[00:00:00] Speaker A: Foreign.
Hi, everyone. On this live episode of Ethicast reacts. We'll cover the abrupt firing of Kohl's CEO Ashley Buchanan for cause and an embarrassing data privacy breach for the NFL. I'm your host, Bill Coffin, and I'm joined by Ethis, your chief strategy officer, Erica Salmon. Burn. Erica, as always, it is great to see you. Thanks for joining us on the program.
[00:00:32] Speaker B: Oh, Bill, it is my pleasure to be here 100%. And sometimes the news gives us gifts, right? And when the news gives us gifts, we're gonna react to them and, and, and give them to all of you as well. So one of the things I wanted to open with, Bill, if you'll give me the, the grace for this for just a moment. I've had a number of Bella members ask me over the course of the last couple weeks, particularly Bill, after we did our live five parter from the stage at the Global Ethics Summit, whether they can use these Ethicast Reacts inside their own organizations. And the answer to that is, of course, yes, absolutely. We host all of these on our YouTube channel. We have seen organizations use them to open manager meetings. We have seen them as a pre read around, you know, a communication on a particular topic for somebody who wants to watch something instead of read something. So, yeah, Bill and I put these out in the world because we hope that you'll make use of them because everybody's problem should be all of our opportunity to learn something.
[00:01:24] Speaker A: Yeah, I could not agree more. In an era of media hot takes and people sort of getting together just to dunk on things, that's not what this is all about. This is all about, you know, very pressing examples of how the things we talk about in the ethics of compliance space are very real. They're very pressing. They renew themselves every single day. And we touch upon these things to kind of remind ourselves. These are the most recent examples of things that we come back to again and again and again. And, and today we have a special double feature because we've got two big stories with important business integrity lessons to get into. So I'm going to jump into the first one, which is around the retailer Kohl's. On April 30, the board of directors of retail chain Kohl's terminated its CEO Ashley Buchanan for cause for violating the company's code of ethics on two counts. Buchanan had been on the job for less than 100 days. According to Cole's SEC filing on the matter, quote, Mr. Buchanan's termination follows an investigation conducted by outside counsel and overseen by the audit Committee of the Board during which it was found that Mr. Buchanan had directed that the company conduct business with a vendor founded by an individual with whom Mr. Buchanan has a personal relationship on highly unusual terms favorable to the vendor, and that he also caused the company to enter into a multi million dollar consulting agreement wherein the same individual was a part of the consulting team. End quote. Kohl's found that in both cases, Buchanan failed to disclose the relationship as clearly required under the company's code of ethics. The conflicts of interest here, and this is where it gets a little twisted, involve former Bed, Bath and Beyond CEO Chandra Holt. According to the Wall Street Journal, which I believe broke the story, Buchanan and Holt worked together several years ago as senior executives at Walmart. Buchanan left Walmart in 2020 to become CEO of Arts and crafts retailer Michaels. Buchanan entered divorce proceedings that year in which it was revealed that he and Holt were having an extramarital affair. Holt left Walmart in 2021 to become the CEO of home goods retailer Kahn's Home plus, which has since filed for bankruptcy. Holt became CEO of Bed, Bath & Beyond in 2024, but only lasted a few months there. In August 2024, she joined Boston Consulting Group as a senior consultant. Now in January 2025, she founded Coffee pod seller Incredibrew along the side. Buchanan became CEO of Kohl's in January 15 and apparently directed the company to buy from Credibrew as well as to bring Holt on as a consultant. That's a lot.
[00:03:52] Speaker B: Yes, it is.
[00:03:54] Speaker A: Buchanan's investigation and termination followed shortly thereafter, and Holt has been let go from Boston Consulting Group for her failure to disclose conflicts of interest. Buchanan, who was hired with a $20 million compensation package, will forfeit all equity awards he received from Kohl's and will be required to REIMB the company $2.5 million for a pro rata portion of his signing incentive. Kohl's has named board member Michael Bender as interim CEO while the company initiates a search for a permanent CEO. Okay, Erica, let's unpack this.
