WHITE PAPER

BEST PRACTICES IN CODE OF CONDUCT DEVELOPMENT

2014

BEST PRACTICES IN CODE OF CONDUCT DEVELOPMENT 3

in full, as much of that information only applies to those whose job responsibilities require them to act in that area. However, the code addresses the key topics and makes clear the behavioral expectations and company values—with the best codes focusing on affirmative conduct rather than prohibitions. The more detailed information is delivered through policies, which should be cross-referenced in the applicable section of the code.

However, organizations often view the code of conduct as a necessary evil, mandated by various regulatory and governmental agencies, rather than an opportunity to educate employees about the behavioral expectation to which they are held.1 Codes that focus on rules rather than values tend to be overly formal and difficult to read, having clearly been written by a team of lawyers. Organizations that take this approach miss a prime opportunity to pronounce their values, standards, and expectations to both internal and external constituents. Studies show that companies exhibiting a pronounced emphasis on ethics and trust have higher employee retention rates and attract more prospective employees. Therefore, taking time to relate your company’s values, reputation, and success with compliance in a meaningful way not only helps your organization fulfill the FSG, but is also a shrewd business decision.

An effective ethics and compliance program must establish standards of ethical conduct, as well as procedures to prevent and detect criminal conduct. Those standards should be clearly drafted and appropriate both for the size of the organization and the industry in which the organization operates.

Indeed, a properly assembled and distributed code of conduct is the single most effective and impactful part of any compliance and ethics program. Such a code is a written record of not only an organization’s expectations, but also its ethical culture. This fulfills the first hallmark set forth by the Federal Sentencing Guidelines (FSG), which recommends “the promotion of an organizational culture that encourages ethical conduct and a commitment to compliance with the law [through the establishment of] standards and procedures to prevent and detect criminal conduct.”

A code of conduct is called the cornerstone of an effective compliance program because it “knowledge-sets” the “floor” across the organization. The document’s goal is to provide the tools to allow every employee, regardless of job description, to spot the key red flags for the company’s most important risk areas. It is not intended to include all of the information they may need to understand each substantive risk area

“A well-written and designed Code of Business Conduct is the focal point of an effective compliance and ethics program.”

I. Executive SummaryA company Code of Conduct is often the foundation of upon which an effective compliance program is built. – Resource Guide to the U.S. Foreign Corrupt Practices Guide, Chapter 5.

BEST PRACTICES IN CODE OF CONDUCT DEVELOPMENT 4

The code-creation or -revision process is a daunting task and can quickly become overwhelming without proper planning and knowledge of the issues at hand. NYSE Governance Services, with its team of attorneys, analysts, subject matter experts, writers, and editors, has provided this article as a useful reference guide for those embarking on or considering the code of conduct revision or development process.

The code serves as the primary means for your organization to communicate its commitment to ethical and legal conduct to both internal and external stakeholders: employees as well as vendors, customers, agents, shareholders, and the communities in which you do business. While a single document cannot anticipate every possible situation that an employee might face, your code should provide proper and effective guideposts for behavior. To achieve this, tie the code’s guidelines to your company’s values and ethical commitments. Do so in a manner that facilitates employees’ grasp of the critical nature of compliance and ethical decision making, consistent with the code. In addition, the code should enable employees to quickly recognize when to seek guidance, encourage them to report concerns, and provide various avenues through which they can do both.

When revising or creating the code, consider the audience to which the code is directed. Ensure that the language is at such a level that your largest employee base will fully comprehend the content. Take into account the locations where your employees conduct business and ensure that all code content is applicable to all of the audiences receiving it. Scrub this content to ensure that it will resonate with employees in foreign jurisdictions, and be sure to provide translated versions of the code in these locations, as appropriate. Furthermore, in order to reach your employees in an effective and engaging manner, allocate proper resources to layout and graphic design.

When engaging in the code-creation or code-revision process, be sure to account for the many ways in which the code will be used. For example, factors such as proliferation, certification, and training should all be considered. Properly distributing the code, tracking its acknowledgement, and conducting training on its subject matter sends strong signals to regulatory and legal entities that your organization is making a good faith effort to implement an effective compliance program.

Many an organization has fallen prey to miscalculated budgets, poorly planned timelines, and improper preparation of or delegation to project stakeholders. Taking the time to properly define the scope and reach of the code-creation or code-revision process will save your organization substantial time and money—not to mention headaches—later on in the process. Knowing that you want to end up with a best in class Code of Conduct is the easy part. Getting there involves understanding your starting point, assessing the Company’s long and short-term goals, planning the process, and ensuring consensus from all internal parties, especially those who will be part of the review and/or approval teams.

Determine The Starting PointIs your organization in need of its first ever Code? Does your organization have a Code that needs to be updated? If the latter, when was the Code last reviewed?

Best practices are for the Code to be updated every 2 years. Even if the laws haven’t changed for your industry (which is fairly unlikely), you’ll want to freshen up the content in light of new company initiatives and recent accomplishments, reinvent the leadership letter, create new learning aids in line with emerging risks and company demographics, also taking into account recent mergers and acquisitions. The Company should formally distribute the Code document to all employees and include an acknowledgment form that must be signed, collected, and maintained.

