Watch the webinar on demand
What separates a Code of Conduct employees use from one that gets filed and forgotten? In this webinar, LRN's Jim Walton is joined by Lisa Card, Executive Director of Corporate Compliance at CVS Health, and Steve Caris, Senior Counsel at General Motors, to share practical insights on designing, formatting, and embedding a Code that works. Watch the full discussion below, then explore the key themes in this recap.
Most organizations have a Code of Conduct. Employees read it, or at least acknowledge that they have, and the box gets ticked. Job done.
Except it isn't.
That was the central theme of LRN's recent webinar, where compliance leaders from CVS Health and General Motors joined us to dig into the findings from our 2026 Global Code of Conduct Report, drawing on analysis of more than 1,000 codes worldwide and survey responses from approximately 2,000 employees. The webinar was moderated by Jim Walton, Director, Advisory Services, at LRN.
Here are the key themes that emerged.
Most Codes are found, but few are used
Nearly every employee surveyed works somewhere that has a Code of Conduct and asks them to acknowledge it, but acknowledgement isn't usage. Only one in four employees say they use their Code often or very often, and nearly one in four say it's difficult to navigate.
The problem isn't that organizations don't care. It's that most Codes are designed to be read once, not returned to. They sit in a drawer, physical or digital, rather than functioning as a live resource employees reach for when something doesn't feel right.
That's what's driving CVS Health's current redesign including, restructuring around corporate values, simplifying language, adding scenario-based Q&As and real-world examples, and building toward a "compliance hub": A one-stop intranet destination where the Code sits at the center, surrounded by linked policies, training, and resources.
Format is a compliance issue
Steve Cares, Senior Counsel on GM's compliance team, made the case for rethinking how employees receive the Code entirely and highlighting that the question isn't just what's in the document, it's how people actually access information today.
GM's refreshed Code launched this year as a web-based experience that’s searchable, navigable, with an embedded CEO video, that ties the code to broader GM culture and strategy. It also includes data analytics showing exactly how employees engage with it. Which sections get the most traffic? Which business units keep landing on conflicts of interest content? That data now drives targeted training decisions.
LRN’s 2026 report found that web-based codes are gaining ground, but PDF remains the dominant format, and roughly half of employees surveyed still receive a printed copy. For a compliance function trying to keep guidance current, that's a meaningful constraint.
Addressing AI in your Code
Only 1 in 10 of the Codes analyzed globally include specific guidance on artificial intelligence. Both CVS Health and GM have added AI sections to their codes, but both panelists cautioned against overreach.
The tension is real: AI risks are evolving faster than most organizations can update governance documents. Adding granular AI policy to a Code risks obsolescence before the ink is dry. CVS Health's approach in its new Code is to keep the AI section at a principles level, focused on how to think about emerging technologies, and link out to a dedicated AI governance site for up to date information.
GM's Steve Cares framed it as future-proofing: A Code should be evergreen enough to hold up without annual rewrites, but specific enough that employees find value in returning to it. The sweet spot isn't a rulebook. It's a framework for ethical decision-making that can flex as new risks emerge, including emerging areas like predictive markets, which are already on compliance teams' radar.
Training is necessary, but it's not sufficient
Seventy-eight perfect (78%) of employees receive Code of Conduct training. However, only 3 in 5 say their manager talks about the Code regularly and that gap widens as you move away from the C-suite toward frontline employees.
Training once a year isn't enough to keep a Code alive in an organization’s culture.
CVS Health takes a deliberately multi-channel approach: Regular compliance communications targeting specific topics, three-to-four-minute micro-learnings tailored to specific business lines, and Code principles included in performance reviews. Meanwhile, at GM, the web-based Code launch coincided with "Win with Integrity Week," and a compliance liaison program gives non-compliance employees the training to act as peer-level messengers within their teams.
The best Code is the one employees can use
Every research finding points to the same conclusion: An effective Code isn't about word count, page count, or legal coverage. It's about whether an employee facing an uncertain situation reaches for it.
That means a code written in language people can understand. Navigation that gets them to the right answer fast. Practical tools, such as decision frameworks, scenario Q&As, and realistic examples, that help employees know what to do when the answer isn't obvious. A surrounding communications ecosystem that keeps the Code visible and trusted year-round.
As Lisa Card, Executive Director of Corporate Compliance at CVS Health, put it, “If it's too dense to be digestible, people won't go back to it when they need to. The best codes balance substance with usability, not one at the expense of the other.”
The LRN's 2026 Code of Conduct Report includes benchmarking data across more than 1,000 Codes worldwide. Download it today.
