Writing a code of conduct: A simple method

by Alexandre C. Serpa, CCEP, CFE, CPC-A

Alexandre C. Serpa(serpa21@hotmail.com) is Regional Compliance Head for Latin America and Canada for Allergan plc in São Paulo, Brazil.

A compliance program can only be effective if supported by real tone and actions from top management and the organization as a whole. It is also common knowledge that a risk assessment needs to be conducted before any other activity or pillar is put in place, given that those need to be designed to mitigate the identified compliance risks.

The next step is usually drafting policies and procedures, and the code of conduct is the first document that is created. A code of conduct allows the organization to have a central overview or summary document that will serve to guide all other efforts in the design and operationalization of the compliance program. It doesn’t require too much detailing of each relevant topic, allowing the organization to set out the most relevant principles to be followed by the employees before trying to detail every single policy and procedure that make up a compliance program.

You’ve probably heard, multiple times, that your organization’s code of conduct should not be a copy of any other company’s code, and that is absolutely correct! Your company’s code of conduct should be drafted based on your organization’s needs, culture, and current moment; it also should be unique to your company. Otherwise, the code of conduct will not serve its purpose of being a useful tool for your organization’s employees to use as a guiding document.

Drafting an adequate code of conduct from scratch is not an easy task, but neither is it too complex, as long as you approach it as a multipart and finite task. If we follow a method, and if we accept that no code of conduct is perfect or fully comprehensive, then we have a workable task in front of us.

Initial steps

So, how can we do it? Let’s start by separating the task into individual components.

What is the format and media we want to use?

There is no rule or legal requirement stating that a code of conduct needs to be in text or video format. No rules exist about having the code as a document hosted in a network folder or as an interactive, three-dimensional shape that can be rotated, zoomed in and out, clicked on, and moved around. Therefore, feel free to decide which format and media will have the most impact, will be more useful, and will best engage your company’s employees. Of course there is always the matter of resources, which may limit your options.

You will want to work with your company’s creative department here, be it those in Marketing, Communications, HR, or any other department that will help you choose a good format, layout, media, color scheme, visual identity, etc.

How long should it be?

Again, there are no rules related to the length of a code of conduct. Think about what you want to achieve with the document. Do you want it to be a quick guide about your organization’s principles (short document) or do you want it to be comprehensive guidance on each relevant topic (long document).

I have a personal preference for shorter codes. They are easier to remember, cheaper to print, allow for more flexibility in terms of format and platform, and will probably be more useful to our colleagues.

What will its content be?

Even though you should not copy another organization’s code, reading various existing codes from different companies may help you envision the interesting and useful components you want to consider. A number of standard components are usually included in codes of conduct, and you may choose which ones to include in your company’s code. A list of the most common/basic components are:

Letter from the company’s CEO (or top executive): This should emphasize the company’s commitment to its compliance program, urge all employees to be active agents in the company’s journey to be compliant, include a call to action, and have a good example of what the company expects from its employees.
Company’s values: Consider adding the company’s mission and vision statement here, including how they relate to the code of conduct.
An explanation of what this Code is, and what its purposes and objectives are: This section will outline that the code of conduct serves as a reference document, where employees will get an overview of the company’s compliance program and how to approach relevant risks. It should not provide all the answers to every question employees might have, but it should tell them how to find answers.
Questions and answers and/or scenario-based examples of relevant situations: Try to include tangible examples of good compliance practices or cases that may have occurred in the past, either from one of the founders or one of the employees of the company. These could be spread throughout the document or concentrated in a separate section of the code.
Details about your hotline: Given the relevance of this pillar of compliance programs, one section in your Code is usually dedicated for this.
Other resources: Usually this section has links to several other resources — such as the policies repository or a directory of compliance personnel — to which colleagues may refer to when the information they are seeking can’t be found in the Code.
The risk topics to be addressed: This should include the requirements and guidance around each risk area.

From this point forward, we will be talking about how to develop the risk content of the code.