Codes of Conduct, Compliance and Governance

Introduction and Context

Organizational conduct is not secured by publishing a code of ethics alone. It depends on an integrated system of standards, leadership behavior, reporting mechanisms, investigation procedures, disciplinary practices, documentation, monitoring, and governance oversight. In human resource management, this system is strategically important because conduct failures can damage employee safety, organizational legitimacy, customer trust, regulatory standing, and enterprise value.

A modern conduct system must answer five questions:

1. What behavior does the organization expect and prohibit?
2. How can employees raise concerns safely and accessibly?
3. How will allegations be assessed, investigated, and resolved fairly?
4. How will the organization prevent retaliation and inconsistent discipline?
5. How will executives and the board know whether the system works?

The answers must be aligned with employment law, sector regulation, collective agreements, privacy requirements, whistleblowing protections, and the organization’s risk profile. Although legal rules differ across jurisdictions, the underlying governance principles are widely applicable: clarity, proportionality, independence, confidentiality, due process, documentation, and accountability.

Learning Objectives

By the end of this chapter, readers should be able to:

• distinguish a code of conduct from detailed policies and procedures;
• design a conduct architecture that connects values, rules, controls, and accountability;
• evaluate reporting channels and non-retaliation safeguards;
• plan fair, timely, and appropriately independent investigations;
• improve consistency in disciplinary decisions without creating mechanical outcomes;
• identify documentation, privacy, employment-law, and regulatory requirements;
• assess executive and board oversight of conduct risk; and
• critically evaluate emerging technology, including artificial intelligence, in conduct administration.

1. The Conduct Architecture

A code of conduct is a high-level statement of expected behavior. It normally expresses principles such as integrity, respect, safety, lawful competition, confidentiality, responsible use of assets, and avoidance of conflicts of interest. A policy translates a principle into more specific requirements. A procedure explains how a requirement is implemented. A control is a mechanism that reduces the likelihood or impact of misconduct.

These instruments should form a coherent hierarchy:

A common design error is to treat the code as a legal encyclopedia. Excessive detail makes it difficult to read and may cause employees to overlook the central standards. The code should be accessible, translated where necessary, and written in behavioral language. It should also identify where employees can obtain advice and report concerns.

Risk-based design

Conduct requirements should reflect the organization’s actual risks. A financial institution may emphasize market abuse, conflicts, customer treatment, and anti-money-laundering obligations. A hospital may emphasize patient safety, confidentiality, informed consent, and professional boundaries. A technology company may emphasize data protection, cybersecurity, intellectual property, algorithmic bias, and workplace respect.

A risk assessment typically considers:

• the seriousness and likelihood of possible misconduct;
• vulnerable groups and power relationships;
• geographic and legal differences;
• third-party and supply-chain exposure;
• previous incidents and near misses;
• incentives that may encourage rule breaking; and
• the effectiveness of existing controls.

The assessment should not be static. New products, acquisitions, remote work, restructuring, artificial intelligence, and regulatory change may create new conduct risks.

2. Theories and Frameworks for Conduct Management

Ethical culture and the “tone at the top”

Ethical culture concerns shared perceptions about what behavior is rewarded, tolerated, ignored, or punished. Senior leaders influence culture through formal communications, but their decisions are often more influential than their speeches. If a high-performing employee violates a rule and receives preferential treatment, employees may infer that performance excuses misconduct.

“Tone at the top” should therefore be supplemented by “mood in the middle” and “experience at the front line.” Middle managers translate principles into everyday decisions, while employees judge the system through their experiences of workload, targets, voice, and fairness.

Procedural justice

Procedural justice explains why employees are more likely to accept decisions when they perceive the process as fair, even when the outcome is unfavorable. Four features are especially important:

• voice: the person has a meaningful opportunity to provide information;
• neutrality: decisions are based on consistent and relevant evidence;
• respect: participants are treated with dignity; and
• trustworthy motives: decision-makers demonstrate good faith.

Procedural justice does not require organizations to accept every allegation or provide unlimited process. It requires a proportionate, unbiased, and explainable process.

Three lines of responsibility

A useful governance model assigns responsibilities across three lines:

1. First line—management and operations: own conduct risks, set expectations, supervise work, and address concerns.
2. Second line—compliance, ethics, risk, and HR: establish frameworks, advise management, monitor risks, and challenge weak practices.
3. Third line—internal audit: independently evaluates whether governance, risk management, and controls are designed and operating effectively.

