This weekend, the New York Times reported that McKinsey & Company, the famed consulting firm, had compiled a report identifying Twitter users opposed to the Saudi government’s policies. As the Times piece noted:

Three people were driving the conversation on Twitter, the firm found: the writer Khalid al-Alkami; [Omar] Abdulaziz, the young dissident living in Canada; and an anonymous user who went by Ahmad. After the report was issued, Mr. Alkami was arrested, the human rights group ALQST said. Mr. Abdulaziz said that Saudi government officials imprisoned two of his brothers and hacked his cellphone, an account supported by a researcher at Citizen Lab. Ahmad, the anonymous account, was shut down.

In response to the story, McKinsey issued a statement saying, “We are horrified by the possibility, however remote, that it could have been misused in any way. … We have seen no evidence to suggest that it was misused, but we are urgently investigating how and with whom the document was shared.” This is the firm’s second scandal in recent months, following its disastrous dealings in South Africa, where it was accused of complicity in government corruption and eventually repaid money it had made on overcharges.

To talk about McKinsey and its history, I spoke by phone with Duff McDonald, the author of The Firm: The Story of McKinsey and Its Secret Influence on American Business. (His most recent book, about Harvard Business School, is called The Golden Passport.) During the course of our conversation, which has been edited and condensed for clarity, we discussed how McKinsey’s practices have changed over the years, whether the company gives thought to working with repressive regimes, and how it managed to stumble upon a perfectly amoral business model.

Isaac Chotiner: McKinsey said it is worried the report it compiled might have been misused. What, exactly, does that mean? And why would it be compiling a list for the Saudi government?

“The thing about the consulting industry is that it’s never their fault. Well, whose fault is it? Who takes responsibility for the work that you do?” — Duff McDonald

Duff McDonald: I haven’t seen the report, so we’re both guessing here. But that did not sound terribly novel to me. If you follow the people who do reputation management online and do brand-management services for big corporations or brands, they do follow sentiment on social media, and they even have little dashboards that will show you: Are you trending up or down?

What I think is interesting is that one would think the people compiling said reports might take this one further step and wonder what might happen with that information. Following Twitter sentiment is not new to McKinsey. Everybody does it. The question for these guys is: What’d you think was going to happen to that information?

There’s not thinking about it or not caring about it, and I think that they’re similar but distinct. What does your knowledge of the company tell you about how they would approach or not approach the possible issues and consequences?

In The Firm, I talk about what I think is one of the Achilles’ heels of the business model, which is power and influence without responsibility. In their typical strategy work, they gave advice and made no representations about implementation. So if a strategy that McKinsey offered someone went horribly wrong on the implementation level, their response was always, “We have nothing to do with this. We simply gave them some ideas.”

It’s been the central pillar of the business model since day one. If you don’t feel responsibility for what is done with the content of your work once you hand that work over, then do you open yourself up to carelessness? Apparently so. Is this a new thing? No. This is the business model. Are we seeing the limitations of that business model, right now, in real time? It appears so.

This has followed the South African scandal, which seems like it’s probably the biggest scandal in the company’s history. (For people who haven’t read about it, go read it—it’s pretty astonishing.) Do you attribute this happening now to the leadership getting worse? That you can’t get away with this stuff in the same way? That the firm has lost its way, either because of leadership or something else?

There are clearly questions of leadership here. At some point, institutional responsibility has to land somewhere, and it’s getting kind of tiring to hear from one of the most influential institutions on the planet that they had no idea that they were having influence. One of the points I make in The Firm too is near the end of the book: I look into the future and say, OK, what is it the future holds for this firm? The biggest threat, I concluded, was not from outside competition, which is the answer you’d have for a lot of institutions. I concluded that the biggest threat to McKinsey was themselves, whether with the success they’ve had and the increasing size they’ve had, whether the center holds. And what does that mean? If your business is, essentially, dealing in influence, you need to be concerned about rogue actors out on the edge.

