How do you identify conflicts of interest, what is the difference between a risky situation and improper conduct, and how do you turn background checks and employee declarations into an effective tool for managing organizational risk?
A conflict of interest does not necessarily indicate a lack of integrity
A procurement manager at a large company holds shares in one of the organization's suppliers. A candidate for a senior position is married to a manager at a competing company. A CFO is negotiating a future position at a company that has business dealings with his current employer.
What do the three cases have in common?
In each of them, there are circumstances that may create a conflict of interest. But none of the cases, in itself, proves that an offense occurred, that an improper decision was made or that the person involved is dishonest.
This distinction, which seems simple at first glance, is one of the most important distinctions in managing organizational integrity.
In practice, the term "conflict of interest" sometimes triggers an almost automatic reaction of suspicion. Managers are reluctant to declare personal or business ties, candidates fear that a finding in a background check will hurt their chances of being hired, and organizations struggle to distinguish between a risk that can be managed and conduct that requires a substantial inquiry.
The result may be twofold: on one hand, people refrain from reporting relevant circumstances; on the other hand, organizations give excessive weight to the mere existence of a personal or business tie, even when there is no evidence of improper conduct.
A professional approach to conflicts of interest starts with a basic understanding: a conflict of interest is first and foremost a situation that requires examination and management, not proof of wrongdoing.
What is a conflict of interest according to the OECD?
On 28 May 2003, the Council of the Organisation for Economic Co-operation and Development (OECD) adopted the Recommendation on managing conflict of interest in the public service.
The document, Recommendation of the Council on OECD Guidelines for Managing Conflict of Interest in the Public Service, is intended to help countries develop effective policy for identifying, preventing and managing situations in which private interests may influence the performance of a public role.
According to the definition, a conflict of interest exists when there is tension between the public duties of an official and their private interests, in a way that those interests could improperly influence the performance of their duties and responsibilities.
However, the document emphasizes an important distinction even before presenting the definition.
A conflict of interest in itself is not corruption. A conflict that was not identified or not properly managed may develop into a breach of integrity and into improper conduct.
The document adds that when a private interest has already compromised the proper performance of the role in practice, it is more accurate to describe the case as misconduct, as abuse of office or, in the appropriate cases, as corruption.
This is a substantive difference between a situation in which there is potential for improper influence and a situation in which that influence has already materialized.
The distinction is also important from a management perspective: the mere existence of a conflict of interest does not necessarily indicate a personal failure, but failing to identify it, declare it or manage it may create a significant organizational failure.
Source: OECD, Recommendation of the Council on OECD Guidelines for Managing Conflict of Interest in the Public Service, 2003, sections 4 and 10-15.
Three types of conflict of interest every manager should know
The OECD distinguishes between three main categories. The distinction between them helps the organization determine the level of risk and the appropriate way to handle it.
1. Actual conflict of interest
A situation in which there is already a conflict between the official's responsibility and a private interest that may influence the exercise of their authority.
Example: A procurement manager takes part in selecting a supplier while holding a personal financial interest in one of the competing companies.
The holding itself does not prove that the procurement manager gave the company an advantage, but their participation in the selection process creates a conflict of interest that requires handling.
2. Apparent conflict of interest
A situation in which the circumstances create a reasonable impression of possible influence by a private interest, even though in fact there is no such conflict.
Example: A member of an investment committee has the same surname as the owner of a company being considered for investment. This raises a suspicion of a family relationship, but an inquiry reveals that they are not related in any way.
In such a case, an arrangement to prevent a conflict of interest is not necessarily required, but it is important to inquire and to document the findings, in order to prevent unjustified damage to trust in the process.
It is important to distinguish between mere appearance and a situation in which there is a real tie that may create a conflict of interest. When the tie exists, it should not be classified as mere appearance only because the person involved is perceived as trustworthy.
3. Potential conflict of interest
A situation in which there is a private interest that could become a conflict of interest if the official takes on certain responsibility or authority in the future.
Example: An employee holds shares in a company that provides services to the organization, but is not currently involved in decisions concerning that supplier. If they are promoted to a role responsible for selecting suppliers, a conflict of interest may arise.
