Modules / KM-04

KT0103 - Structures and processes and industry codes of practices

Intoduction to Cybersecurity Governance | KT01: Governance

The SIX Code of Conduct sets the values and principles that we as employees follow in our interactions with each other and with our stakeholders such as customers and other business partners, our shareholders and the regulatory authorities. It forms the basis for our behaviour and for the public image of SIX. What is the difference between a code of conduct and a code of practice? Some scholars distinguish a code of practice from a code of conduct. A code of conduct is defined as a practical document of standards governing client relationship, and a code of practice, as a technical document setting standards for the members of a profession. What is the difference between an industry code and legislation? When it comes to safety in the workplace, what is the difference between code of practice and legislation? Codes of practice are guidelines and rules that employers are expected to implement in the workplace. Legislation, on the other hand, refers not to suggestions or recommendations but laws that must be followed. Elements of an Effective Code A code of conduct publication does not work in a vacuum. Important factors for a successful code include: Foundations that support a successful code program. Components of a successful code program. Dimensions for an effective code publication. Foundations for a Program These foundations serve as important considerations for a successful code of conduct program. While not all of the foundations are mandatory – and in fact they will exist in each company in varying forms – the more firmly that they are established, the more likely that the code (and the larger ethics and compliance initiative) will lead to success. Leadership commitment to the program – Without senior leadership’s commitment, any code initiative is unlikely to truly engage employees and demonstrate to them the “tone at the top” that is so critical to any business initiative – especially one focused on ‘doing the right thing.’ Ethics and compliance processes – Leadership’s commitment means so much more when the organization can point to procedures and processes that support a code standards and expectations. Otherwise, employees are right to wonder about how leadership expects to achieve adherence to the company’s standards and address concerns. Company culture – A company culture focused around an enduring mission or vision and supported by lasting values sets the best foundation for a proper focus on long-term value and success. These core foundations help a code rise about a narrow focus only on the law to other commitments, promises and aspirations that the company seeks to achieve. Understanding of risk – A company’s awareness of the ethics and compliance risks that it faces is central to a code of conduct. With the hundreds of issues that a code could possibly address, a more targeted risk identification and assessment effort helps to focus the code’s contents to those issues that are most important to the company’s operations and that will provide it with a higher chance of success. Coordination with policies – A company’s policies often provide the detail underlying its expectations. Policies also can provide the initial framework for a new code of conduct and serve as additional resources to support a code’s standards. Where policies exist, they provide important context for a code development or revision effort. A Code Program Before beginning development of a code, it behooves a company to understand how it fits into a larger code program. This is because some of the choices for the code development can impact how the code is introduced, and visa versa. The five components of an overall code of conduct program include: Code publication – The publication is the starting point for a successful code program. But a document alone will not achieve the goal of making its standards live in the hearts and minds of employees. Code introduction – How the code is delivered to employees and others establishes an important precedent for how the company and its leadership will reinforce and support the code and employees’ actions regarding it. Code education – Leadership should not assume or expect that employees will instinctively understand, appreciate and know how to apply the code simply from reading it. To obtain the best value from the code, a company should effectively education employees (and others) to it. Ongoing reinforcement – Just as with an ethics and compliance program, leadership must continue to reinforce the code – its purpose, importance, application – and the systems that support it for it to maintain lasting value. Metrics & improvement – In the end, a code and its related programs can be assessed for effectiveness and improvement opportunities. Just as business continues to change, a code program should respond to these changes to ensure it remains viable in a changing business environment.