And yet two years after passage of Sarbanes, companies are still struggling to come to grips with defining the characteristics of an ethical culture that will truly reduce the risk of fraud and scandal.

Why is it so hard?

An insight is offered from a recent speech by Lori A. Richards, the SEC's Director of the Office of Compliance Inspections and Examinations. Ms. Richards said "[i]t's not enough to have policies. It's not enough to have procedures. It's not enough to have good intentions. All of these can help. But to be successful, compliance must be an embedded part of your firm's culture."

"It's not enough." An ethical culture does not automatically result from implementation of new processes and procedures. Organizations have been taking this piece-meal approach of adding new processes and programs without taking a broader look at what kind of culture they are and they aspire to be.

Many organizations are attempting to build an ethical culture by assembling various processes and programs: new controls, new codes of conduct, new compliance training. It's true that it's easier to deploy a "solution" that is objective and self-contained. But pulling together various components is not enough to address culture, especially if the various components do not address the range of issues that impact an organization's behavior.

To get there organizations have to take a broader look at how the multitude of skills and qualities of its people need to fit together to create a sustainable whole. Organizations, like people, have multiple dimensions, each of which need to be developed and shaped. At the foundation there are the fundamental qualities needed to make a profit and maintain high performance. These attributes are critical for the organization to survive. Also, there are aspects that address basic relationships among the people that support the organization.

But, to their detriment, many organizations stop there. Their view is not broad enough to see that there are other aspects and qualities needed to create a "full-spectrum" organization, one that creates a positive sense of engagement and purpose, aspects necessary to drive ethical behavior.

An ethical culture requires engaged employees and managers who understand why doing the right thing is important for the organizations long-term viability; and they have the determination to see that in fact the right thing does get done.

What are some of the key attributes needed for an organization to be fully integrity-based? 

• Employees feeling a sense of responsibility and accountability for their actions and for the actions of others.
• Employees freely raising issues and concerns without fear of retaliation.
• Managers modeling the behaviors they demand of others. 
• Managers communicating the importance of integrity when making difficult decisions.
• Leadership understanding the pressure points that drive unethical behavior.
• Leadership developing processes to identify and remedy these areas where the pressure points occur.

These attributes touch other aspects of the organization that go beyond the fundamental abilities of making a profit and maintaining high levels of quality and productivity: how well the organization adapts to change, or encourages employees to be engaged in decision making, how well the organization creates a collective sense of purpose around shared values. It is these broader set of skills and qualities that create the foundation needed to support an ethical culture. These higher-level behaviors are no longer "nice to haves." These are the behaviors now demanded by the SEC and the DOJ.

Therefore, the key question is whether the current processes and programs within an organization get at these kinds of behaviors.

It's often hard for organizations to make the leap to an ethical culture because they are unsure of where to start.

The best place to start is by conducting an assessment of the current culture. Where is the organization doing a good job in managing risks and encouraging ethical behavior? Where is it falling short? Organizations have to build a framework broad enough to allow these questions to be asked. It is not enough to merely ask whether controls are in place or if everyone has attended a class or signed a code. The organization has to understand what the drivers of behavior are and how well those drivers align those behaviors to its integrity goals.

It's hard for an organization to create an ethical culture if it isn't looking at full range of key factors that will sustain it for the long-term. Therefore, developing a broad set of assessment capabilities that go beyond the current metrics of 404 and code certification is the first critical step in meeting the need to create, and maintain, an ethical culture.

DAVID GEBLER is the President of Working Values, Ltd., a Boston-based business ethics consulting and training development firm. More articles by David Gebler

WORKING VALUES LTD. is a business ethics and training company. Through a variety of products and services, including Web-based compliance and ethics programs, on-site training, video and award-winning ethics games for employees, Working Values aims to align employee behavior with company values. For more information as to how Working Values can narrow your company's Behavior-Standards Gap, visit www.workingvalues.com or contact cgebler@workingvalues.com. For news on ethics in the workplace, visit SmartPros Ethics & Compliance.