Sometimes these news stories make an episode of at. The cast reacts because they detail behavior that is so outlandish and so egregious that we feel compelled to hold them up as of examples of what not to do. And personally in Buchanan's case specifically, that's certainly so. But I like to flip this around a bit because Kohl's is a seven time world's most ethical company's honoree. And in this situation, while Buchanan failed the most basic of ethical tests, it looks like the guardrails that Kohl's has in place worked really, really, really well. So what are your thoughts on that?
[00:04:56] Speaker B: Yeah, I mean, look, Bill, the, this is the, the classic formal system, informal system setup, right? On the, on the one hand, you have the formal systems that Kohl's put in place. Clear expectations that you disclose conflicts, including romantic relationships where, you know, you might be directing business to somebody that you are in that you are, you know, that is your romantic partner.
Very clear language in the code of conduct. Very clear expectation. And then you also, of course, have other controls related to vendor contracts and agreements and things along those lines. It all worked, right? I mean, Buchanan is a different story because the fact that that man has been through as many companies as he has, and I mean, this kind of disclosure, Bill, is as basic as it comes, right? Can't hire your girlfriend. Come on, people, you really can't like that. It is as basic as it comes. And so, you know, the fact that he failed to disclose it to Kohl's, the fact that she failed to disclose it to bcg, the fact that they thought that nobody would find out, even though she is named in his divorce proceed in today's day and age is about as night. I mean, I don't know what they were thinking in that regard, but, but those systems worked. So the informal systems, which is the decision making that Buchanan Engra engaged in here, didn't work. But the systems that Kohl's had in place worked. And Kohl's was very public. Right. They could have made a decision to do this in a different fashion. They could have made a decision to not fire him for cause. They could have made a decision to say that, you know, upon further reflection, he decided to spend more time with his family. We are all very familiar with those kinds of corporate departures. Instead, in spite of the fact that this is, I think, Kohl's fourth CEO and third CEO in four years. Four CEO in five years, something like that. A lot of turnover and headwinds at the retailer. The Kohl's board looked at this and said, this is as wrong as it gets. This is even more offensively as stupid as it gets.
[00:06:52] Speaker A: Yeah.
[00:06:53] Speaker B: And we are going to be public with the reason that this happened.
[00:06:56] Speaker A: Now, Buchanan never disclosed his romantic relationship with Holt, even though, as I said before, Cole's code of ethics clearly required him to do so at a time of sky high CEO churn and headwinds, not just for retailers, but for all business. As we look at supply chain duress, international trade Disruptions and more. What is the big board level takeaway here when it comes to recruiting and retaining top level leadership?
[00:07:19] Speaker B: Yeah, so I think the one thing I would do if I were a member of the Kohl's board or if I was a member of the compliance team at Kohl's is I would look really carefully at my onboarding procedures and I would ask myself, how is it possible that, that this person did not disclose this relationship? Was my form not as clear as it could have been? Did I, Did I ask the question in the negative instead of the affirmative? Did I, you know what? Is there something in my, the way in which I brought this person into the organization that contributed to this decision making process? Now it may well be that after that exercise, what the Kohl's teams discovers is no, there was nothing I could have done differently. I was clear as Claire could be in this person just made a. Deliberately made, deliberately made the wrong choice. That is always, that's always possible. Yeah, but that would be one of the things that I would do if I, if I were there. And that would certainly be one of the things that I would do if I were somebody from a similar organization that was listening into this saying to themselves, is there something I need to do too that makes this more clear? If I was a director at Kohl's, that I was, you know, and I was part of that, that, that interview process, that selection process. Right. That is a rigorous process that a board goes through to try to find a CEO. This is obviously a disappointing exit for this particular CEO because you know, he's, he had only been in seat for five months. So.
