20questionsabout cod eof conduct

8/12/2019 20questionsabout Cod Eof Conduct

1/28

20 QuestionsDirectors Should Ask about

Codes of Conduct

Second Edition

WRITTEN BY

Michael A. Gunns, FCAMark N. Wexler, PhD

2 0 q u e s t i o n s


2/28

WRITTEN BYMichael A. Gunns, FCAMark N. Wexler, PhD

PROJECT DIRECTIONGigi DawePrincipal, Risk Management and GovernanceCICA

The CICA has granted permissionto the ICD to use these materialsin its Director Education Program.

How to use thispublication

Each 20 Questions publication is designed to bea concise, easy-to-read introduction to an issueof importance to directors. The question formatreects the oversight role of directors, whichincludes asking management and themselves tough questions.

The questions are not intended to be a precisechecklist, but rather a way to provide insight andstimulate discussion on important topics. In somecases, boards will not want to ask the questionsdirectly but they may wish to ask management toprepare briengs that address the points raisedby the questions.

The comments that accompany the questionsprovide directors with a basis for criticallyassessing the answers they get and digging deeperif necessary. The comments summarize currentthinking on the issues and the practices of leadingorganizations. They may not be the best answerfor every organization.

Thus, although the questions apply to anyorganization, the answers will vary according tothe size, complexity and sophistication of eachindividual organization.


3/28


Codes of ConductSecond Edition


4/28

Copyright 2010Canadian Institute of Chartered Accountants277 Wellington Street WestToronto, ON M5V 3H2

All rights reserved. This publication is protected by copyright and written permissionis required to reproduce, store in a retrieval system or transmit in any form or by anymeans (electronic, mechanical, photocopying, recording, or otherwise).

For information regarding permission, please contact [email protected] in CanadaDisponible en franais

December 2010

Library and Archives Canada Cataloguing in Publication

Gunns, Michael

20 questions directors should ask about codes of conduct/Michael Gunns,Mark Wexler

(20 questions series)

ISBN 978-1-55385-538-5

1. Accountants Professional ethics. 2. Executives Professional ethics.I. Wexler, Mark N., date II. Canadian Institute of Chartered Accountants. III. Title.IV. Title: Twenty questions directors should ask about codes of conduct. V. Series.

HD2745.G86 2005 1749657 C2005-900501-7


5/28

1

20 Questions Directors Should Ask about Codes of Conduct, Second Edition

Preface

To help members of boards fulll their respon-sibility for the oversight of an organizations eth-ical climate, the Risk Oversight and GovernanceBoard (ROGB) of the Canadian Institute ofChartered Accountants (CICA) has commissionedthis re-issue of its publication 20 QuestionsDirectors Should Ask about Codes of Conduct .This edition has been updated to reect changesin the business and regulatory environments.

Directors oversight role includes assuring them-selves that the organizations culture is character-ized by ethical practices and business behaviour.This brieng provides suggested questions fordirectors to ask the CEO, senior management,professional advisors and themselves. Directorsand CEOs will nd it useful in assessing theirpresent approach to formulating or revisingCodes of Conduct and to overseeing the imple-mentation of these Codes throughout organiza-tions for which they are responsible. Readingthis document may also prompt dialogue amongdirectors and between boards and executives.Thats exactly what an effective Code should do.

The ROGB thanks the authors, Michael Gunns andMark Wexler, and acknowledges the contributionof the Directors Advisory Group. They identi-ed the need for research and guidance in this

important area and have provided high levelcommentary and suggestions to the authorsthroughout the course of their work.

Giles Meikle, FCAInterim Chair, Risk Oversight and GovernanceBoard

RISK OVERSIGHT ANDGOVERNANCE BOARDGiles Meikle, FCA, Interim ChairAlexandre Guertin, CABryan Held, FCA, ICD.DAndrew J. MacDougall, LL.B.Michael B. Meagher, FCASue Payne, FCA, C.DirDebi Rosati, FCA, ICD.DCatherine Smith, ICD.DJohn E. Walker, FCBV, CA, LL.B.

DIRECTORS ADVISORY GROUPGiles Meikle, FCA, ChairHugh Bolton, FCAJohn Caldwell, CAWilliam Dimma, F.ICDGordon Hall, FSA, ICD.DCarol Hansell, LL.B.Ronald Osborne, FCATom Peddie, FCAGuylaine Saucier, CM, FCA, F.ICD

Hap Stephen, CAPeter Stephenson, PhD, ICD.D

CICA STAFFGigi Dawe

Principal, Risk Oversight and GovernanceBeth Deazeley, LL.B.

Principal, Risk Oversight and Governance


6/28


7/28

3


But we must remember that good laws, ifthey are not obeyed, do not constitute good

government. Hence there are two parts of good government; one is the actual obedienceof citizens to the laws, the other part is the

goodness of the laws which they obey...

Aristotle

Directors of public companies in Canada areobliged by regulation to ensure that certainobligations relating to Codes and business ethicsare observed in those companies. The relevantregulations are reproduced in Appendix 1 of thisdocument. Where appropriate, reference is madeto these regulations in the text of this document.However, directors of public companies will alsowant to acquaint themselves in some detail with

the content of the regulations. In addition, theincreasing reach of legislation relating to bribery,corruption and related offences make a robustCode of Conduct more important than ever.

Introduction:Why directors shouldask questions aboutCodes of Conduct

In parallel with boards involvement in strategyand risk oversight, directors are recognizingthat Codes of Conduct (Codes) can enhancean organizations reputation and contribute toits success. Like strategy and risk management,the responsibilities associated with developingand implementing an effective Code are sharedbetween the board and management manage-ment usually designing materials and processes,and the board reviewing and approving them andoverseeing the Codes effective implementation.

Accordingly, this document has been prepared intwo principal sections:

A. Code context, development and revision; and

B. Code implementation and execution.

Where an organization has an existing Code,and where directors are generally condent inits relevance and content, boards may chooseto focus primarily on the questions in section

B implementation and execution. Where a Codeis being introduced for the rst time, or where amajor revision or re-launch of an existing Code isplanned, directors may also wish to become morefamiliar with the questions in section A contextand development.

