The Document Isn't the Point
Picture yourself on your first day. Someone slides a forty-page code of professional conduct across the table, and you tuck it behind the health insurance paperwork without reading past the preamble. If you're a new associate at a law firm, that turns out to be a mistake you'll spend your career correcting. If you're a junior analyst at a financial services firm handed something nearly identical, numbered principles, a section on conflicts of interest, a preamble invoking integrity, you can probably leave it there. It will not be consulted again until a regulator asks to see it.
Both documents were drafted by serious people and approved by boards. The words are not that different.
The architecture underneath them is.
The puzzle isn't why bad actors ignore ethics codes. That's too easy, and too flattering to everyone else besides. The real question is why structurally identical documents, covering professions with similar financial temptations and similar organizational pressures, produce such radically different outcomes. A bar association's rules genuinely constrain what lawyers do. A bank's internal code of conduct, in most cases, constrains very little.
The Thing That Actually Does the Work
The mechanism that separates a living code from a decorative one is external enforcement with asymmetric consequences. Not internal. External.
Take the legal profession. A lawyer who bills fraudulently, represents conflicting interests without disclosure, or suborns perjury faces disbarment: the permanent loss of the credential that makes their entire career possible. The enforcement body, the state bar, exists independently of any law firm and has no financial interest in protecting the firm's revenue. The individual practitioner, not the institution, bears the terminal consequence.
A typical corporate ethics code works nothing like this. Enforcement is internal. The compliance department reports to the general counsel, who reports to the CEO, whose compensation is tied to results the code might inconveniently impede. Someone who raises an ethics violation through internal channels is, structurally speaking, complaining to the people most motivated to minimize the complaint. The asymmetry runs the wrong way: the institution absorbs any fine, and the individual who flags misconduct often absorbs the career damage. That isn't cynicism. It's just the incentive geometry, and it produces predictable results at predictable scale.
Two People, Same Temptation, Different Outcomes
Consider two professionals in adjacent fields. Call them Marcus and Diane.
Marcus is a certified public accountant working inside a manufacturing company. His employer asks him to sign off on revenue recognition that he believes is aggressive to the point of being misleading. His professional code, maintained by the AICPA and enforced through state licensing boards, says he cannot. If he does and it surfaces, he loses his CPA license. Not the job, not a bonus clawed back. The license. Every future employer in every jurisdiction will see the disciplinary record. His professional identity is the hostage, and everyone in the room knows it.
Diane works in the compliance function of a financial firm. She has an internal code of conduct that says something remarkably similar about accuracy and transparency. But if she refuses to approve a product structure she thinks is misleading, the decision goes up the chain. The chain has quarterly targets. She gets overruled, and six months later, quietly managed out for being difficult. The code didn't protect her, and it didn't stop the product.
The difference between Marcus and Diane isn't character. It's whether the enforcement mechanism has any independence from the institution it's supposed to police.
Why Medicine and Law Held, and Why That Was Never Inevitable
The professions that maintained genuinely constraining ethics codes share a particular historical origin: they built their enforcement infrastructure before corporate employment became the dominant mode of practice.
Medicine's ethical architecture, licensure, peer review, hospital credentialing, malpractice liability, was largely established when most physicians were independent practitioners. The code governed individuals, not employees. When corporate medicine expanded, the individual license remained the irreducible unit. A hospital can employ a doctor, but it cannot make the licensing board look the other way.
Law developed similarly. The attorney-client privilege and the duty of confidentiality aren't principles in a handbook. They're enforceable through sanctions, contempt proceedings, and disbarment. Courts are external to any law firm, and courts have the power to bite.
Engineering is the instructive counterexample. Engineers have codes too, including the famous obligation to hold public safety paramount. Most engineers are employees, not licensed independent practitioners in the same structural sense, and the enforcement gap shows. When engineers working on the Ford Pinto's fuel system raised concerns internally, the corporate cost-benefit calculus overrode them. The code existed. The architecture to enforce it against an employer's direct interest did not. The result was a car that behaved, under rear impact, like a poorly designed incendiary device.
