The Abbey Grange, the Quality of Justice and Codes of Conduct

This article was republished with permission from Tom Fox’s FCPA Compliance and Ethics Blog.

In honor of the return of Sherlock to PBS with Season 3, I begin a week of Sherlockian-themed posts. Today we consider the quality of justice that Holmes discussed in The Abbey Grange, in which he allowed a man who murdered a wife-abusing husband to go free. Holmes’ concern with justice, as opposed to simply following the letter of the law, is an excellent introduction into the subject of codes of conduct.

What is the value of having a code of conduct? I have heard many business folks ask that question over the years. In its early days, a code of conduct tended to be lawyer-written and lawyer-driven to “wave in a defense situation” by claiming, “See? We have one.” But is such a legalistic code effective? Is a code of conduct more than simply your company’s law? What is it that makes a code of conduct effective? What should be the goal in the creation of your company’s code of conduct?

Carol Switzer, President of the Open Compliance and Ethics Group (OCEG), explored some of these questions in a recent article in Compliance Week, entitled “The Code of Conduct Conundrum.” As a part of her article, Switzer interviewed Jimmy Lin, Vice President of Product Management and Corporate Development at The Network and Kendall Tieck, VP of Internal Audit at Workday, for their thoughts on what makes an effective code of conduct.

Tieck views a code of conduct as not simply a static piece of paper or document, “but as a set of expected behaviors that are integral to the fabric of the business and an organization’s value system. A code of conduct is not a compliance activity, but how an entity demonstrates integrity and acquires trust from markets, shareholders, customers, partners and governments. To achieve these outcomes, a careful plan, aligned with a policy life cycle management framework, should articulate how the code is integrated in the core of the company’s activities and culture.”

Switzer believes that one of the key components of a best practices code of conduct is to integrate the connection between a business’ objectives, risks and compliance management. There are numerous factors that can move a company toward having such an effective integration. Switzer wrote that some of these include “external stakeholder expectations and pressures, internal culture and context, objectives for the code, process of development and implementation, content of the code, consequences for non-conforming conduct, strength of sub-codes (e.g. policies) and employee character.”

A GRC Illustrated series provided with Switzer’s article, “The Next Generation Code of Conduct,” lays out six steps for the compliance practitioner to think through and implement during a code of conduct upgrade or rewrite. These six steps are as follows.

Design

Under this step, a company needs to define the behavior that it desires to inspire and allow employees to collaborate at all levels. Lin said that a key aspect was relevancy, “but times change—business environments change, cultures change, risk appetites change. We all need to keep in mind that the code, the ultimate policy, should not be a stale document on the shelf. It needs to inspire, engage and change with the organization.” Tieck said that your code of conduct should be “considered a part of the entity’s overall policy landscape. Leveraging an effective policy life cycle management framework will promote integration and alignment across the policy governance landscape.”

Deliver

Switzer also identified the delivery of a code of conduct as a key element of its effectiveness. She said, “modern communication methods that allow the user to engage, interact and research further behind the code into related policies, procedures and helplines for additional guidance can be better monitored and measured. Code content that is integrated with efforts to monitor changes in the external and internal environment can be updated as needed rather than on a static schedule.” This should also include relevant third parties such as suppliers and sales agents. “And failure to comply with the code can be better identified and tracked, indicating possible need for clarification, additional training or better screening of employees.”

Interact

Lin pointed out that a code of conduct is both a corporate governance document and a marketing document. As such, you will need to create a marketing campaign to get the message of your code of conduct out not only to your employee base, but also to relevant third parties, such as suppliers and agents. If you have a large number of non-English speaking personnel or employees without access to online training, these factors needs to be considered when determining the delivery method.

Measure

Initially, you should prioritize both qualitative results with positive feedback by including such metrics as speed of completion, reminders (which must be sent to facilitate completion of code of conduct training) and the percent of employees and third parties who attest to reviewing your code of conduct. You should also measure the effectiveness of your communication campaign. Tieck suggests drilling down further because each component of your code of conduct sets “an expected behavior. Selecting a few critical behaviors to measure and monitor may be adequate for most organizations. These selected measures might represent an aggregate measure of the overall conformance to the code. Large organizations may be able to mine HR data to capture statistics associated with the identified behaviors. For instance, termination reason codes may be one source.”

Maintain

All commentators note that it is important to keep your code of conduct design fresh. One of the ways to do this is by employee feedback, which can assist you in identifying if your code of conduct is not only effective, but truly reflective of your company’s culture. Lin pointed out that to gain these insights, you need to incorporate both formal and informal techniques for gauging the relevant employee and third-party populations. Some of these techniques, including “questionnaires, surveys, forms and hotlines can be good anonymous sources, but engaging employees in conversation is just as, if not more, important. Make sure executives and managers alike spend time in small-group and one-on-one conversations. Have these conversations throughout the year and across your employee base to get the “real” story. This helps engage the employees and ensure they know you value their input.”

Improve

OCEG advocates that your code of conduct should be evaluated for revision at least every two years. This should be done to keep abreast of the changes in laws and regulations and to reassess your own business operations and risk tolerances. Switzer said that “code content that is integrated with efforts to monitor changes in the external and internal environment can be updated as needed rather than on a static schedule.”

Switzer ends her piece by relating that there is a huge benefit to a company for a well thought-out code of conduct, as a tool to drive both corporate values and sinew the expectations of conduct into the fabric of the company. By designing a code of conduct that can be measured for effectiveness, you can continuously keep the goals moving forward and, as Holmes did in the Abbey Grange, further your cause beyond the simple letter of the law.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business advice, legal advice or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The author gives his permission to link, post, distribute or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.