The Context
Prime Minister Keir Starmer appointed Peter Mandelson as UK ambassador to the US. The Foreign Office’s own security team flagged a problem. They failed the vetting. The team’s recommendation was overridden. Mandelson served for 7 months before being dismissed. The trigger? Undisclosed, extensive ties to convicted sex offender Jeffrey Epstein. A police inquiry now investigates allegations of leaked sensitive documents. The Prime Minister assured Parliament “due process had been followed.” He states he was not told of the vetting failure. The system was bypassed at the highest level.
The Risk
This is a governance collapse. It’s not just political. For a director, the personal liability is profound. Ignoring a formal, expert risk assessment is a cardinal sin. In New Zealand, this may indicate a failure of the duty of care, skill, and diligence under section 137 of the Companies Act 1993. It creates a direct line to personal liability. The reputational damage is instantaneous and severe. The ‘Court of Public Opinion’ delivers its verdict long before any police inquiry concludes. Your brand is now synonymous with secrecy and failed oversight. Trust, once dissolved, has a multi-year recovery timeline. The psychosocial damage to organisational culture is deep. Staff see that rules don’t apply at the top. This erodes the very integrity you are legally required to foster.
The Control
You must treat your risk and compliance functions as sacrosanct. Their ‘red flags’ are non-negotiable board business. Create an immutable protocol: any overridden critical risk assessment requires full board disclosure and a documented, dissenting minute. The control is cultural—a zero-tolerance policy for circumventing established safety checks, especially for high-profile appointments.
The Challenge
These are the critical questions you should be raising at the board table:
| Who in our organisation has the unilateral authority to override a failed security or integrity vetting, and what is the immediate, mandatory board reporting process when they do? | |
| If our CEO stood in Parliament tomorrow and said “due process was followed,” what verifiable, documented audit trail do we have to prove that statement is categorically true? | |
| What is our single-point-of-failure? Map the one decision, one person, or one missed meeting that could cause our own “vetting void” scandal to erupt. |