The management implication is clear: checking the situation at the time of hiring is not enough. It is necessary to identify how a change in role, authority or relationships could change the level of risk.
Actual: The interest conflicts with an existing responsibility. Appropriate organizational response: an immediate arrangement, limiting involvement or another solution.
Apparent: There appears to be a conflict, but an inquiry may rule it out. Appropriate organizational response: checking the facts and documenting the conclusion.
Potential: A conflict may arise in the future. Appropriate organizational response: documentation, monitoring and re-examination when circumstances change.
A private interest is not only money
Organizations tend to focus on financial conflicts of interest: shareholdings, ownership of companies, ties with suppliers or receiving benefits.
These are certainly significant sources of risk, but the professional definition is much broader.
A private interest may also relate to family ties, membership in organizations, additional professional activity, personal commitments, past business ties and even future employment opportunities.
For example:
• A human resources manager who takes part in a decision on promoting a relative.
• A board member who serves at the same time on the board of a company with conflicting business interests.
• An information security manager who advises, for payment, a company that provides services to their organization.
• A vice president who is negotiating a future position at a supplier with which they manage a commercial engagement.
• A project manager who is involved in selecting a contractor owned by a close personal friend.
In some cases the ties are open and known to everyone involved. In other cases they are not known to the organization.
The central question is not whether the tie looks unusual, but whether it may influence judgment, the independence of the decision or the fulfilment of professional responsibility.
Why do honest people also find themselves in conflicts of interest?
One of the common mistakes in risk management is treating a conflict of interest as a character trait.
In management meetings one sometimes hears the claim: "We have known him for years. He is an honest person. There is no conflict of interest here."
But integrity and conflict of interest are two different concepts.
Integrity refers to a person's values and conduct. A conflict of interest refers to the circumstances in which they operate.
A person can have exceptionally high integrity and still find themselves in a situation where personal and professional interests pull in different directions.
In fact, it is precisely people who hold senior positions, with extensive professional experience and a wide network of contacts, who may be exposed to a larger number of such situations.
A veteran manager may know suppliers personally. A director may be involved in several companies. A professional expert may serve as an adviser to other bodies in their field of activity.
These are not necessarily signs of improper conduct. Sometimes they are the natural result of legitimate professional activity.
The organization's challenge is to collect relevant information, assess the risk and create a mechanism that allows people to continue performing their roles while protecting the independence of their judgment.
The paradox of the duty to declare: the more disclosure is punished, the more concealment is encouraged
Many organizations require employees and managers to sign a declaration of no conflict of interest.
At first glance, this is a basic and logical control measure. However, its effectiveness depends to a large extent on the organizational culture.
When an employee understands that the very act of declaring a business or personal tie may harm their promotion, their reputation or their standing, a negative incentive to report may arise.
The risk is not only in a deliberately false declaration. Sometimes an employee does not even know whether a certain tie counts as a conflict of interest, and therefore prefers not to mention it.
Such a reality may lead a mechanism meant to increase transparency to create, instead, a sense of apprehension and uncertainty.
An organization that wants to receive reliable information must distinguish between the act of disclosure itself and a breach of the duty to disclose.
An employee who reports in time a tie that requires examination allows the organization to act in an informed way. By contrast, an employee who knowingly conceals a material tie, contrary to an explicit reporting duty, raises a separate question about their conduct and trustworthiness.
It is also important not to turn the declaration into an immunity mechanism. A late, partial or misleading disclosure is not equivalent to full and accurate reporting at the required time.
The preferred approach is to encourage early and transparent reporting, to clarify which situations must be reported, and to allow employees to get advice when they are not sure whether certain circumstances require a declaration.
From conflict of interest to insider threat: when does the risk materialize?
A conflict of interest is not the same as an insider threat, but in certain cases it may be one of the risk factors for its development.
An insider threat arises when a person with legitimate access to the organization's resources, information or authority uses them in a way that may cause harm, whether maliciously or as a result of negligent or mistaken conduct.
An unmanaged conflict of interest may create circumstances in which an employee makes decisions influenced by a personal interest, uses business information improperly or gives an advantage to a third party.
