question for employment counsel, who should be in the room from the first day. The rest of this guide covers what you do in public, which counsel will also want to review.

<aside class="callout">
<span class="callout-label">Limit</span>
<h4>Legal exposure and public judgment can disagree</h4>
<p>A statement that is safe in court can read as evasive online, and a statement that reads well online can create legal risk. Have counsel review the wording, and decide together which risk each sentence carries.</p>
</aside>

## The first day: a sequence that protects people and the record

The first day is about doing things in the right order, because the order is what outsiders can later see in your timeline. The steps below assume the matter is credible enough to act on. If it is a rumor with no evidence, the work is verification first.

<figure class="fig">
<figcaption><b>Response sequence for a conduct case, first 24 hours</b></figcaption>
<ol class="fig-steps">
<li><b>Preserve the record</b>Save the posts, messages, logs and complaint history as they stand, with dates. Do not ask anyone to delete anything, including the original post, until counsel has seen it.</li>
<li><b>Contact the people affected</b>Speak to the customer, colleague or client before you speak to the public. They are the first audience and the most likely to publish your reply.</li>
<li><b>Appoint someone uninvolved</b>The investigator should have no stake in the outcome. Where that is impossible in a small firm, bring in an outside person rather than a friend of either side.</li>
<li><b>Decide on interim measures</b>Consider changing duties, shifts or reporting lines before suspension. Suspension is for cases where it protects people or the evidence, not a way of signalling action.</li>
<li><b>Protect the person who raised it</b>Tell them in writing that retaliation will not be tolerated, who their contact is, and what happens next.</li>
<li><b>Agree the holding line</b>Three confirmed facts at most, the process and the time of the next update. Nothing about the person's character or guilt.</li>
<li><b>Start the search watch</b>Record what the company-name page and the AI answers say now, so later changes can be read against a baseline.</li>
</ol>
</figure>

On the investigation, Acas, the UK's workplace advice service, says on its page about <a href="https://www.acas.org.uk/investigations-for-discipline-and-grievance-step-by-step/step-2-preparing-for-an-investigation">preparing for an investigation</a> that the employer should get somebody who is not involved in the case to carry it out, to avoid a conflict of interest, and that an investigation should usually be kept confidential and should start as soon as possible. The reason it gives for speed is fairness to the worker: people remember events more clearly when asked sooner. On <a href="https://www.acas.org.uk/suspension-during-an-investigation">suspension</a>, Acas says it is only appropriate in some situations, should not be used automatically, should only be used if there is no other option, and does not mean the employee has done anything wrong and should not be used to discipline someone.

## What to say in public about a person you are investigating

Say what you know about the conduct, what you are doing, and when you will speak again. Do not say who the employee is, what you believe about them, or what you expect the finding to be. An investigation that is announced as a foregone conclusion loses the trust of the staff who will be asked to take part in it.

A workable rule is to sort every fact into three piles before a word is published.

- **Public:** the nature of the matter in plain words, the steps taken, the date of the next update, how to raise a concern.
- **Private:** the employee's name when they are not already public, personnel details, the complainant's identity, health information, anything said in confidence to the investigator.
- **Held until verified:** anything repeated by only one source, anything about motive, anything about other employees who may be involved.

Three habits keep the statement durable. Use the same text everywhere: on your site, on social profiles and in replies to journalists, because a second slightly different version is what gets quoted. Avoid language that minimizes ("a misunderstanding", "an isolated lapse") before the check is done. And avoid language that overreaches in the other direction ("this person is no longer with us") unless it is true, confirmed and lawful to say.

A complainant's privacy sits beside the employee's. Naming either in a company statement can expose a person to harassment, and a later finding in the person's favor will not undo it. If a name is already in the press, you do not need to repeat it.

## When the employee's name and the company name appear together

Once a case is public, the search page for the company name and the search page for the employee name start to share results. Customers and journalists reach the story through whichever name they know, and AI assistants assemble answers from the same pages. This is the part most response plans leave out.

You can do four things, and they are all lawful, accurate and slow.

