Cracking the Code: Codes of Conduct That Actually Work

Nearly every company has a code of conduct. At some it's a commonly cited document that guides behavior at the organization. At others, it gets more use as a beverage coaster.

Security and aerospace giant Lockheed Martin, for example, falls into the first category. When the company announced late last year that its board of directors had asked Vice Chairman and COO Christopher Kubasik to resign, it cited the company's code of ethics and business conduct. According to the announcement, an ethics investigation revealed that Kubasik had a close personal relationship with a subordinate, a clear violation of the code, which identifies such behavior as a potential conflict of interest.

The fact that Lockheed Martin fired a top executive for violating its code of ethics—the announcement notes that the Kubasik's actions had no effect on the company's operations or finances—is an indication of how seriously many companies are taking, or trying to take, their codes of ethics or conduct.

At the same time, opinions differ on just how long a code of conduct or ethics should run, which can vary depending on what the company views as the purpose of the code. Some favor longer codes that address multiple ethical risks, while others want a shorter, more accessible document that focuses on broad principles.

As a starting point, a code of conduct must fulfill legal requirements, such as those outlined by the stock exchanges and the Sarbanes-Oxley Act, says Susan Roberts, executive vice president and chief compliance officer at eye health company Bausch & Lomb. A code “can also educate employees about the company's expectations, and raise awareness about key compliance and ethics risks and associated company policies.”

A code should describe employees' obligations to the organization and their peers, colleagues, and clients, notes Ellen Zimiles, managing director and head of the global investigations and compliance practice at Navigant Consulting. “It's how you conduct yourself as an individual.” Most companies expect their employees not to break any laws, of course. A code may go further, and talk about treating people fairly and with respect. 

The goal is to provide enough information that the code becomes a helpful guide to employees, yet contain it within a document that employees can actually read, Roberts says. Finding that balance can be challenging, she acknowledges, especially in a global company. “Our code applies to all of our employees, regardless of their job or where they work in the world.” Bausch & Lomb uses the code to provide overall guidance, and as a “gateway” to more detailed policies and procedures.

In deciding how long to make the code, companies need to take a “Goldilocks approach,” says Donna Boehme, a principal at Compliance Strategists, a New York-based consulting firm. That is, codes of conduct should be “not too long, not too short, but just right for the company.”

A code of conduct “can educate employees about the company's expectations and raise awareness about key compliance and ethics risks and associated company policies.”

—Susan Roberts,

Chief Compliance Officer,

Bausch & Lomb

A code that's just a list of broad principles really is a values or mission statement—fine for establishing the big picture, but still requiring the support of a code, Boehme says.  On the other hand, a code that stretches into a white paper or is written in legalese is less likely to be read, and thus less likely provide much value to employees. 

Petco Rewrites Its Code

At pet supplies retailer Petco, early versions of the company's code of ethics “were pretty much lists of dos and don'ts,” says Jim Brigham, vice president of internal audit services and chief compliance officer. Some versions lacked even contact information employees could use if they had a question or wanted to report an incident. The document also had just a few examples of ethical dilemmas most employees could apply to their own work.

That began to change in early 2011, when Brigham was asked to develop a shorter, livelier document with examples of situations employees might face on a day-to-day basis. The idea was to make it “a fun read, not like reading a law book,” Brigham says.

Brigham and his colleagues went to work, instituting a number of fundamental changes to the code. The document was shortened to about 30 pages, including a heavy sprinkling of photographs of animals (including Buster, a lovable canine used in some of Petco's marketing) and ample white space.

Equally important, the new document focuses on a theme somewhat unique to Petco: a commitment to pets. The code is titled, “Petco Code of Ethics and Conduct: Buster's Guide to Good.” The letter from CEO Jim Myers, which lists the various stakeholders to which each employee has legal and ethical obligations, starts with the animals in their care, and then mentions associates, customer, and others. “It's now more a culture document regarding what we are and who we want to be,” Brigham says

Petco's code also includes information that could apply to any organization. Among other topics, it identifies the company's core values, such as integrity and teamwork; describes examples of ethical dilemmas employees might encounter, with advice on handling them; and provides a hotline number for reporting concerns.

