Putting Ethics into Code

Christa Wessel remembers a time not that long ago when a code of conduct was a “nice to have,” usually in companies that have given some thought to what they were and wanted to capture that essence in a document. But now, thanks to a confluence of factors, having a code of conduct in place is so critical to an organization that she couldn’t see herself living without it.

“I don’t know how I could implement a detailed anti-corruption policy, as an example, without having established a clear code of conduct,” says Wessel, chief human resources and legal officer with McCain Foods Limited in Toronto. “You could write a 2,000-page policy with a detailed set of guidelines and dos and don’ts, and you could never capture all the possible events, transactions or circumstances that may arise. Referring back to the code of conduct helps provide that framework for when you need people to make judgment calls.”

Having a code of conduct has become critically important because of the significant increase in new laws and compliance-related activities both at home and abroad, as well as the organization’s need to mitigate headline risk that could cause significant reputational or financial damage if management, employees or associated third parties engage in either unethical or illegal behaviour.

“Given some of the recent changes in the law, particularly in Canada with respect to foreign anti-corruption and anti-bribery legislation, all companies that carry on business in jurisdictions outside Canada have to ensure their employees are compliant,” says Anna Fung, vice president, legal and general counsel with TimberWest Forest Corp. in Vancouver. “If there’s any negative publicity [from people not being compliant with the laws], it gets out there to a lot of people very quickly as a result of social media. So, the issue of having ethical business practices has come to the forefront of any company that has a responsible board of directors at the helm who need to be sure that its senior executives and employees are willingly adhering to an ethical culture.”

Doing the “right” thing

In many ways, having a strong code of conduct and ethical culture within an organization is the first step toward having a strong culture of compliance. But unlike a compliance-related document or policy, “a code is not meant to be prescriptive and tell you everything that you should and shouldn’t do,” Fung explains. Rather, as Wessel says, “It’s the overarching set of principles or guidelines that talk about the kind of company you are and the kinds of behaviour you expect.”

The fact that a code of conduct is usually void of strict rules makes it especially helpful in cases where the law hasn’t necessarily caught up and you may not know what the rules of the game are, according to Patricia Kosseim, senior general counsel with the Office of the Privacy Commissioner of Canada (OPC): “Ethics codes can certainly, and increasingly, help serve as guideposts and help managers, directors or decision-makers navigate through uncharted waters in order to know or determine what to do in novel situations. If anything, this has become more important in the modern context.”

Kosseim, who has been with the OPC since 2005, has seen first-hand the impact that a well-structured code of conduct can have in an organization when no laws have been set in place for a certain matter. “Long before the [OPC] became subject to the Access to Information Act in 2007, [then privacy commissioner Jennifer Stoddart] had already inculcated a culture here of openness and transparency, and always led the organization to act as though we were subject to these laws,” she says. “When we were made subject to the Act, compliance was all that much easier… and it was inspired by a desire to do the right thing.”

Walking the talk

So, what exactly should be the key elements in a code of conduct? According to Eric Miller, senior vice president and chief legal officer with Agrium Inc. in Calgary, “A good code of ethics talks about respect for employees in the workplace, safety—and puts it very high on the list, if not first—and will speak to doing more than complying with the law. It also recognizes human rights, encourages people to speak up and provides direction on how to raise concerns. When it has all those components, you start to develop that [ethical] culture. But ultimately, the document does nothing for you unless you have people who walk the talk. So, it’s important for the leadership of your company to speak of the values and how important they are to the company.”

This leadership component is critical—the board of directors and senior management need to promote by example a culture of adherence to a core set of values. People within an organization need to accept responsibilities for core concepts such as honesty, integrity and doing the right thing instead of the expedient thing, according to Fung.

It’s not just internally that the message needs to get across. “One of the key elements in today’s changing world is that some of the new anti-bribery and anti-corruption laws require compliance not just of the company and its subsidiaries, but also of suppliers and joint-venture partners you do business with. The U.K. Bribery Act is very clear about this,” says Janne Duncan, a partner with Norton Rose Fulbright LLP in Toronto who’s involved in the firm’s global business ethics and anti-corruption practice. “So, what’s very important for corporate counsel to look at is having a code of conduct that doesn’t just apply to your own subsidiaries and employees, but also to your suppliers, consultants and joint-venture partners. And another issue is how to conduct proper due diligence of these parties to ensure they don’t embarrass the company.”