1. **Publish one dated company page** on a domain you own that sets out what happened at the level you can say, what you did and what has changed, and update it in public with a visible date. A single clear source gives searchers, and the AI assistants that read the same pages, one place to find your account instead of fragments.
2. **Keep the employee's name off your own pages** unless there is a public reason to use it. You are not obliged to feed the pairing, and your page should not become the first result for their name.
3. **Correct errors at the source.** If an article gets a fact wrong about the company or the case, send the publisher a short, documented correction request. If an AI answer blends two cases or companies, find the page it drew from and fix that.
4. **Watch both name pages and two or three assistants** on a fixed schedule: daily in the first week, then weekly, then monthly. Log what changed against your baseline.

There are things you must not do. You cannot make an accurate news report about a real case disappear, and a company that sends takedown threats to the reporter or the complainant gives the press a second story. Fake reviews, planted profiles and paid content to push the story down are against the rules of review platforms and damaging when found. For an accurate story, the route is more good material on the company's own record, over months, not removal.

For ongoing monitoring of both name pages and AI answers, the <a href="/reputation-monitoring">reputation monitoring</a> service covers that work as a monthly routine, which fits the weeks after a case better than ad hoc checking.

## When employees speak out, post or review on the company's behalf

Some of the conduct that reaches the public is staff speaking about the company rather than behaving badly, and the two are easy to confuse. A current or former employee who describes poor conditions is not committing misconduct merely because the description is embarrassing.

In the United States, the National Labor Relations Board says on its <a href="https://www.nlrb.gov/about-nlrb/rights-we-protect/your-rights/employee-rights">employee rights page</a> that employees covered by the National Labor Relations Act have rights to join together to improve wages and working conditions, with or without a union, and that two or more employees discussing work-related issues such as safety with each other is an example of protected concerted activity. That page does not address social media or a single employee's online posts, so whether a particular post is protected is a question for counsel. The reputational rule is simpler: disciplining staff for raising a working-conditions concern, in public or in private, is read as retaliation and will become the story.

The opposite problem is staff who promote the company without saying so. The Federal Trade Commission's guidance on endorsements says that an employee who writes a review on a consumer review site should disclose the employment relationship, and that listing the employer on a profile page is not enough. It also says an employer is not expected to monitor every post, but should set up a formal program to remind employees of its policy periodically, and that if the company encouraged employees to review its products it takes on more responsibility for monitoring them. If it learns of undisclosed reviews, it should act: remind staff of the policy and ask them to remove the reviews or disclose the relationship. The text is in the FTC's <a href="https://www.ftc.gov/business-guidance/resources/ftcs-endorsement-guides-what-people-are-asking">endorsement guides questions and answers</a>.

Do not ask employees to write praise to offset a bad case. It is the most common way a conduct story acquires a second chapter, and review platforms and regulators can treat undisclosed insider reviews as manipulation, as the FTC guidance above shows.

## A worked example: a recorded argument at a service counter

This is an invented scenario with generic parties. It shows the sequence in a mid-size case; it is not a record of any real company, and the timings are typical rather than promised.

Assumptions: a regional service firm of about 120 staff. A customer posts a 40-second video showing a front-desk employee raising their voice and refusing to take a complaint. The post is shared several thousand times in two days. The firm has a written conduct policy but no public statement of its customer standards. A review site shows a handful of earlier comments about "dismissive staff". Nobody senior knew about the video before it was posted.

Against the four tests: capacity is clear (uniform, counter, company premises); knowledge is no, but the earlier comments invite the question; response is what the firm controls; pattern is partly visible.

<div class="tablewrap"><table><thead><tr><th>When</th><th>What the firm does</th><th>What it deliberately does not do</th></tr></thead><tbody>
<tr><td><strong>Hours 0 to 2</strong></td><td>Saves the video and the earlier reviews, calls the customer, informs counsel and the manager</td><td>Replies to the post or asks the customer to take it down</td></tr>
<tr><td><strong>Hours 2 to 24</strong></td><td>Appoints an uninvolved manager to review, reassigns the employee's counter duties, posts a short holding line</td><td>Names or characterizes the employee, or announces an outcome</td></tr>
<tr><td><strong>Days 2 to 3</strong></td><td>Hears both sides, reviews the complaint log and records of prior comments, apologizes to the customer directly</td><td>Argues about the video's editing</td></tr>
<tr><td><strong>Week 1</strong></td><td>Publishes a dated page: what happened, the process and the standard customers can expect</td><td>Publishes the personnel decision</td></tr>
<tr><td><strong>Weeks 2 to 6</strong></td><td>Applies the outcome under its policy, retrains the team, creates a visible complaint route, checks both search pages weekly</td><td>Asks staff to post positive reviews</td></tr>
<tr><td><strong>Month 3</strong></td><td>Adds a short update to the dated page and reviews whether complaint response times improved</td><td>Claiming the matter is closed in search while the video still ranks</td></tr>
</tbody></table></div>