Yeah, not even as we think about the, about that piece of it. I would examine my diligence process. I would ask questions about prior experiences. Right. The, the news reporting on this indicates that he tried to bring her on to his prior company and the only thing that prevented that from happening was an anti poaching agreement that they had with Walmart. So this is clearly a behavior that he has tried to engage in in the past. And, and I would ask myself as a director, is there something in our diligence process that caused us to miss this and have this be something that surfaced as quickly as it did so because you know, the conflicts of interest is an age old issue. We've been talking about conflicts of interest for far longer, Bill, than either you or I has have been doing this work. And this idea that, you know, a conflict of interest, the concept of it exists because we can be tempted to put our own best interests ahead of the interests of the business. And one of the ways that you control for that is by making sure that everybody understands the potential factors that could cause you to do that, which is disclosure. So that, that's the reason why every conflicts of interest process begins with a disclosure process. You know, what are your relationships? And we have seen this conflict of interest issue, Bill, you know, surface in other news stories as well. We, there have been director cases with interlocking directors where, you know, I'm on, I'm on the board of another company that is a competitor of mine and that runs into antitrust issues and also conflict of interest issues when it comes to balancing your fiduciary duties. So, you know, really thinking about, okay, how do I make my disclosure process?
A, as easy as possible, B, when do I repeat it? Because to flip this to the Boston Consulting Group side of things, where apparently Holt did not disclose this relationship to the BCG team either. If I were at bcg, one of the things I would be asking myself is, what's wrong with my conflict conflicts of interest disclosure process. That this didn't come up. You know, did, did Holt make an affirmative decision not to disclose this conflict? And if so, again, she's listed in his divorce proceedings? People like a Google would figure this out.
[00:10:47] Speaker A: Yeah, yeah.
[00:10:49] Speaker B: The, the, you know, the, the. So what's going on with, with that disclosure process? Am I not having to, to affirmatively redisclose any particular relationships that could arise when I go into, when I join a particular transaction team or consulting team? Right. So at the moment that she was on the pitch team, everybody on that pitch team should have been asked, are we confident that there aren't any conflicts here? So those are, those are some of the takeaways that I would have. And you know, certainly if I'm listening into this, I would say, you know, if, if you've got a transaction team where you're not asking people to redisclose, or you've got a consulting team or a pitch team where you're not asking people to redisclose. And if you're not, if, if you're allowing people. Again, if we go to the fraud triangle. Right. Opportunity. So weak controls, motivation, personal interest, rationalization. Yeah, it's, it's not going to matter. Right. Or I wasn't dishonest on the forum because of the way the question was worded. So that's something else to ask yourself. Right. The way you've set your conflicts disclosures process up, are you say, are you asking People to affirmatively say I have no conflicts, or are you letting them say I have nothing to disclose?
[00:11:59] Speaker A: Yeah, those are different. Yeah. So. Well, you know, when we do these episodes, Erica, I always look forward to them quite a lot because I learned something from you every time we do it. Because I really appreciate your insight on this. But I'll just say as a, as a media professional, myself and somebody who has been involved on the, on the journalism side of things, just a quick note that I really have to applaud, like the transparency with which Kohl's addressed this and the ease with which it made a guy like. It made it for a guy like me to, to find out what exactly had happened. There was. I mean, I detected no obvious obfuscation here. They didn't try to put anything away. And they were very out and open about this on multiple, multiple levels. And even when I wanted to take take a look at their code of ethics to see, you know, to see what the language is, like, code of ethics was super easy to find. And we always talk about, like sometimes there are companies that have, like, we always like to say Enron had a great code of ethics. Right. You know, but, but the point that you met, you've made a bunch of times. And it really, this observation lives rent free in my head is not so much how nice looking is the code of conduct, but how easy is it for you to find. Right. And this was, I found this in, in 0.2 seconds. It was so easy to find. It was so out there, very easy to read. And within, within five minutes I was able to find it and to lock in exactly going, Yep, I see exactly why he was fired for cause because it's plain as day. And I think plain as day that, that, that clear, that clarity and that transparency, I think really speak well, speaks well of Kohl's. Honestly, you know, as we like to say, humans are messy and complicated creatures. Sometimes, you know, you get one in the CEO chair.
[00:13:26] Speaker B: But for sure.
[00:13:28] Speaker A: Yeah. Well, we have a second story here.
[00:13:30] Speaker B: We do have a second story. Yes.
