Putting Teeth in Corporate Ethics Codes

Feeling pressure on all sides, more CEOs are pushing to make sure these documents are detailed, understood -- and enforced

By Amey Stone

Clark Consulting (CLK ), a compensation and benefit consulting firm, has had a corporate code of ethics in place for years. But following the 2002 passage of the Sarbanes-Oxley law reforming corporate governance, Chief Executive Tom Wamberg revised it, redistributed it, and started referring to it in weekly newsletters distributed to all employees. It wasn't long before the code was put to the test.

Earlier this year, Wamberg learned that one of his senior consultants was bragging to other employees about how he had "fired" a particularly demanding client. Wamberg was outraged. Rule No. 1 of the code is that clients come first. "For us, that was a cardinal sin," says Wamberg, who dismissed that consultant, citing the code.

Now he sees the benefits of having a public statement in place and sticking to it. "If you don't have something to stand up to and look to, you could easily give a slap on the wrist and say, 'Don't do it again,'" says Wamberg.


  Well, not so easily anymore. In part due to new regulatory requirements (including a new Nasdaq rule that goes into effect May 4, requiring listed companies to distribute a code to all employees) -- and also because of so many high-profile cases recently where corporate malfeasance has brought down major businesses -- chief executives are doing their best to turn the code of ethics into a document with real teeth.

"There's a whole spectrum of activities that can make this thing come alive," says Dan DiFilippo, who leads PricewaterhouseCoopers' governance and compliance practice. Companies are rewriting the codes, making them much more detailed and specific. German software giant SAP (SAP ) has a 14-page code with sections that describe conduct with customers, vendors, and competitors, as well as stock-trading rules.

Businesses are adding enforcement measures, including guidelines for employees to follow if they see violations. A "sanctions" section in SAP's code explains that any act "in opposition to this Code of Conduct is subject to internal review, and can result in consequences that affect employment, and could possibly lead to external investigation, civil law proceedings, or criminal charges."


  No longer just published in an employee handbook, the codes are being posted on corporate Web sites and around offices. Companies now want the statement to be visible to people outside, like regulators, vendors, and customers -- as well as employees.

"It always was part of our DNA," says Harold Tinkler, chief ethics and compliance officer at accounting firm Deloitte & Touche, which is finalizing a new, more detailed code. "But in today's world, the public at large wants to see it demonstrated." According to a recent survey by New York-based research firm Governance Metrix, which rates companies on their compliance efforts, 51% of U.S. concerns disclose a code of ethics, although 32% allow a waiver in some cases.

Perhaps most notably, businesses are increasingly requiring all employees to read and sign the ethics statement. This measure is an apparent extension of the Sarbanes-Oxley rule that CEOs and CFOs certify the accuracy of company financials. "They're pushing that requirement down the ranks," says Kirk Jordan, a compliance attorney who's vice-president for research at Integrity Interactive, which provides Web-based ethics and compliance training programs. Usually the sign-off is a condition of employment -- and sometimes a condition of getting a bonus or a raise.


  Another new trend: Companies are adding more training around their codes of ethics. Jordan says the new focus is on providing guidance for senior managers, rather than assuming they understand the issues. At software concern Hyperion Solutions, CEO Jeff Rodek trains managers to distinguish between employees who underperform -- who should be given several chances to improve -- and workers who violate the ethics code, where "it can be one strike, you're out," he says. "It's important that people know the difference."

One goal of the training is to bring ethics into play during key decision-making points. Some outfits are making research into ethical issues a part of the due diligence on another company during an acquisition, says PWC's DiFilippo. Deloitte & Touche will ask managers to explore ethical issues with the engagement team before starting each new audit, says Tinkler.

Technology is increasingly involved in all these pursuits. Integrity Interactive's code-of-ethics training course includes a testing component. All employees must continue training until they score 100% on a test.


  Last November ACL Services, which makes software used in internal audits, launched a new "Continuous Controls Monitoring" solution, which flags possible code-of-conduct violations, like purchasing from a vendor that charges more than the standard price (that might mean the employee is getting some sort of kickback). "Actively testing for controls begins to create a culture of accountability and ethics," says Harald Will, ACL's president and CEO.

It's still unclear how much good a code of conduct can do in preventing ethical lapses. Even though accounting firm Arthur Andersen had a strong ethics program in place, it didn't survive the fallout of having signed off on failed energy giant Enron's books. The program clearly didn't do much good when the firm's Houston office should have raised questions about a major clients' activities.

"It's during difficult decisions that someone's ethics are put to the test," says William Henrich, vice-chairman of turnaround consulting firm Getzler Henrich & Associates and a former partner at Arthur Andersen. "At that point, whether or not they signed a piece of paper doesn't make a difference."


  Many consultants on business-risk issues say a company needs to take more important measures than a statement to prevent ethical lapses from harming it. "A code of ethics is an easy thing to redo," says Michael Chagares, who leads consulting firm Marsh's business-risk practice. "The question is how you get a real change in behavior."

More important than emphasizing the code is making sure the board has independent members and that a system of checks and balances on management is in place throughout the company. It's also essential that the business has mechanisms in place that lets problems come to the surface, Chagares says.

Even if a code of ethics is just a starting point, it certainly doesn't hurt, consultants and chief executives agree. And it has the most power if it appears to come straight from the top. Wamberg says he worries that people at his company pay only lip service to standing by the corporate code of ethics. "That's why I just pound it in," he says. When it comes to ethics statements, employees can expect more pounding in the months to come.

Stone is a senior writer for BusinessWeek Online in New York

Edited by Beth Belton

Before it's here, it's on the Bloomberg Terminal.