06 Code of Conduct
Internal Audit Report Limited Operational Audit Code of Conduct and Ethics Program April 1, 2010 - March 18, 2013 Issue Date: June 11, 2013 Report No. 2013-06 Internal Audit Report Code of Conduct and Ethics Program April 1, 2010 - March 18, 2013 Table of Contents Transmittal Letter ...................................................................................................................... 3 Executive Summary .................................................................................................................. 4 Background ............................................................................................................................... 5 Highlights and Accomplishments ............................................................................................ 8 Audit Scope and Methodology ................................................................................................. 9 Conclusion .............................................................................................................................. 10 2 of 15 Internal Audit Report Code of Conduct and Ethics Program April 1, 2010 - March 18, 2013 Transmittal Letter Audit Committee Port of Seattle Seattle, Washington We have completed an audit of the Code of Conduct and Ethics Program. We examined information from April 1, 2010, through March 18, 2013. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We extend our appreciation to the Workplace Responsibility Officer, the management and staff of the Legal Department, Human Resources and Development Department, and Labor Relations Department for their assistance and cooperation during the audit. Joyce Kirangi, CPA, CGMA Director, Internal Audit 3 of 15 Internal Audit Report Code of Conduct and Ethics Program April 1, 2010 - March 18, 2013 Executive Summary Audit Scope and Objectives We examined the Code of Conduct and Ethics Program for the period from April 1, 2010, through March 18, 2013. The purpose of the audit was to: 1. Determine whether management controls are adequate to ensure: a. Awareness/visibility of Helpline/Hotline. b. Training in Code of Conduct is provided timely to all new employees. c. Training is reinforced with employees and management. d. Code of Conduct policies are enforced Port wide. e. Investigations are conducted timely and properly. f. Access to the SharePoint site that houses reports (WRITS) is controlled. g. Information in WRITS is maintained confidential. h. Management reporting is timely and accurate. i. State Auditor's reports, in accordance with RCW 43.09.185, under the purview of the Workplace Responsibility Officer, are complete, timely, and accurate. 2. Develop maturity models for: a. Training. b. Investigation. 3. Benchmark organizational structure against similar entities. Background In 2010, Senior Port leaders led the development of the Port's Code of Conduct Handbook (Handbook), which is composed of Policies CC-1, through CC-14; a team of Port employees developed the Port's Statement of Values. (Appendix A) The Port created Workplace Responsibility, to provide overall leadership and coordination of the Port's ethics and compliance program, and hired its first Workplace Responsibility Officer (WRO) in February 2010. The WRO guides, supports, and reinforces the Port of Seattle's efforts to advance the Port's mission, while upholding the highest standards of business ethics and workplace behavior. In May 2010, the Workplace Responsibility Officer distributed the Handbook Port wide, and all Port employees were asked to certify that they had read and were familiar with it. All new employees are asked to certify that they have read and are familiar with the Handbook within a short time after their hire date. Audit Result Summary Given the relative youth of this program, it is operating at a reasonable level of maturity (Appendix C), and management controls are adequate. Organizational placement of Workplace Responsibility is comparable to the majority of similar entities (Appendix B). 4 of 15 Internal Audit Report Code of Conduct and Ethics Program April 1, 2010 - March 18, 2013 Background In 2010, Senior Port leaders led the development of the Port's Code of Conduct Handbook (Handbook), which is composed of Policies CC-1, through CC-14; a team of Port employees developed the Port's Statement of Values. (Appendix A). The Workplace Responsibility Officer, in May 2010, distributed the Handbook Port wide, and all Port employees were asked to certify that they had read and were familiar with it. All new employees are asked to certify that they have read and are familiar with the Handbook within a short time after their hire date. The Port created Workplace Responsibility, to provide overall leadership and coordination of the Port's ethics and compliance program, and hired its first Workplace Responsibility Officer (WRO) in February 2010. The WRO guides, supports, and reinforces the Port of