[00:13:32] Speaker A: And then this involves the NFL. So on April 24th through the 26th, the National Football League held the 2025 NFL Draft for franchises to select newly eligible players. The draft was held at Lambeau Field and its adjacent title town district in Green Bay, Wisconsin, and was televised on espn, ABC and the NFL Network, as well as on various streaming services. Now, this is one of the biggest days for the league and a massive media event as players wait with phones provided by the NFL to receive the call that they had been selected to play on a team. Capturing those live reactions from the players when they discover their professional career has begun is a really big part of the televised coverage. Unfortunately, during this year's draft, a number of prospects including Abdul Carter, Mason Graham, Tyler Warren, Josh Connolly Jr. Kyle McCord and Chase Lunt all received prank calls from people masquerading as NFL front office staff during the draft. The most notable victim of this, however, was quarterback Shador Sanders. And I hope I'm pronouncing his name right if I haven't.
[00:14:35] Speaker B: I thought as a Denver resident, you are right on, right on, right on the money with that there.
[00:14:40] Speaker A: There you go. Because I think he's the son of Deion Sanders, correct?
[00:14:42] Speaker B: Yes, indeed.
[00:14:43] Speaker A: Yeah, he is. So Shadur Sanders, a a high profile prospect who received a pair of prank calls on day two of the draft by someone pretending to represent the New Orleans Saints. The prank calls were a public embarrassment for Sanders and the NFL, which launched an immediate investigation and within 24 hours learned that Jax Ulbrich, 21 year old son of Atlanta Falcons defensive coordinator Jeff Al, was the culprit. According to a statement issued by the Falcons earlier that week, Jack. Jack Ulrich, the son, quote, unintentionally came across the draft contact phone number for Shador Sanders off an open iPad while visiting his parents home and wrote the number down to later conduct a prank call. Jeff Ober was unaware of the data exposure or any facets of the prank and was made aware of the above only after the fact. End quote. The NFL has fined the Falcons $250,000 and Jeff Ulbricht $100,000 for quote, failing to prevent the disclosure of confidential information distributed to the club in advance of the NFL draft. End quote. Both the Falcons and the Ulbrichts have accepted the fines, apologized for the breach of confidential information and for the prank call and promise to make sure that this sort of thing doesn't happen again. Erica, let's unpack this.
The NFL provides single use phones to draft prospects and then sends those numbers to some 2,000 NFL and staffers, mainly general managers, their staff and coaches, but secondary staffers and some media are reported to have also received these numbers. So I guess given what's happened, what can we learn about the role that both compliance and culture have to play in upholding good organizational data security?
[00:16:20] Speaker B: Yeah. So Bill, you and I talk a lot about intangible assets like brand and reputation and confidential company information. And all of those are, you know, at play in this particular fact pattern.
These numbers were confidential, you know, confidential company information that were, that was supposed to be shared with individuals on a need to know basis. Now if you think about the size of that list, I would question whether or not that is actually, you know, conscribed to a need to know basis. I would also question the wisdom of emailing those numbers in today's day and age. I'm sure that there are any number of secure portal companies that would be delighted to provide that service to the National Football League to make sure that these numbers are protected. And the reason for that, Bill, you know, to go back to our. Why this particular story caught my attention not only because I'm based here in Denver and the where will Shadur go in the draft was like, like the talk radio out here. Because of course he was playing at CU talk radio out here was talking about nothing for weeks. Nothing other than where is he going to go in the draft. And he, you know, he, he stayed, he stayed on the board. He stayed on the board. He stayed on the board. There was a lot of energy and attention around this. And this is a, you know, to go again, to go back to the why this is a person who is sitting by a phone that was provided to the NFL waiting for a team to call him and tell him that they were taking a risk on him.
[00:17:56] Speaker A: Yeah.
[00:17:57] Speaker B: And instead of that being treated appropriately and you know, with the level of gravitas that it deserved, the. I won't use the words to describe him in the way that I want to in my head, son of this defensive coordinator decided that he was going to insert himself into this particular set of circumstances that was being live streamed. Right. So that not only was the NFL broadcasting this whole thing, but, but Shadur was broadcasting his house as well. And so, you know, they saw, they saw an opportunity to, to, you know, to, to get on, to get, to get into this story.