Many smaller organizations will not need tointroduce the formality of structure or processdescribed in several places in this document.The principles, however, remain the same anddirectors can use their intimate knowledge of theindividual organizations they serve in tailoringtheir enquiries and assessing responses.

A Code is always a work in progress its betterto make a start with an unsophisticated Code,developed or revised according to sound principles,than to lose the benets of having one or, worse,to promote a Code that is irrelevant or unrealistic.


8/28

4

Section A Code Context,Developmentand Revision

When an organization is adopting a Code ofConduct for the rst time or when a revised Codeis being introduced, the board of directors has animportant role to play. While the initial respon-sibility for designing and articulating the Coderests with management, the board is responsiblefor reviewing the Code to ensure that it is suitablein its tone and content, that it meshes well withthe culture and objectives of the organization,and that it is capable of being implemented.

Some boards of directors may delegate thedetailed review of the Code to one of the boardcommittees (generally the governance commit-tee, although some elements of the Code maybe of particular interest to the audit committee),while in other organizations this may be under-taken by the full board. Regardless of how theboard organizes itself, the nal approval of theCode must come from the full board. The boardshould expect to receive information as the Codeis developed, including drafts of proposed newor reissued Codes, along with information on howthey were developed and plans for distributionand training. This culminates in the nal Codebeing submitted to the board for its approval.

This section contains questions which boards ofdirectors should consider when reviewing a newor substantially revised Code. The initial ques-tions are more general and will assist directors inunderstanding the importance of Codes and therole they play. More specic questions follow, tohelp directors assess the particular Code whichmanagement has presented to them.

1. What are the objectives of a Codeof Conduct?

A Code of Conduct is a key vehicle for:

reducing the risk and associated costs of fraud,conicts of interest and other ethical lapses;

helping introduce new employees to theorganizations standards;

attracting and retaining high-calibre employ-ees and business partners;

setting the boundaries of acceptablebehaviour;

providing employees and others subjectto the Code with comfort that they will notinadvertently stray offside;

informing contractors, suppliers and othersdoing business with the organization of itsexpectations regarding acceptable behaviour;

providing the basis for sanctions againstthose that deviate from the Code; and

fullling the regulatory obligations of publiccompanies (Appendix 1).

Organizations which walk the talk with regardto their Code develop a reputation for honesty,integrity and principled business behaviour.This can be a key element of a companys brandand can enhance its reputation. An effectiveCode also reinforces an organizations cultureby emphasizing each individuals responsibilityto observe its principles and requirements.Ultimately, it is this culture of shared responsibil-ity that affords the greatest protection againstthe risks of unethical behaviour.

On the other hand, merely issuing a Codedoes not assure an organization that it will beobserved. Organizations that issue Codes simplyto fulll legal requirements or in response tostakeholder concerns, yet do little or nothing toembed the principles, invariably sow the seeds ofcynicism.


9/28

5


2. What is the Codes relationship to theorganizations mission, vision, valuesand culture?

Codes of Conduct are an integral part of organ-izational culture. In most organizations, Codes areintroduced or revised within an existing context ofexplicit directional and behavioural expectations.

Whereas statements of mission, vision and valuesmay be expected to inspire employees and otherstakeholders in achieving organizational object-ives, a Code has a different purpose. A Code setsboundaries of acceptable behavior. Positioned cor-rectly, an appropriate Code completes the pictureof an organizations aspirations and expectations.

An organizations ethical climate is signicantlyinuenced by its leadership. A term often used forthis inuence is tone at the top. This climate cre-ates the overall context in which all of the organiza-

tions directional statements (including the Code)are interpreted. Some factors that can inuence theethical climate of an organization include:

the nature and inuence of its shareholders;

the regulatory environment (which mayrequire specic standards);

the country or countries in which it operates;

its ethical history good or bad;

its short and long-term rewards structures;

the behaviour of its contemporaries andcompetitors; and

the perceived consequences of ethical break-downs in terms of nancial and reputational loss.

An organizations ethical climate also inuencesmany key dynamics surrounding a Code and itseffectiveness. If people feel free to raise issues,the likelihood of problems being hidden until theydevelop into major crises is signicantly reduced.This right to dissent may vary according to thecircumstances and the nature of the organiza-tions business.

3. Who are the champions of the Code?

The role of the board of directors

Directors themselves should be subject to theCode and their obligations go further. The boardhas a key leadership and governance role inensuring that the Code is appropriate to theorganization and in overseeing its consistentapplication. This commitment is reinforced whendirectors individually sign off on the Code.

A board should study any new Code or revisionbefore approving it to ensure that it is suitable andcapable of being implemented. The board canalso act as an invaluable resource and guide tothe CEO. The varied perspectives and experiencesof individual board members can generate wise

counsel to the CEO as to the suitability of theCode to the organization and the potential risks inintroducing or monitoring compliance with it.

Finally, directors are also responsible for ensur-ing that their own actions and those of the CEO(whether or not a member of the board) areconsistent with the Code. As such, the boardsets the tone at the top of the organization, fromwhich all other behaviour follows.

Directors often underestimate the signicantindividual and collective inuence they can andshould have over the organization by signalingto the CEO and the rest of the organizationwhat is expected and acceptable behaviour.

The role of the CEO and executive team

Establishing, disseminating and supporting aCode are leadership activities. Typically, the CEOwill appoint others (such as a respected executiveor chief ethics ofcer) to create and maintain theCode and to monitor its application. The organiza-tional relationship of this individual or individualsto the CEO, their personal credibility and the

support and resources they are afforded can beseen as indicators of the CEOs personal commit-ment to the Code. One way or another, the CEOmust be the ultimate champion of the Code, if it isto be taken seriously.

If ethics are poor at the top, that behaviouris copied down through the organization.