Abiding (or not) by the code

After an organization sets out the expectations of management, employees and external associates, there is still the challenge of ensuring that they actually abide by the code—and that repercussions are meted out if people don’t take it seriously. That’s why enforcement is a critical component of having an effective code of conduct.

Miller also adds that at the heart of any enforcement program must be the establishment of a culture in which people are encouraged and unafraid to speak up when they see something that doesn’t sit right—whether it’s related to wrongdoing or an issue that will impact business—and that they will never be punished for it.

Where he’s seen the best results in that are in the environmental health and safety (EHS) area, which involves people watching the workplace and looking for dangerous conditions. In particular, he points to instances when he was general counsel at Calgary-based oil and gas company Nexen Inc. where “people would make serious business decisions in order to affect safety until a situation could be assessed and/or remedied. I recall one time when one of our biggest platforms was shut in during a major storm because someone saw something and brought it to the attention of the rig management. And shutting in a platform that’s producing 100,000 barrels a day until it could be repaired is not an easy thing to do.”

To do this properly, you must have a system that “involves access to a number of different people, so if people have complaints or concerns, they can go to legal, human resources (HR) or their managers. There needs to be multiple outlets to create that conversation,” Miller explains, noting that this also builds a culture of responsibility and accountability. That said, there may be situations in which employees may not feel comfortable discussing an issue with these departments, so an organization should also have a confidential hotline people can call with concerns.

“Whistleblowing is an important issue,” says Duncan. “Typically, there should be an ability for a whistleblower to report, confidentially, to the chair of the audit committee or the general counsel or the chief compliance officer, and there’s a chain of command that goes up the organization so if you do get a whistleblower, there’s someone on the ground who knows who to talk to upward within the organization so that the issue gets dealt with properly.”

Understanding legal’s role

If the matter is of a serious nature, where there could be sanctions involved, that’s when the legal department should step in. “Rarely are situations black and white, and there’s always different circumstances and perspectives resulting in the assessment of whether to enforce or not, or what action to take, and lawyers can do a great job of working through that,” says Wessel.

 Of course, there are many other vital roles corporate counsel can play throughout the entire process, and a significant one is in creating or updating the organization’s code of conduct. But rather than taking the lead, as they would during any compliance-related exercise, they should take a more supporting role. “Corporate counsel can’t be in the driver’s seat on an initiative like this,” Kosseim explains. “I don’t think it’s helpful for [them] to lead the discussion by dictating what senior managers must do to comply with black-letter law. The best role you could play as corporate counsel is to help navigate why you need to do something and help them get there.”

Involved as members of this team should be senior management, EHS and, more than ever, HR. As an example, TimberWest recently updated its code of conduct to reflect the fact that the company is no longer a public entity, and although Fung was heavily involved in the process, she did not lead it. “The minute that you have someone from legal spearheading it, as opposed to a team that is cross-functional, it tends to be seen as another legal or compliance initiative that lawyers are trying to enforce, which is never popular,” she says.

Instead, Fung involved senior HR personnel and gave them examples of good codes of conduct. The team took it away and wrote it in language that was non-legalistic and easy for everyone in the organization to understand. In addition, a training program was rolled out for employees, as well as an annual certification exercise to test their knowledge of the code. She explains, “You have to go and talk to people about it because it’s people who make compliance work, not a document.”

Going through a similar exercise at the moment is Wessel, who notes that the process of updating the code began about a year and a half ago, and it’s likely to be another year until it’s completely rolled out. Although the core of McCain Foods’ code has been consistent for a long time and will not change, what has is the need to tie those values into recent changes in the law as well as how these messages will be imparted to employees. “The feedback we received has helped in making adjustments to the code,” she says. “The code will be the code, but the training material will have different examples and adaptations for certain specific sets of employees, as the need of a regional president is different than the needs of someone who’s accepting potatoes at the back door.”

Undoubtedly, creating or updating a code of conduct takes an extraordinary amount of work. The important thing to remember, though, is that having a code of conduct that resonates with employees is not a one-time thing. Rather, a good code of conduct is “an ongoing process. You can’t just do it once and walk away from it,” says Fung. “[In fact,] the process itself is not as important as the ongoing emphasis on the need to live the spirit and the core values you have enunciated in your code of conduct.”