The Code of Conduct Conundrum

When's the last time you heard the question, “Do we really need a corporate code of conduct?” asked in your company, if ever?  And do you react with surprise or even a bit of annoyance as you read it here, thinking it's stupid to even ask such a thing in 2014?

Perhaps it is. Whether your company has established a code of conduct because it faced a legal requirement to have one, or to satisfy stakeholder demands, or to serve as the foundation of the organization's compliance program, the very idea of questioning the value of having a corporate code of conduct seems out-moded in today's business world.  And yet, if we slightly rephrase the question to ask, “What value can we gain from a code of conduct” we set the stage for a meaningful management discussion that takes place all too infrequently. 

The development of codes of conduct became a cottage industry for lawyers in the United States starting about two decades ago, and grew substantially following the 2004 amendment of the U.S. Sentencing Guidelines for Organizations. In 2005, I assessed the codes of conduct of half of the Fortune 50 and found, as I expected, that they were all written above the 12th grade reading level even though the average for the workforce was only the 8th grade. It made sense, though, since they appeared to have been pieced together by attorneys, whose concern was having a document to wave in a defense situation, not teaching their client's employees how to behave when faced with uncertainty. 

Since then, there have been numerous research studies done purportedly analyzing the “effectiveness” of codes of conduct (sometimes referred to as codes of ethics or business codes), but as is clear from the review of much of this literature by Kaptein and Schwartz in a 2008 Journal of Business Ethics article entitled “The Effectiveness of Business Codes: A Critical Examination of Existing Studies and the Development of an Integrated Research Model,” each of these studies had limitations or design flaws that leave a critical reader questioning their varied and contradictory conclusions. And, despite the thoughtful proposal in the Kaptein and Schwartz article for an integrated research model to measure the effectiveness of business codes,  the pathway to developing, implementing, and maintaining a code of conduct that can be proven to add value to the organization remains elusive.

Kaptein and Schwartz call for consideration of a number of variables that they believe are determining factors in an assessment of effectiveness. Amongst these are external stakeholder expectations and pressures, internal culture and context, objectives for the code, process of development and implementation, content of the code, consequences for non-conforming conduct, strength of sub-codes (e.g. policies), and employee character.  They note that as of the date of their article, no study of effectiveness had been done that considered all of these interrelated factors.

I would argue that no such study could have been done at that time, and perhaps still cannot today, but the future possibility of such meaningful analysis of variables that dictate code effectiveness is closer than you might think. The available methodologies, supported by technology, for knowing and managing each of these variables is better now than ever before, and next generation codes of conduct will be built and maintained in ways that will allow real analysis of effectiveness, perhaps for the first time.

Just as the proposed research model is described as “integrated” so too is the modern Code of Conduct, which is based on a meaningful connection between the organization's objectives and its risk and compliance management.  Codes of conduct that are delivered through modern communication methods that allow the user to engage, interact, and research further behind the Code into related policies, procedures, and helplines for additional guidance can be better monitored and measured. Code content that is integrated with efforts to monitor changes in the external and internal environment can be updated as needed rather than on a static schedule. And failure to comply with the Code can be better identified and tracked, indicating possible need for clarification, additional training, or better screening of employees.

“What value can we gain from a code of conduct?” Not much if the only reason we have one is to satisfy a legal requirement to do so. But quite a lot if we use it as the central hub of a well-thought-out and supported capability for driving corporate values and expectations for conduct into the fabric of the company culture and design a code system that truly can be measured for effectiveness.

Keeping the Code of Conduct Relevant: An OCEG Roundtable

Switzer: Go to any ethics and compli­ance conference and 12 years after the Enron scandal you still are likely to hear the phrase “Enron had a great Code of Conduct” from at least one speaker, who then goes on to say “to gain ethical conduct you need more than a well-written document relegat­ed to the shelf.” True, but not terribly helpful in defining what does make a Code of Conduct meaningful and ef­fective.

So let's start by asking, what are the most important things you need to do in the design, distribution, and ongoing management of your code to make it, and the values it represents, part of the fabric of your organization's culture?

Lin: A key aspect in working with your Code is making sure it is relevant. Codes could have been great when they were written, whether that was 2 years ago or 10 years ago. But times change—business environments change, cul­tures change, risk appetites change. We all need to keep in mind that the Code, the ultimate policy, should not be a stale document on the shelf. It needs to inspire, engage, and change with the organization. So a critical review, of not only the content, but the way you distribute the information, and how your audience consumes information, is critical.

Tieck: Company codes, including a Code of Conduct or Code of Eth­ics, should be considered a part of the entity's overall policy landscape. Le­veraging an effective policy lifecycle management framework will promote integration and alignment across the policy governance landscape. OCEG's thought leadership around policy man­agement is a great place to start for enti­ties creating or revisiting the employee Code of Conduct. The five stages in OCEG's “Effective Policy Manage­ment” Illustration include:

Determine Need

Develop and Update

Communicate and Train

Implement and Enforce

Measure and Re-Evaluate

Without adequately addressing each of these five stages, a Code of Conduct or Code of Ethics will most likely not be effective.

