Industry
Part of A code of conduct only works if it survives real pressure, not just launch day
Codes of conduct checklist: every item, with the reason behind it
Codes of conduct, audited: twelve tests from finding the gift rule in a minute to whether anyone senior has ever been disciplined, with scoring.
This is a review of a code that already exists. Twelve tests, each answerable in an afternoon with the document, a few colleagues and access to whatever records the organization keeps. Each has a pass condition and says what a fail means, because a checklist that only produces ticks is a form.
Run it once a year, and run it again after any incident that the code should have prevented.
What to take away
- A code passes when people can find the rule they need, apply it without asking, and see it applied to people senior to them. Everything else is presentation.
- Six of the twelve tests need no document at allthey are answered by what has happened in the last year.
- A code that fails tests 7 to 9 is not a code. It is a description of what would happen to a junior person.
- Do the tests in order. The early ones are cheap and a fail on them makes the later ones moot.
Finding and reading
1. The gift rule in sixty seconds. Hand the code to someone who joined in the last three months. Ask them to find what they may accept from a supplier at a trade event. Time it. Pass: under a minute, and they can say the rule in their own words. Fail: they find a section on "business courtesies" that refers them to a policy that refers them to a manager. The fix is a two-line rule at the top of a short section, and the same for every other rule someone actually needs.
Finding and reading tests
- Gift rule found in under a minute
- Every must has a how
- Named person, not a function
2. Every "must" has a "how". Go through the document and mark each obligation. Beside each, write the route by which a person complies: the form, the person, the approval. Pass: every obligation has a route. Fail: obligations that exist only as sentences. "Employees must avoid conflicts of interest" with no way to declare one is a rule written to be broken.
3. A named person, not a function. For each route in test 2, find the name. Pass: a person, reachable, who has answered a question under this rule in the last quarter. Fail: "contact Compliance" with no indication that Compliance is a person and not a mailbox. If the name changes often, publish a role and keep the role's holder current somewhere people can see it.
Applying
4. The rule everyone breaks. Ask five people from different teams which rule in the code is routinely ignored. Pass: they cannot think of one, or they name one and it has been dealt with. Fail: they all name the same one. A rule that is openly broken without consequence teaches staff that the whole document is optional. Either enforce it from a stated date or delete it; there is no third option.
Applying the code tests
- Rule everyone breaksnone or dealt with
- Manager override route exists and protects
- Friday at elevenreporting route works
5. What to do when your manager says otherwise. Find the paragraph that tells a person what to do when their manager instructs them to do something the code forbids. Pass: it exists, it names a route around the manager, and it says the person will not be penalized for using it. Fail: it is absent, or it says to "raise concerns with your manager". This is the single most common omission, and the one that matters most on the day. Which disclosures by a worker are legally protected is a separate question with a different answer in each country: the UK's statutory whistleblowing framework is one example of the shape it takes, and counsel is the source for yours.
6. Friday at eleven. Try the reporting route at a time nobody is at work. Pass: it accepts the report, confirms receipt, and states when a human will respond. Fail: a phone that rings out, a form that errors, or a mailbox that auto-replies with office hours. The person who needs it at that hour is the person who has just been told to do something and has the weekend to think about it.
Enforcing
7. Has anyone senior been disciplined under it? Look at the last three years. Whether discipline has reached senior people is one of the things the Department of Justice tells prosecutors to ask about a compliance program, for the same reason it matters to your staff. Pass: at least one person above the level of team lead has faced a consequence under the code, and staff know about it in general terms. Fail: every case involved someone junior. A code that only reaches downward is understood by everyone to reach only downward, and it will not be used against anyone else because nobody will report anyone else.
Enforcement tests
- Senior person disciplined under code
- Top performer held to the rule
- Scope binds contractors, board, founder
8. The top performer. Identify the last time the code was applied to someone whose results the organization depended on. Pass: it happened, and the rule held. Fail: it has not come up, or it came up and an exception was found. The pillar on codes of conduct calls this the test that matters, and it is: a rule that bends for the person who brings in revenue is a rule for the people who do not.
9. Contractors, the board, and the founder. Read the scope clause. Pass: it names contractors, temporary staff, directors and the most senior executive as bound, and there is a mechanism by which each could be held to it. Fail: it says "all employees", which excludes the people most able to cause a serious problem. Where the organization's relationship with contractors or directors is governed by contract or by company law, the mechanism has to be built into those documents, and counsel should confirm it has been.
Living
10. The incentive that contradicts it. Take the organization's bonus scheme, sales targets and promotion criteria. Find the one that most directly rewards behavior the code forbids. Pass: you looked and there is none, or there is one and it is being changed. Fail: you found one and it is still in place. This is the test that most organizations skip, because it is the one whose fail is expensive. The mechanics of why incentives win are in leadership ethics.
Living code tests
- No incentive contradicts the code
- Code changed a decision this year
- Question log exists and shapes revisions
11. When did it last change something? Find one decision in the last year that went differently because of the code: a deal declined, a gift returned, a hire not made, a practice stopped. Pass: you can name it and the people involved would agree it was the code that decided it. Fail: nothing comes to mind. A code that has not changed a decision in a year is not operating; it is on file.
12. The question log. Find the record of questions people have asked about the code. Pass: it exists, it has entries from the last quarter, and the entries have shaped a revision. Fail: no such record, or a record that nobody reads. The questions are the only reliable signal of where the document does not match the work, and the method for turning them into revisions is in ethics training programs, where the same signal drives the curriculum.
Scoring
| Fails on | What it means | First action |
|---|---|---|
| 1 to 3 | The document is unusable | Rewrite the sections people need, not the whole thing |
| 4 to 6 | The document is unapplied | Fix the manager-override route and the reporting channel before anything else |
| 7 to 9 | The document is one-directional | This is a leadership decision, not a drafting one |
| 10 to 12 | The document is inert | Change the incentive, then look at the log |
Do not weight the tests equally. A pass on 1 to 6 and a fail on 7 and 8 describes an organization with a well-written code that everyone knows does not apply upward. That is the most common result, and the most dangerous, because it looks like success from the compliance function's chair.
What the checklist will not tell you
Whether the rules are the right rules is a separate question. The mistakes that produce wrong rules are a separate article.
It also will not tell you whether people would report a serious problem, only whether they could. Most organizations live in that gap. The individual's side of it is set out in employee ethics.
Common questions
How long does the full run take?
An afternoon for tests 1 to 6, most of which need only the document and three colleagues. Tests 7 to 12 need records and a candid conversation with whoever holds them, and can take a week to schedule.
What if we fail most of it?
Fix 5 and 6 first: the manager-override paragraph and the reporting route. Those two make the code usable on the day it is needed. Everything else can follow over a quarter.
Should the results be shared with staff?
The fixes should. A note saying "we tested the code and changed these three things because of what we found" does more for the code's standing than any launch did.
