How to build a codes of conduct framework stage by stage

Producing a code is a project with six stages, four roles and two logs. Treat it as one and it takes a quarter and produces something people use. Treat it as a writing task and it takes a fortnight and produces something people sign.

This is the project plan. It assumes you are starting from nothing or from a document nobody reads, which are the same starting point.

What to take away

The roles

Owner. One person, senior enough to be heard and not so senior that they cannot spend a day a week on it for a quarter. Not the general counsel, for reasons given below. Their job is to make the decisions the other roles disagree about.

Counsel. Reviews every card for legal accuracy, and is the authority on which conduct is legally governed. Their job is to correct, not to compose. Where the code restates a regulated obligation, the wording has to match the source: the Information Commissioner's guidance on consent is the kind of document a data rule has to be checked against rather than summarized from memory. Where a rule touches employment law, competition law, anti-corruption law, data protection or anything else regulated, counsel's wording stands, and the rule says that a legal requirement is a legal requirement, not a company preference.

People function. Owns the route by which the code is enforced, and the protections for people who use the reporting channel. Their job is to make the consequences real and the reporting safe.

Operations. Two or three people who do the work the code governs, one from each function with a distinct conflict profile. Their job is to say "that is not how it happens" and to write the examples.

Stage one: scope

Collect the questions. Ask every manager for the conduct questions they have been asked in the last year, in the words they were asked. Ask the people function for the issues that reached them. Ask the reporting channel for its categories, without details.

You will get somewhere between twenty and fifty. Group them. The groups are the sections of the code. A group with one question is probably a section that does not need to exist; a group with ten is the section that needs the most examples.

Do not, at this stage, look at any other organization's code. It will supply topics that are not yours and crowd out the ones that are.

Stage two: draft the cards

Each rule is written on a card with five fields. The card format is the whole method.

The example values are illustrative. Your thresholds are your own to set, and where hospitality or gifts are regulated in your sector or jurisdiction, counsel sets them.

A rule that cannot fill the "how" field is an aspiration. A rule that cannot fill "override" is a rule for junior staff only. Both go back to the operations members until the fields are full or the rule is dropped.

Stage three: test

Write six scenarios, each a paragraph, each realistic for this organization, each sitting near a line. Give them to ten people who were not involved in drafting, with the draft code. Ask each person, alone, in writing, what the code requires them to do.

Where all ten agree, the rule works. Where they split, the rule is ambiguous, and the split tells you where. Rewrite and retest that rule only.

This stage is skipped more often than any other, because by the time the draft exists everyone is tired of it. It is the stage that separates a code from a document. The kind of scenario that does the work is described under ethical dilemmas, which covers how a case is built to sit on a line.

Stage four: launch

Not by email. Each manager receives the three cards most relevant to their team, and a half-hour slot. They walk the team through the three cards, run one scenario, and take questions. Every question is written down and goes to the owner.

The launch is also the first enforcement test. Somewhere in the organization, in the first month, a rule will be tested by someone whose results matter. What happens then is the launch. The pillar on codes of conduct covers why this test decides everything that follows.

Stage five: operate

Two logs, both owned by the owner.

The question log. Every question asked about the code, who asked (by role, not name), and what answer was given. Reviewed monthly. A question asked three times is a rule that needs rewriting, or an example that needs adding.

The exception log. Every time someone is permitted to depart from a rule: who approved it, why, for how long. Reviewed quarterly. A rule with frequent exceptions does not match the work. A rule with no exceptions in a year is either perfect or ignored, and the question log will tell you which.

Both logs are the evidence that the code is alive. A board that asks whether the code is working should be shown the logs, not a completion rate. The same preference for evidence of operation over evidence of existence runs through the Department of Justice's guidance on evaluating compliance programs.

Stage six: revise

Once a year, from the logs. The revision has three mandatory outputs: at least one rule rewritten because the question log showed it was unclear, at least one rule changed or removed because the exception log showed it did not fit, and at least one new example drawn from a real (anonymized) case.

A revision that produces none of these was not a revision. If the logs are empty, the code is not being used, and that is the finding.

Where it conflicts with everything else

A code does not exist alone. It sits next to an incentive scheme, a set of contracts, a body of law and a culture. It loses to all four unless the conflicts are addressed by name.

Timeline

A quarter to launch, then a day a month to run. Organizations that take longer are usually stuck in stage two arguing about wording that stage three would have settled in an afternoon.

Common questions

Why not make the general counsel the owner?

Because the owner's job is to make trade-offs between clarity, enforceability and what the business will accept, and counsel's job is to be right about the law. One person cannot argue both sides of that with themselves. Counsel's role is to correct, and it is essential.

What if the operations members disagree with counsel?

Counsel wins on what the law requires. Operations wins on how the rule is worded so that people can follow it. The owner decides when the two cannot be reconciled, and records why.

We already have a code. Where do we start?

Stage three. Test the existing document with six scenarios and ten people. The results will tell you whether you need stages one and two or just a revision.