Robert Noyce Mayor of Silicon Valley

CODE

MISSION

VISION VALUES


10/28

6

The senior executive team also has a responsibilityto ensure that the Code is embraced and fol-lowed by the rest of the organization. This teamrepresents the rst potential for a schism withinthe organization between espoused practices (theCode) and actual behaviour. An apparent lack ofinterest or cynicism on the part of the CEOs directreports will immediately send a message to therest of the organization that the Code is not to betaken seriously.

4. Who develops, administers and maintainsthe Code?

Although the CEO and the board of directorschampion the Code, its development, periodicrevision, administration and maintenance is usu-

ally delegated to another individual.

In large organizations, the individual assignedthese responsibilities may be termed a chiefethics ofcer or the role may be assigned to anexisting chief compliance ofcer. In somewhatsmaller organizations, the responsibility may beassumed by the head of the Law Department,the Human Resources department, or by theCorporate Secretary. As noted above, it isextremely important that those assigned todevelop, revise and administer the Code beviewed as credible and impartial.

In all organizations, the CEO is the ultimatechief ethics ofcer.

Organizations may also engage an externalconsultant on an as-needed basis to draft andrevise Codes. External advisors can contributevaluable advice and perspective to organizationsseeking to ensure that their Code represents bestpractice.

5. What is the process for developing theCode?

Stakeholder participation

Although the initiative for a new or revised Codeusually emanates from the top of the organization,the timing and manner of inclusion of the repre-sentative views of other constituencies is a keyfactor in the Code being widely adopted andfollowed.

There can be no true agreement without theopportunity for discussion and negotiation.

Giles Meikle Corporate Director

Principal stakeholders

Those having a strong ties to or in-depth involve-ment with an organization typically include theboard of directors, employees, major suppliersand contractors. One best practice is to establishrepresentative teams from each group subjectto the Code and engage them in a participatoryprocess of discussing alignment of businesspractices and behaviours. In the case of directorsand employees, the organization will likely seekinput on both content and wording.

Other stakeholders

Other stakeholder groups such as environmental-ists, union representatives, regulators, or otherspecial interest groups will legitimately have aninterest in the content and application of theCode. Increasingly, institutional investors andother shareholder groups are also sensitive to theethical practices of investee companies. Seekinginput from these groups is not obligatory, how-ever including them in the development processcan help to build stronger relationships and trustwith them.

Expert input

It is essential that those developing or revising

the Code consult frequently with the organiza-tions legal expert, whether an internal lawyeror outside counsel. Other technical specialistsin areas covered by the Code (e.g., investmenttraders, environmental specialists, etc.) shouldalso be consulted.


11/28

7


Supplementary Codes

At times material is relevant only to a particularpart, or parts, of an organization. Examples wouldinclude detailed insider trading requirements forinvestment personnel, or supplier relationships forpurchasing departments, etc. In these and similarcases, it is appropriate to have supplementaryCodes. Those who are specically affected bythese supplementary Codes will likely have asignicant role in developing them.

Where a company operates an employer-spon-sored pension plan, the plan will typically have itsown Code. This is to recognize that providing andadministering pensions is usually a fundamentallydifferent activity than that of the companys corebusiness, and operates in a different regulatory

and stakeholder environment. As far as possible,however, the tone and substance of the twoCodes should remain similar.

6. What is the process for the periodicreview and revision of the Code?

A Code is always a work in progress. Regularreview of the Code will help demonstrate thecontinuing commitment of the organizationsleadership.

Key factors inuencing the need to revise a Codeinclude:

changes in the organizations business , or theenvironment or locations in which it operates;

changes in relevant laws and regulations;

input from shareholder or other stakeholdergroups;

public opinion regarding acceptable businessbehaviour;

experience gained from monitoring infrac-tions, or difculties in applying the Code; and

input received from those subject to the Code(including the organizations leadership)

regarding missing elements, unclear languageor other weaknesses in the Code.

Language, examples and specics will change asthe business and regulatory environment chan-ges. However, even with todays rapidly changingbusiness environment, if appropriate effort is putinto initially developing the Code, its fundamen-tals will change little over time.

Organizations may consider:

reviewing the contents and applicability ofthe Code at least annually;

reporting annually to the CEO and the boardthat the Code remains generally appropriate,and describing areas where revisions arecontemplated; and

having the organizations leadership fullyrevise reissue and formally re-endorse theCode every three to ve years. This is also asuitable time frame for an organization-widere-education in the Code, even if the contentis not signicantly changed.

The method for a comprehensive review, revisionand reissue of the Code would correspond to thatused for developing the Code. Interim changesor supplements to the Code would follow a lesscomprehensive process, particularly if they affectonly one part of an organization or a relativelynarrow aspect of its activities (e.g., new privacyregulations).

7. Is the Code at the right level for theorganization?

When reviewing a new or revised Code ofConduct, the board should consider whether itis at the appropriate level for the organization.Three important elements that directors should

consider are: how high the standards of the Code should

be in relation to those established by theexisting law;

how the Code will deal with areas requiringindividual discretion; and

the timeframe for enhancing the organiza-tions culture.

Appropriate but realistic standards

Organizations are required to follow the law. ACode only adds value if it establishes organiza-tional standards where the law is silent, or setsstandards above those legally required. A Codethat merely repeats or summarizes existing legalrequirements is likely to be seen as a token effort.

Setting high standards in the Code providesthe maximum potential for organizations toenhance their reputation and build a high espritde corps . Many feel that as a standard for Codesof Conduct, the requirements of the law are often


12/28

8

too little and frequently too late. However, Codesthat establish unrealistically high standards ofbehaviour can result in the organization beingoffside from the outset. Unrealistically highstandards could also reduce competitiveness andproductivity.

Codes which cannot be complied with alsoexpose the organization to vulnerability in termsof unwanted disclosure for public companies (seeAppendix 1). If non-compliance is accepted or notaddressed in some areas, the Code as a wholemay lose credibility and management will nd itharder to enforce compliance in other areas.

Establishing a Code of Conduct in an organ-ization offers signicant potential benets.

It also exposes the organization to risks.