Seattle's efforts to advance the Port's mission, while upholding the highest standards of business ethics and workplace behavior. The WRO: Strives to clarify the Code of Conduct policies and conduct regular training to achieve Port-wide understanding of the requirements of the Code and its application to all departments. Guides and supports daily decisions by providing advice and coaching to help employees implement ethical business and workplace practices, make sound decisions and manage conflicting interests and values. Fosters a high-trust culture, by working with executives, managers, and employees to develop a high-trust environment that inspires exceptional performance and morale, customer loyalty, and public confidence. Ensures responsiveness, fairness, and accountability by: o Documenting and promptly reviewing reported concerns and potential Code violations. o Determining appropriate follow-up and coordination of investigations. o Reinforcing fair and consistent accountability Port wide. To ensure contact types are tracked, the WRO uses the Workplace Responsibility Information Tracking System (WRITS). This system allows the WRO to monitor activities related to the Code of Conduct policies and provide reports to management. For the period January 1, 2011, through December 31, 2012, the following contact types were tracked. Workplace Responsibility Contact Types Contact Types Definition of Contact Types 2011 2012 Total Allegation Asserted facts, if true, constitute a conduct violation 41 72 113 Concern Asserted facts, if true, do not clearly constitute a potential conduct violation 71 47 118 Customer Service Issue Asserted facts do not relate to Code of Conduct 17 19 36 Disclosure Individuals self-disclose potential Conflicts of Interest and Gifts 22 24 46 Inquiry A query for information and/or guidance regarding a Port value or conduct standard 143 135 278 Violation 1 Individual admits facts that constitute a conduct violation 4 8 12 Other Contact Type not entered into system 1 1 Grand Total 298 306 604 Data Source: WRITS 1 The WRO stopped tracking this contact ty pe in 2012 and began classify ing it as an allegation 5 of 15 Internal Audit Report Code of Conduct and Ethics Program April 1, 2010 - March 18, 2013 A significant number of these contacts were inquiries (278), which are considered a leading indicator of compliance with the Code of Conduct. The Code of Conduct policies cited most frequently were: CC-1 - Employee Ethics and Conflicts of Interest. CC-4 - Gifts and Hospitality. CC-8 - Anti-harassment. A significant number of contacts were reported allegations and concerns, which are also considered a leading indicator. Chart 1 identifies the Code policies cited in reports to Workplace Responsibility in 2011 and 2012. The "Other" category consists of reports of potential misconduct that are not related to the Code of Conduct. The se reports are captured in WRITS, but are referred to other departments for follow-up. Port employees (currently 1,800) may make inquiries or report allegations or concerns through a telephone helpline within Workplace Responsibility, through email, in person, or by phone to the WRO. Additionally, the WRO maintains an electronic bulletin board, where employees may post their questions and receive quick responses. Employees may also make reports through the Legal and Human Resources & Development departments or through an anonymous hotline, which is administered by a third party. External parties may report issues through this hotline, which is posted on the Port's external web site. A team of individual reviewers from Workplace Responsibility and the Legal, Human Resources & Development, and Labor Relations departments meets twice weekly to discuss reported concerns and allegations, to determine whether they warrant investigation or other follow-up. This determination is based on an objective standard -- if true, the facts constitute a potential Code violation. 6 of 15 Internal Audit Report Code of Conduct and Ethics Program April 1, 2010 - March 18, 2013 Paramount considerations of the review team are: Confidentiality. No retaliation for reports made in good faith. Fair and consistent responses to reported concerns and allegations. Completion of investigations as swiftly as possible. Over the last three years, the WRO has improved processes surrounding the Code of Conduct and Ethics Program. On January 16, 2013, the WRO and a 17-member cross-functional team began a formal process improvement effort of the Code of Conduct/whistleblower intake, review, and investigation process, in order to implement further program improvements, some of which are: Improved timeliness, efficiency, and quality. A more transparent and consistent process. Clear roles, protocols, and procedures. Throughout the start-up period, the WRO has emphasized outreach to management and individual work groups and Port-wide forums to publicize values and expectations. In 2011, the WRO used