And you know, and, and, and you know, Jackson, his buddy, because there was another person in the video with him, posted their own video. Right. They videotaped themselves too, making these phone calls. And I think to me the, the decision to stick to email instead of, you know, some sort of conscribed, harder to access way of distributing this list combined with the media hype, which again, if we go to our old fashioned fraud triangle. Right. All kinds of opportunity here. Weak controls, lax processes, motivation, making a name for yourself doing something that all your buddies are going to high five you for. Inserting yourself into a media story.
[00:19:22] Speaker A: Yeah.
[00:19:23] Speaker B: And rationalization. Right. Oh, you know, it's not a big Deal. Like it's a prank, right? Haha. Well, it wasn't a prank to Shadur or his family.
[00:19:33] Speaker A: No.
[00:19:33] Speaker B: And it's definitely not a prank to the NFL because it's embarrassing. And you know, and that. And we see that in the fines.
I can say this. I, you know, I wouldn't blame his dad if he decided to use him as a tackle practice dummy with no pads.
[00:19:50] Speaker A: Yeah, yeah, yeah.
[00:19:53] Speaker B: But it's a good lesson. It's a good lesson, Bill, to all of us that, you know, if we don't. If we are not vigilant in reminding people that confidential information has to be protected no matter where it is.
[00:20:08] Speaker A: Yeah.
[00:20:08] Speaker B: The fact of the matter is this was emailed out and then left on an unlocked iPad sitting on a coffee table in the living room.
[00:20:15] Speaker A: Yeah.
[00:20:15] Speaker B: And it happened to be his son walking by. But, you know, what if it was a neighbor?
[00:20:20] Speaker A: What if it was house cleaner?
[00:20:22] Speaker B: House cleaner. What if it was the pool guy? I don't know. Yeah.
[00:20:26] Speaker A: It could have been anybody. Yeah.
[00:20:29] Speaker B: You left at the. Fundamentally speaking, you left confidential information sitting in an unsecured fashion in an area where anybody could have come across it. And that, that is the same fact pattern that we've been talking to people about in terms of like, you know, having that deal conversation in the back of the Uber. It's the same conversation that we've had about working on that confidential information memorandum on your. On the plane with, you know, without any controls on your laptop. It's the same conversation like we've. This is add. It's a great story. It's got human elements. It's got football, it's. But at the base of it all, what this is, is a reminder that you have to treat confidential information confidentially and you have to make sure that you're safeguarding it appropriately.
And this could be an insider trading case, as we saw during the pandemic, with people trading on information that they heard their spouses or their partners working on, you know, from other rooms in the house. And there were multiple cases of that during the pandemic. In particular, this could be, you know, my bag got stolen and my laptop didn't have a password on it. Right. We have. We have seen this. We have seen this. And at the base of it, you know, if you are somebody who is concerned about the way in which some of your employees might be, you know, playing fast and loose with stuff on their iPads, this is a good reminder to folks that there are consequences when you choose not to protect confidential information.
[00:21:52] Speaker A: Indeed. And Just as a quick aside, you know, when you talk about intangible assets, we talk about things like reputation and brand, which is something that kind of comes up in, in the work that we do. You know, social media conduct is often looked at as a vector of risk. You know, somebody who spends probably an unhealthy amount of time online. I am alarmed by the rise of, of so called prank videos that are clearly trespassing into the realm of, of just what, you know, criminal behavior. And it's just a prank bro, is not, is not sufficient defense on a lot of these things. And you know, as organizations look at, you know, full as they look at now social media or online conduct and behavior as something that gets worthy of code of conduct mention, the whole online pranking thing should probably be looked at at some point in time only because there appears to be just sort of a, A, a cultural critical mass around a certain level of pranking is, is seen to be seen to be permissible in ways that the rest of society does not think is so. And I think that's worth, worth looking into. But I think a more, a more important thing to raise though is my second question for you, which is this.