Exercise of Individual Discretion

Some organizational activities are closelysupervised and easily monitored. In other areas,expected behaviour is not self-evident and iscapable of a wide range of reasonable interpreta-tion. Where individual discretion is inherent inthe conduct of the organizations business, itwill be necessary to decide how this should beconsidered and reected in its Code.

Principles-based Codes allow for the use ofindividual discretion and articulate the principleswhich should guide the use of that discretion.Such Codes can support peak performancethrough appropriate empowerment, encourageorganizational learning through discussion andassessment of alternatives, and can reinforcepersonal and organizational accountability.However, if principles are vague or their applica-tion is unclear, such Codes can also encourageambiguity which limits their effectiveness.

A more rules-based Code which limits individualdiscretion may be easier to monitor and enforce,

but it may also be seen as unduly detailed andrestrictive more an operational policy than aCode. In addition, a focus on following strict rulesrather than internalizing and applying principlesmay be less effective in creating an ethical culturethroughout the organization.

Time Frame

Finally, the time frame over which the Code isexpected to inuence the organizations cultureshould be considered. Successfully introducingand embedding a Code within an organization isitself an important change initiative. Most suc-cessful change initiatives take time and many arebest approached as continuing processes, ratherthan quick xes. On occasion, however, there is aneed to make major changes in behaviour quicklyto avoid exposure to legal or reputational risks.

The use of a longer time horizon demonstratesrecognition that cultural change and buildingshared commitments are long-term processes.This can provide a better t with the timehorizons of companion mission, vision and

values. However, a long time horizon can prolongorganizational vulnerability if there are signicantgaps between Code expectations and presentperformance. It may also encourage indenitepostponement of tough issues.

While a shorter time horizon can contribute toa quick revitalization of an organization, andmay be necessary if there are signicant gapsbetween actual and required performance, careshould be taken as unrealistic expectations canundermine peoples commitment to the Code andlead to widespread cynicism.

8. Is the content and tone of the Codeappropriate for the organization?

When reviewing a Code, the board should con-sider whether it is appropriately balanced in itstone. There are three types of content in a Code:

aspirational content;

descriptive content; and

proscriptive content.

The aspirational content of a Code is idealisticand can be related most clearly to the organiza-tions mission, vision, values and long-term goals.

The descriptive content of a Code outlines thespecic behaviour sought by the organizationin areas such as conicts of interest, the accept-ability of gifts from customers and suppliers, andother similar areas where the organization seeksto establish its particular position. The descriptivecontent is largely silent with regard to sanctionsfor specic Code violations.


13/28

9


The proscriptive content of a Code sets outwhat the organization prohibits. This thou shallnot material increases the clarity of the Codeand lends itself to forbidding behaviours that,although legally permissible, are unacceptable tothe organization. If this content is dominant withina Code, it may impede proper risk-taking and limitinnovation.

The overriding objective is to create a Code thatappropriately balances aspirational, descriptiveand proscriptive content. This will be differentfor each organization and will be affected by theorganizational culture. Most organizations willbe best served by a Code that is largely descrip-tive in nature and includes only the proscriptivecontent that is essential to its particular circum-stances. The board should review the Code to

determine whether the appropriate balance hasbeen found and whether the Code is consistentwith the culture of the organization.

Simple language

Each organization, industry, and region tends tohave its own particular style of communicating.In reviewing the Code, directors should considerwhether the language is appropriate to theorganization and is sufciently clear and specicto allow those subject to the Code to understandwhat conduct is expected of them.

To increase the probability of satisfying variedreaders, the Code should:

state general principles or policies as brieyas possible, followed by more explanatorytext;

use practical examples;

use pictures and graphics to emphasize keypoints; and

make reference to appendices or additionalsources in technical areas (e.g., detailedinsider trading policies).

9. How has the organization determined itsactual ethical risks?

There is an important link between an organiza-tions Code of Conduct and its identication,assessment and management of risk. Althoughmany of the topics that will typically be coveredin a Code are common across organizations,the practical exposure to ethical risk may varyconsiderably. Exposure to specic ethical risksmay also vary widely across the different partsof an individual organization. Certain types ofethical risks (e.g., insider trading, corruption offoreign ofcials, etc.) will warrant enhanced focusin some companies or parts of companies. A listof topics which may be addressed in Codes ofConduct can be found in Appendix 2.

When reviewing a new or revised Code, boardsshould receive information on managementsassessment of the organizations ethical riskexposure. Directors should consider whether theyare comfortable with the assessment, and, if so,ensure that the Code is reective of it.

A key input to the assessment will be the organ-izations awareness of previous breakdowns inethical behaviour. Wider industry history or theexperience of others with similar exposures mayalso prove to be invaluable in assessing risks.

As organizations adopt formal risk managementprocesses, it is important to integrate the resultsof an ethics audit into the overall risk assessmentprocess. Sometimes, it might seem that ethicallapses would typically have less impact than, say,overlooked strategic risks. However, there arenumerous examples of high-prole corporatefailures which demonstrate the very real conse-quences and costs of poor ethical behaviour.

We can afford to lose money, even a lot ofmoney. We cannot afford to lose our reputa-tion, not even a shred of it.

Warren Buffett


14/28

10

10. How does the Code apply to foreignoperations?

Operations in countries other than an organiza-tions home base can present many complica-tions, not the least being the application of theorganizations Code in other jurisdictions andcultures. Foreign operations may present chal-lenges in terms of:

additional or different exposures to ethicalrisk, and

difculties in implementation and monitoringcompliance.

Directors of organizations with foreign operationsshould ensure that the assessment of ethical risksis undertaken as part of strategy development

for those operations both before entering theenvironment and regularly thereafter. These risksnot only include exposures to loss or censureabroad but also the impact in the organizationshome country of real or perceived ethical short-comings in overseas operations.

Simply following a policy of When in Rome, do asthe Romans do is unlikely to serve an organizationwell when it comes to ethics. Many organizationshave paid dearly in terms of damaged reputations

as a result of media attention to local child labourpractices, weak environmental controls and thelike in overseas operations. The arguments thatits necessary to meet the local competition orits expected locally may be technically correctbut are unlikely to convince todays public.