The board and its committees provide oversight rather than replacing management. This separation helps prevent conflicts of interest and clarifies accountability.

3. Designing an Effective Code and Policy System

Essential content

A robust code commonly addresses:

• respect, dignity, inclusion, and freedom from harassment;
• health, safety, and wellbeing;
• conflicts of interest, gifts, hospitality, and outside activities;
• fraud, bribery, corruption, money laundering, and improper payments;
• competition and fair dealing;
• privacy, information security, records, and confidential information;
• responsible use of technology and organizational resources;
• accurate books, records, expenses, and reporting;
• interactions with customers, public officials, suppliers, and competitors;
• political activity and charitable contributions where relevant;
• speaking up, cooperation with investigations, and non-retaliation; and
• consequences of violations.

The code should distinguish between “must,” “must not,” and “should.” Mandatory requirements should be unmistakable. It should also explain that local law may impose stricter requirements and that employees should seek advice when rules conflict.

Policy governance

Policies require ownership. Each policy should have a named accountable owner, an approval authority, a review cycle, an effective date, a version history, and a method for communicating changes. A policy inventory prevents contradictory or obsolete documents. Policies should be reviewed after major incidents, legal developments, organizational changes, or control failures.

A policy is ineffective if it is available only on an intranet that employees cannot navigate. Accessibility includes plain language, searchability, translation, accommodations, mobile access, and practical examples. Training should focus on judgment and application rather than merely requiring employees to click “complete.”

Exceptions and local adaptation

Exceptions may be necessary, but they should be documented, time-limited, approved by an authorized person, and assessed for precedent and risk. Local adaptation is legitimate when required by law or cultural context, but it should not weaken core protections such as anti-retaliation, safety, or investigation integrity.

4. Reporting Channels and Speak-Up Systems

Employees may report concerns to a supervisor, HR, compliance or ethics office, an ombudsperson, a hotline, a designated safeguarding officer, a union representative, or an external authority where legally protected. Multiple channels are valuable because no single channel is trusted or accessible to everyone.

An effective reporting system has the following attributes:

• Accessibility: available across locations, languages, shifts, disabilities, and employment statuses.
• Independence: routes concerns away from implicated managers and allows escalation.
• Confidentiality: limits information to those who need it, without promising absolute secrecy.
• Competence: receives reports through trained personnel using consistent triage.
• Traceability: provides a case reference and allows status communication where possible.
• Safety: identifies urgent risks involving violence, self-harm, safeguarding, or evidence destruction.
• External access: permits legally protected reporting to regulators or law enforcement where applicable.

A reporting channel should not become a substitute for good management. Excessive reliance on anonymous hotlines may signal that employees do not trust supervisors. Conversely, a low volume of reports does not necessarily indicate ethical health; it may indicate fear, futility, lack of awareness, or weak detection.

Triage

Triage classifies an incoming concern according to urgency, seriousness, legal significance, conflict risk, and required expertise. A credible allegation of immediate physical danger requires a different response from a minor policy misunderstanding. Triage should preserve neutrality: an allegation is not a finding, and early classification should not predetermine the result.

5. Non-Retaliation Safeguards

Retaliation is adverse treatment because a person reported a concern, participated in an investigation, sought advice, refused improper conduct, or exercised a legal right. It may include dismissal, demotion, undesirable scheduling, exclusion, threats, poor evaluations, denial of opportunities, harassment, or subtle social punishment.

A non-retaliation program should include:

1. a clear prohibition covering direct and indirect retaliation;
2. protection for good-faith reports, including reports that are not substantiated;
3. interim risk assessments for reporters, witnesses, and subjects;
4. separation of reporting lines where conflicts exist;
5. manager training on prohibited responses;
6. periodic check-ins after case closure;
7. prompt investigation of alleged retaliation; and
8. consequences for retaliation that are visibly meaningful.

“Good faith” does not mean the report must be correct. It generally means the reporter honestly believes the information may indicate wrongdoing and is not knowingly fabricating it. Organizations should distinguish malicious fabrication from an unsubstantiated report; confusing the two suppresses legitimate voice.

6. Investigations and Due Process

An investigation is a structured fact-finding process, not a prosecution. Its purpose is to determine what can reasonably be established, identify control weaknesses, and support a proportionate response.

