How the Best Leaders Respond to Rule Breaking

When a rule gets broken at work, a leader’s first instinct is to act fast. The business response feels obvious: punish the offender and move on. But it’s rarely that simple.

In a new paper that reviews and synthesizes more than 250 studies across four decades, Michael J. Gill, an associate professor of organization studies at the University of Oxford’s Saïd Business School, shows that people break rules for very different reasons. Some do it for personal gain; others to help customers or colleagues. And sometimes the environment pushes people over the line.

The Ethics & Compliance Initiative’s “2023 Global Business Ethics Survey” reported that 65% of employees around the world said they had observed misconduct at work, up from 60% in 2020. In the United States more than half of workers reported seeing rule breaking. Prior surveys found much lower levels, suggesting the problem is increasing.

Gill started studying the topic after hearing the same question from companies: Why does this keep happening? His work divides misconduct into four types: self-interested, or meant to help oneself; prosocial, or meant to help others; corrupted, or driven by pressure; and edified, or encouraged in the name of doing the right thing. Most organizations treat all of them the same way, which is a problem because breaking rules can be beneficial. For example, an employee trying to appease an upset customer may expedite an order even if company policy doesn’t call for it.

Before punishing rule breakers, leaders should ask two critical questions: Was the behavior constructive or destructive? Was it driven by individual choice or the situation? “If your first move is to punish someone, you may be solving the immediate issue but missing the real cause. And that can hurt the business in the long term,” Gill says. “A better approach is to be less reactive and more curious.” He recommends several best practices for resolving rule breaking at work:

Understand what happened. Before jumping to conclusions, talk to the people involved. Ask why the policy was violated—and do so in a way that isn’t confrontational and that gets to the reality of the situation. For instance, was the person’s rule-breaking behavior prosocial or corrupt? This assessment sounds obvious, but often it doesn’t happen. Many leaders assume they already know the answer, and many employees assume they’ll be judged no matter what they say.

That’s why tone matters. If employees think your goal is understanding, you’re far more likely to hear what’s really going on. That approach builds trust over time and helps leaders understand the pressures behind people’s decisions. It also shifts conversations from blame to learning, which leads to better outcomes for everyone.

“If your people believe they are in trouble, they’ll shut down, but if they think you’re trying to understand what happened before coming to your final conclusions, they are more likely to open up,” Gill says.

Separate intent from impact. Not all misconduct is created equal. Yet when people believe their intent doesn’t matter, they either stop using judgment or start hiding what they’re doing. And when every misstep is treated as self-interest or corruption, they learn to play it safe or stay quiet. The result is less initiative, less transparency, and fewer opportunities to fix problems early.

But if employees see that good intentions are recognized—even when outcomes fall short—they are more likely to take smart risks and speak up when something feels off.

Pay attention to patterns. One-off incidents can be misleading; patterns are where the insights are. If a rule keeps getting broken, that usually points to something bigger, such as a policy that is unrealistic, unclear, or in conflict with what employees are rewarded for doing. Repeated violations can be a form of feedback about where the system doesn’t line up with the work. For example, an employee who regularly buys office supplies from an unapproved vendor to get a better price is violating policy, but the intent is to save the company money, not enrich themself. When leaders spot a pattern like this, it’s often useful to take a hard look at the rule.

Uncover what you’re not being told. Many instances of observed misconduct never make it up the chain. People may not report it, and managers may not escalate it. That’s why leaders need other ways to understand what’s happening, such as establishing anonymous reporting channels, spending more time seeing how work gets done, or simply asking broader questions about the company’s policies and how restrictive they are.

Leaders can treat these signals as an early warning system. Small workarounds, quiet shortcuts, and informal fixes often show up before bigger problems do. Paying attention to them helps you see where pressure is building inside the system. For example, a company rule may require customer support responses to be approved by a manager before being sent. In practice, however, customers may expect quick replies, and getting approvals can cause delays and frustration. When leaders make space for that kind of visibility, they are less likely to be surprised later and more able to fix issues before they escalate.

Fix the causes of rule breaking. If you execute the earlier steps well, you’ll identify root causes that may be driving misconduct, including bad incentives, unclear rules, or pressure that’s pushing people in the wrong direction. Now it’s time to find a systemic fix for the problem. Focusing only on the individual might fix the behavior in the short term but won’t always solve what’s driving it.

None of this means rules don’t matter. Many policies should never be broken, even for prosocial or edified reasons. But others may need to be revisited, clarified, or applied with more flexibility. Leaders who respond with curiosity instead of assumptions are far more likely to get it right.

“Misconduct isn’t going away,” Gill says. “The real goal isn’t to catch it faster. It’s to understand it better.”

About the research: “Rule Breaking in Organizations: An Integrative Review,” by Michael J. Gill (Academy of Management Annals, 2026)

“Coach the Intent but Enforce the Boundaries”

Art Gilliland is the CEO of Delinea, a cybersecurity company based in San Francisco with approximately 1,200 employees. Gilliland spoke with HBR about how he distinguishes between true misconduct and well-intentioned rule breaking, and how he works with managers to apply consistent judgment across situations. Edited excerpts of the conversation follow.

Is it realistic for managers to respond to rule breaking in a nuanced manner?

Yes, but maybe not in the way it reads on paper. I work in cybersecurity, where you don’t have the luxury as a manager to sit back and be overly introspective every time something bad happens. By the time it gets to the CEO, it’s usually serious. So when I am involved, my first step is to seek to understand what happened. If it’s something regulatory or legal, you must take a hard line; there’s just not much flexibility there. But a lot of the time people are trying to help a customer or move quickly, and they cross a line without realizing it. In those cases I’d much rather educate and coach.

Have you dealt with a serious misconduct issue?

We’ve had situations where employees shared pricing information for our services with customers when they shouldn’t have. In our model we partner with third parties to sell services, and they set the market price. Getting ahead of that process can be a regulatory violation. Usually employees aren’t thinking about the potential for price-fixing or legal exposure; they’re just being responsive to customers.

How did you react?

What I don’t do is immediately come down hard on people. First, I ask how often the rule breaking has occurred with this specific employee. Then we spend time educating them on why that rule exists and what the right behaviors are. If it’s a one-off problem, coaching usually solves it.

What happens when the behavior isn’t meant to help the company?

Then you’re dealing with a different kind of issue. We still want to understand the context first, but the lens changes. Now you’re asking, Was this self-serving, careless, or knowingly against the rules? If someone knowingly breaks a rule for personal gain, our tolerance is zero. You might still give feedback, but you’re likely taking formal action.

What if you find a pattern of problems?

Repeated behavior tells you something different. Either the person isn’t understanding the expectation or they’re choosing not to follow it. At that point you must be direct. You still want to be fair and give clear feedback, but you’re also thinking about the message you’re sending to the rest of the team. If someone continues breaking a rule after coaching and support, eventually you must make the call to let them go.

Have you been able to train managers to handle these situations well?

Yes, and it requires being clear about what matters, where the hard lines are, and where there’s room for judgment. A lot of it comes down to communication and repetition. We talk through real examples, what we did, and why. The goal is to coach the intent but enforce the boundaries. You’re never going to get perfect alignment between people and rules, and that’s OK. But if you hire the right people, reinforce the company’s values, and stay involved in the tougher cases, you can get as close to perfect as possible.

Copyright 2026 Harvard Business School Publishing Corporation. Distributed by The New York Times Syndicate.

Explore AAPL Membership benefits.