Plausible deniability is also unlikely to save aCEO or a board of directors if weaknesses or poorpractices are highlighted, particularly if an organ-ization is blamed for observing lower standardsaway from home.

When reviewing a new or revised Code ofConduct, directors should ensure that the Codetakes into account the particular risks related toforeign operations and that managements planfor implementation and monitoring of compliance

addresses the challenges involved.Where organizations operate in different coun-tries, it is vital to make sure that not only are thetranslations of the Code into different languagesaccurate but that they convey the intent and not

just the actual written word. Dif ferent culturesplace differing weights and interpretations onmoral and ethical principles. It is essential toensure that the Codes readership receives andunderstands the intended message.


15/28

11


Section B Code Implementationand ExecutionThe boards responsibilities regarding the Codeof Conduct dont end with the approval andadoption of a Code. Even the most well-thoughtout and drafted Code will have little impact on anorganization if it is not ef fectively implemented.

Once a Code of Conduct is in place, bothmanagement and the board should turn theirattention to its implementation and execution.This includes educating employees and othersaffected by the Code, monitoring compliance andaddressing both criticisms and violations of theCode.

While management is responsible for the day today implementation of the Code, the board mustoversee this implementation as part of its respon-sibility for the overall culture of the organization.It is up to the individual board to determine how itwill organize itself to discharge this responsibility.

11. What information should the boardreceive?

The board of directors has an ongoing respon-sibility to assess whether a Code is:

relevant;

properly developed, championed, adminis-tered and maintained;

supported by suitable education;

accompanied by appropriate processes toassure compliance; and

accompanied by adequate channels foremployees and others to express grievancesor concerns.

Exactly how the board discharges its role andoversight duties in these areas will vary fromorganization to organization.

The board will likely receive reports on the Codeon an annual basis. These may include:

Code review, addressing continued applicabil-ity, any addenda or supplements issued, andthe date of the next scheduled Code revision;

brieng on responsibilities for maintainingand administering the Code;

results of ongoing compliance and monitoring

activities; report on annual sign-offs and the handling of

exceptions; and

reports from any ethics hotline provider.

As well, there are other issues about which theboard should expect to be informed as theyoccur, such as:

notication of signicant criticism of thecompanys ethics;

signicant Code violations and relatedsanctions;

Code waivers granted, or being considered;and

results of any audits and their relationship tothe organizations overall risk managementactivities.

Although oversight of the Code and the com-panys compliance with it is ultimately the respon-sibility of the whole board of directors, certainitems may be brought rst to the attention of oneof the boards committees, such as the audit orgovernance committee and reported on by thatcommittee to the whole board.

12. How is the Code communicated and howare people educated in it?

When overseeing the implementation of theCode, one of the issues upon which directorsmust satisfy themselves is that it is effectivelycommunicated by management, and that thoseaffected by it are educated about the Code.

Communication

In todays media-rich world, organizations havethe opportunity to disseminate information in

many different ways. The board should satisfyitself that the means of communication manage-ment uses are appropriate to make the informa-tion accessible to those affected.

The board should also seek assurances thatpublicly disclosed information regarding theorganizations Code (on the website, in regula-tory lings, etc.) is consistent with that which isdisseminated internally.


16/28

12

Education

Without appropriate educational programs,the Code will not signicantly inuence organ-izational behaviour. Although managementwill determine the exact methods to educateemployees (and others subject to the Code) inits principles and requirements, directors shouldassure themselves that educational support isrobust and appropriate.

Leading organizations use many approaches, andoften a combination of them. These include:

presentations by the organizations lead-ers and their availability for questions anddialogue;

discussions between supervisors and their

employees; videos and web-based educational materials;

and

briengs for suppliers and contractors.

To truly add value, ethics codes must extendbeyond a compliance focus and strive tocultivate and maintain a collective spirit andculture throughout the organization thatfocuses on promoting positive moral behav-iour while simultaneously striving to preventethical lapses.

K. M. Gilley and others The bottom-line

benets of ethics code commitment .Business Horizons, 2010

Although some of these communication vehicleswill be necessarily one way, interactive sessionsare what really bring a Code to life. Participatingin discussions gives those subject to the Codethe opportunity to raise and discuss its practicalapplication. It also (if an appropriate system isestablished) provides invaluable input to thoseresponsible for Code revisions.

Education also has an important role with regardto new employees or other business partners.Many organizations provide orientation sessionsfor new hires and this is an appropriate vehiclefor initial education in the organizations Code.Leading organizations, however, will cover thisorientation before an offer is extended to aprospective employee, supplier or contractor.This provides far greater assurance that both theorganization and those it engages are willinglycommitted to its Code from the outset.

13. How is criticism of the Code handled?

Regardless of the effort devoted to design anddevelopment, any Code will have its critics. Somewill see the Code as unnecessary (believingappropriate behaviour is self-evident), othersmay feel the Code goes too far or fails to becompletely precise.

Some criticism is to be expected. How the organiza-tion handles that criticism, however, demonstratesits true commitment to its principles and beliefs.

Statements in Codes of ethics are most likelyto have an impact when they address new

situations or when they take positions withwhich one mildly disagrees.

Bruce Gamatz and John Lere Certied Planning Journal, 2003

Acknowledging and listening respectfully to criticalfeedback regarding the Code is of paramountimportance. Undertaking to consider these opinionsin subsequent revisions of the Code is also appro-priate. However, bending to the expectations ofvigorous critics, at the expense of the organizationswell-thought out and purposefully developed prin-ciples, will quickly weaken everyones commitmentto the Code and can lead to widespread cynicism.

The board should be satised that managementhas established an explicit process for handling

criticism of the Code. The board may receive asummary of this information on an annual basis. Aswell, there may be some types of criticism which,due to its nature or the credibility of the critic(e.g. a regulator), the board will wish to be madeaware of immediately. Directors should ensure thatmanagement has a clear understanding of whattypes of criticism should be brought to the board.

14. How is compliance with the Codemeasured and monitored?

As part of the boards responsibility for oversee-

ing the implementation of the Code, directorsshould receive information from managementthat satises them that compliance is beingappropriately measured and monitored.