The Importance Of BenchmarkingUnder the U.S. Federal Sentencing Guidelines (FSG), an organization can be held criminally responsible and prosecuted for acts committed by employees based on the quality (or lack) of the organization’s efforts to prevent unethical behavior. Guideline §8B2.1 requires regular monitoring and auditing of your program, as well as your compliance risks.

One of the best ways to identify risk is to conduct periodic benchmarking exercises against your industry peers, as 82 percent of WME winners did in 2013 (a number we expect will continue to rise). Benchmarking provides your organization with valuable perspective into how others are addressing emerging risks such as conflicts minerals, supplier relations, or data privacy. Further, and most importantly, it gives insight into varied risk priorities of other organizations. In the event your organization faces, for instance, a government investigation, if your organization is seen as having fallen behind the curve with a subpar code and overall compliance program, any penalties resulting from the investigation are likely to be more severe than if a code and overall program on par with industry peers was in place. While having a solid code is only one step on the road to an effective compliance program, it’s the foundation, and it touches every corner of the organization.

Stakeholder SelectionDecide whether you will engage a vendor or create the code in-houseFirst, you will need to consider whether you will engage an external vendor to handle the code-creation process. Working with an external vendor that has a dedicated focus on writing, editing, and designing compliance- and ethics-related documents can significantly benefit the average organization. Generally, engaging outside vendors to develop the code is more cost- and time-effective than creating or revising in-house. The right vendor will bring to the table the collective view of expert attorneys, risk analysts, and subject matter experts on applicable compliance risks as well as a team of writers, editors, and designers with expertise on best practices for code drafting, language selection, formatting, and graphic design. A vendor should also be able to provide project management resources to guide you through the process from inception to completion.

II. Developing A Plan

BEST PRACTICES IN CODE OF CONDUCT DEVELOPMENT 5

BEST PRACTICES IN CODE OF CONDUCT DEVELOPMENT 6

and various other operational departments. For international organizations, establish key contacts from each major geographical region for location-specific feedback. Where applicable, be sure to involve any European works councils, as council representatives may need to review the code before it can be disseminated to the employees they represent.

Determine at what point stakeholders will be involvedIt is advisable to involve internal stakeholders as early in the process as is feasible. Involving reviewers on an ad hoc basis may potentially lead to radical or sweeping changes to the second or third iterations of the draft, which can significantly prolong the drafting process and quickly exhaust your company’s resources. Gathering feedback from critical stakeholders as early as the outline phase will help mitigate the likelihood of substantial changes occurring late in the drafting process.

While it can be difficult to involve international reviewers before the code has been translated, keep in mind that engaging these stakeholders at the earliest possible juncture will help your company avoid future difficulties. Often, it is helpful to provide these groups with a summary list of the pertinent risk topics addressed and policies cited (in the case of a code creation) or of the major revisions made (in the case of a code rewrite). Doing so allows international reviewers to formulate an understanding of the final product’s look and feel, and gives them a sense of ownership in the project.

Project Timeline DevelopmentIt is critical that your organization establish a realistic process timeline before embarking on the project. This requires budgeting adequate time for the various integral phases of the code-creation and code-revision processes, such as outlining, drafting, reviewing legal content and subject matter, and editing. Be sure to factor in additional time for translations (generally 15 weeks), a step

Ensure that the process of engaging a vendor is thoughtful and carefully planned; failure to do so can result in unmet expectations and strained relationships on one or both sides.

Determine who will be involved in the processIf you choose to draft the code in-house, you will need to coordinate a code-writing team, commonly comprising attorneys, writers, editors and subject matter experts. To avoid falling victim to the obtuse, legal language that commonly results from asking inside counsel to handle drafting duties, be sure to involve professional writers and editors (see “Readability and Tone”). Clearly, the content of the document will also need extensive legal and subject matter review. Thoroughly establish who is responsible for writing or editing each draft of the code, as this will reduce confusion and simplify the code-creation process.

Furthermore, you will need to establish a review team. Whether you are engaging an external vendor or writing the code in-house, it is important to involve all applicable internal stakeholders at the outset of the process. If these individuals share a cohesive vision for the final product’s look and are apprised of the timeline for code drafting, they will be more likely to provide effective and timely feedback. The input and involvement provided by key internal stakeholders will also translate into increased buy-in from these groups when it comes time to roll out the code—an invaluable asset.

It can be difficult to determine exactly which internal parties should be asked to contribute feedback throughout the creation process. Obviously, this list will vary from one company to the next, based on factors such as size and corporate structure. For larger organizations with legal subject matter experts, it’s advisable to include those experts whose areas directly relate to the Code content. To develop a list of internal stakeholders whom you will involve in the code-creation process, identify key contacts among your ethics and compliance function, human resources department, legal department

BEST PRACTICES IN CODE OF CONDUCT DEVELOPMENT 6

want to read more?

Please click the link below for the complete

Best Practices in Code of Conduct development whitepaperView the detailed 5-part code of conduct development process:Developing a planDeveloping the codeCommunicating the codeBringing the code to lifeMaintaining the code

http://request.corpedia.com/WPBestPracticesinCodeofConduct