Xero board chair David Thodey and chief executive Sukhinder Singh Cassidy have issued a joint, unreserved apology to former employee Ally Naylor over the company’s 2017 handling of her complaint. The apology follows the conclusion of Maria Dew KC’s review and comes with a package of governance reforms. Those reforms are welcome. They are also, almost line for line, the controls a company of Xero’s size should have had in place before anyone needed them.
This is not only an HR story. It is a board design story, and every founder-led business in New Zealand should read it that way.
A complaint with nowhere independent to go
In 2017, Naylor, then a junior employee, raised an internal complaint alleging unwanted sexual contact by co-founder Sir Rod Drury while he was CEO. Xero investigated internally at the time. She went public in March 2026 after Drury was named New Zealander of the Year. By May, four women in total had alleged inappropriate behaviour by Drury during his time as chief executive.
Drury denies all the allegations. He has described his relationship with Naylor as “consensual and mutual”, a characterisation Naylor rejects, and called a separate claim by his former private chef “unfounded” and part of a “sustained media campaign”.
Whatever the facts of the individual allegations, the structural failure is not in dispute. Governance and ethics commentator Jane R. Arnott argues Xero’s code of conduct required disclosure of intimate relationships but never specified to whom, or what should happen when the person who ought to receive that disclosure is the CEO himself. Her phrase for it: “integrity is expected but not defined”.
Growth outran the rulebook
The contrast with Xero’s commercial performance is hard to miss. In FY26 the company posted revenue of $2.753 billion, up 31%, adjusted EBITDA of $757 million and 4.9 million customers. It is ASX-listed but New Zealand-incorporated, operating under the Companies Act 1993 while following ASX governance principles.
In other words, this was never a scrappy startup without the resources to get it right. Xero engineered world-class systems for billing, compliance and scale. The system for handling an allegation against its most powerful person stayed informal for years.
The law had already left the room
By the time the allegations surfaced publicly, legal remedies were effectively gone. In April 2026, employment lawyer Max Whitehead pointed out that the 90-day personal grievance window and the 12-month Human Rights Commission limit had long expired. He estimated the KC review could cost $30,000 to $80,000, and noted that “even if the review did find something, Xero couldn’t do anything to either of them”, because both Naylor and Drury had left.
That is the uncomfortable point for boards. When Xero commissioned Dew in April 2026, the trigger was not an audit finding or a board escalation. It was public reputational risk. The only accountability mechanism that actually worked was a journalist.
The fixes are the right ones
To its credit, Xero’s current leadership has not hidden behind the limitation periods. In May, Singh Cassidy said Xero does “not tolerate sexual harassment or misconduct in the workplace”, and argued its “safe culture today is proven by data”. The company also confirmed it does not impose confidentiality restrictions on people discussing lived experiences relevant to the review.
The new package goes to the heart of the problem. Staff can now report concerns to an independent third-party organisation. Serious complaints involving senior executives or directors must go to independent investigators. Employees raising sexual harassment complaints against senior leaders or board members will get financial contributions toward independent legal advice, which directly addresses the power gap between a junior staffer and a chief executive. Complaint handling, outcome communication, wellbeing support and exit interviews have all been tightened.
That legal advice provision is the standout. It recognises that a fair process is worth little if one side has a company behind them and the other has nothing.
What every board should copy now
None of this is unique to Xero. Arnott draws a line to Kristy McDonald’s 2022 review of KiwiSaver governance, which flagged the risk of staff tailoring their work to please a chief executive whose personal interests were engaged. Founder-CEOs carry informal authority that formal charts never capture, and that authority bends even well-meaning processes.
The test for directors is simple. If a junior employee made a serious complaint about your CEO tomorrow, who would receive it, who would investigate, and would the board hear about it at all? If the honest answer runs through the CEO’s own reporting line, the governance gap is already there.
Xero has now closed it, at a cost measured in reputation rather than dollars. The smarter move for every other high-growth company is to build that escalation path before the board finds out about a complaint from a headline.
Sources
- Stuff: Xero apologises for handling of alleged unwanted sexual contact complaint after Stuff investigation (2026-10-20)
- RNZ: Xero launches review over misconduct allegations about co-founder, former CEO Sir Rod Drury (2026-04-15)
- RNZ: Xero CEO speaks out amid allegations against founder Sir Rod Drury (2026-05-12)
- BusinessDesk: Xero to learn from past, CEO says, as Drury review unfolds (2026-05-15)
- Xero: Maria Dew KC Review – 2026 (2026-05)
- Xero Limited Annual Report 2026 (2026)
- Xero Corporate Governance Statement 2026 (2026)
- The Ethics Conversation: CEO Integrity Must Be Defined (2026-04-30)
- Max Whitehead: Employment law expert on the investigations into Xero’s former chief executive Sir Rod Drury (2026-04-15)
Join the discussion
Add useful context, ask a good question, or challenge an idea — keep it specific and respectful.