10 cases. Each names what happened, the source, and the standard that already existed when it happened.

• Wells Fargo, 2016. Sales targets and incentives produced more than two million accounts customers had not authorised. $185 million in penalties; 5,300 employees terminated. CFPBInstead: design incentives that cannot be met by harming the customer, and claw back when they are. Four federal regulators set that out in joint guidance six years before this happened.
• Volkswagen, 2015. Software that recognised an emissions test and cheated only during one. EPAInstead: test the thing as it is actually used, by someone who did not build it. The EPA now runs on-road testing alongside the lab cycle.
• Boeing 737 MAX, 2018 and 2019. MCAS could command repeated nose-down trim from a single angle-of-attack sensor with no redundancy and no clear description in the manual. Two crashes killed 346 people. Design choices were shaped by an objective of avoiding simulator training for pilots, which would have cost customers money. Boeing 737 MAX certification recordInstead: never let a single sensor command a flight-critical surface, and never let a commercial training target drive a safety-critical design decision. Redundancy requirements for flight controls long predate the MAX.
• Uber, 2016. Attackers took 57 million rider and driver records. Uber paid them 100,000 dollars through its bug bounty programme, had them sign non-disclosure agreements, and did not notify regulators or users for over a year. The security chief was later convicted of obstruction. US v. Sullivan, obstruction convictionInstead: a payment to an attacker is not a bug bounty, and breach notification is a legal duty rather than a communications choice. The timelines were already statutory.
• Wirecard, 2020. Roughly 1.9 billion euros of reported cash did not exist. Journalists and short sellers raised the alarm for years while the German regulator investigated the journalists instead, and banned short selling of the stock. Wirecard scandalInstead: confirm cash with the bank that holds it, not with an intermediary. Independent third-party confirmation is one of the oldest audit procedures there is.
• Theranos, 2018. Blood tests marketed as running on proprietary hardware were largely run on modified commercial analysers. Patients received results that were wrong, including for cancer and pregnancy, and the company was valued at nine billion dollars while doing so. SEC action and criminal trialInstead: publish the validation data. Clinical laboratory tests have a mandatory verification pathway under CLIA, and the point of it is exactly this.
• FTX, 2022. Customer deposits were moved to an affiliated trading firm. There was no board, no reliable ledger of who owned what, and expense approvals ran through chat messages with emoji reactions. Chapter 11 and criminal proceedingsInstead: segregate customer assets and reconcile them daily. This is not a novel crypto question; it is the oldest rule in custody.
• Enron, 2001. Losses were moved into special purpose entities to keep them off the balance sheet, with the auditor collecting consulting fees from the same client it was signing off. The auditor shredded documents as the investigation began. Enron scandalInstead: separate audit from consulting, and consolidate entities you control. Sarbanes-Oxley exists because these rules had to be made statutory after being merely obvious.
• Nikola, 2020. A promotional video showed a truck apparently driving under its own power. It had been towed to the top of a hill and rolled down. The founder was later convicted of fraud. Nikola CorporationInstead: do not demonstrate a capability you do not have. Securities law calls this a material misstatement; everyone else calls it lying.
• Purdue Pharma, 2007 and 2020. OxyContin was marketed as carrying low addiction risk, a claim unsupported by the evidence, with sales incentives driving prescription volume. The company pleaded guilty twice, thirteen years apart. Purdue PharmaInstead: do not let the sales compensation plan set the clinical claim. The first guilty plea in 2007 was itself the published standard that the second one violated.