You are the Chief Compliance Officer (CCO) of a medium-sized corporation. Sitting in your office on Friday afternoon, you receive a call from the Securities and Exchange Commission (SEC). They want to come by your offices on Monday morning to discuss potential code of conduct violations by your senior management. Further, they tell you that these code of conduct violations may be evidence of ineffective internal controls and therefore a potential FCPA violation.

So, what do you do?

Let’s explore how to survive a code of conduct violation and ways to avoid this nerve-wracking situation in the first place.

How to Survive

1. Know Your Code of Conduct  

The substance of your code of conduct should be tailored to your company’s culture, and both its industry and corporate identity. It should provide a mechanism that encourages employees to do the right thing when it comes to compliance and business ethics. The code of conduct can be used as a basis for employee review and evaluation. Your company’s disciplinary procedures must be stated in the code of conduct and should be invoked if there is a violation. Finally, your company’s code of conduct should emphasize it will comply with all applicable laws and regulations, wherever it does business.

Your code of conduct should not be written by lawyers for lawyers. It should be tailored to your organization. Most importantly – train on it and use it for all employees.

2. Show Complete Accessibility Throughout the Organization

The SEC has repeatedly noted the most effective codes are clear, concise and accessible to all employees, as well as those conducting business on the company’s behalf. This is also true for those with whom you are doing business, so third parties need to be considered when communicating your code of conduct. For those employees who do not speak English, you must translate both the code of conduct and their training into the local language.

Everyone must be able to understand the concepts set out in your code.   

3. Provide Detailed Training Records

While many companies understand the need for robust, ongoing training for their compliance program, they do not always have the same rigor around the code of conduct. It may be provided when an employee is on-boarded and then via online training once per year, or even bi-annually. But that alone is not sufficient. And if it is, you should at least have effectiveness metrics to back up your code distribution and training strategy.

Begin with live training that can be held at the corporate headquarters with senior management and executive involvement. Many companies will even videotape a message from the CEO to help celebrate the rollout of a fresh code. Here exists the opportunity for localized training that gives employees an opportunity to see, meet and speak directly with their compliance officer. This type of event turns the training into a more significant dynamic in the corporate environment. Such personal training also sends a strong message of the organization’s commitment to the code of conduct.