Simply “having” a code of conduct will not mitigate risk on its own. It requires constant upkeep, fresh training and communication and regular updates. If your code is lonely, your organization may be exposed.
The story is familiar: Organizations with a code of conduct suffer an embarrassing misconduct allegation or ethical lapse. As they pick up the pieces, they’re left wondering what went wrong.
If you have a great Code of Conduct but don't know your front-line processes, then congrats: you're Enron.
— Broadcat (@TheBroadcat) June 20, 2017
Such codes are important, but they don’t exist independently from the rest of the organization. For a code of conduct to thrive, it must emphasize people, processes and systems. Combined with a strong culture of compliance, companies can use their codes to further their missions while reducing risk.
The Lonely Code
Most businesses have a code of conduct, and many of them put it online for their employees to reference. These codes may even be bright, shiny, public-facing documents available for shareholders, partners, suppliers and customers to see, which shows the world that yes, our company is serious about ethics, company values and doing the right thing.
Employees may be told about their company’s code during onboarding or given a handbook or binder with it to review. Some organizations even incorporate the code into yearly training — but usually, it’s the same experience regardless of who’s training or what their unique role at your company is.
These approaches often fail because they view the code of conduct as a static, check-the-box document. The online link is browsed once and never visited again. The binder gets thrown into a desk drawer and forgotten. The training doesn’t change, leaving users unimpressed because it was the same content they saw last year … and the year before … and the year before.
These struggles are unfortunate because so much work may go into the drafting of the code only for it to be ignored afterward. This neglect isn’t just a missed opportunity — it also increases compliance risk. In 2021 and beyond, having a code is merely a formality, a paper-program exercise, unless organizations promote the last mile of application and operational integration to drive its effectiveness.
What to Ask Yourself
Most organizations already have a code of conduct and refresh cycles in place, which is perhaps the biggest initial task. The next step is ensuring that the code is working for you rather than against you. Start by asking yourself the following questions:
Accessibility/Empowerment
- Are your code and policies updated and easily accessible for employees to view?
- If you have a global footprint, are your code and policies localized per country/region?
- Do you have a culture in which people feel safe and comfortable speaking up if they have questions or see alleged wrongdoing?
Content/Guidance
- Are your employees trained on proper handling of common dilemmas, how to report problems and where to go for guidance?
- Do employees with management, reporting or investigation responsibilities receive additional guidance?
- Besides online training, do employees receive clear guidance and resources on how to act ethically, morally and compliantly?
- Is there messaging outside of training that reinforces appropriate behaviors to those who need it?
Measurement/Monitoring
- Do behavioral insights from training demonstrate clarity and readiness from your employees? What trends do you see if they don’t?
- Are internal systems and controls properly working to identify and monitor potential red flags?
- Does helpline and other reporting data match the behavioral insights gained from training metrics?
- Are investigation and substantiation processes working effectively, both anecdotally and through any reporting data? What trends are visible?
Once you identify any gaps, work to fill them while refining and expanding your company’s unique culture. The next step is to ensure the people, processes and systems support your code.
The Focus on People
Although codes of conduct establish acceptable behavior, highlight risk areas and support company policies, employees bring all those principles to life. Inspiring confidence and trust in those employees helps ensure that when someone is faced with an ethical dilemma, they know the right choice to make and act accordingly — or, at a minimum, they know where to go for help.
This journey starts with company culture and a strong tone from management, from the C-suite down to rank-and-file supervisors. When an organization’s leaders take ethics and compliance seriously, the people they lead tend to do so as well.
Managers must also be trained on how to handle personal and professional conduct issues, such as what to do when fielding an allegation from an employee. When employees know their superiors are listening to them and have their backs, they have a greater sense of organizational justice and more confidence to report misconduct when they see or experience it.
Quality training also builds confidence — but it must be more than a barrage of rules and rote memorization. The best training gives people the ability to improve their knowledge, through simulations and learning-by-doing, in code scenarios they might encounter in their daily roles. Giving employees a safe place to practice, coupled with ongoing feedback and reinforcement, increases the odds they’ll choose the appropriate behavior when they encounter a real ethical crisis.
The Proper Processes
A culture that relies on people to do the right thing must also have related processes in place to support them. For codes of conduct, this includes:
- Policy governance: This ranges from how the code and its supporting policies are updated to how investigations are handled to what the consequences are for violations.
- Reporting mechanisms: What processes are in place for employees and managers to report a code violation or concern? And what protections are they given for doing so?
- Monitoring capabilities: This requires keeping tabs on the code, the nature of violations and the gray areas that employees might be misunderstanding.
Strong processes also contribute to employees’ confidence and security — they know that there are consequences for actions, no matter who you are or where you sit. Policies are clearly defined, and when conflicts or confusion do arise, there are ways to achieve resolution.
Supportive Systems
Automated reporting connects hard data to the efficacy of a code of conduct, and it is an important key to success. For example, knowing the number of times a helpline is used and the topics employees are seeking help on can go a long way toward determining which parts of a code are working and which aren’t quite as well understood.
Training data also informs strategy and tells you what employees know and don’t know. With online adaptive training, this can happen during a code of conduct course itself — the program recognizes proficiency and either switches the user to more advanced topics or wraps up the learning sooner, thus saving valuable seat time. And with AI-fueled training platforms, the system can automatically and efficiently detect and predict potential red flags and institute measures such as reinforcement or additional training sessions.
Focus on the Last Mile
Ultimately, a code of conduct must act as a guide for employees as they go about their daily work. For that to happen, the code must be pervasive and weaved into the fabric of the organization — a tall order if an employee does not see evidence of its principles in their day-to-day.
For a code of conduct to permeate and inform everything employees do, compliance teams must re-evaluate their approach and ensure that people, processes and systems are aligned. Only then will the code transform from a static, dust-collecting book into an active tool for reducing risk, promoting culture and empowering employees.
Harper Wells is Director of Compliance Insights and Strategy with 
