Why have a formal Code of Conduct?

According to the report ‘Solving the Compliance Conundrum’ published by Towards Maturity in June 2017, 77% of the 250+ compliance professionals surveyed identify Code of Conduct as a key risk within their business. This makes Code of Conduct the second highest risk area behind data privacy and a higher risk priority than health and safety.

This fact won’t surprise compliance professionals; the conduct and behaviours of people (e.g. employees, contractors, and third parties) poses the greatest risk for non-compliance in the workplace (either through a lack of awareness, inappropriate behaviour, or through deliberately malicious activity). Organisations may attempt to manage this risk through a collection of policies and procedures that are supported by compliance training programmes for each topic area.

Surprisingly, though, many organisations do not have an up-to-date formal Code of Conduct in place – perhaps they see this as a duplication of information from the existing policies and training they have in place, or maybe it has never become a high enough priority. In this article we explore the benefits of having a formal Code of Conduct and help you to build the business case for a Code of Conduct.

Onboarding

New starters often get overloaded with information upon joining an organisation; maybe in the form of face-to-face briefings, death by PowerPoint, multiple sources of background reading, and/or a collection of eLearning programmes. All of this information competes for the attention of new employees and they are left unable to see the ‘wood for the trees’, with only a small proportion of the information sinking in.

A well designed Code of Conduct provides a high level overview of this complex information landscape. It lets new employees know immediately what is expected of them and what they can expect from the organisation in turn. It signposts the most complex information and allows more time for this to be absorbed. It also creates immediate value in the relationship between the new starter and the organisation, and gets their induction off to the best possible start.

Of course, a Code of Conduct isn’t just for new employees. Equally, it’s an ideal platform through which to let employees know of organisational changes, and also to reinforce the Code of Conduct over a prolonged period of time.

Tone from the top

A Code of Conduct is the ideal way for senior management to endorse the organisation’s overall compliance programme and in doing so set the tone from the top.

It’s an ideal platform for the CEO, and other C-Suite board members, to endorse the standards of conduct expected by everyone within the organisation (including themselves), and it promotes the ‘Speak Up’ process for reporting instances where these standards are not being met.

Creating a compliance culture

The message from the CEO and other C-Suite board members starts the process of creating a compliance culture within your organisation. The investment in producing and implementing your Code of Conduct will not go unnoticed and will naturally reinforce the importance of ethical behaviours and, in doing so, strengthen the compliance culture within your organisation.

The compliance culture is further strengthened when your Code of Conduct provides:

Clear guidance on what is acceptable and unacceptable behaviour (ideally though real-life scenarios and/or anecdotal references)
Encouragement to behave in an acceptable and ethical way
Help on how to identify unacceptable behaviour
Support and encouragement on reporting unacceptable behaviour

Life doesn’t exist in silos

Once you drill down to specific compliance risks, e.g. data privacy or anti-bribery, policies and training material naturally gravitate to the subject matter being covered. But life is never this simple, and almost always a situation will be affected by multiple compliance risk areas.

A Code of Conduct is an umbrella for all compliance risks, and will allow you to explore complex scenarios/situations covering multiple compliance topics. This is much more aligned to real-life situations and allows employees to explore ethical solutions to these more complex scenarios.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”