the services of the Ethics Resource Center to conduct a Port-wide survey, to establish a baseline for program and leader performance benchmarks. The survey provided feedback on: Staff's awareness of the Code of Conduct. Staff's perspectives on how well the program was functioning. Adequacy of training efforts. The Port's program compared to national survey results. Some of the significant results of this survey, which was distributed to all Port employees in August 2011, are provided below: Workplace Responsibility Program Strengths Awareness of Conduct Standards and Reporting Mechanisms Almost nine in ten Port employees know about the Code of Conduct, the Read and Sign requirement, the Helpline, and the availability of a resource for anonymous reporting. Over 90% are confident in their ability to recognize ethics issues. Employee Utilization & Perceived Effectiveness of Resources Three-quarters of employees refer to a resource at least sometimes when they face an uncertain legal or ethics situation. Over two-thirds perceive the Code of Conduct to be an effective resource for guiding decisions and conduct at work. 7 of 15 Internal Audit Report Code of Conduct and Ethics Program April 1, 2010 - March 18, 2013 Workplace Responsibility Program Areas for Improvement Training About 46% of employees say their current work environment poses situations that could lead to Code of Conduct or other legal/policy violations. Two-thirds feel prepared to handle situations that could lead to a Code of Conduct or other legal/policy violation. Response to Reports of Misconduct On average, a little more than half of employees who say they observed violations in the past year found their supervisor or other organizational resources helpful when deciding what to do about the misconduct they observed. About 30% of employees who reported misconduct say there were satisfied with the Port's response to their report. Visible encouragement of ethical behavior and visible discouragement of unethical conduct and compliance violations One-third of employees say that top leadership and middle management give positive feedback for ethical behavior, and half say their supervisor provides positive feedback. About one-third of employees say they are evaluated on their ethical conduct as part of their performance reviews; 38% say they don't know whether they are evaluated on ethical conduct. Less than half agree with the statement that the Port does not reward employees who get good results by using questionable means. Two-thirds say they are aware that the Port has a formal system to discipline employees who violate the Code of Conduct; 26% say they don't know about a formal discipline system. Three-quarters of those who did not report observed misconduct say it was because they did not believe corrective action would be taken. About half who did not report say it was because they feared retaliation from management. Data Source: 2011 Ethics and Resource Center Survey of Port of Seattle Employees. Highlights and Accomplishments During 2011, the Ethics Resource Center conducted a Port-wide survey to benchmark the Port's programs against national results and to establish a benchmark for measuring the Port's progress in building an effective program. The survey results were distributed by the CEO to all Port employees. The WRO plans for the Ethics Resource Center to conduct a follow-up survey in 2015. During the first quarter of 2013, the WRO and 17 Port employees began a review of the Code of Conduct/whistleblower intake, review, and investigation process to identify process improvements. In March 2013, the WRO produced the first Code of Conduct management reports for 2011 and 2012, and provided 2012 data to the Executive Team in May 2013. 8 of 15 Internal Audit Report Code of Conduct and Ethics Program April 1, 2010 - March 18, 2013 In April 2013, the WRO prepared a three-year work plan, through 2015. The timelines for some of the planned tasks are: o Orient managers on Code duties in fall 2013. o Publish revised Code of Conduct in January 2014. o Require annual signed Conflict of Interest Disclosure Certification (beginning in January 2014). o Publish Ethics and Compliance Annual Report in June 2013 and thereafter. Audit Scope and Methodology The scope of the audit covered the period from inception of Workplace Responsibility in 2010, through March 18, 2013. W e utilized a risk-based audit approach. We interviewed management and staff. We reviewed the Code of Conduct Handbook. We observed the deliberations of the review team. We analyzed the information in WRITS. We assessed significant risks and identified controls to mitigate those risks. We evaluated and tested whether the controls were functioning as intended. We conducted the following procedures to address our audit objectives: Objective 1 Helpline/Hotline We determined the visibility of these reporting vehicles on the Port's internal and external web sites. We compared the