For example, a manager with a personal interest in a supplier may be exposed to information about the price quotes of its competitors. The existence of the interest does not prove that the information was misused, but the combination of the interest and access to the information creates an exposure that should be examined.
The possible development can be illustrated in four stages:
Stage one: a private interest exists. The employee has a family, business or financial tie that may be relevant to their role.
Stage two: a conflict of interest arises. The employee receives authority or access to information that places the private interest against their duties to the organization.
Stage three: no appropriate management. No arrangement is set, the employee does not report, or the organization ignores the information.
Stage four: possible materialization of the risk. The employee makes a biased decision, passes on prohibited information or uses their authority to grant an improper advantage.
This is not an inevitable path. Most conflict of interest situations do not necessarily lead to improper conduct. But the more material the conflict, the higher the level of exposure and the weaker the control mechanisms, the more important early handling becomes.
From this follows a basic principle in managing insider threats: handling should begin with identifying and managing the risk conditions, not only with investigating incidents after the damage has already occurred.
The role of background checks in identifying conflicts of interest
A professional background check may provide the organization with important information about ties, holdings and roles that do not necessarily come up during a job interview or in the CV.
As part of background checks based on open-source information (OSINT), and subject to the law and to the purpose of the check, it is possible to examine, among other things:
• Holdings and business ties: registered ownership of companies, board positions, partnerships and documented corporate ties.
• Additional occupations: parallel professional roles, consulting activity or other business involvement documented in open sources.
• Ties with suppliers and competitors: affiliations that can be established through records, publications or other reliable sources.
• Employment history: relevant ties to previous employers, related companies or parties with an interest in a transaction.
• Business interests of senior officers: involvement in other companies that may create affiliations with the organization's field of activity.
However, there is a significant limitation: not every private interest is documented in open information.
A family tie that is not public, a personal commitment, an unregistered partnership or confidential negotiations on a new position will not necessarily appear in sources that can be checked.
Therefore, a background check is not a substitute for a declaration by the person being checked, and a declaration is not a substitute for a background check either, when there is a professional and legal justification for carrying one out.
The two tools complement each other: the declaration provides information from the person's side, and the background check can verify some of the information, complete it and sometimes point to gaps that require inquiry.
The most important limitation is that a background check cannot determine, based on the mere existence of a tie, that the person acted improperly.
It can describe a factual finding and help assess the relevance of the tie to the role. The conclusion as to whether an arrangement to prevent a conflict of interest is required should be reached by the authorized party in the organization, after examining all the circumstances.
What should a conflict of interest finding look like in a background check report?
The quality of a background check is not measured only by its ability to locate information. The way the information is analyzed and presented is just as important.
A sweeping statement such as "The candidate is in a severe conflict of interest" may be unfounded if the check did not examine the candidate's areas of responsibility, their authority and the connection between the finding and the role.
On the other hand, ignoring a material business tie only because no evidence of improper conduct was found may miss a relevant risk.
Consider an example.
A candidate for the position of procurement manager is found to be a shareholder in a company that provides services to the hiring organization.
A professional report should separate four questions:
1. What is the factual finding?
The candidate appears as a shareholder in a specific company, according to a defined information source and a given check date.
2. What is the possible connection to the role?
The company operates in a field in which the procurement manager may be involved in decisions on engagements, pricing or supplier selection.
3. What is still not known?
The current shareholding percentage, the extent of business involvement, the candidate's future authority or the existence of a prior arrangement to prevent a conflict of interest may not be known.
4. What is the recommended action?
Obtain the candidate's response, verify missing details and examine whether an arrangement is required that would limit their involvement in decisions concerning that company.
A possible professional wording would be:
"According to the information located, the candidate holds a business affiliation with a company operating in a field relevant to their intended role. The finding may raise a concern of a conflict of interest, depending on the scope of the authority and responsibility to be given to them. It is recommended to clarify the nature of the affiliation and to examine the need for an appropriate arrangement."
Such wording reflects the known information, flags the risk and does not attribute to the candidate conduct that has not been proven.
This is a central difference between a report that provides raw information and a report that helps the organization make a professional and proportionate decision.
How are conflicts of interest managed in an organization? A practical working model
Managing conflicts of interest should not come down to a declaration form signed at the start of employment.