Actively monitoring the Code can enhance theculture of the organization by encouragingcompliance as well as by reassuring those whoare following the Code that their actions will besupported.


17/28

13


A further reason for monitoring compliance isto develop an ongoing understanding of wherebreakdowns in expected behaviour may beoccurring in order to discern patterns of weak-ness either in organizational culture or Codedesign. This information can serve as input tothe established revision process, or, in the caseof signicant breakdowns, may lead to timelysupplements to the Code or the introduction ofmeasures to mitigate risks associated with non-adherence. Where monitoring reveals signicantor pervasive weaknesses, this information canalso inuence the organizations overall riskmanagement process.

In measuring and monitoring compliance, thereis an important distinction to be drawn betweeninvestigating infractions and seeking assurance

that the systems and processes surrounding theCode are effective.

Both of these types of review have their place.Almost all organizations realize the need toinvestigate infractions. Fewer organizations dedi-cate themselves to systemic learning from theseinvestigations (rather than merely dealing withtransgressors and plugging gaps). Boards shouldconsider adopting a formal and comprehensiveprogram of ongoing systemic review involving avariety of methods.

15. What measures does management taketo reafrm commitment to the Code?

The board should expect to receive informationfrom management on steps taken to reafrmcommitment to the Code as part of the process ofimplementation and monitoring. Many organiza-tions ask those subject to the Code to conrm inwriting that they:

received a copy of the Code,

understand its contents, and

commit to applying it.

Additionally, many organizations ask direc-tors and employees (and others subject tothe Code) to complete such a sign-off annu-ally reconrming their continuing commitmentand explicitly stating that they have followedthe requirements of the Code throughout theprevious year. Sign-off forms should make provi-sion for disclosure of incidences of known orsuspected non-compliance.

Legal requirements or the detailed proscriptiveelements of a Code may require more detailedand specic sign-offs from those in seniorpositions or holding specic roles. Such detailedsign-offs should be tailored to the circumstances,as should sign-offs from contractors, suppliers orother parties subject to the Code.

Asking people to regularly sign off on a Codecan keep the Code front of mind. It may alsoencourage individuals to come forward withreal or perceived difculties arising from past oranticipated actions or circumstances.

16. What procedures are in place regardingadvice, issue resolution, or waivers of theCodes application?

A Code of Conduct is not law at its best itrepresents a common agreement on behav-iour between people working together.

If someone has a problem with the Code, itsbetter to hear about it and try to resolve it,than to ignore or suppress it.

Despite using best efforts to develop a clearCode, circumstances will invariably arise whichwere not contemplated by the Code, or in whichthe application of the Code is unclear. Directorsshould ensure that management has put in placemechanisms to allow individuals to seek adviceand/or issue resolution.

An individual seeking guidance about the applica-tion of the Code would normally raise such issueswith his or her immediate supervisor. Where thisdoes not lead to satisfactory resolution, the issuemay proceed higher up the reporting line.

The Code should offer explicit guidance to be fol-lowed in circumstances in which employees maybe reluctant to raise concerns with their immedi-ate supervisor. Typically the channels for such

enquiries will include the chief ethics ofcer, thechief compliance ofcer or the head of the Law,Human Resources or Internal Audit functions.

Although it is usually most appropriate to seekadvice on interpretation or application of the Codewithin the company, there may be circumstancesin which an employee wishes to maintain anonym-ity. In such cases, the employee may wish to makeuse of any ethics hotline that the company mayhave established with an outside provider.


18/28

14

External stakeholders such as customers, sup-pliers and investors should also have an explicitpoint person within the organization to contactwith questions regarding the organizations Code.This may be the chief ethics or compliance ofcer,if the organization has appointed one. Otherwise,questions might be directed to the PublicRelations department or the Corporate Secretary.

On occasions where employees or others subject tothe Code seek to have its provisions waived thereshould be an explicit process for people to seek suchwaivers. To discourage people from seeking relieffrom what they perceive as inequitable treatmentfrom the strict application of the Code ultimatelyacts as an incentive to cover up. However, suchrequests require deliberation at senior executivelevels and, usually, at the board level. All waivers

granted, regardless of signicance, should bereported to the board of directors.

17. How does the Code relate to the rewardssystem and how are violations handled?

Perhaps the most difcult aspect of implementinga Code is linking it to rewards and sanctions.Some organizations specically claim that soundethical behaviour is a component of their rewardsstructure but, understandably, there is littlepublicly-available evidence in this regard.

In most organizations, however, there are oppor-tunities to identify instances where difcult choiceswere made that respected the intent of the Code.Directors may wish to seek assurances frommanagement that such choices are appropriatelyrecognized and that the organizations operationalpolicies facilitate such recognition. For example,employees who come forward with informationregarding errors rather than attempting to coverthem up should receive appropriate recognitionfor making the right decision.

The question of sanctions is more straightforward.That is not to say that the necessary actions will beeasy or comfortable to take. However, an organiza-

tion committed to its Code has no choice but totake seriously all alleged transgressions. To dootherwise is the fastest and most certain course toundermining all the efforts put into developing andimplementing the Code.

There should be clear procedures in place toinvestigate alleged Code violations in order tomake a determination as to the veracity of theallegation and the appropriate sanctions, shoulda breach of the Code be determined to have

occurred. These procedures should be impartialand should take into consideration the privacy ofthe parties involved.

Often, the exact circumstances surrounding theneed for and nature of disciplinary measurescannot be made public. It is essential, however,that the organization is seen as having followed afair and established process in examining all sidesof a matter before imposing sanctions.

While the board of directors will not need to beadvised immediately regarding every breach ofthe organizations Code, breaches committed bymembers of the management team, or otherswith the potential to seriously affect the com-panys reputation should be brought immediatelyto the attention of the board.

FOR MORE INFORMATION, SEE THECICA PUBLICATION 20 QUESTIONSDIRECTORS SHOULD ASK ABOUTRESPONDING TO ALLEGATIONSOF CORPORATE WRONGDOING .

