The events of the past few weeks show us that somewhere, somehow Facebook’s management, board and institutional investors lost sight of the company’s most valuable asset, its users.

Or more correctly, only saw the value in how the users and their data could be mined and sold for profit, not as valuable customers. Valuable customers who may walk away or change their usage habits if their trust was lost, as happens with every other retail business. What was the users’ privacy worth?

And while the mainstream media flagellates Mark Zuckerberg, the obvious target, for the Cambridge Analytica breach, there is a marked absence of focus on the broader board’s role in this gross failure of governance.

The Facebook Board of Directors is made up of Mark Zuckerberg, COO Sheryl Sandberg, four venture capitalists, the CEO of The Gates Foundation, the CEO of Netflix and the CEO of WhatsApp. And all, as outlined in the company’s own corporate governance guidelines are “encouraged” to speak to any member of the management team about any concerns at any time.

One has to wonder how much time and energy the board spent considering the risk associated with Facebook’s known, cavalier approach to users’ personal privacy and their openness about mining their own data for revenue gain. Or were they all in the thrall of Mr Zuckerberg, perhaps the emperor with new clothes on this issue and could not manage their CEO?

When did they start to express their concerns about Facebook’s fast and loose approach on privacy? Did they consider it, or was the revenue raising possibility of its customers the only consideration? What type of culture was the board being allowed to breed and what sort of risk was it opening the company up to when its customers said enough?

It is well documented that Facebook was among the first serious wave of internet-based social media platforms that struggled early on to find a way to create reliable revenue stream that could be turned into profit. But has the hunt for revenue, and then the astounding success of their advertising algorithms been at the cost of understanding what the company’s purpose is, and who keeps them in business.

Governance is not just about ensuring and maximising cash flow. It is also about understanding the full range of risks that may threaten the viability of a company. It is worth remembering that while the number of users outside of North America and Europe are growing the fastest, the revenue stream from these regions is low. It is the more stable user groups of North America and Europe that provide the vast majority of advertising revenue. It can also be argued that the customers in these markets are the most likely to change their user behaviour if they perceive their privacy has been invaded  beyond their comfort threshold.

And what is more the institutional investment community seem blithely unaware of how they may have encouraged a culture that led to this outcome, but are quick to ‘raise concerns’ when it is already too late. Fund managers, who invest on behalf of us, are only now beginning to review their investments in Facebook due to ethical concerns, after this widely-reported breach of privacy and the harvesting of information of 50 million users. Concerns about how Facebook guarded their users’ privacy is not new. Cambridge Analytica’s particular use of the data is deeply disturbing but is not a solo event for Facebook.

AMP Capital says it has been monitoring the ‘data and privacy issues in the realm of social media’ for some time, but has it done serious risk analysis of a known issue with Facebook? From a pure business perspective, besides the actual platform, Facebook’s most valuable asset is its users and the company has had to be dragged into dealing with a myriad of privacy issues over years.

Australian Ethical said “if they formed a view they disregarded privacy, we won’t invest in them.” It doesn’t take much of a search to find Mr Zuckerberg’s view that privacy is dead.

None of what has happened to Facebook is really that surprising. All of the landmarks of this particular road to hell were well signposted – the disregard of the value of people’s privacy, the primacy of using data (known to users or otherwise) to generate advertising revenue and the lax control over who else was using that data. And if these signs were so obvious, how and why did the management team, the board and the professional investment community ignore them?

A sinking feeling tells me, that the reaping as much profit as possible, and a belief that they were the smartest people in the room, clouded all other risks and any respect and consideration for their users.

And if they want to understand how the hubris of believing themselves to be the smartest people in the room plays out, they only need to Google the hedge fund name ‘Long Term Capital Management’.