The reputational result depends less on the video than on whether the dated page, the earlier reviews and the follow-up tell a consistent story. In this scenario the likely outcome after three months is that the video still appears in search for the company name, beside a company page that explains what changed. That is a normal end state and a reasonable one: the accurate record remains, and the firm's account of it is next to it.

## Rebuilding trust after the case is closed

Trust returns through evidence of changed behavior that outsiders can check, not through a statement that the matter is over. After the process ends, three things do most of the work.

- **A short public account of what changed.** One page, factual, no adjectives: the new complaint route, the training, the review of the policy. Keep the date visible and update it if more is done.
- **Visible follow-through to the person who raised it.** If a complainant has a good experience, they may say so, and former staff and employer review pages reflect it more honestly than anything you write.
- **A standard applied evenly.** The next case will be compared with this one. The same threshold, the same process and the same speed in the next case is the strongest signal you can send.

Then measure. Use the brand-name search page, two or three AI assistants asked neutral questions about the company, and the review sites your customers and candidates use. A case is over in search when the company's own record sits beside the story, when AI answers describe both accurately, and when new searchers find the response as easily as the incident. It is not over because the incident has stopped ranking, which for accurate coverage it usually will not.

## Your next step: write the conduct standard before you need it

The cheapest reputation protection in this area is a short, public conduct standard and a reporting route that works. It is the "reasonable steps" evidence, the pattern answer and the response speed answer in one document, and it is far easier to write when nothing has happened.

<div class="box hot"><b>If this is happening to you now</b>
<p>Preserve the record, appoint someone uninvolved and agree a three-fact holding line with counsel before anyone replies publicly. If you want a second pair of eyes on what the company-name search page and AI answers show today, a private audit sets out where the exposure is.</p>
<p><a href="/audit">Request a private audit</a></p></div>

If the case is moving fast and you need a team beside you, <a href="/crisis-management">our crisis desk</a> works with in-house counsel and communications, and Reputation Partners handles the search and AI-answer side while your lawyers and managers handle the people side.

## Questions people ask

### Can a company be blamed for what an employee does outside work?

Public blame follows the connection to the job, not the clock. An off-duty act that mentions the employer only because someone found out where the person works is judged lightly. An act that uses a company title, account or uniform is judged heavily. The test is the link, so a company should know in advance which kinds of off-duty conduct its policy covers and apply that evenly.

### Should we fire the employee before the story spreads?

Not because of the story. A dismissal made in an hour can be unfair to the person, hard to defend later and read by staff as theater. Act on the facts as quickly as a fair process allows, use interim measures where they are justified, and decide the outcome under your policy. Speed in starting the process matters more to outsiders than speed in ending it.

### Do we have to name the employee?

Usually not, and often you should not. A company statement can describe the conduct and the steps taken without a name. If the name is already public through a customer's post or a news report, you do not need to repeat it. Naming can expose the person and any complainant to harassment, and it ties your pages to their name in search.

### Can we get articles about the employee's conduct taken down?

If an article is accurate and lawful, a request to remove it will almost always fail and may produce a second article about the request. If it contains a factual error, ask the publisher to correct it with documents. If the content is unlawful in your country, such as a privacy or defamation breach, legal routes may exist, and counsel decides.

### How long does the search page take to settle after a conduct case?

In most files the first week is volatile and the first three months shows the new shape: your dated page and owned profiles in place, the story still present but no longer alone. Accurate coverage tends to stay for years. What changes is how much of the page is your own record, and that is built by publishing evidence, not by waiting.

### What if the misconduct was reported by a whistleblower?

Protect them and do not pursue them. Retaliation can be a legal risk, depending on where you operate, and it is a reputational one everywhere, because staff and the press treat it as proof of the underlying claim. Keep the complainant's identity private, route all contact through one named person, and let the investigation proceed without anyone connected to the matter. Counsel should advise on the rules where you operate.