Codes of conduct have been an element of effective ethics and compliance programs since the first programs were created in the late 1980s. Over the years, codes have significantly improved, and today’s best practice codes are far different and much more effective than early examples.
Today, best practices for codes of conduct have been widely accepted and are common in every industry, except one - higher education.
In a recent review of higher ed codes, we found they often fall short on a number of key benchmarks. We reviewed a sample of 30 higher ed codes representing public and private institutions; we found:
- Key risk areas were missing. For example, 30% of the codes did not cover harassment, 70% did not address lobbying and political activity, and a similar percentage did not cover antitrust. Only 7% addressed social media use, and none discussed human rights.
- Common code of conduct features were also largely missing: only 20% included an opening letter from leadership, just 13% included Q&A, and 67% omitted the most basic resource for navigating a code a table of contents.
- Most were written with extensive use of legalese and had a compliance-based approach; best practice codes present a blend of values and compliance.
- Few included any design elements to help engage users.
In short, the structure, format, and design of codes of conduct for institutions of higher education have not kept pace with best practices. It’s time for colleges and universities to catch up.
Code Best Practices
While Codes vary, at a minimum best practice Codes include:
Risk-based scope – The range of topics covered by Codes should address the organization’s key compliance risk areas and keep pace with the emergence of new compliance topics.
Values and culture – No longer are Codes simply a summary of compliance requirements, best practice Codes emphasize the importance of values and culture and the critical role they play in employee behavior.
Writing style – Legalese has been minimized. While still covering complex legal and regulatory requirements, Codes are now written with diverse audiences in mind. Employees and others who rely on Codes need to be able
Why Higher Ed Needs to Catch Up
While higher ed lags behind in codes, they have made significant strides in recent years to develop other elements of effective compliance programs. Colleges and universities have created dedicated positions responsible for compliance, established compliance oversight controls, created helplines and case management systems, developed compliance training and awareness programs; and many institutions have begun to address their organizational culture to ensure that it supports values-based behavior, ethics, and compliance.
While these developments are encouraging, without a code of conduct that follows best practices, all of these program elements are less effective than they could be. And given the very public nature of a code, an out-of-date code is not only a missed opportunity, it can send the wrong message about how seriously an organization is addressing compliance.
It is difficult to identify a single reason why higher ed codes have lagged behind corporations in embracing code best practices. There is no question that, from a compliance perspective, more should be done.
First, the regulatory standards that were largely responsible for kick-starting corporate compliance programs and driving best practices apply equally to corporations and higher ed. These include the U.S. Sentencing Guidelines for Organizations, the Federal Acquisition Regulation, and the requirements of the U.S. Department of Health and Human Services’ (HHS) Office of the Inspector General (OIG).
Second, beyond these foundational guidelines, the case for best practice codes is bolstered by the sheer complexity of higher ed compliance. The compliance risks facing higher ed are at least as complex as any other industry. One major university has created a matrix listing 38 compliance topics and hundreds of statutes and regulations with which they must comply. One of the hallmarks of a best-practice code of conduct is that it helps prioritize and summarize this matrix of requirements.
Third, like any organization, higher ed faces common risk areas that fall under the broader headings of Human Resources (including diversity, discrimination, health, safety and harassment), Business Operations (including accurate books and records, use of organizational assets and conflicts of interest) Confidentiality (including data privacy and intellectual property), Interactions with the Community and Partners (including supplier relations, gifts, bribery, and political activity) and reputational risk areas involving Social Responsibility (including human rights, sustainability, and ethical sourcing).
Fourth, in addition to common risk areas, colleges and universities also face additional compliance challenges:
- Higher ed is mission driven – As such, policies and compliance-focused codes are not enough. Best practice codes go beyond simply listing compliance requirements. They explain how the requirements relate to the organization’s mission and values, and they give guidance on how to make decisions that further the organization’s mission, are grounded in its values and are consistent with law and regulations.
- Universities and colleges have a very diverse workforce – It is essential that the code communicates clearly and in a way that is accessible and understandable to all. The code’s writing style, organizational structure, and design are key to helping the user understand the content and navigate the code and other compliance resources.
- Higher ed has a significant number of employees, especially faculty, who work independent of any direct oversight - and yet they are in a position to expose the organization to significant compliance risks. This was true even before COVID-19, but the risks associated with remote employees has since increased. For these employees, a code should be their go-to resource to help ensure that they are aware of and follow the organization’s standards.
- Donor contributions and sponsored research expose the organization to risks and to complex financial controls and conflicts of interests, and they often require compliance with specific terms associated with the funding source. A code can help keep compliance top-of-mind and ensure vigilance, due process and heightened attention to compliance.
- An overseas research project, new students or visiting faculty can instantly plunge a university into compliance matters involving trade compliance, technology transfers, money laundering and even corporate espionage. Though the number of at-risk stakeholders may be small, the impact of misconduct on the organization can be significant.
