From a code of conduct to working rules
A code of conduct sets expectations, but it needs supporting policies to work, covering matters such as conflicts of interest, gifts and entertainment, use of company assets, dealings with public officials, and record keeping. Each policy should be specific enough that employees know when to ask for help and whom to ask. Training should match the risks of particular roles rather than being the same slide deck for everyone. The Justice Department's written guidance on evaluating corporate programs has been revised more than once, so a program should be measured against the current version. Regulators tend to look past the documents to whether the program is used, funded, and enforced.
Reporting channels and protection from retaliation
Employees need a way to raise concerns, including an anonymous option, and the company needs a process for receiving, sorting, and investigating what comes in. How those reports are handled is often what regulators and courts examine most closely. Retaliating against someone who reports based on a reasonable belief can create separate liability under federal and state whistleblower laws, even when the underlying concern is not borne out. Policies and agreements should not discourage employees from reporting to government agencies, since some regulators treat such restrictions as violations in their own right. Documenting each report and the response protects both the company and the people involved.
Building, reviewing, or investigating
Our work in corporate ethics and compliance usually takes one of three forms: building a program for a growing company, reviewing an existing program against its real risks, or investigating a specific report. In an investigation, decisions about who conducts it, whether it runs through counsel to preserve privilege, and what is reported to the board come early and affect everything after. A first meeting covers the company's industry, size, current policies, and any open issues. Bring the code of conduct, related policies, hotline records if any exist, and a description of the concern that prompted the call.