visibility of the Port's internet hotline to other public and private web sites. Code of Conduct Training We identified the 2012 new hires (176) and selected a representative sample of 74. As part of our control work, we determined whether training in the Code of Conduct was in compliance with the prescribed timeline of 60 days for permanent staff and 14 days for interns. We determined whether training in the Code was being refreshed at regular intervals. Applicability of Code Port Wide We gained an understanding of the applicability of the Code. We reviewed the Memorandum of Understanding (MOU) signed by represented work groups, wherein they acknowledged that they must report Code issues to the Workplace Responsibility office, and determined whether all represented work groups had signed the MOU. Intake/Investigations/Recommendations We gained an understanding of the processes and tested the controls affecting timeliness of intake, review, and investigations. 9 of 15 Internal Audit Report Code of Conduct and Ethics Program April 1, 2010 - March 18, 2013 We evaluated the timelines of investigations from open date to outcome date, to determine whether investigations were completed within a reasonable period of time. Workplace Responsibility Information Tracking System (WRITS) We determined how access to the system is controlled, how management ensures information is kept confidential, and whether system reports are accurate and provided timely to management. We obtained a report of access levels and determined whether appropriate to ensure confidentiality. We determined whether the 2011 and 2012 reports produced from WRITS by management were accurate and timely. Fraud Reporting We identified the issues in WRITS that could warrant reporting to the State Auditor's Office (SAO) and determined whether they were reported completely, accurately, and timely to SAO in the multi-owner extranet system, in accordance with RCW 43.09.185. Objective 2 We developed maturity models (Appendix C) based on the SEI Carnegie-Mellon Capability Maturity Model for the following aspects of the Code of Conduct: Training. Investigation. Objective 3 We conducted a survey (Appendix B) of members of the Association of Airport Internal Auditors (AAIA) to compare the Port's organizational placement of Workplace Responsibility with similar entities. Conclusion Given the relative youth of this program, it is operating at a reasonable level of maturity (Appendix C) and management controls are adequate. Organizational placement of Workplace Responsibility is comparable to the majority of similar entities (Appendix B). 10 of 15 Internal Audit Report Code of Conduct and Ethics Program April 1, 2010 - March 18, 2013 APPENDIX A CODE OF CONDUCT POLICIES AND STATEMENT OF VALUES The Code of Conduct Handbook includes the following policies: Employee Ethics and Conflicts of Interest, CC-1 Consultant Ethics and Conflicts of Interest, CC-2 Former Employee Ethics and Conflicts of Interest, CC-3 Gifts and Hospitality, CC-4 Fraud Awareness and Prevention, CC-5 Loss Prevention, CC-6 Electronic Systems, CC-7 Anti-Harassment, CC-8 Equal Opportunity, CC-9 Violence in the Workplace, CC-10 Substance Abuse, CC-11 Employment of Relatives, CC-12 Political Activities, CC-13 Reporting Concerns or Violations, CC-14 The Handbook also includes the Port's Statement of Values: We conduct business with the highest ethical standards. Our business practices reflect integrity, accountability, honesty, fairness, and respect at all levels. We honor our commitments to one another, the Community and our customers. We provide outstanding service and value to each other, our customers, the citizens of King County and the region we serve. We are capable, high-performing people who appreciate the privilege of public service. We practice open communication, innovation, collaboration and transparency in all interactions. We embrace the richness of a diverse workplace and support employee development. We encourage a healthy and diverse organization that enhances our contributions locally and globally. We are responsible stewards of community resources and the environment. We exercise care and wisdom in the use of both financial and natural resources. 11 of 15 Internal Audit Report Code of Conduct and Ethics Program April 1, 2010 - March 18, 2013 APPENDIX B ORGANIZATIONAL PLACEMENT Workplace Responsibility at the Port of Seattle is located in the Port's Legal Department. In order to benchmark this organizational placement, we asked the following questions of members of the Association of Airport Internal Auditors: 1. Does your organization have a department or group focused on workplace responsibility, compliance, or ethics? 