Publicly traded companies are required to abide by ethical standards included in the Sarbanes-Oxley Act of 2002. However, many private and not-for-profit organizations are voluntarily following suit. "It's become more of a norm as a good business practice," says Lisa R. Callaway, director of labor relations and general counsel for The Management Association of Illinois.

The Sarbanes-Oxley Act was adopted in the wake of the Enron, WorldCom, and other corporate scandals, as well as reforms led by the New York Stock Exchange. Section 406 of the Act specifically addresses corporate codes of ethics and disclosure requirements in corporations, Callaway explains. Under Section 406, public companies are required to disclose whether they have a code of ethics and whether they have granted any waivers for certain senior executives. They must also file their code of ethics as an exhibit in their annual report or on their website and provide a free copy on request, she says. If a covered company does not have an ethics code, it must explain why.

A directive in the Sarbanes-Oxley Act required that the U.S. Sentencing Commission amend the Federal Sentencing Guidelines, Callaway notes. Those amendments, which went into effect November 2004, specify seven requirements for ethics policies that apply to public, private, and not-for-profit companies.

A company facing criminal penalties as a result of financial corruption would likely face smaller penalties if it has met the seven requirements, according to Callaway.

She outlines the seven requirements as follows:

1. Establishing ethics compliance standards and procedures.
2. Assigning a specific high-level person to oversee the compliance program.
3. Taking due care in the delegation of substantial discretionary authority to individuals (i.e., being careful to select an objective, high-level person to investigate any violations).
4. Communicating standards and procedures to all employees through training and through printed and electronic materials.
5. Monitoring and auditing the operation of the compliance program, and establishing a help line to report possible wrongdoings.
6. Consistently enforcing discipline for violations by employees.
7. Responding promptly to any wrongdoing and remedying any deficiencies.

HR professionals interested in developing or strengthening their company's ethics policy should consider the following advice from Callaway:

• Get support from the top. "You have to have buy-in from top management," says Callaway. Management should be involved in the development of the policy, as well as implementation and enforcement efforts.
• Don't be too specific. If you provide examples of violations in your code of ethics, be sure to note that the list is not inclusive.
• Make it part of your corporate culture. Just developing an ethics policy is not enough. It should change the way your business operates going forward.
• Provide training. Employees need to understand your company's principles, its expectations of employees, how to report a possible violation, and that the company cannot retaliate against them for making such a report. During training, you should also explain what the company means by ethics violations, what the internal appeals process is, and that employees have the right to report possible violations to federal agencies.