What People Get Wrong About 'Culture'
The standard corporate response to ethics failures is to invoke culture. We'll improve the culture. We'll do ethics training. We'll hire a Chief Ethics Officer.
This misses the mechanism almost completely, and it is worth being direct: culture is downstream of structure. A firm can have genuinely good values and still produce systematic misconduct if the incentive architecture makes misconduct rational and disclosure dangerous. Conversely, a firm with mediocre values will produce reasonable behavior if the external consequences of misconduct are severe and certain enough. What ethics training almost never does is change the answer to the question every employee is implicitly running: what actually happens to me if I refuse?
The Chief Ethics Officer position deserves particular scrutiny. In most organizations, this person has no independent enforcement authority, no external accountability, and no power to impose consequences the CEO hasn't already approved. The role functions, structurally, like a pressure valve, absorbing complaints before they become regulatory problems. This isn't a criticism of the individuals who hold these positions, many of whom are serious people doing constrained work. It is a description of what the role is actually designed to do. Think of it as a smoke detector wired to muffle the alarm rather than sound it.
Real ethics infrastructure looks like independent audit committees with genuine separation from management, whistleblower protections with external legal teeth, and professional licensing that the employer cannot revoke. Those things are expensive and inconvenient and sometimes stop companies from doing profitable things, which is precisely why they work when they exist.
The Regulatory Substitute and Its Limits
For industries without strong professional licensing traditions, regulation sometimes fills the gap. Financial services regulators can bar individuals from the industry. Health and safety regulators can refer cases for criminal prosecution. Securities law creates personal liability for executives who sign fraudulent disclosures.
This is the right structural instinct. When it works, it works because it replicates the key feature of professional codes that survive: individual consequence, imposed by an external body, that the institution cannot absorb on the individual's behalf.
The limits are real. Regulatory enforcement is episodic, resource-constrained, and politically vulnerable in ways that professional licensing bodies simply are not. A bar association doesn't have its budget cut by a legislature friendly to law firms. A financial regulator might. That enforcement asymmetry, the thing that makes professional codes durable, is also what makes regulatory substitutes less reliable over time.
Then there's the capture problem, which gives this whole question its sharpest edge. Regulatory agencies and the industries they oversee develop relationships over years. Staff move between them. Information asymmetries favor the regulated. Professional ethics boards are not immune to this, but they carry a structural buffer: the members enforcing the code are also the people whose professional reputation suffers when the code becomes a joke. A bar association that routinely ignores attorney misconduct damages the credential it's selling to every attorney in good standing. The self-interest of the membership runs, at least partially, toward actual enforcement.
The Honest Question to Ask About Any Code
If you want to know whether an ethics code is real, don't read the preamble. Ask four questions.
Who enforces it, and do they have a financial interest in non-enforcement? What is the worst thing that can happen to an individual, not an institution, who violates it? Can the employer shield a violator from that consequence? And what has actually happened in documented cases where the code was tested?
That last question is the most clarifying. A code with a clean enforcement history and no public disciplinary cases is more likely a sign the code has never been tested than a sign it's working. Living codes leave a record: names, cases, sanctions, sometimes appeals. The paper trail of actual enforcement is what distinguishes a professional standard from a mission statement with better typography. No paper trail means no bites, and no bites means no deterrent, which means the number of future violations is already trending in one direction.
The uncomfortable conclusion is that most corporate ethics codes are not designed to constrain behavior under pressure. They are designed to demonstrate that the organization takes ethics seriously, which is a different project entirely, and a much cheaper one. The professions that resisted this slide did so not because their members were more virtuous, but because their enforcement architecture made virtue the path of least resistance. That's not an inspiring story about human nature. It is, though, an actionable one: fix the architecture, and the behavior follows. Leave it broken, and no amount of training will change what happens when the pressure arrives.