SCCE’s Code of Ethics for Compliance and Ethics Professionals

Nearly 20 years ago, in 2007, we took part in an effort to produce a set of ethical standards for those in the compliance and ethics field. The Society of Corporate Compliance and Ethics (“SCCE”) formed a team to draft a Code of Professional Ethics for Compliance and Ethics Professionals. The goal of the Code was to establish a set of standards for those of us working in this field. 

At the time, the Compliance and Ethics profession was still relatively young, but it was beginning to come into its own. One hallmark of a mature profession is the articulation of shared ethical standards – a recognition that those who hold themselves out as professionals have not only technical responsibilities, but also broader obligations grounded in integrity and public trust. The development of the Code was therefore both practical and symbolic: it provided guidance for practitioners and signaled that Compliance and Ethics had emerged as a distinct profession. What is the Code about and what guidance does it offer us?

Background of the Code.  The objective of the Code was to create a set of standards for compliance and ethics professionals (CEPs). This is a growing, global profession, and one that plays an increasingly important role in our society. The standards are drawn from reviews of ethical standards in other fields, including the Health Care Compliance Association’s code.  The original draft was written by a committee of six members of what was then the SCCE Advisory Board: Joe Murphy and Rebecca Walker, co-chairs, Urton Anderson, Michael Horowitz, Shelly Milano, and Marjorie Doyle.  The draft was reviewed by the SCCE Board and circulated to all SCCE members for comment.  Valuable input from the membership was incorporated into the final. 

The Code reflects the experience of other professions, that the existence of ethical standards can strengthen those who work in a specific field by providing external support for doing the right thing. It is a hallmark of a profession to set standards that address what is distinct about that field. It should be noted, however, that these rules are not a matter of law, and are not binding on the companies who employ CEPs.  Rather, they are adopted by those of us in the profession as a mark of our commitment.  However, companies may well want to adopt these standards for their CEPs as a sign of their commitment to having a vigorous compliance and ethics program.

We present here a brief overview of the Code, touching on some of the more important provisions.  For guidance on any specific questions, please refer to the Code itself, which is available here.

Structure of the Code. The Code contains 4 elements: 

Preamble – This introduces the Code and makes the important point that CEPs serve a critical role in preventing and detecting misconduct and promoting ethical conduct.

Principles – These are broad standards that set the framework for the detailed rules.  

Rules – These are specific standards that prescribe the minimal level of professional conduct for CEPs.

Commentary – These are important explanations and examples that clarify how the Rules apply in real-world situations. The drafters of the Code sought to create a document that did more than simply sound nice; they wanted a Code that provides practical answers to real world questions.  The objective was to address dilemmas we knew practitioners faced, and provide specific guidance. Thus, the commentary is an essential part of the Code.   

The Preamble. The Preamble sets the tone of the Code and spells out some key definitions. One particularly important term that appears throughout the Code is “misconduct.”  This covers illegal and unethical conduct; it is not limited to legal rules. We recognized that our work is not just about scraping by with the minimum the law requires; as reflected in the US Sentencing Guidelines we also seek an ethical culture in our organizations. 

The Code also defines “highest governing body” to make clear that when escalation is necessary, the CEP needs to reach the highest point in an organization, where the ultimate power resides. In a complex organization this can be the parent company’s board, not just the board of a subsidiary.

The Principles. After the Preamble the Code is then divided into three sections, each based on a Principle.  The Principles reflect our duties to three groups:  the public, our clients, and the profession.  The first obligation – to the public – is to be expected of a profession.  While we certainly have a duty to those who pay us for our work, we also have a duty that transcends the paycheck. The second is to our clients – those who have hired or retained us to assist in their compliance programs. As the Code makes clear, this duty is to the organization, not to management or any individual managers. The third is to the profession of compliance and ethics.  The following is a review of the Code’s provisions, organized by Principle.

Principle I – Obligations to the Public

R1.2  CEPs must take the steps necessary to prevent misconduct. This is not a passive standard.  CEPs cannot simply sit back and wait for others to seek advice. They must reach out to ensure the organization is acting properly, and do what is necessary to head off misconduct. Our role is to protect those who may be injured by the organization’s misconduct:  employees, customers, investors, and others who may be affected by what the organization does. The commentary adds that while the CEP must be active, the actions must be legal and ethical.  Where improper actions of a client cannot be stopped, the commentary takes the CEP to rule 1.4.