And fifth, if the above weren’t enough to drive home the critical need for an up-to-date code, higher ed increasingly finds itself in the crosshairs of regulators and prosecutors. The following are just a sample of recent, high-profile compliance issues that directly impact higher education.
- Since at least 1989, the U.S. Department of Justice (DOJ) has been concerned about possible antitrust violations by elite colleges and universities. Most recently, in December, 2019, the DOJ entered into a consent decree with the National Association for College Admission Counseling over the ways colleges and universities compete in recruiting students.
- For the last two years colleges and universities have come under increased scrutiny from the U.S. Federal Bureau of Investigations and other agencies over efforts by students and scholars who take advantage of their university positions to steal confidential information and in particular the intellectual property of U.S. government-funded research.
- In May of 2020, the U.S. Department of Education released new regulations governing how colleges and universities that receive federal funding must handle allegations of sexual assault under Title IX, the law prohibiting sex discrimination at federally funded institutions.
In addition, the admissions cheating scandals have exposed potential oversight failures, campus protests have renewed the debate over limits on campus free speech, and we have yet to see the full fallout and compliance implications of the COVID-19 pandemic.
On the surface, each of these challenges represent a risk area that higher education needs to address, and adding the risk area to its code is one of many steps that need to be taken.
On these and other fronts, higher ed is under unprecedented scrutiny from the public and the enforcement community. Right now, colleges and universities can’t afford to be perceived as being lax on compliance. An out-of-date code is like waving a red flag in the DOJ’s face.
Next Steps – How to Begin Updating Your University Code of Conduct
If you are in higher ed and believe you may need to update your code of conduct, here are some steps to consider:
Step One – Assess your current code
Reviewing your current code in light of the above information is a good start, but a more formal benchmarking assessment may be needed.
- If you have conducted a compliance risk assessment recently, compare the results to your current code. Are key risk areas adequately addressed?
- Take a look at codes of conduct from other colleges and universities, especially those you consider peers, but don’t stop there: It is far more likely that you’ll find examples of code best practices among corporate codes. While there are certainly differences between corporations and academic institutions, comparing your code to best practice codes regardless of the industry is more likely to provide a sense of where you stand.
- As you assess your code, be sure to evaluate not only the scope of topics covered but also the writing style and design. Is it easy to use and understand?
- It may be wise at this stage to solicit the opinions of colleagues, faculty, staff, and even third parties. What do they think of their codes of conduct? How are they used? What changes would they like to see?
When conducting your assessment, keep in mind that a best practice code of conduct is different from a policy handbook or a faculty or staff manual. These documents may address a subset of the risk areas also covered by a code, but they are generally intended to address other important topics, such as employee benefits. Furthermore, these documents typically do not include design or interactive elements often used in codes; and they are often dominated by policy and procedural details. Best practice compliance programs typically have both a code of conduct and policy documents. The code usually includes links to the underlying policies for users who need additional information.
Step Two - Make the Case for a New Code of Conduct
One common obstacle many compliance officers face is convincing leadership that a new code of conduct should be a priority. When making the case, do not assume that leadership fully appreciates the current compliance and regulatory landscape. They might need to be brought up-to-date on the requirements of the Sentencing Guidelines or F.A.R.
To make the case, remind leadership of the importance of a code:
- A code of conduct is the foundational document for any ethics and compliance program.
- It communicates expected behaviors for faculty and staff, and points to additional resources when situations are complex, difficult, or sensitive.
- It reduces legal liability by addressing the organization’s key compliance risks. It is one of the first components of a compliance program that will be reviewed if a government inquiry is launched.
- It represents your values and commitment to ethics and compliance to external constituents, including parents and students, donors, business partners, and regulators.
When making the case to senior leadership, it’s often best to tackle budget issue head-on. While codes can be developed using in-house resources, many compliance officers are pleasantly surprised to learn that affordable code of conduct services are available that can provide editing assistance, complete drafting, and design.
Step Three – Assemble Your Team
Gather a core team that will work with you on every stage of the code development process. It’s often best to include human resources and legal representation, but it’s even more important that - whoever is selected - the core team understands what is needed and has a common goal.
Don’t rush the prep work. There’s nothing more discouraging than being two months into a code development process only to discover that a key decision-maker disagrees with the overall approach or tone. Get consensus from the start.
In addition to the core team, select subject-matter experts to be responsible for helping the core team review drafts of the code. It is essential that these SMEs also understand the vision and goals for the code of conduct, as well as the time commitment that is expected.
Once these preliminary steps have been taken, you are in a position to begin developing a new code of conduct. Learn more with these resources:
- Our Definitive Guide to Your Code of Conduct
- Code of Conduct Tune up Toolkit
- Our Code of Conduct Portfolio includes best practices
Don’t let your code of conduct be the weak link in your ethics and compliance program. It’s time for colleges and universities to update their codes of conduct. Higher ed needs to set a higher standard.