Investigation stages

Intake and preservation. Record the allegation, date, source, relevant policies, immediate safety concerns, and potential conflicts. Preserve relevant documents, messages, access logs, and other evidence in accordance with law and policy.

Planning. Define the questions to be answered, scope, investigators, interview order, evidence sources, confidentiality limits, and decision authority. Investigators should be competent and independent enough to resist pressure.

Evidence collection. Gather relevant evidence rather than only evidence supporting the initial allegation. Assess authenticity, completeness, reliability, context, and chain of custody where material.

Interviews. Use open questions before testing specific claims. Explain the purpose, confidentiality limits, non-retaliation protections, and expectation of truthful cooperation. Avoid promises about outcomes.

Analysis. Separate facts, inferences, credibility judgments, and policy interpretation. Consider alternative explanations and whether the evidence meets the organization’s stated decision standard, such as the balance of probabilities where permitted and appropriate.

Outcome and action. Communicate the outcome to the extent lawful and appropriate. The subject should understand the allegation and have a fair opportunity to respond. The reporter should receive appropriate closure information, although privacy rules may limit details about discipline.

Remediation. Address root causes, control failures, training needs, workload pressures, incentive problems, or management behavior. Closing a case without correcting systemic conditions is incomplete governance.

Confidentiality and privacy

Confidentiality should be described accurately. Information may need to be disclosed to investigators, decision-makers, legal advisers, regulators, insurers, or authorities. Personal data should be collected for legitimate purposes, accessed on a need-to-know basis, retained only as long as justified, and secured against unauthorized access. Cross-border investigations require attention to data-transfer and localization rules.

7. Disciplinary Consistency and Proportionality

Consistency means that materially similar cases are treated similarly, while relevant differences are recognized. It does not mean every violation receives the same penalty. Relevant factors may include:

• seriousness and actual or potential harm;
• intent, recklessness, or negligence;
• seniority and responsibility;
• prior conduct and disciplinary history;
• promptness of disclosure and cooperation;
• concealment or obstruction;
• impact on vulnerable persons;
• applicable law, contract, collective agreement, and policy; and
• whether the organization has treated comparable cases similarly.

A decision matrix can support consistency, but it should not operate as an automatic sentencing tool. Rigid matrices may conceal bias or produce disproportionate outcomes. Decision-makers should record both the general range and the reasons for departure.

HR should periodically conduct a consistency review, comparing outcomes by case type, business unit, manager, level, gender, race or ethnicity where lawful and ethically justified, employment status, and other relevant dimensions. Such analysis must protect privacy and avoid drawing conclusions from small or non-comparable samples.

Managers should not promise discipline before an investigation is complete. Nor should organizational status, revenue generation, or personal relationships create informal exemptions.

8. Documentation and Records Governance

Documentation enables continuity, accountability, quality control, legal response, and organizational learning. A case file commonly contains the intake record, triage decision, conflict checks, investigation plan, evidence log, interview notes, analysis, decision rationale, communications, remedial actions, and closure review.

Good records are:

• contemporaneous rather than reconstructed from memory;
• factual and precise rather than inflammatory;
• clear about allegation, evidence, finding, and action;
• secure and access-controlled;
• retained according to a documented schedule; and
• capable of showing why a decision was made.

Records should not include unnecessary speculation, discriminatory labels, unsupported credibility judgments, or informal commentary. Legal privilege, where recognized, should not be assumed merely because HR or a lawyer is involved; its availability depends on jurisdiction and circumstances.

Documentation must be balanced against privacy. Keeping everything forever increases risk and is not the same as good governance. Destruction holds may be required when litigation, investigation, or regulatory inquiry is reasonably anticipated.

9. Employment-Law and Regulatory Considerations

Conduct administration intersects with many legal domains. The exact duties vary by jurisdiction, but HR professionals should assess at least the following:

• anti-discrimination and harassment law;
• occupational health and safety;
• whistleblower and protected-disclosure regimes;
• wage, working-time, and employment-status rules;
• privacy and data-protection law;
• labor relations and collective bargaining obligations;
• due process requirements in public-sector or regulated settings;
• financial crime, bribery, competition, and sector-specific rules;
• accessibility and accommodation duties; and
• recordkeeping, reporting, and regulator-cooperation obligations.