18. How does the Code deal with whistleblowing?

The board of directors should also expect to

receive information from management regardingwhistle blowing. Effective Codes accomplish twogoals with regards to whistle blowing:

Firstly, they help to create an organizationalculture in which whistleblowers nd it easierto raise actual or perceived wrongdoingwithin the organization, rather than turning tothe media or other outsiders.

Secondly, effective Codes provide explicitprotection to the whistleblower from retalia-tion by those adversely impacted by thewhistleblowers actions.

In most instances, whistleblowers go to outsidersbecause they feel that:

their views have not been, or will not be,taken seriously;

their concerns relate to someone to whomthey report, or who has other signicantinuence over them; or

the actual or perceived wrongdoing is harm-ful to others or to the public.


19/28

15


19. What additional steps can directors taketo satisfy themselves of the effectiveimplementation of the Code?

In addition to reviewing written documents and ask-ing intelligent questions, directors should considertaking some additional, practical steps to help ascer-tain whether the principles of the Code are actuallybeing practiced throughout the organization.

Youre on ethical thin ice when you hear thesewarning signs

Well, maybe just this once No one will ever know It doesnt matter how it gets done, as long

as it gets done

It sounds too good to be true Everyone does it Whats in it for me? We didnt have this conversation.

Mark Wexler Confronting Moral Worlds

Directors should use their instincts and experi-ence to assess the behaviour of the CEO andother members of the senior management teamand should be prepared to discuss it openlyamongst themselves and, if necessary, directlywith the CEO. If this feels too uncomfortable,

either within the board or with the CEO, its prob-ably an indication that something is wrong.

Directors should also take advantage of opportun-ities to observe what is actually happening in theorganization and to listen to what others say about it.

Many directors nd that eld visits, when theychat informally with management and front lineemployees, are invaluable not only to understand-ing the business but to assessing the organizationsethical climate. They factor this assessment into theircondence in everything from the organizationssustainability to the probable accuracy of its resultsand reporting. Again, if directors feel uncomfortableraising the subject of eld visits, or feel that theresno opportunity, its probably a cause for concern.

At their root, Codes are concerned with behaviour both organizational and individual. Directorsyears of experience inform their instincts andobservations. However, directors may be reluc-tant to act on their instincts or voice concerns.It is important that they feel free to do so, asdiscussing concerns openly is a key part of theircontribution to the tone at the top.

Effective Codes provide people who choose toblow the whistle with several options to speakcandidly and condentially about their concerns inorder to improve the likelihood that individuals willrst seek to resolve issues and concerns internally.

Wise organizations go out of their way toprovide several internal avenues for raisingconcerns. They also provide an external whistleblowing hotline and encourage employees touse it when all other avenues have failed. Thefairness and respect with which an organizationtreats whistleblowers is an acid test of its com-mitment to openness and transparency.

Increasingly, organizations are making useof specialist external hotline providers whooperate under strict condentiality and ethical

guidelines. The Audit Committee of a Canadianpublic company is obliged by regulation (seeAppendix 1) to establish procedures to safe-guard complaints received regarding account-ing, internal accounting controls, or auditingmatters. That committee must also providean avenue for the condential, anonymoussubmission by employees of concerns regardingquestionable accounting or auditing matters. Inpractical terms, in the absence of robust internalmechanisms, this may necessitate the use of anexternal hotline provider.

One of the most difcult situations that an organ-ization has to face is how to deal with anonymouscomplaints concerning ethical behaviour. Whetherfrom employees or other sources, they cannot beignored. Each instance must be weighed on itsown merits, while carefully protecting the rights aswell as the privacy of all those involved.

FOR MORE INFORMATION, SEE THECICA PUBLICATION 20 QUESTIONSDIRECTORS SHOULD ASK ABOUTRESPONDING TO ALLEGATIONSOF CORPORATE WRONGDOING .


20/28

16

20. How does an organizations Codecontribute to its long-term sustainability?

Over time, organizations all organizations aretested. They are tested by whistle-blowingincidents, product recalls, indiscretions by lead-ers, accidents that injure innocent third partiesand the like. Codes cannot prevent all such eventsfrom occurring.

Codes are a means of creating resilience inorganizations. They are always a work in progress.It is only through ongoing dialogue among allthe organizations stakeholders that the sharedcommitment of superior organizational behaviouris maintained.

By building a culture of integrity, an organization

may protect itself from some of the damage thatcan result from deliberate wrongdoing. By build-ing and maintaining a culture of openness andmutual respect, an organization can protect itselffrom being blindsided being the last to know.

Ethics is an area where practice makes perspective.

John Dalla CostaFrom: The Ethical Imperative Why MoralLeadership is Good Business

The board of directors possesses one of thegreatest funds of knowledge, experience andwisdom available to the organization it serves.Through its own contribution and by the exampleit sets to the CEO and the rest of the organization,the board can encourage a culture of openness,healthy introspection and the pursuit of organiza-tional excellence.


21/28

17


Appendix 1:Regulations relating to Codes of Conduct forCanadian public companiesThe Canadian Securities Administrators are responsible for the securities regulations of all Canadianprovinces and territories. CSA members work closely in the development of new policy initiatives andthe continuous improvement of the regulatory framework for securities. Investigation and enforcementare also core CSA activities.

There are three pieces of regulation that address the need for Codes of Conduct and sound ethical practi-ces of Canadian public companies. The relevant excerpts from these regulations are reproduced hereunder.

NATIONAL POLICY 58-201

CORPORATE GOVERNANCE GUIDELINES

Effective June 30, 2005

Board Mandate

3.4 The board should adopt a written mandate in which it explicitly acknowledges responsibility for thestewardship of the issuer, including responsibility for:

(a) to the extent feasible, satisfying itself as to the integrity of the chief executive ofcer (the CEO)and other executive ofcers and that the CEO and other executive ofcers create a culture ofintegrity throughout the organization;

Code of Business Conduct and Ethics

3.8 The board should adopt a writ ten code of business conduct and ethics (a code). The code shouldbe applicable to directors, ofcers and employees of the issuer. The code should constitute writtenstandards that are reasonably designed to promote integrity and to deter wrongdoing. In particular,it should address the following issues:

(a) conicts of interest, including transactions and agreements in respect of which a director orexecutive ofcer has a material interest;

(b) protection and proper use of corporate assets and opportunities;

(c) condential ity of corporate information;

(d) fair dealing with the issuers security holders, customers, suppliers, competitors andemployees;

(e) compliance with laws, rules and regulations; and

(f) reporting of any illegal or unethical behaviour.

