In the aftermath of these very public collapses, organizations are scrambling to demonstrate their own compliance. They are making sure they have developed or updated codes of conduct and have taken steps to prove that everyone has been exposed to the code. The regulators’ response has been to call for more laws and penalties to prevent corporate misdeeds. In fact, most high-profile scandals are not caused because codes aren’t in place or because individuals faced with ethical dilemmas have no clear standards to follow. After all, Enron had a well-publicized code of conduct. Nor do these issues arise in a vacuum of legal regulations. The prosecutions and lawsuits already under way indicate that improper conduct occurred not in the absence of protections but in spite of them.

    In most cases, corporate catastrophes start with questionable, illegal or unethical acts such as "cooking the books," falsifying records or defrauding investors. Next, individuals attempt to conceal these "bad acts" in a variety of ways. When people do eventually try to raise concerns, they are either ignored or retaliated against, and the cover-up escalates. Gradually, this kind of behavior becomes the standard of business practice in the eyes of the company’s employees--it’s "how we do things here." When the company culture ignores, promotes or even rewards improper conduct, training everyone on the intricacies of numerous compliance laws won’t be enough to prevent a business disaster. Stock prices don’t plummet, a brand name isn’t seriously harmed and the government doesn’t launch massive investigations because individuals failed to recognize the applicability of an obscure regulation or misjudged an ethical gray area. Instead, companies should look at how people behave at work. They may find that they have to change "how we do things here."

    Scores of state and federal laws regulate financial transactions, employment practices, environmental safety, antitrust, and a number of other compliance areas. In addition to prohibiting certain kinds of conduct and business methods, they forbid retaliation against individuals who try to complain of unlawful practices internally. In the current climate, all of these laws are seen as vital to maintaining an ethical, legally compliant workplace. Therefore, providing education is a necessary part of the process.

    However, if the idea is to affect the way people behave at work, inundating everyone with the details of these laws and regulations is not the answer. It’s nearly impossible to communicate every form of improper business conduct--no one could remember such a list. Even if they could, new forms of misconduct always seem to be around the corner. The U.S. Department of Labor’s Web site currently lists nine different provisions prohibiting retaliation against individuals for complaining of potentially illegal practices, and there are other statutes that prohibit retaliation for raising other kinds of concerns. Many states also have regulations.

    Beyond the complexity, regulatory statutes are also often ambiguous. A recent example of this is the Sarbanes-Oxley law, which contains provisions whose meaning is unclear even to those who supported the legislation. Additionally, workplace regulations are often, by their very nature, extremely complex, rife with exceptions and counterintuitive. For these reasons, it’s simply unrealistic to think that individual managers can be taught to recognize the nuances of not one but many applicable laws to avoid legal and business pitfalls.

    On the other hand, we know that instruction on legal issues is important. It communicates the significance of legal conduct, is required under some laws and can sometimes help reduce damages and penalties. So how can organizations most effectively use their training time and dollars to educate their workforce about these issues?

    Recently I worked with an international corporation to help them communicate standards of behavior to managers throughout the world. We realized that attempting to address all of the laws governing individual countries would not only be difficult but also would diminish the effectiveness of the message. Instead, we developed a program based on shared policies, skill building and a business rationale that all participants can understand and apply, regardless of where they are located. Similarly, when training nuclear-industry professionals, we don’t focus on the intricacies of the Nuclear Regulatory Commission’s statutes and regulations. We focus on behaviors that managers should follow, and give them skills to effectively handle employee concerns.

    We can’t expect businesspeople to become legal experts, but the good news is that they don’t have to. Rather than focusing on complex and often confusing legal regulations, organizations should communicate clear responsibilities and behaviors that reflect their values, codes and policies. Tying behaviors to responsibilities can help organizations instill messages about ethical practices in the same way they do other important business initiatives. The training should have a legal foundation, but by applying a clear set of behavioral guidelines to all workplace situations, managers will be able to minimize risk without having to know every detail of the laws. When managers understand the business consequences of improper conduct and have the skills to recognize and respond to such behavior, they can begin to change "how we do things here."