A code cannot contract out of statutory rights. A confidentiality clause cannot lawfully prevent protected reporting where the law protects it. Monitoring employee communications may require notice, proportionality, a legitimate purpose, and safeguards. Investigations involving contractors, suppliers, volunteers, or customers may require different contractual and legal approaches.

Multinational employers face a recurring tension between global standards and local law. The organization should establish non-negotiable global principles, identify local variations, and provide jurisdiction-specific advice. Legal review is particularly important before disciplining employees, collecting sensitive data, interviewing witnesses across borders, or reporting matters to authorities.

10. Executive and Board Oversight

Boards should oversee conduct risk without micromanaging individual cases. Their responsibilities may include approving the code and risk appetite, ensuring adequate independence and resources, reviewing material allegations, monitoring trends, and holding executives accountable.

Useful board-level information includes:

• reporting volumes and channels, interpreted cautiously;
• time from intake to triage and closure;
• substantiation rates by category, with methodological caveats;
• retaliation allegations and outcomes;
• overdue or reopened cases;
• repeat issues and root causes;
• training completion and demonstrated understanding;
• disciplinary consistency indicators;
• high-risk third-party findings; and
• results of culture surveys, audits, and employee listening.

Metrics can mislead. A high reporting rate may reflect trust and accessibility rather than poor ethics. A low substantiation rate may reflect weak evidence, poor triage, or overly broad reporting. Boards should ask qualitative questions: Are employees safe to speak? Are powerful people held accountable? Are managers rewarded for ethical performance? Do remediation actions address causes rather than symptoms?

The chief ethics or compliance officer should have sufficient status, resources, access to the board or relevant committee, and protection from retaliation. HR, legal, compliance, internal audit, security, and risk functions should define escalation responsibilities and avoid gaps caused by unclear ownership.

11. Technology and Artificial Intelligence

Case-management systems can improve workflow, deadlines, access control, audit trails, and trend analysis. Automated text classification may help route cases, but it should not determine credibility, guilt, or disciplinary outcomes without meaningful human review.

AI creates several risks:

• biased classification based on historical case data;
• inappropriate inference from sensitive personal information;
• opaque recommendations that cannot be explained;
• over-collection or unauthorized use of employee communications;
• security and vendor-access weaknesses; and
• automation bias, in which decision-makers accept a system’s output uncritically.

Responsible use requires a defined purpose, lawful basis, data minimization, validation, human oversight, explainability appropriate to the decision, testing for disparate impact, access controls, vendor governance, and an appeal or correction mechanism. Organizations should not use generative AI to draft investigative findings from confidential data unless security, privacy, accuracy, and accountability requirements have been carefully addressed.

12. Illustrative Case: The High-Performing Regional Director

Background

Northstar Components, a fictional multinational manufacturer, has a global code prohibiting harassment, retaliation, falsification, and abuse of authority. Employees can report concerns to managers, HR, or an external hotline. The regional director of its largest sales unit consistently exceeds targets and is viewed as central to a planned acquisition.

Problem

Three employees separately report that the director humiliates staff in meetings, threatens undesirable assignments, and instructs sales personnel to record anticipated orders as confirmed revenue. Two witnesses fear retaliation. A local HR manager initially recommends “coaching” because the director is commercially important.

Analysis

The allegations involve possible harassment, retaliation risk, financial-reporting misconduct, and a senior leader’s conflict of interest in the process. The organization must not allow commercial importance to determine the outcome. The report requires immediate preservation of sales records and communications, an independent investigator, and interim safeguards for reporters and witnesses.

The compliance officer escalates the matter to the audit and ethics committee because financial reporting may be affected. The director is informed of the allegations at an appropriate stage and instructed not to contact witnesses about the investigation. The organization reviews comparable disciplinary cases and examines whether sales targets created incentives to misstate revenue.

Approach and solution

The investigation interviews reporters, witnesses, finance personnel, and the director; tests sales records against delivery evidence; and reviews messages and performance-management records. It finds that the director knowingly pressured employees to misclassify pipeline opportunities and retaliated against one employee who challenged the practice. The harassment allegations are partly substantiated.

Northstar removes the director from financial-reporting authority during the investigation, protects affected employees from schedule manipulation, corrects financial records, and imposes termination after applying its disciplinary framework. It also revises sales incentives, adds finance approval controls, provides manager training, and conducts follow-up checks with reporters.

