LRN provides a valuable report on codes of conduct

The LRN study

As an editor of this newsletter, I have found empirical studies of practices in our field to be very useful.  LRN has offered a detailed report on its survey of over 1000 codes of conduct, including responses from approximately 2000 full-time employees.  The empirical base for the study was impressive, encompassing 16 industries in 15 countries and conducted in 11 languages. LRN noted that they used an AI tool to analyze this huge volume of codes.  Among other encouraging observations, they noted that code usage is strong. 

What is covered in codes?

An obvious question in a study of codes is determining what they cover – what risks are covered or neglected, and what else do codes provide.

LRN found there was a consistent foundation in topics: Prevalent topics include conflicts of interest and the treatment of confidential and proprietary information. In addition, 9 out of 10 codes cover corruption and bribery, gifts and entertainment, and protection of company assets. One observation that jumped out at me was how much of this was simple corporate self-interest. While preventing bribery serves the public, much of the rest is not to protect others; it is to protect the business.  This is a two-edged sword.  If you are making a case to management, it is helpful to show that the compliance efforts make business sense in protecting the company.  But on the other side, it is not necessarily a reflection of values, ethics, or any noble impulse. 

The report mentions that certain types of risk are not as widely covered and includes labor laws as an example.  This could raise an issue that I rarely, if ever, see addressed in dealing with codes.  In addition to codes, companies also typically have employee manuals or handbooks.  While these cover work hours, attendance, and other work life details, they may also have some coverage of policies, such as harassment and labor laws.  In the compliance and ethics profession I rarely if ever hear these handbooks or employee manuals discussed.

The report notes that fewer than 1 in 10 codes address AI or technology.  This alone might be an argument for having at least the rapidly developing areas of code coverage supplemented online.  When technology evolves rapidly even a yearly code update may not be enough. The report, on page 46, also includes a useful chart of risks covered in codes.

In addition to listing the risk area topics the report looks at how useful the codes are.  It notes that fewer than 1 in 3 include scenario-based Q&A even though these can make the code’s messages easier to understand.  LRN finds that 1 in 4 employees find their codes difficult to navigate and 1 in 5 say their code lacks practical guidance. 

Reaching employees, employee engagement and supporting efforts

The value of the code and its content of course depends on what happens with the code.  Do employees interact with it, or does it sit unopened and unused? 

An opening point in the Report is that almost all employees report their organization requires them to confirm the code. No surprise here, but having this empirical resource may be useful in case there is any management push back for requiring code acknowledgment.

How is the code distributed?  65% receive a digital PDF version, 48% a printed copy and 38% have access via a website.  Since 2025 website access has increased by 6% while the other methods have decreased slightly.

How do employees use the code? Only 3% said don’t use the code at all, but no more than 2 out of 5 said they had no challenges using the code. 1 in 4 employees considered their codes difficult to navigate; 1 in 5 said their codes lacked practical guidance. 

On employee engagement in 2026, 63% said they used the code as a workplace resource, but this was down from 70% in 2025.  Only 1/3 said they used the code often or very often.  Presumably the significance of this could be affected by what other resources were available to provide guidance. There might be guidance available online, separate from the code. There may be business unit compliance ambassadors that provide guidance. Also there may be employee manuals or handbooks.

What management and training efforts were there regarding the code?  61% of employees said supervisors talked about the code, but this was down from 67% in 2025.  Code training was also a factor.  The report says that nearly all who have had code training say it helps. That is an encouraging conclusion.  It seems to be routine, at least in some online commentary, to treat compliance training as if it were an unmitigated failure of no benefit.  But LRN’s conclusion that employees reported that the code training helped suggests that critics may be missing what is happening on the ground. One concern, though, is that the use of training may be declining. The report says the trend for code training is down, from 85% in 2025 to 78% in 2026. 

On the positive side, another encouraging statistic is that 80% of those whose first language is other than English say the code is available in their native language.

The report includes an important recommendation: “Test usability across the workforce.” I believe this applies not just to the code itself, but also to the training and any other means of communications.  The report addresses different generations and employee groups. I would add the need for sensitivity to neurodiversity and sensory issues (e.g., vision, hearing, age).  For example, for those of us who “have been young for a very long time,” please avoid tiny font or light-colored print that is hard to read.    

Reporting systems & Retaliation

Our publication has a consistent history of championing those who speak up and calling for companies to upgrade their reporting systems and improve efforts to protect whistleblowers.  It was not a surprise to find that overall, codes cover their reporting systems.  But the problem we see in this that the coverage of whistleblower issued in codes incorporates magical thinking.  The magic is believing that merely stating this in a code makes it reality.  It does not. 

More revealing is a separate point in the report:  only 2 in 5 companies explain what happens next after a report is made, i.e., the investigation process.  The report also notes that employee confidence is moving in the wrong direction, from 75% in 2025 to 69% in 2026.  The Report offers the right direction: “They need to know what to expect after raising a concern and understand the protections available to them.”  If legal counsel is advising compliance people not to give away any secrets about the investigation process, then this is another sad example of why compliance should not be reporting into the legal department.  The greatest risk a company faces is not that employees will expect too much of the investigation process; the truly dangerous risk is the employee who does not trust the company and goes instead to the government or the press. 

It is essential to remember that speaking up in any organization is a giant, potentially dangerous step for an individual. Companies need to shine a light on the reporting and investigation process so employees understand it.  Also, after they call, instead of waiting in quiet fear wondering what is happening, employees who report can begin to understand why it takes time.  There is no benefit in pretending this is a big secret. 

Continuing to provide wise advice, the Report warns: “The code should clearly address confidentiality, anonymity and non-retaliation.” That is true as far as it goes. But because the code has no power of its own, that cannot be anything more than a beginner step. If you do not take strong management steps to protect whistleblowers and prevent retaliation, there will very likely be retaliation in at least some form.  For other preventive steps, beyond the code, see Amii Barnard-Bahn & Joe Murphy, How to Prevent Retaliation: 6 Practical Steps,  https://ideasandanswers.com/how-to-prevent-retaliation-6-practical-steps/ ; Keith Read, Retaliation – The Reality: From passive policy to a data-driven active anti-retaliation program, https://ideasandanswers.com/retaliation-the-reality/

Conclusion

There are definitely useful points for compliance and ethics professionals in this report.  But it also shouts out at me an essential point:  You need to talk with your employees, and you especially need to do user testing on your code.  This should be done in draft, so there is time to respond to employee input. See what employees say, what would make the code more useful.  Test out different formats, adding Q&A, trying scenarios, using online video clips, or whatever tools work for your people. Test out the code training on the same basis.

We should thank LRN for these deep data dives and providing these reports over the years so we can compare industry trends to assess where our own efforts stand.

Visit this link to download a copy of the report: 2026 LRN Code of Conduct Report