There can be a downside to all the talk about certain companies having a culture of compliance and transparency. They may have a reputation for “doing the right thing,” but word and deed don’t always piece together as neatly as rhetoric might suggest.

Our subject du jour is Marc Benioff, chairman and CEO of Salesforce, a leading provider of cloud services and CRM software. His company has a stellar reputation as a great place to work. So, it was quite a surprise to see him before the cameras of 60 Minutes, addressing evidence of a gender pay gap at his company.

His response, when that wage discrepancy was first suspected: “It’s impossible because we have a great culture here. We’re a ‘best place to work.’ We don’t do that kind of thing. We don’t play shenanigans paying people.”

Alas, at the urging of Cindy Robbins, Salesforce’s chief of personnel, the suspected pay gap was confirmed by a company-wide audit. Gender-based pay disparities were found throughout, “the whole company, every department, every division, every geography,” Benioff told 60 Minutes. Fixing the gap cost the company nearly $3 million. 

The morals of the story: Back up good intentions with hard numbers; and even the most acclaimed company or compliance program can never rest on its laurels.

Consider Starbucks, a company that has touted its commitment to social issues and, deserved or not, has a reputation of having a progressive corporate culture. Nevertheless, the recent racial discord that erupted when two black men waiting for an associate at a Philadelphia location were arrested for “loitering” after an employee called the police raises important questions. Starbucks, apparently, agrees. In response to the incident and public outcry, it is closing more than 8,000 of its U.S. stores on the afternoon of May 29 in order to educate its employees on racial bias. 

This much is clear: Culture failures can start small and trigger an avalanche. Just ask Wells Fargo, on the cusp of a $1 billion fine from regulators. It is yet another massive penalty for a company that allowed shady sales practices to spread like wildfire.

A daunting challenge for companies is that their corporate culture must now extend well beyond the safe and controllable confines of their headquarters and branch locations. Can you ensure that every third-party vendor or supplier lives up to your own exacting standards? A lesson from the sourcing due diligence demanded by the still-in-limbo conflict minerals rule is that asking isn’t enough, telling isn’t enough, and even demanding isn’t enough. Questionnaires don’t cut it. When in doubt, or in need of confirmation, an audit may be necessary, as are “boots on the ground” and on-site visits. 

As for the pay inequality situation that Salesforce discovered and addressed, all companies should gird themselves for continuing headaches. Pay disparities, by gender, will surely be singled out and amplified by social media, especially as new regulations in the U.K and Canada demand wage transparency. The recent “pay ratio” rule from the Securities and Exchange Commission is already inflicting reputational damage on companies that are now forced to declare how their median employee compares to the CEO. Triple-digit ratios are already being seized to fuel the dissent of activists, unions, and—depending on the company—shareholders.

Not all complaints regarding issues such as wage disparities will have merit. Only those companies, however, that develop metrics to measure and defend the building blocks of their culture can successfully, and speedily, shake off a reputational hit. Companies that live by an unwavering commitment to transparency, and a track record of measuring and making public successes and failures alike will rapidly regain trust and put complaints into perspective. If you talk the talk, but don’t walk the walk, your culture of compliance has neither much culture nor compliance.