Outcome and learning points

The case demonstrates that a conduct system must integrate ethics, HR, finance, legal, and governance. It also illustrates why low-level “coaching” is inadequate when allegations involve retaliation, financial integrity, and senior leadership. The board’s role is to ensure independence, challenge conflicts, and verify remediation—not to decide every factual question.

Challenges and Limitations

Conduct systems face persistent limitations. Employees may fear career consequences, investigations may rely on incomplete evidence, laws may conflict across borders, and confidentiality may constrain communication. Formal policies can also create an illusion of control while incentives and leadership behavior reward misconduct.

Organizations should avoid three extremes. First, excessive legalism can make the code unreadable and discourage judgment. Second, excessive informality can produce favoritism and unreliable records. Third, excessive measurement can reward the appearance of compliance rather than ethical performance. The strongest systems combine clear standards with human judgment, independent challenge, proportionality, and continuous learning.

Best-Practice Implementation Road Map

A practical implementation sequence is:

1. map legal, regulatory, strategic, and cultural conduct risks;
2. define values and behavioral expectations;
3. inventory and simplify codes, policies, and procedures;
4. establish reporting channels and triage standards;
5. implement non-retaliation and interim-safety protocols;
6. train investigators, managers, HR, compliance, and decision-makers;
7. create disciplinary guidance and consistency reviews;
8. establish secure records and retention controls;
9. define executive and board reporting;
10. test the system through audits, simulations, surveys, and case reviews; and
11. revise controls when evidence shows that the system is not working.

Chapter Summary

A code of conduct is one component of a broader conduct and governance system. Effective systems connect values, behavioral rules, policies, procedures, controls, reporting channels, investigations, discipline, documentation, and oversight. They are risk-based, accessible, legally informed, and supported by credible leadership.

Reporting systems must be independent, confidential within lawful limits, accessible, and protected against retaliation. Investigations should be impartial, proportionate, evidence-based, and properly documented. Disciplinary consistency requires comparable treatment while allowing relevant differences and avoiding automatic outcomes. Privacy and employment-law obligations shape every stage of case administration.

Executives and boards should monitor culture, case trends, retaliation, repeat issues, and remediation rather than relying on simplistic metrics. Technology can improve administration but cannot replace human accountability. Strategic HR professionals therefore act not merely as policy administrators, but as designers and stewards of organizational integrity.

Key Terms

Code of conduct: A high-level statement of expected and prohibited organizational behavior.

Compliance: Conformity with applicable laws, regulations, policies, standards, and commitments.

Conduct risk: The possibility that behavior or organizational practices will harm stakeholders or violate obligations.

Policy: A formal statement of required or prohibited practices in a defined area.

Procedure: A specified sequence for implementing a policy.

Control: A preventive or detective mechanism that reduces risk.

Speak-up system: The set of channels through which concerns and questions are raised.

Triage: Initial classification of a concern according to seriousness, urgency, and required response.

Retaliation: Adverse treatment because a person reported, participated, refused wrongdoing, or exercised a protected right.

Good-faith report: A report honestly believed to concern possible wrongdoing, even if not substantiated.

Procedural justice: Perceived fairness of the process used to reach a decision.

Investigation: A structured process for gathering and evaluating relevant facts.

Conflict of interest: A situation in which personal interests may improperly influence professional judgment.

Disciplinary consistency: Comparable treatment of materially similar cases.

Proportionality: Matching organizational response to seriousness and relevant circumstances.

Need-to-know access: Limiting information access to people who require it for a legitimate role.

Records retention: Rules governing how long records are kept and when they are securely destroyed.

Three lines model: Allocation of risk responsibilities among operations, oversight functions, and internal audit.

Tone at the top: Senior leadership’s influence on ethical expectations through words and actions.

Conduct dashboard: A structured set of indicators used to monitor conduct risks and system performance.

Review Questions

5 Short Answer Questions

1. Distinguish a code of conduct, a policy, a procedure, and a control.
2. Why does a low number of reports not necessarily indicate a healthy ethical culture?
3. Identify four safeguards against retaliation.
4. What is the purpose of triage in a conduct case?
5. Why should disciplinary matrices not operate as automatic sentencing tools?