3.9 The board should be responsible for monitoring compliance with the code. Any waivers from thecode that are granted for the benet of the issuers directors or executive ofcers should be grantedby the board (or a board committee) only.

Although issuers must exercise their own judgement in making materiality determinations, theCanadian securities regulatory authorities consider that conduct by a director or executive ofcerwhich constitutes a material departure from the code will likely constitute a material change withinthe meaning of National Instrument 51-102 Continuous Disclosure Obligations . National Instrument


22/28


23/28

19


FORM 58-101F1

CORPORATE GOVERNANCE DISCLOSURE

5. Ethical Business Conduct

(a) Disclose whether or not the board has adopted a written code for the directors, ofcers andemployees. If the board has adopted a written code:

(i) disclose how a person or company may obtain a copy of the code;

(ii) describe how the board monitors compliance with its code, or if the board does not mon-itor compliance, explain whether and how the board satises itself regarding compliancewith its code; and

(iii) provide a cross-reference to any material change report led since the beginning of theissuers most recently completed nancial year that pertains to any conduct of a directoror executive ofcer that constitutes a departure from the code.

(b) Describe any steps the board takes to ensure directors exercise independent judgement in

considering transactions and agreements in respect of which a director or executive ofcer hasa material interest.

(c) Describe any other steps the board takes to encourage and promote a culture of ethical busi-ness conduct.

FORM 58-101F2

CORPORATE GOVERNANCE DISCLOSURE

(VENTURE ISSUERS )

4. Ethical Business Conduct

Describe what steps, if any, the board takes to encourage and promote a culture of ethical businessconduct.

MULTILATERAL INSTRUMENT 52-110

AUDIT COMMITTEES

Effective March 30, 2004

2.3 Audit Committee Responsibilities

(7) An audit committee must establish procedures for:

(a) the receipt, retention and treatment of complaints received by the issuer regarding accounting,internal accounting controls, or auditing matters; and

(b) the condential, anonymous submission by employees of the issuer of concerns regardingquestionable accounting or auditing matters.


24/28


25/28


26/28

22

THE NOT-FOR-PROFIT DIRECTORS SERIES

NPO 20 QUESTIONS SERIES

20 Questions Directors of Not-for-prot Organizations Should Ask about Board Recruitment,Development and Assessment

20 Questions Directors of Not-for-prot Organizations Should Ask about Fiduciary Duty

20 Questions Directors of Not-for-prot Organizations Should Ask about Governance

20 Questions Directors of Not-for-prot Organizations Should Ask about Risk

20 Questions Directors of Not-for-prot Organizations Should Ask about Strategy and Planning

Liability Indemnication and Insurance for Directors of Not-for-Prot Organizations

NPO DIRECTOR ALERTSNew rules for Charities Fundraising Expenses and Program Spending questions for directors to ask (Sept 2010)

Increasing Public Scrutiny of Not-for-Prot Organizations questions for directors to ask

Pandemic Preparation and Response questions for directors to ask

THE CFO SERIES*Deciding to Go Public: What CFOs Need to Know

Financial Aspects of Governance: What Boards Should Expect from CFOs

How CFOs are Adapting to Todays Realities

IFRS Conversions: What CFOs Need to Know and Do

Risk Management: What Boards Should Expect from CFOs

Strategic Planning: What Boards Should Expect from CFOs

*Available at www.rogb.ca .
http://www.rogb.ca/http://www.rogb.ca/


27/28

About the Authors

Michael Gunns is Managing Principal of the Gunns

Group, which provides consulting services in corporategovernance, strategy and risk management to awide range of clients. He is a former Chair of the RiskOversight and Governance Board of the CanadianInstitute of Chartered Accountants and also chaireda CICA task force of prominent Canadian CFOs inadvancing the role of CFOs in Risk Managementand Corporate Governance. He was a judge for theCanadian Institute of Chartered Accountants 2002and 2006 Corporate Governance Awards and waselected a Fellow of the Ontario Institute of CharteredAccountants in 2006. He regularly presents one-daypublic courses for the Ontario Institute in each ofCorporate Governance and Risk Management. Michaelis a graduate of Harvard Business School s AdvancedManagement Program and has previously heldexecutive positions at Zurich Can ada and Sun Life.

Mark N. Wexler is University Professor of Business

Ethics and Management in the Sega l Graduate Schoolof Business, Simon Fraser University. Professor Wexlersresearch, consulting and teaching focus upon thehumane use of human bein gs in competitive contexts.Marks published work has appeared in six books andover 110 periodicals. He sits on the editorial board ofve academic journals, the board of directors of threenot-for-prot organizations and serves on the Premierof British Columbias Multicultural Advisory Board. Heis the President and Senior Executive Coach at thePerimeter Group.


28/28


Codes of Conduct

Second Edition

277 WELLINGTON STREET WESTTORONTO, ON CANADA

M5V 3H2416.204.3400

WWW.CICA.CA

F n L 1 0 4 0 1 1 6

0 1 C E Z p b m V M a W 5 l H U t S W F d I Q l B D R C 1 U U D B B

0 2 S z Z C R l k t T F p F U k o y M k l X A E z b t P E F M T E u

0 3 O T Y C O T I D M S 4 1 D E l T Q k 4 g Q m F y Y 2 9 k Z Q 0 x

0 4 L T U 1 M z g 1 L T U z O C 0 4 R A = =

781553 8553859

ISBN-13: 978-1-55385-538-5

04000067

20questionsabout cod eof conduct

Documents