1.4  If the CEP becomes aware of proposed misconduct, rule 1.4 provides instruction. A CEP cannot consent to, or passively appear to go along with, misconduct.  The CEP needs to object clearly.  If this does not work, the next step is to escalate, including to the board where appropriate. If these steps fail the CEP may consider resignation – but not too soon, since the CEP is in a position to prevent misconduct, and removing the CEP as an obstacle may make the misconduct more likely to occur.  If there is a legal obligation to report, then the CEP must report; this just states a fundamental point – if there is a legal obligation to report something, the Code supports compliance with the law.

When is escalation to the board necessary? The commentary provides guidance on this determination.  Specifically, escalation is called for when directed to do so by the board (e.g., by a prior board resolution), when escalation to management has not proved effective, or when the CEP believes escalation to management is futile.  Note, however, that these are examples, and escalation may be appropriate at other times as well.  In practice, determining when escalation is “appropriate,” and to whom, requires judgment. The Code does not eliminate that judgment, but it does provide structure and clarity when the stakes are high.

Principle II – Obligations to the Employing Organization

2.1  CEP’s must act in a timely, competent and professional manner.  The Code recognizes that CEPs are not expected to be experts in every discipline, but they need sufficient education to do the job effectively, and needs to stay current.

2.2  CEPs should ensure, to the best of their abilities, that their employer complies with the law.  But, as the commentary makes clear, while the CEP plays a leadership role in making this happen, all employees have a responsibility to ensure compliance.

 2.4  CEPs have a duty to keep senior management and the highest governing body informed of the status of the compliance and ethics program, both as to implementation and areas of risk. This duty, in turn, reflects the duty of management and the board to monitor compliance, following the standards set forth in the Delaware Chancery Court case, Caremark, and subsequent cases.  In Caremark the Delaware court, whose decisions strongly influence corporate law throughout the US, cautioned that directors face potential personal liability if their failure to ensure that adequate compliance and reporting systems are in place results in losses to the company. Rule 2.4 reinforces the expectation that compliance professionals play a central role in enabling boards to fulfill their oversight responsibilities.

2.5  Retaliation undermines a compliance program and can expose a company to serious legal consequences. Thus, this rule prohibits CEPs from aiding or abetting retaliation and requires them to pursue procedures designed to protect whistleblowers. 

2.7  As CEPs, we should avoid conflicts of interest, and report anything that might constitute a conflict.  But, involvement in a matter that is the subject of such a report will not automatically disqualify the CEP from participating.  The CEP’s experience may provide valuable insight into misconduct, and the CEP may be the one best positioned to prevent or detect it.  The key is disclosure, so everyone knows of the CEP’s involvement, and ethical handling. 

 Principle III – Obligations to the Profession

3.1   We pursue our work with honesty, fairness and diligence.  We cannot agree to unreasonable limits that would interfere with our professional responsibilities.  For example, as the commentary makes clear, it would be unacceptable for a CEP to be asked to conduct an investigation, but not to talk to certain employees or officers.  If limits placed on the CEP’s conduct are unreasonable, then the CEP must decline to perform the activity and explain to the board why.

3.2  Protecting the confidentiality of client information is essential for CEPs to function effectively in organizations.  If the information clients provide us is exploited in litigation, it can seriously erode the effectiveness of compliance and ethics programs.  CEPs are encouraged to work with legal counsel to minimize litigation risks.

• CEPs need to keep up to date with the field, and participate in professional

dialogues and exchanges. Compliance is a dynamic and evolving field, comprised of professionals who are generally willing to share experiences and lessons learned. We all benefit from the experiences of others.

Conclusion. SCCE adopted this Code to strengthen the field of compliance and ethics, to bring increased recognition to the professional status of compliance and ethics work, and to support practitioners in making difficult professional decisions.  Ours is an important profession, and this Code stands as both a guide and resource in our daily work.