2. If "yes," where is this department located in your organization, and to whom does the head of this department report? We received six responses: City State Organization Separate Department Orlando Florida Greater Orlando Aviation Authority No GOAA Chairman, Legal, or Florida Commission on Ethics Washington Virginia Metropolitan Washington Airports Authority Yes Ethics Officer (Autonomous) Reno Nevada Reno-Tahoe Airport Authority No Human Resources Department Austin Texas City of Austin Department of Aviation No Legal Department Minneapolis Minnesota Metropolitan Airports Commission No Human Resources Department Buffalo New York Niagara-Frontier Transportation Authority No Legal Department Based on the above, the organizational placement of Workplace Responsibility at the Port of Seattle comports with three of the six respondents, summarized as follows: Organizational Placement Results: Department No. Legal Department 3 Human Resources Department 2 Autonomous 1 12 of 15 APPENDIX C - MATURITY MODEL CHARACTERISTICS OF METHOD OF CONTINUUM EVOLUTION OUTCOMES CAPABILITY ACHIEVEMENT OPTIMIZING OPTIMIZING FEEDBACK Issue resolution strategy Issue management a source Increased emphasis on of competitive advantage taking and exploiting opportunities Potential for increased Increased quality costs is accepted to and productivity ensure process Rigorous management consistency and quality MANAGED QUANTITATIVE Methodologies/analysis Issue measured/managed Intensive debate on trade- quantitatively and aggregated off issues enterprise-wide Uniform process DEFINED QUALITATIVE/QUANTITATIVE Remaining components of Typical target zone: Policies, process and infrastructure Cost and performance standards defined and Rigorous methodologies management are institutionalized effectively balanced Common language REPEATABLE INTUITIVE Qualified people assigned Process repeatable, but Defined tasks dependent on individuals Initial infrastructure Likelihood of increased Increased risk costs due to process and variability Undefined tasks issues and inconsistency INITIAL AD HOC/CHAOTIC Relies on initiative Dependent on heroics, "Just do it" institutional capability lacking Reliance on key people APPENDIX C- MATURITY MODEL-TRAINING PRESENT-DAY PARTIAL TARGET MATURITY DEMONSTRATION MATURITY TRAINING What Are the What are the Business How Do the People & What Are the Systems What Management Reports AND Strategies and and Risk Management Organization What Methods Are Used? Used & Data Are Produced? OUTREACH Policies? Processes and Controls? Respond? Maintained? Close alignment of CC WRO monitors CC training, to Managers emphasize WRO externally publishes WRO keeps CC front-of-mind with The training system is OPTIMIZING training and CC outreach ensure it is occurring timely. importance of CC in all comprehensive Port-wide annual refresh of all CC policies. WRO sufficiently integrated with with Port-wide strategies. WRO establishes and aspects of work. metrics of CC training recognizes departments and staff for the CC system to correlate requires participation in a Employees keep CC top of compliance and attendance at achievements related to CC. Breaches adequacy of training with regular cycle of CC outreach mind in every aspect of their outreach programs. Less than of CC publicized. CC reported CC issues. events. jobs. 2% noncompliance. compliance/breaches included in performance evaluations. CC training and CC To augment training, WRO Managers include CC WRO internally publishes WRO uses Ethics Resource Center to The training system provides MANAGED outreach ingrained in maintains a web site, which discussions as part of comprehensive Port-wide benchmark employee awareness of CC entity level overview of CC Port-wide culture. answers questions and regular agenda at staff metrics of CC training against national results. The CEO training and CC outreach provides timely guidance on meetings. compliance and attendance at circulates benchmarking results Port- completed. ethics and CC. WRO conducts a regular CC outreach programs. wide. schedule of Port-wide Survey by Ethics Resource Center helps outreach. WRO establish frequency and areas of training. POTENTIAL FOR INCREASED COSTS ACCEPTED TO ENSURE PROCESS CONSISTENCY AND QUALITY A separate policy defines Workplace Responsibility Managers employ similar WRO and HR publish metrics by HR sends automated email alerts of Training status (completed DEFINED timelines for the CC Office (WRO) and HR require methods for ensuring department for timeliness of CC training exceptions to managers. or delinquent) is training and the planned CC training for all new staff training is completed timely. training. systematically collected schedule of CC outreach and interns. CC-8 Managers share with WRO and HR circulate results of within LMS. Employee and events. (Workplace Harassment) employees leadership leadership outreach Port wide. managers can access refreshed annually. outreach training. information at any time. TARGET MATURITY Code of Conduct (CC) Human Resources (HR) Each employee assumes HR alerts employees and HR monitors status of new-hire training. The Learning Management training part of new-hire conducts orientation and primary responsibility for