Compliance. Good written policies are just that, written policies. To protect your firm, you must have compliance. First, compliance requires knowledge. That, in turn, means that the members of the CI staff should be trained on legal and ethical issues and that training should be renewed on a regular basis. Also, the current and future end users of CI should also be trained on these issues to avoid having them accidentally place a CI staff member in the position of violating legal or ethical concerns.

Second, CI staff members should be encouraged to discuss specific ethical concerns with a supervisor or, if that is not possible or appropriate, with another person outside the reporting relationship chain in which they are located. Specifically, CI staff members should be allowed, or even encouraged, to contact a designated, trained, and educated member of the legal team with any concerns they may have.

Third, CI staff should make sure that contractors, consultants, and other third parties whose services they use have a formal policy dealing with the collection of CI data. That policy should be reviewed before any contract is signed or work begun. Then, the contractor should be made aware of the company's policies and agree, in writing, to be bound by them. If company policies and contractor policies are in conflict, then the best solution is to have the contractor bound by the stricter of the policies.

Fourth, every contractor should also agree that any work it subcontracts will be subject to the same standards. Asking to see any subcontracting agreements is a good way to protect your firm here.

Fifth, if necessary, contractors should be encouraged, or even required, to participate in company-approved training on legal and ethical issues.

Sixth, as with employees, contractors should be able to contact someone out of their reporting chain with any serious concerns about ethical or legal problems. Just as an overzealous end user might pressure a CI staff member into improper activities, it is possible that an overzealous CI staff member's actions could apply the same pressure to an outsider.

Personal Ethical Considerations. Remember, one role for your firm's policy is to help employees resolve whether their actions, or planned actions, violate the law or your firm's formal policies involving legal or legal and ethical considerations. If the actions would be in violation, then they should not be permitted or undertaken. Only an action that is permitted under all the relevant laws and your own firm's policies can involve a personal ethical question.

In resolving whether personal ethical issues are raised, consider the following guidance:

• If the action doesn't feel right, don't do it.

• If it could damage a business relationship, don't do it.

• If you or the firm would be embarrassed/ashamed if your conduct was published on the front page of the newspaper, don't do it.

• If there is an alternative way of gathering information that produces equal or greater benefits to the parties affected by the proposed action and does not raise any questions in your mind, you should use the alternative.