For the system to be effective, it needs to operate throughout the employee's life cycle and include identification, assessment, decision, documentation and control.
Step 1: Mapping sensitive roles
The organization needs to identify roles in which there is a significant risk of conflict of interest.
Usually these are roles that include authority to make financial decisions, access to sensitive business information, supplier selection, recruitment of employees, setting engagement terms or oversight of third-party activity.
The appropriate level of control for a director, a procurement manager or an investment manager is not necessarily the same as that required for an employee who has no material decision-making authority.
Step 2: A declaration of interests adapted to the role
A general declaration stating "I am not in a conflict of interest" may be insufficient.
It is better to ask the employee to answer concrete questions related to the nature of their role, such as business ties with suppliers, holdings in relevant companies, additional occupations or family ties that may influence their decisions.
It is important to explain to the employee that the goal is to identify situations to be managed, and not to assume in advance that there is improper conduct.
Step 3: Verifying and completing information
In roles that justify it, background checks and external information sources can be used to verify relevant data or to complete the picture.
Verification should be focused, proportionate, lawful and relevant to the risks of the role. There is no justification for unlimited collection of personal information only because the employee holds a sensitive role.
Step 4: Assessing the severity of the risk
Not every conflict of interest justifies the same response.
When assessing the risk, it is worth examining the strength of the private interest, the extent of its possible influence, the employee's decision-making authority, the sensitivity of the information they are exposed to and the extent of organizational exposure.
In addition, it should be checked whether there is a practical way to prevent the employee from taking part in certain decisions without significantly harming the organization's functioning.
Step 5: Setting an appropriate arrangement
The solution does not have to be disqualifying a candidate or ending employment.
Depending on the severity of the conflict and the circumstances, solutions such as the following can be considered:
• Refraining from taking part in decisions related to the specific party.
• Transferring decision-making authority to another manager.
• Limiting access to certain sensitive information.
• Changing areas of responsibility or reporting lines.
• Ending an outside business activity that creates the conflict.
• Giving up a relevant financial interest, when this is appropriate and required.
• Disqualification from a specific role when the conflict cannot be managed effectively.
The choice of solution should be proportionate, workable and open to monitoring.
Step 6: Documenting the decision and the responsibility for implementing it
It is not enough to determine that the employee will not take part in decisions concerning a certain supplier.
It is necessary to document the scope of the restriction, who approved it, the person responsible for overseeing it and the cases in which it should be re-examined.
An arrangement that is not documented, or for whose implementation no one is responsible, may remain a statement only.
Step 7: Monitoring and updating
A conflict of interest is not a static situation.
Changes in role, authority, organizational structure, business ties or personal circumstances may create a new conflict or make an existing conflict more material.
Therefore, it is recommended to define events that require an updated declaration and a re-examination, alongside periodic refreshes in sensitive roles.
The important lesson: a conflict of interest can arise even after years of employment
Organizations invest significant resources in the screening and onboarding process, but sometimes assume that once the background check is complete and the declaration of no conflict of interest has been signed, the issue has been dealt with.
This is a problematic assumption.
An employee hired without any conflict of interest may later be appointed to a new role. A relative of theirs may start working at a supplier. A company in which they hold shares may become a contractor of the organization. A change in the supplier base or in the suppliers' ownership structure can also create a conflict that did not exist before.
In such cases, the original background check may be completely correct for the date on which it was carried out, but no longer reflect the current risk.
Hence the importance of an organizational mechanism for updating declarations, re-examining conflicts upon material changes and making focused use of updated checks when this is justified.
The solution is not necessarily to check all employees continuously. Such monitoring may be disproportionate, costly and harmful to privacy. A risk-based approach is preferable, focusing on roles, authorities and events in which there may be a material change in exposure.
What do the OECD findings teach about the gap between policy and implementation?
In the Anti-Corruption and Integrity Outlook 2024 report, the OECD pointed to a gap between the existence of formal rules and arrangements for managing conflicts of interest and the ability of authorities to check the declarations and make sure that the risks are actually addressed.
One of the prominent findings in the report is that only eight of the OECD countries reviewed verified at least 60% of asset and interest declarations in the two years preceding the report.
