Standards of Conduct, Policies, and Procedures
What is tested
The code of conduct is the program's foundational statement of values and expectations; policies translate it into rules, and procedures into steps. Know the hierarchy: code, then policy, then procedure, then work instruction. Questions probe drafting, review and approval cycles, version control, attestation, translation, and retirement of obsolete documents.
Concepts to name
Risk-based policy development (write where the risk is, not where it is easy), plain-language and readability standards, statements of who must do what and when, policy ownership with review triggers (regulatory change, incident, acquisition), and the distinction between acknowledgement and understanding. Also the global-versus-local tension: a single global policy must yield to stricter local law, never override it.
Traps
More policies do not equal a better program; a bloated manual nobody reads is a finding, not a strength. An electronic acknowledgement proves receipt, not comprehension. A code is a values document, not a contract, and should not be drafted as one. Waivers of the code for executives require board or committee approval and disclosure - a common test item.
Rule of thumb
The three-click, one-minute test: can a new employee find the rule governing a real decision in three clicks and read it in a minute? If not, rewrite rather than reissue.
Worked example
Post-acquisition, two gift-and-hospitality policies conflict. Correct sequence: identify the stricter standard, adopt a single global policy with local addenda, communicate the change, collect attestations, retire the legacy documents, and set a review date - not simply publish both and let managers choose.