If you’re in Hong Kong, the resignation of Octopus chief Prudence Chan this week was as inevitable as that of Tony Hayward’s departure from BP.

 

Since Chan was caught claiming the company hadn’t sold off personal data when in fact it had been, she was a carcass in the breeze; the usually staid South China Morning Post even ran a tabloid-style headline telling Chan to Q-U-I-T.

 

On Wednesday she finally did, saying she did not believe the company had broken the law but was leaving to help the company regain public trust and confidence. 

 

Although she is stepping down, she won’t be leaving for six months as she helps with a number of inquiries, chairman Lincoln Leong told reporters.

 

Chan admitted to the Privacy Commissioner last week that the company had earned HK$44 million ($5.7m) from selling the personal data of 1.97 million users of the Octopus card, which provides for cashless payments throughout Hong Kong.

 

Two weeks earlier she had denied this was the case. Now the company has appointed an interim CEO and plans to donate money earned to charity, but questions remain.

 

Most obviously, where was the board? Leong, who is CFO of MTR Corp., which owns 57% of Octopus, said that the board was not aware of the “operational details” of the scheme.

 

One lawmaker has called for the entire board – which includes several MTR representatives – to step down.

 

The other question goes to the core issue: how did the company come to treat personal data so recklessly and how could it have thought it could wave the issue away?

 

The difference between Octopus and BP is that the Hong Kong company has suffered a reputational loss – the oil giant has suffered that and a massive financial hit as well.

 

The CEO is ultimately responsible for reputation, but Chan appears also to be a scapegoat for a failure of corporate governance.

 

Corporate governance is a less obvious culprit in the case of another recently-departed CEO, Mark McInnes, the former chief of high-end Australian retailer David Jones – but it could cost the company anyway.

 

McInnes resigned suddenly in June following a sexual harassment claim from a 27-year-old staff member, alleging he groped her on several occasions and sent her lurid text messages.

 

McInnes has issued an apology to the staff member and to shareholders, but faces a court action from the woman, who is seeking A$37 million ($34m) in damages.

 

The woman, Kristy Fraser-Kirk, says she complained to her superior about his behavior but was told to deal with him firmly.

 

Whatever the truth of the allegations they do not sit with the company’s brand. Nor does the massive payout, which Fraser-Kirk has filed with her employer, not her former boss.

 

Reputation goes straight to the bottom-line. If CEOs are not aware of it, boards need to make other arrangements.

 

They could start by ensuring that CEOs who do trash the public image of their companies walk away empty-handed.