Implications of the Boeing Crashes for CPAs

Boeing, the world's largest aerospace manufacturer, designs and builds commercial aircraft. The 737 MAX, one of its best-selling models, experienced two fatal crashes between 2018 and 2019 that killed 346 people. Investigations revealed that internal pressures—to save money, meet delivery deadlines, and protect profits—led engineers and managers to downplay or hide safety risks rather than escalate them to decision-makers. This is a real-world example of an internal control system that looked good on paper but failed in practice because the company's leadership did not genuinely prioritize ethical behavior and transparency. When a company's "tone at the top" is weak—meaning senior executives tolerate corner-cutting or silence dissent—even well-designed control procedures break down.

• Boeing's leadership prioritized cost and speed over safety, signaling to employees that shortcuts were acceptable → the tone at the top sets whether employees believe controls actually matter.
• Engineers aware of safety flaws did not feel safe reporting them up the chain, meaning monitoring and communication controls failed → strong controls require both formal procedures AND a culture where people trust raising concerns won't hurt them.
• The crashes happened because control activities (design reviews, safety testing) existed but were overridden or bypassed by management pressure → controls only work if management actually follows them.
• Auditors and CPAs must look beyond the control structure and ask whether the organization's actions match its stated values → internal control assessment includes evaluating whether leadership actually enforces what it preaches.

Internal control

A system of policies, procedures, and oversight designed to ensure a company operates ethically, reports financial information accurately, and safeguards assets.

Tone at the top

The ethical culture set by a company's senior leadership; it signals to employees whether the organization truly values integrity or merely gives it lip service.

Control environment

The foundation of internal control—includes the company's values, ethics policies, and how seriously management enforces them.

Control activities

Specific procedures and checks (like approvals, reconciliations, or safety reviews) designed to prevent or detect errors or misconduct.

Monitoring

Ongoing observation of whether controls are working as intended; includes internal audits and management review of exceptions.

AICPA Code of Professional Conduct

The ethical rules that all certified public accountants (CPAs) must follow; includes duties to act in the public interest and maintain integrity.

1. 01

   Boeing's internal control structure included safety review processes, yet the 737 MAX crashed—what does this teach us about the difference between having controls and having working controls?

   Show answer

   Answer: Students should recognize that control procedures on paper do not guarantee control in practice. Boeing had safety review processes, but a weak tone at the top—where leadership prioritized profit over safety—meant employees either ignored the procedures or had no incentive to use them honestly. The key point is that controls require both design AND genuine commitment from leadership and staff.
2. 02

   If Boeing's senior management knew about safety risks but chose not to disclose them to protect profits, which element of internal control—control environment, risk assessment, control activities, information systems, or monitoring—broke down first?

   Show answer

   Answer: The control environment broke down first. The tone at the top is the foundation; when senior management signals (through actions, not just words) that cutting corners is acceptable, it undermines every other control element. Risk assessment, control activities, and monitoring all depend on a culture where people believe doing the right thing matters.
3. 03

   A CPA auditing Boeing would have reviewed the company's internal controls; what sign should the auditor have looked for to spot that the tone at the top was weak?

   Show answer

   Answer: The auditor should have looked for behavioral red flags: Are safety concerns being reported, or are they being suppressed? Do employees feel safe raising concerns? Is there pressure to minimize or hide problems? Are exceptions to procedures being overridden by management without strong justification? If the answer to these questions suggests a weak tone, the auditor should question whether the company's controls are reliable.
4. 04

   Why is 'tone at the top' so critical to internal control—why can't a company just rely on written procedures and formal approvals without leadership modeling ethical behavior?

   Show answer

   Answer: Tone at the top is critical because it determines whether employees believe rules apply to everyone (including leadership) or only to lower-level staff. Written procedures mean little if employees see leadership violate them without consequence. A strong tone at the top ensures that the control environment—the foundation of all other controls—is built on genuine commitment to ethics, not just compliance theater.

Start by asking students: 'If a company has written safety procedures but crashes anyway, whose fault is that?' Push them past 'the company failed' to 'who in the company failed, and why?' Draw a pyramid on the board with 'Tone at the Top' at the foundation and the other four control elements (risk assessment, control activities, information & communication, monitoring) stacked above. Erase the foundation and ask: 'What happens to the rest?' Highlight one concrete detail—engineers reporting safety flaws but being ignored—and let students work backward to which control element failed. End by asking: 'What would you do if you were an engineer at Boeing and knew about a problem but your boss said, 'We don't have time for that'?' This anchors abstract concepts in real pressure and choice.