This does not mean that all the other declarations were wrong, but that the existence of a declaration mechanism does not in itself guarantee the ability to verify the information or to detect gaps.
Although the findings relate to public systems, the management lesson is relevant to business organizations as well.
A declaration form without a mechanism for clarifying findings, settling conflicts and monitoring the implementation of the arrangements may create a sense of security that has no basis.
Similarly, a background check that identifies a relevant business affiliation does not provide full protection if the information does not reach an authorized decision maker or if no practical decision is made on how to handle it.
The effectiveness of a conflict of interest management system is therefore measured not only by the number of declarations collected or the number of checks carried out, but also by the ability to translate the information into decisions and control mechanisms.
Five common mistakes in managing conflicts of interest
First mistake: seeing the declaration itself as an admission of improper conduct.
Such an approach undermines employees' willingness to report and makes early detection of risks harder.
Second mistake: assuming that an honest person cannot be in a conflict of interest.
An assessment of integrity does not replace an examination of the circumstances and of the relevant interests.
Third mistake: settling for a one-time declaration at the time of hiring.
The risk may change during employment and requires an appropriate updating mechanism.
Fourth mistake: treating every business or family tie as automatic grounds for disqualification.
What is required is an examination of the relevance to the role and of the possibility of managing the conflict through proportionate means.
Fifth mistake: treating a finding in a background check as proof of improper conduct.
A finding may point to a situation that requires inquiry, but it does not prove that an improper act took place.
Summary: the test is not the absence of conflicts of interest, but the ability to manage them
Conflicts of interest are an unavoidable part of organizational reality.
People hold financial interests, maintain personal relationships, are involved in additional professional activities and develop business ties throughout their lives. The mere existence of such interests does not necessarily indicate an integrity problem.
The organizational challenge is to identify when a private interest may conflict with professional responsibility, to make sure that the relevant information reaches the authorized party, and to decide how to manage the risk.
OSINT-based background checks have an important role in the process. They may locate affiliations and ties that are not known to the organization, provide a factual basis for risk assessment and help check information provided in declarations.
But the background check is only one component of a broader system, which includes an organizational culture that encourages disclosure, clear procedures, proportionate decision making and ongoing control.
An organization with a developed culture of integrity is not necessarily an organization with no conflicts of interest. It is an organization in which conflicts of interest are identified in time, reported without unjustified fear, examined professionally and managed before they turn into an incident that harms the organization.
And the most important point is that the next conflict of interest in the organization will not necessarily be found in an employee who concealed information.
It may arise precisely in an employee who reported all their ties at the time of hiring, on the day their areas of responsibility, the organization's business ties or their life circumstances changed.
Therefore, managing conflicts of interest is not a one-time act of checking and approval. It is an integral part of managing integrity and organizational governance over time.
Professional sources
1. OECD (2003). Recommendation of the Council on OECD Guidelines for Managing Conflict of Interest in the Public Service. OECD/LEGAL/0316. The original Recommendation, adopted on 28 May 2003, and in particular section 4, and sections 10-15, which define conflict of interest and its types. https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0316
2. OECD (2004). Managing Conflict of Interest in the Public Service: OECD Guidelines and Country Experiences. OECD Publishing, Paris. An expanded publication of the guidelines, together with comparative experience from different countries. https://doi.org/10.1787/9789264104938-en
3. OECD (2020). OECD Public Integrity Handbook. OECD Publishing, Paris. Principles for managing conflicts of interest through declaration mechanisms, controls and proportionate arrangements. https://doi.org/10.1787/ac8ed8e8-en
4. OECD (2024). Anti-Corruption and Integrity Outlook 2024, chapter Conflict of Interest. A review of the gaps between regulatory frameworks and implementation, verification of declarations and control in practice. https://www.oecd.org/en/publications/anti-corruption-and-integrity-outlook-2024_968587cd-en.html
This article deals with principles of organizational risk management. The 2003 OECD Guidelines were written for the public service, and the application proposed here in business companies is a management adaptation of their principles. Specific legal obligations, including privacy, employment relations and the duty of disclosure, are subject to the law that applies to the organization and to the officers.