Yes / This paper proposes a model to explain what makes organisations ethically vulnerable. Drawing upon legitimacy, institutional, agency and individual moral reasoning theories we consider three sets of explanatory factors and examine their association with organisational ethical vulnerability. The three sets comprise external institutional context, internal corporate governance mechanisms and organisational ethical infrastructure. We combine these three sets of factors and develop an analytical framework for classifying ethical issues and propose a new model of organisational ethical vulnerability. We test our model on a sample of 253 firms that were involved in ethical misconduct and compare them with a matched sample of the same number of firms from 28 different countries. The results suggest that weak regulatory environment and internal corporate governance combined with profitability warnings or losses in the preceding year increase organisational ethical vulnerability. We find counterintuitive evidence suggesting that firms’ involvement in bribery and corruption prevention training programmes is positively associated with the likelihood of ethical vulnerability. By synthesising insights about individual and corporate behaviour from multiple theories, this study extends existing analytical literature on business ethics. Our findings have implications for firms’ external regulatory settings, corporate governance mechanisms and organisational ethical infrastructure.