Checklist for spotting codes of conduct mistakes before they cost you

Most bad codes were written by capable people under conditions that guaranteed the result. The mistakes below are not about carelessness. Each one is the natural outcome of a reasonable-seeming decision about who writes the document, who it is for, and what it is meant to do.

For each: how it happens, what it looks like from the floor, and the repair.

What to take away

1. Legal wrote it alone

How it happens: someone senior asks for a code, the request goes to the general counsel, and a document arrives that is accurate, complete and defensive.

From the floor: sentences that begin "Employees shall" and end in cross-references. Nothing about what to do on Tuesday when a supplier offers tickets.

The repair: legal reviews it, and must, because parts of any code touch regulated conduct and the wording there has to be right. But the first draft comes from the people who will use it, and it is written as instructions. Then counsel corrects what is wrong. A document corrected by lawyers reads differently from a document composed by them.

2. It was copied from a larger company

How it happens: a template from a well-known organization, or a published code admired at a conference, is adapted by changing the name.

From the floor: rules about situations that do not arise here (foreign officials, listed-company disclosure, a procurement function that does not exist) and silence about the ones that do.

The repair: start from the last twenty real questions people in the organization asked about conduct. If nobody kept them, ask managers to recall them. Those twenty questions are the table of contents. The borrowed template can supply wording where the topics overlap, and nothing where they do not.

3. It protects the organization, not the person

How it happens: the document is drafted with the disciplinary hearing in mind. Every rule is written so that breach can be proven, which means every rule is written as a prohibition with no guidance.

From the floor: a document that tells you what you will be punished for and nothing about how to stay out of trouble. People respond by asking permission for everything or by asking nothing and hoping.

The repair: every rule gets four lines. What the rule is. Why it exists, in one sentence. How to comply, with the route. Who to ask when it is unclear. The prohibition is still there; it is now surrounded by help.

4. Values instead of rules

How it happens: a leadership team, uncomfortable with a list of prohibitions, writes a document about integrity, respect and excellence.

From the floor: a poster. Nobody can say what it forbids, so it forbids nothing. The pillar on codes of conduct makes the distinction between a code and a values statement; this mistake is the one that erases it.

The repair: keep the values if they are genuinely held, and put them in a different document. The code contains rules that a person can break, and knows when they have.

5. No examples

How it happens: examples are hard to write, easy to argue with, and legal worries that an example will be read as the limit of the rule.

From the floor: "reasonable hospitality" means whatever the reader wants it to mean, and the reader who wants it to mean the most is the one you wrote the rule for.

The repair: each rule gets one example that clearly falls inside it and one that clearly falls outside, both realistic for this organization. The examples do more work than the rule. Where a rule genuinely has a hard boundary that examples might obscure, say so in the rule and give the examples anyway.

6. Launched by attestation

How it happens: the code is finished, and someone proposes that every employee confirm they have read it. A system sends reminders. Completion reaches a satisfying percentage.

From the floor: an email, a link, a checkbox, and a lesson learned about what the organization thinks the code is for. The completion figure is now on a dashboard and will mislead a board for years.

Guidance for prosecutors on evaluating compliance programs asks whether training actually changed behavior, not how many people completed it. The dashboard cannot answer that question.

The repair: each manager sits with their team for half an hour, walks through the three rules most relevant to that team's work, and answers questions. Questions go into a log.

This costs more than a checkbox and produces a code people have heard a human explain. Attestation and its cousins move nothing; reasons are in ethics training programs.

7. Punishing the reporter's tone

How it happens: a report arrives that is angry, badly written, or raised in the wrong forum. The response addresses the manner, and the substance is left for later. Later does not come.

From the floor: everyone learns that a report must be perfect to be heard. Reports stop.

Punishing the manner is also how organizations lose the protection that reporting rules are meant to give them: the UK's guidance on whistleblowing turns on whether a worker made a qualifying disclosure, not on whether they made it politely.

The repair: a written rule, in the code, that the substance of a report is dealt with regardless of how it was raised, and that the manner is discussed separately, afterwards, if at all. Then apply it the first time it is tested, visibly.

8. One document for everyone

How it happens: a single code, applied uniformly, feels fair and is easier to maintain.

From the floor: the sales team's real conflicts (discounts, entertainment, side arrangements) and the engineering team's (data access, shortcuts under deadline) each get a paragraph, and neither gets enough.

The repair: a short common core that binds everyone, including directors and contractors, and a one-page annex per function that names that function's actual conflicts. The annex is written with the function, and it is the part they will read.

9. Rules are never retired

How it happens: each incident adds a rule. Nobody is ever asked to remove one, because removal looks like lowering standards.

From the floor: a document that grows by a page a year, in which the rule that matters this week is buried under rules about incidents from a decade ago.

The repair: an annual review with one mandatory output: at least one rule removed or merged. If the reviewers cannot find one, they have not read the document closely enough. Removing a rule that no longer describes a live risk is not lowering standards; it is making the remaining standards findable.

How these compound

The last column of each row is where the cost lands, usually a year or two after the mistake, on someone who was not in the room when it was made.

The one that is not on the list

Writing a good code and then applying it only downward is not a drafting mistake. It does not belong here, but it undoes every repair above.

That choice comes from people at the top, usually by not deciding. The mechanism appears in leadership ethics. The person on the floor who has to live with the result is the subject of employee ethics.

Common questions

Which mistake is cheapest to fix?

Adding examples. Two per rule, written by the people who do the work, in a week. It does not fix the structural mistakes but it makes the existing document usable while you address them.

Can a code written by legal be rescued?

Yes, by rewriting each rule as a card with the how, the why and the person to ask, then sending it back to counsel for correction. The legal accuracy survives; the tone does not.

How do we retire a rule without looking like we lowered standards?

Say what the rule covered, say that the risk it addressed is now handled elsewhere or no longer arises, and say where the remaining rule on that topic now lives. Retirement with a reason reads as maintenance.