5 Long Answer Questions

1. Explain how procedural justice can improve acceptance of conduct-related decisions.
2. Design a reporting and investigation system for a multinational organization with remote employees.
3. Discuss the relationship between documentation, privacy, legal privilege, and records retention.
4. Evaluate the responsibilities of HR, compliance, internal audit, executives, and the board under the three-lines model.
5. Explain how incentive systems and leadership behavior can undermine a formally comprehensive code of conduct.

3 Analytical / Application Questions

1. An employee reports harassment by a manager who controls scheduling and performance ratings. Develop an immediate-risk, non-retaliation, and investigation plan.
2. A company’s hotline reports have declined by 40 percent after a restructuring, while employee-survey trust scores also decline. Analyze possible explanations and recommend diagnostic actions.
3. An AI tool recommends high disciplinary risk for cases involving employees from one demographic group. Identify governance questions, testing requirements, and safeguards before the tool is used again.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes a code of conduct from a procedure?

A. A code states broad behavioral expectations, whereas a procedure specifies implementation steps.

B. A code is legally binding, whereas a procedure is never binding.

C. A code applies only to executives, whereas a procedure applies only to employees.

D. A code records evidence, whereas a procedure determines financial results.

Correct Answer: A. A code states broad behavioral expectations, whereas a procedure specifies implementation steps.

Question 2

What is the primary purpose of triage in a conduct-reporting system?

A. To determine guilt before an investigation begins.

B. To classify urgency, seriousness, conflicts, and required response.

C. To select the most severe disciplinary penalty.

D. To prevent the subject from learning that an allegation exists.

Correct Answer: B. To classify urgency, seriousness, conflicts, and required response.

Question 3

Which action most directly supports non-retaliation?

A. Promising the reporter a specific disciplinary outcome.

B. Providing periodic follow-up checks after case closure.

C. Automatically treating every report as substantiated.

D. Restricting all reports to the employee’s direct manager.

Correct Answer: B. Providing periodic follow-up checks after case closure.

Question 4

Why should a disciplinary matrix not be used as an automatic sentencing tool?

A. It prevents organizations from documenting decisions.

B. It makes all conduct policies unnecessary.

C. It may conceal relevant differences and produce disproportionate outcomes.

D. It eliminates the need for managerial judgment by law.

Correct Answer: C. It may conceal relevant differences and produce disproportionate outcomes.

Question 5

Under the three-lines model, which function primarily provides independent evaluation of governance, risk management, and controls?

A. Operations management

B. The compliance function

C. Human resources

D. Internal audit

Correct Answer: D. Internal audit

Question 6

Which statement about confidentiality in investigations is most accurate?

A. Confidentiality always guarantees that no information will be disclosed.

B. Confidentiality should be limited to people with a legitimate need to know, subject to legal requirements.

C. Confidentiality means the subject has no opportunity to respond.

D. Confidentiality permits permanent retention of every case record.

Correct Answer: B. Confidentiality should be limited to people with a legitimate need to know, subject to legal requirements.

Question 7

A low reporting rate may indicate weak conduct governance because it may reflect:

A. Perfect compliance in every business unit.

B. Fear, lack of awareness, or belief that reporting is futile.

C. Automatic substantiation of all complaints.

D. Excessive independence of the board.

Correct Answer: B. Fear, lack of awareness, or belief that reporting is futile.

Question 8

Which board-level question is most useful when reviewing conduct metrics?

A. How can all reports be reduced to zero?

B. Which individual should be punished before facts are established?

C. Are employees safe to speak and are powerful people held accountable?

D. Can the organization eliminate all investigation records?

Correct Answer: C. Are employees safe to speak and are powerful people held accountable?

Question 9

What is the principal governance risk of allowing an AI system to determine disciplinary outcomes without human review?

A. The system may produce biased or opaque decisions without accountable judgment.

B. The system will necessarily increase reporting accessibility.

C. The system will eliminate all privacy obligations.

D. The system will make policies easier to translate.

Correct Answer: A. The system may produce biased or opaque decisions without accountable judgment.

Question 10

Which factor is generally relevant when assessing proportional discipline?

A. The employee’s popularity alone

B. The organization’s desire to avoid all documentation

C. Intent, harm, cooperation, prior conduct, and comparable cases

D. The employee’s ability to generate revenue regardless of misconduct

Correct Answer: C. Intent, harm, cooperation, prior conduct, and comparable cases