Sanders was not the only player pranked this draft, nor was this the first year pranking situation has marred the NFL draft.
[00:23:00] Speaker B: Yep.
[00:23:00] Speaker A: When we see a recurring issue like this at an organization, what can ethics and compliance do to affect a strategic solution to what is clearly more than just simply a tactical problem?
[00:23:12] Speaker B: Yeah.
Yeah. I mean the first off obviously is root cause. So I don't, you know, I'm obviously you and I are speculating 100% but I don't know what kind of root cause analysis the NFL has historically done on these kinds of, of prank calls and the, the genesis of them. I, I do know that some of that behavior is the reason why they have, they started handing out these confidential, you know, NFL only phones in the first place was to try to make sure that they were appropriately controlling who was contacting these young men and you know, having these conversations with them. So you know, I don't probably a root cause analysis here is very, very much worthwhile both in terms of, you know, how did that number go into the iPad? Is he accessing NFL email on the iPad? What kind of controls are on the iPad? All of those kinds of things. And then obviously you gave the list of people who also got prank calls this time around who was. There's. It does not appear that, that Jax was responsible for all of those there. It seems like there were probably other people who were, we're pranking other players.
How did that happen? Right? What is, what does that root cause look like? What does that investigation look like? And then that will guide what sort of behavior we need to see going forward. So is it moving to a secure portal that you log into? Is it controlling the list, the distribution? Right. Really? Do 2000 people need all these phone numbers? You know that it's, it's interrogating who's on that list, Interrogating who's actually, you know, who actually needs to have that information. This is classic, you know, risk analysis of information distribution. Do I have a business need to have this information? Do I have a business need to have this number? Or have I just always been on this distribution list? And so I'm on this distribution list still. Those are the kinds of things that I would be asking if, if I were, you know, if I were thinking these things through. What does that root cause analysis look like? What have we done on the prank calls that have happened in the past? What kind of behavior change have we engaged in? Has it made the problem better or worse? What could we do next time around?
Because, you know, at the bottom, at the bottom of it, Bill, these are, these are young men who are waiting to hear whether or not their lives are going to change. And we shouldn't be, we shouldn't be messing around with that.
[00:25:30] Speaker A: No, no, I. Look, you and I, everybody out there has remembered what it's like to be waiting for that call for the job you really, really want to come through. And that's going to be a big deal. And everybody knows what kind of butterflies you get. The snot in your stomach. Now imagine that times a thousand. And now it's also online for the whole Internet to see. You know, that's, that's a moment of vulnerability that really nobody has a right to trample upon. And it deserves, to your point, it needs to be treated with, you know, state secret level, level priorities because you're dealing with, well, you're dealing with psychological safety, frankly.
[00:26:03] Speaker B: Yeah, yeah, exactly. Exactly. So certainly, you know, if I, if I were in a decision making position at the NFL, I'd be doing a root cause on exactly what happened and I would be trying to figure out how I'm going to fix it going forward.
Because, you know, the fact that this is a repeated problem means that whatever you've looked into in the past hasn't fixed it.
[00:26:21] Speaker A: Indeed. Indeed. Well, this has been a slightly longer than usual episode, but only because we had so much news to cover. So Erica, thank you so much for stopping by once again and for being our ear to ear to the ground on these news stories.
[00:26:32] Speaker B: Yeah, no Bill, absolutely I'm delighted to be here. And fortunately for both you and I, the news is a gift that keeps on giving. So I'm sure it will not be too much longer before you and I are reacting together again.
[00:26:42] Speaker A: Most definitely. Well, for plenty of helpful resources around conflicts of interest, board governance, values based leadership, data security, organizational culture and more, please visit the Ethisphere resource
[email protected] resources. I'm Bill Coffin and this has been the Ethicast. For more episodes please Visit the Ethisphere YouTube
[email protected] ethisphere and if this is your first time enjoying the show, please make sure to like and subscribe on YouTube, Apple Podcasts and Spotify. Thanks for joining us and until next time, remember, strong ethics is good business. Bye now.