Lin: That's right, and you also need to remember that when you consider your Code as both a policy document and a marketing document, you want to in­corporate and leverage the communi­cations that best suit your audience. If your workforce is young, make sure to incorporate interactive content. That's how they expect engaging information to be presented. Add graphics, charts, and videos—bring your Code to life. The more you can keep the audience engaged, the better.

Switzer: I think these are really impor­tant points, Jimmy. The old, multi-page Code of Conduct written by lawyers just doesn't encourage engagement or adoption of Code values at any mean­ingful level. The best ones really speak to the workforce in ways that make a better connection.

So once you've designed your Code of Conduct and put in place ways to keep it fresh, how and what do you need to measure so that you can track and de­termine the effectiveness of the Code and its impact on behavior?

Lin: To evaluate the effectiveness of your Code, you have to make sure you take an integrated view into how your organization is living the values. It's not just about looking at attestation rates or ensuring that new employees are signing off on the Code, but look­ing at all the factors that show how ef­fectively the message is being carried throughout the organization. Review data by departments, regions and for various levels of employees. Look for outliers and trends—make sure not to focus on the averages. Averages can hide issues.

Switzer: The point about not relying on averages is key, I think, and clear­ly, just having signed attestations of understanding isn't enough. Do you have some specific examples of what to monitor and measure, Kendall?

Tieck: Each component of a code de­scribes an expected behavior. Selecting a few critical behaviors to measure and monitor may be adequate for most or­ganizations. These selected measures might represent an aggregate measure of the overall conformance to the code. Large organizations may be able to mine HR data to capture statistics as­sociated with the identified behaviors. For instance, termination reason codes may be one source.

Lin: And there are other metrics to re­view, that are not directly measuring the Code, which are factors that can drive changes in risk. Review hotline activity and trends, compliance risk as­sessments, control failures, corrective actions, and behavioral survey results. Behavioral survey results can indicate both behavioral risk as well as hidden mentalities around the organization that do not align with your values. Use multiple data points to provide mean­ing and derive action around your Code of Conduct.

Switzer: So you can get a lot of useful information by mining data from sev­eral aspects of the organization's data, but should you also have a direct way to collect information from the employees on the code itself? How important is employee feedback on the code, and the ways it is applied and enforced? And how do you get that feedback?

Lin: I believe it's paramount to have employee feedback. Listening to the employee base, at all levels, helps iden­tify enforcement issues and you un­derstand if the Code is truly reflective of the culture. As I mentioned before, the Code should embody and inspire the values of the organization. Metrics can provide one view of enforcement and compliance, but the other view is to listen to what people are saying. Are managers carrying the right tone from the top? Do frontline employees agree with and live the values? What might be changing in the organization that has not been accounted for in the Code?

OCEG ROUNDTABLE PANELISTS

Carole Switzer,Moderator

President,

OCEG

Jimmy Lin,

VP of Product Mgmt &

Corporate Development, The Network

Kendall Tieck,

VP Internal Audit,

Workday

Source: OCEG.

To gain these insights, you need to have both formal and informal ways of gaug­ing the employee population. Ques­tionnaires, surveys, formss and hotlines can be good anonymous sources, but engaging employees in conversation is just as, if not more, important. Make sure executives and managers alike spend time in small-group and one-on-one conversations. Have these conver­sations throughout the year and across your employee base to get the “real” story. This helps engage the employees and ensure they know you value their input.

Tieck: You do need to leverage employ­ee listening systems to assess opinions and perspective associated with the code. Consider training systems that capture comprehension, and perhaps solicit feedback as a part of the pro­cess. Occasionally, targeted surveys or focus groups might be an effective mechanism in some organizations. Do not overlook the company's people managers as a source of important di­rect and indirect feedback. Each peo­ple manager should consider his or her role in demonstrating the behaviors in the code as well as being a part of the feedback cycle.

Switzer: In today's world of ever-evolv­ing technology and methods of com­munication, how should organizations adapt to better deliver and integrate the Code of Conduct so that employees can use it most meaningfully to guide their conduct?

Tieck: Organizations should consider a Code of Conduct not as a document, but as a set of expected behaviors that are integral to the fabric of the business and an organization's value system. A Code of Conduct is not a compli­ance activity, but how an entity dem­onstrates integrity and acquires trust from markets, shareholders, customers, partners, and governments. To achieve these outcomes, a careful plan, aligned with a policy lifecycle management framework, should articulate how the Code is integrated in the core of the company's activities and culture.

Switzer: I think that's a really impor­tant point, Kendall, that the Code of Conduct is a set of expectations, and guidance to meet those expectations. Thinking about it as “a document we need to have” sets the wrong tone, doesn't it?

Lin: Kendall is right; the Code of Con­duct is not just about one document. Making the Code more interactive and alive is important, but making sure you have a coherent, well-planned commu­nications plan helps you leverage the various communication channels to make sure that employees of all types are receiving the message in a way they like to consume it.

Use thirty-second videos to reinforce key values through screens in public areas or on your intranet. Incorporate animation and games to make your message interactive. Create a format for communication that can accommodate mobile devices, laptops. and TV screens alike and leverages formats from paper-based to interactive magazines. Use all the communication methods available to your employees to deliver and rein­force your Code of Conduct.

That's how you make the Code relevant and effective. That's how you get the outcomes you want and meet the objec­tives that form the basis of the reason you have the Code.