When Rajat Gupta, the former managing director, was arrested for insider trading, that was probably the biggest scandal in their history. I spoke to some CEOs, and their clients all said, This is not good, but this is one individual. This is not an institutional failure. This is a personal failure of someone giving in to something, on a purely individual level. But when you start looking, you see, OK, we have South Africa. In the U.S., there’s also—they’re being sued for violations in the federal-bankruptcy system. And the [Wall Street] Journal has covered a bunch of this, including the possibility that they were advising on a bankruptcy that they were also an investor in—a clear conflict of interest. And then you get to this Saudi Arabia thing. Again, is this institutional rot? If it isn’t, then it may very well be a failure of leadership, right? Because at some point, you can’t keep saying, “This isn’t our fault, even though this is us.”

The thing about the consulting industry—at least in the management-consulting industry, this goes back to the business-model thing—is that it’s never their fault. Well, whose fault is it? Who takes responsibility for the work that you do? They threw one guy under the bus in South Africa. I don’t know what they’re going to do with this one.

You have a quote in the book where a McKinsey guy says, “We are advisers, and it is management’s job to take all the advice they receive and make their own decisions. Not to say that McKinsey told me to do this. … Whenever someone in McKinsey tells me they think they know how to run a company, I tell them to go do it. Because that’s not what we’re doing here.” I’m very far from an expert on McKinsey, but it seems like there’s this weird dichotomy where they like to think of themselves as the best and give the best advice, and they have this incredible reputation as the most famed consulting firm. And yet they don’t want to take responsibility for anything.

At the same time, one thing they don’t do is run around trying to take credit for ideas that worked out. If they give a company good advice, the last thing the CEO wants is for McKinsey to be saying, “Oh, by the way, that was our idea.” So that’s the deal that they make. They sell the client credit for their ideas, but at the same time, in the process of making that sale, they also disclaim any responsibility. I might have even said that this is a perfect business model, right? If you don’t have to be responsible for the quality of your own ideas, then where do I sign up? I’ll sell my ideas all day long. I think where it gets interesting here, with both South Africa and Saudi Arabia, in South Africa it was a corrupt regime, the government. They had to have had their heads in the sand to not realize that, and from the reports that came out afterward, there was clearly some internal hesitancy about doing any of the work at all. But they went ahead and did it anyway, until they didn’t.

In Saudi Arabia, this reminds me of Michael Porter’s Monitor Group in Libya. We were all aware that even if [the ruler of Saudi Arabia] is talking progressive reform, one of the first moves he did after consolidating power was to kidnap a huge chunk of the wealthiest people in the country and hold them under detention until they signed over their fortunes, right? So what kind of guy did you think you were dealing with? What is your plausible deniability of responsibility here? Sure, let’s take them at their word that they were not compiling a list of critics for the monarch to silence, right? [But] what did you think was happening?

And this goes back to your first question—apparently no one was thinking about that at all, or not for enough time to say to themselves, “Huh, is this the similar kind of work we would do for Pepsi-Cola? If we were measuring their brand against Coca-Cola?” This is the brand of a repressive monarchy.

Do you have some larger sense whether, over the past hundred or so years since the company’s founding, the culture of the company at the top has changed? Is there some sort of shorthand to try to understand it?

So there was Marvin Bower, who’s the spiritual godfather of the place, right? He was not the founder, but effectively he founded the idea of McKinsey as we know it. A couple of people followed him: Ron Daniel, who operated sort of in his likeness. If you ask people who worked at McKinsey when the culture shifted, it was when it shifted on Wall Street during the ’90s and the internet boom. Part of that came about because they were suddenly competing with both Wall Street firms, who were paying higher and higher salaries and bonuses, and also Silicon Valley.

So even though McKinsey had long been able to stand outside of the complete frenzy of Wall Street and tech compensation, they couldn’t withstand it anymore, and some of the principles by which McKinsey had long been run started to go by the wayside. They started taking stakes in companies that they were advising. Basically, it’s the Rajat Gupta era.

Every business needs revenues, right? Otherwise you’re not in business. So they’ve been chasing fees since day one. And the question is: Has the nature of that chase changed irrevocably for them? It appears that they may be willing to do whatever, you know … [the] standards for the kind of work that they will get involved in don’t appear to be holding up.