Compliance, codes and ethics programs

Almost every large organization has a code of conduct, an ethics hotline and mandatory online training. Yet many scandals have occurred at companies with impressive-looking programs. Enron had a 64-page code of ethics, and its board twice waived the code's conflict-of-interest provisions so that the chief financial officer could run partnerships that traded with the company. The question is not whether an organization has a program on paper but whether it works: whether it prevents, detects and responds to misconduct, and whether it shapes a culture in which people do the right thing when no one is watching. This lesson explains what compliance and ethics programs contain, how regulators and prosecutors judge their effectiveness, and how to design programs that change behavior rather than merely documenting it.

Compliance and integrity

Lynn Sharp Paine distinguished two strategies for managing organizational ethics. A compliance strategy emphasizes conformity with externally imposed rules, aims to prevent criminal misconduct, relies on monitoring, controls and penalties, and is typically led by lawyers. An integrity strategy emphasizes self-governance according to chosen values, aims to enable responsible conduct, relies on leadership, education and shared accountability, and is led by management with the support of legal and compliance staff. Paine argued that compliance alone is insufficient, because it treats employees as potential wrongdoers to be deterred and does little to help them handle the many situations rules do not cover.

Most effective programs combine both. Clear rules and controls are essential for high-risk areas such as bribery, competition law, trade sanctions, privacy and financial reporting, where the consequences of error are severe. But values, judgment and a culture of speaking up are needed for everything else. Research by the Ethics and Compliance Initiative consistently finds that strong ethical cultures, where leaders model integrity, supervisors reinforce it and peers support it, are associated with less observed misconduct, more reporting and less retaliation.

Why organizations need programs: corporate liability

Under US federal law, a corporation can be held criminally liable for crimes committed by any employee or agent acting within the scope of employment and at least partly to benefit the corporation, a broad standard called respondeat superior. Because liability is so broad, the existence and effectiveness of a compliance program matter greatly in prosecutors' decisions on whether to charge, what resolution to offer (such as a non-prosecution or deferred prosecution agreement) and whether to require a monitor, and in sentencing. The US Sentencing Guidelines for organizations reduce penalties for organizations with an effective compliance and ethics program, and the Department of Justice's Evaluation of Corporate Compliance Programs guides prosecutors' assessments. Debarment from federal contracts is a further consequence of misconduct.

Elements of an effective program

Regulators in many countries describe the elements of an effective program in similar terms. The US Sentencing Guidelines list seven elements, which have become a widely used template: standards and procedures to prevent and detect misconduct; oversight by the board and senior management with a designated, adequately resourced compliance officer; due diligence to avoid placing people with a history of misconduct in positions of authority; effective training and communication; monitoring, auditing and confidential reporting mechanisms, with evaluation of the program; consistent incentives and discipline; and appropriate response to misconduct, including remediation to prevent recurrence. The program should be based on a periodic risk assessment.

The Department of Justice's evaluation guidance asks three fundamental questions. Is the program well designed? Is it adequately resourced and empowered to function effectively? Does it work in practice? Prosecutors look for evidence beyond documents: how the company assesses risk using data, whether compliance staff have access to the board and to operational data, whether incentives reward ethical conduct, how the company learns from misconduct at its own and other companies, and how it manages emerging risks, including the use of artificial intelligence. Updates to the guidance in recent years have emphasized data analytics, protection against retaliation for reporting, and clawbacks of pay from people responsible for misconduct.

Risk assessment

A compliance risk assessment identifies the laws and ethical risks that apply to the business, assesses the likelihood and impact of violations, evaluates existing controls and prioritizes resources. The risks depend on the industry and geography: a mining company operating in countries with high corruption risk faces different priorities from a domestic software firm handling personal data. Scoring risks on likelihood and impact, adjusted for control effectiveness, helps focus effort where it matters.

Scoring is a tool for judgment, not a substitute for it. Impact should consider harm to people and the environment, not only financial cost, and low-likelihood, high-impact risks such as catastrophic safety failures deserve attention even when their score is moderate.

Codes of conduct

A code of conduct sets out an organization's values and standards of behavior. Effective codes are written in plain language, organized around situations employees actually face, explain the reasons behind rules, give examples and decision tools, tell employees where to get advice and how to report concerns, promise protection against retaliation, and apply to everyone, including directors and senior executives. Codes typically cover conflicts of interest, gifts and entertainment, bribery, fair competition, confidentiality and data privacy, accurate records, use of company assets, insider trading, respectful workplace and harassment, health and safety, and environmental responsibility.

SEC rules require public companies to disclose whether they have a code of ethics for their senior financial officers and to disclose waivers, and the NYSE and Nasdaq require listed companies to adopt codes applying to all directors, officers and employees, with prompt disclosure of waivers for directors and executive officers.

Conflicts of interest and gifts

A conflict of interest exists when a personal interest could interfere, or appear to interfere, with a person's duty to the organization. Examples include hiring a relative, holding shares in a supplier, taking a second job with a competitor, or accepting valuable gifts from a vendor. As lesson 3 showed, conflicts bias judgment unconsciously, so the safest approach is to avoid them where possible and to disclose and manage those that cannot be avoided, typically by removing the conflicted person from the decision. Gifts and entertainment policies set limits, require approvals and registers, and prohibit cash or anything offered to influence a decision; stricter rules apply to government officials because of anti-corruption laws (lesson 9).

Training, communication and culture

Annual online training is common and often ineffective when it consists of clicking through slides. Better approaches use realistic scenarios drawn from the company's own risks, target training to roles (procurement staff need deeper bribery and conflict training than most), deliver short and frequent messages, involve managers in discussing dilemmas with their teams, and measure understanding rather than completion. Culture surveys, focus groups and data on hotline reports and investigations help assess whether the program is working.

Middle managers are especially important. Employees take their cues from their immediate supervisor more than from the chief executive's speeches. A supervisor who reacts to a concern with irritation, or who praises results without asking how they were achieved, can undo the best program. Training managers to respond well to concerns, and holding them accountable for their teams' conduct, is one of the highest-value investments a program can make.

Monitoring, investigations and discipline

Programs need ways to detect misconduct: internal audits, data analytics on payments and expenses, reviews of high-risk transactions, and confidential reporting channels (lesson 10). When concerns arise, investigations should be prompt, independent of the people involved, proportionate, documented and fair to the people accused, with legal privilege where appropriate. Discipline must be consistent: if senior high performers escape consequences that junior staff face, employees conclude that the code does not really apply to everyone. Finally, every significant case should lead to root-cause analysis and remediation, asking why controls failed and what will change.

Measuring effectiveness

Measuring an ethics program is difficult because success means problems that did not happen. Useful indicators include awareness and use of reporting channels, the proportion of reports that come from identified rather than anonymous reporters (a sign of trust), substantiation rates, time to close investigations, repeat issues, perceptions of retaliation in surveys, and results of audits and testing of controls. A rise in hotline reports can be a good sign, indicating trust, rather than a sign of more misconduct. Boards should receive regular reports on these indicators, and the chief compliance officer should have direct access to the board or a board committee.