70 percent of survey participants reported training more than 90 percent of their workforce in their companies' code of conduct.

More corporate boards are becoming actively involved in providing oversight into companies' ethics and compliance programs, according to a report released today by The Conference Board. The report is based on a survey of 225 companies.

Documented board involvement in ethics and compliance programs jumped from 21 percent in 1987 to 96 percent in 2005. Some 79 percent of corporate board member participants in a similar survey in 1987 had no contact with their company's ethics program; but by last year only 4 percent of boards surveyed were not involved.

"With the growing participation of boards in ethics, it is most likely that more high-level executives are responsible for these programs," says Ronald E. Berenbeim, primary researcher and director for The Conference Board Working Group on Global Business Ethics and Principles. "This is encouraging because ethics and compliance issues are becoming increasingly important to the welfare of [companies]."

Codes of Conduct
Nearly two-thirds or 70 percent of survey participants reported training more than 90 percent of their workforce in their companies' code of conduct. This figure is little changed from the 78 percent who reported training in code of conduct in a 1998 survey. Ethics training of some kind, possibly in response to the Revised 2004 Sentencing Guidelines provision that mandates ethics training throughout the company (including the board of directors), is now standard practice.

The Sentencing Guidelines are not requirements but compliance with them can enable a company to obtain a substantially reduced sentence for improper conduct. Company adherence to the Sentencing Guidelines may even result in a governmental decision not to prosecute.

Beginning with the initial 1991 ruling, the Sentencing Guidelines have had a very significant impact on training. In the 1987 pre-Federal Sentencing Guidelines report from The Conference Board, only 44 percent of the survey participants said that their company had some kind of ethics training program. Among participants from the 2005 Conference Board survey, ethics training for some employees is now almost universal (92 percent) and considerably higher than those surveyed in 1998 who said they offered some kind of ethics training (79 percent).

Another sign of changing times is that more than one-third of the companies surveyed in 2005 (34 percent) conduct more than 90 percent of their training through E-learning programs.

Whistleblowing
The vast majority of participants (91 percent) in the latest study maintain an anonymous reporting system whereby employees can report observed misconduct. The prevalence of hotlines is, perhaps, the most significant change since 1998 when the figure was only 52 percent.

"It is evident that companies go through three stages in the design, implementation and monitoring of their whistleblowing systems," says Berenbeim, author of the study. "The initial stage will generate a large number of complaints -- partially as a result of pent-up demand but also because the employees do not realize that hotline systems are not for all kinds of complaints and grievances. In the second stage, companies tell us that more of the complaints are focused on appropriate subject matter and a larger number of callers are seeking advice before bad things happen rather than reporting improper conduct after the fact. In the third phase, companies may get fewer complaints because employees do not need help on the right person to contact for advice. In some countries, there may also be alternative institutions such as Works Councils that can play this role."

Assessing Risk
Of the companies surveyed last year, 70 percent have responded to the Revised 2004 Guidelines mandate that risk assessment be a critical component of an effective compliance and ethics program. Publicly traded companies are more likely (77 percent) than their privately held counterparts (54 percent) to engage in this practice. Seventy-eight percent of the companies that conduct risk assessments prioritize risk from both a probability of occurrence as well as severity of impact. A little more than half (54 percent) of these companies quantify risk.

Among the companies that analyze general risk to ethics and compliance program effectiveness, an assessment of internal policies and practices (95 percent) is a nearly universal subject. The next two most frequent risk assessment exercises involve employee understanding of ethics and compliance systems (77 percent) and anonymous reporting systems (75 percent).

Specific risk areas are analyzed in two ways: probability of occurrence and potential severity of occurrence. A breach with respect to protection of confidential information was regarded as the most likely risk to occur while general financial statement and earnings manipulation was regarded as the most severe hazard. Since failure to protect confidential information also placed third on the severity list, this problem could on balance be the most serious challenge because of the potentially severe damage risks and the most likelihood that it will occur.