To create the current code, Brigham's group partnered closely with the marketing department for the twelve months or so it took to develop the book. The relationship was essential, he says. “I don't want to understate how important it was to have marketing involved. They understood the brand and the way to make it fun.”

Along with an appropriate length, an effective code needs to be read, signed, and recognized as important by every employee, Zimiles says. Companies want to avoid simply handing out the code for employees' signatures, without any discussion to accompany the action. “If you make this just a ‘check-the-box' exercise, you're defeating yourself,” she adds. Organizations should invest the time and money needed to convey the code's significance to employees and business partners who are expected to abide by it.

A Company-wide Effort

When Roberts came to Bausch & Lomb, she also undertook a revision of the company's code of conduct, transforming it into a document that not only satisfied legal requirements, but was also “helpful to our employees, as well as engaging and user-friendly,” she says.

CODE OF ETHICS OR CODE OF COMPLIANCE?

In practice, many people use the terms “code of conduct” and “code of ethics” interchangeably. In a corporate governance context, the terms do have more specific meanings, notes Robert Wild, a lawyer at Krieg DeVault in Chicago.

Both the New York Stock Exchange and Nasdaq require listed companies to adopt codes of conduct.

Rule 5610 of the Nasdaq Listing Rules provides that “Each company shall adopt a code of conduct applicable to all directors, officers, and employees, which shall be publicly available.” The code also must have an enforcement mechanism.

Section 303A.10 of the NYSE Listed Company Manual reads: “Listed companies must adopt and disclose a code of business conduct and ethics for directors, officers and employees, and promptly disclose any waivers of the code for directors or executive officers.”

In addition, Section 406 of Sarbanes-Oxley (implemented by Item 406 of Regulation S-K) requires companies to disclose in their Form 10-K whether they have a code of ethics for the principal executive officer and senior financial officers, including the principal financial officer and principal accounting officer and/or controller. Companies without a code need to disclose why. Companies also have to disclose on a Form 8-K any change to or waiver in the code of ethics for senior financial officers.

Thus, the code of ethics described under Sarbanes-Oxley applies more narrowly than the codes of conduct required by the exchanges, which apply to directors and all employees, Wild notes. He adds that this stems from Sarbanes-Oxley's focus on ensuring the integrity of companies' financial statements and avoiding conflicts of interest on the part of the CEO and senior financial execs—both common themes in pre-Sarbanes-Oxley corporate failures.

—Karen Kroll

To get there, Roberts and her team met with close to one thousand employees from all levels, functions, and geographic regions. The input the employees provided both improved the final product and helped ensure relevancy. “Our employees had great ideas,” Roberts says. Involving such a broad cross-section of employees in the code's creation also meant that it “was incredibly well received” when it rolled out. “We were pleased to have 1,000 code ‘ambassadors' who were proud to say they had taken part in its development,” Roberts says.

Another way to convey the seriousness with which the organization takes the code is by letting employees know when management acted to deal with a violation, Zimiles says. Although it's not necessary to disclose the names of those involved—indeed, doing so may be unwise—other employees need to know the violation was addressed. “If people think there's no enforcement of the Code, it's not as powerful,” she adds.

The code also should be easily available. “There's no reason not to make it public,” Zimiles says. Vendors and other business partners should be familiar with the code and understand the organization's expectations of employees.

Of course, no one can reasonably suggest that even the most readable and finely crafted code of ethics or conduct will stop an employee intent on violating its provisions or breaking laws. “But it may slow them down and make them think twice,” Zimiles says. “And, somebody else may report it.”

After all, along with its legal function, a code is “a powerful opportunity to share the company's expectations of its employees and reinforce your company's current or desired culture,” Roberts points out.