managers when CC training not System (LMS) is the REPEATABLE expectations. introduces training completing the required CC completed on schedule. Managers employ disparate methods for repository for all required requirements. training. ensuring CC training completed timely. Port training. It is a "self- CC outreach conducted WRO posts outreach summaries service" database. ad hoc. WRO plans outreach for on its web site (e.g., Integrity leaders and other staff. Awareness Week) Port-wide training was Each department has its own Different work groups Oral and ad hoc written HR periodically emphasizes an issue HR retains evidence of INITIAL required related to processes for enforcing handle training differently. communications address and requires additional training. training in HR personnel INCONSISTENCY ethics, whistleblower and training on policies. Reliance on HR to ensure training requirements. files. Managers maintain other policies under HR compliance with training informal employee files. and EX at time of hire. requirements. INCREASED COSTS DUE TO PROCESS APPENDIX C- MATURITY MODEL- INVESTIGATIONS PRESENT-DAY PARTIAL TARGET MATURITY DEMONSTRATION MATURITY INVESTI- What are the Business GATIONS What Are the Strategies How Do the People & What Management What Methods Are What Are the Systems and Risk Management and Policies? Organization Respond? Reports Are Produced? Used? Used & Data Maintained? Processes and Controls? Investigation outcomes and Recognition of CC Executive provides Port- Software produces standard OPTIMIZING Executives use CC results to CC results are analyzed by recommendations are applied investigation results and wide annual message on reports (easily, timely, and strengthen a high integrity, department to identify high- consistently across positions and costs embedded in Port's Code of Conduct outcomes accurately), which provide continuous improvement performing and low-performing departments. Annual Report. and metrics. meaningful analysis of CC culture. and causes therefor. issues. Management reports are well WRO conducts post- Data capture includes relevant FOR INCREASED MANAGED Port managers use CC WRO revisits detailed Management shares investigation defined in relation to investigation assessments information to help analyze and QUALITY investigation results to help procedures regularly and results with work groups and meaningful metrics and are to ensure quality of resolve issues in relation to manage and incentivize refines to ensure working as brainstorms prevention. produced timely and investigations. factors that may contribute to employees. intended across all work accurately. CC issues. groups. POTENTIAL COSTS ACCEPTED TO ENSURE PROCESS CONSISTENCY AND Review team uses a formal CC investigations are Detailed procedures guide the Management and staff support Annual (currently biennial) checklist and decision tree Commercial software provides DEFINED incorporated into Port's investigation process across investigations and know what to reports of CC statistics to guide investigations and secure and confidential overall strategy for achieving work groups. Procedures vary expect during investigations. produced for executive team. to determine whether repository of all issues. Access excellence. depending on work group's Possibility of broader investigation to be can be assigned as low as TARGET own processes. distribution. conducted internally or read-only at the document level. MATURITY externally. Workplace Responsibility Code of Conduct (CC) CC-1 thru CC-13 provides CC Capable staff conducts Investigation results recorded Cross-functional review Information Tracking System REPEATABLE policies are applicable Port expectations. CC-14 provides investigations and coordinates with in WRITS and shared with team guides investigations. (WRITS - a SharePoint file) wide, but managers and staff framework for work groups. Oral briefings appropriate managers and contains event details. Hard apply the policies differently. reporting/investigating. provided throughout investigation review team. copy files continue to be process. maintained some in a WRO and some in Legal. Anti-harassment, drug-free INITIAL As issues arose, they were work place and whistleblower In addition to primary duties, staff in Investigation results shared HR and/or Legal guided Only hard copy investigation addressed. policies preceded Code of legal and HR conducted with parties involved. investigations. files maintained. Conduct. investigations. INCREASED COSTS DUE TO PROCESS INCONSISTENCY
Limitations of Translatable Documents
PDF files are created with text and images are placed at an exact position on a page of a fixed size.
Web pages are fluid in nature, and the exact positioning of PDF text creates presentation problems.
PDFs that are full page graphics, or scanned pages are generally unable to be made accessible, In these cases, viewing whatever plain text could be extracted is the only alternative.