Ethics and Norms — The Undocumented Territory── what no SOP can write, and why it still matters

01Why ethics and norms deserve their own chapter

Ask a pharma compliance officer what her job is, and the honest answer begins with documents: laws, guidelines, SOPs, internal policies. Ask her what actually prevents misconduct, and the honest answer is more complicated.

Rules define the floor — the minimum below which behavior cannot legally fall. They cannot, by design, describe the ceiling. They cannot anticipate every situation. They cannot make a person genuinely care about a patient they have never met. And they cannot make a salesperson hesitate before a gray-zone action that is technically permissible but clearly wrong.

That gap — between what is written and what is right — is the territory this chapter addresses. It does not appear in any regulatory dossier. It does not have a section number in the ICH guideline index. But experienced practitioners know it well. They know it because they have watched colleagues cross it, and they know it because they have sometimes stood at its edge themselves.

"The best compliance programs I have seen," a former industry regulator once said, "were ones where people would have behaved the same way even if no one was watching. That is the definition of ethics. Rules are for when ethics has already failed."

02Documents vs ethics — where they diverge

Documents and ethics serve different masters. Understanding that difference is the prerequisite for making them work together.

Documents fail at the edges — at situations that didn't exist when the policy was written. Ethics fails at the center — when the norm is clear but the individual rationalizes an exception. Both failures are real. Neither document nor conscience alone is sufficient.

The key insight: documents are an attempt to codify ethics that already existed. The JPMA Code didn't create the norm that physicians should not be offered lavish entertainment; it recorded a norm that the industry had already established through hard experience. When the document is removed, the norm should survive. When the norm collapses, no number of documents will substitute.

03Industry norms — codes that are more than documents

Four major industry codes shape pharmaceutical conduct globally. Each deserves more than a citation.

JPMA Code of Practice

Japan's Pharmaceutical Manufacturers Association Code governs interaction between member companies and healthcare professionals: information provision, entertainment limits, grants, speaking fees. Compliance with the JPMA Code is voluntary in a legal sense — no regulator enforces it directly. But that voluntariness is precisely the point. The industry chose to self-regulate because the alternative — external regulation that is less nuanced and harder to evolve — serves neither patients nor the industry well. When companies follow the code because they believe in it, not because they fear inspection, the code functions as ethics. When they follow it only to pass audit, it is just another document.

IFPMA Code of Practice

The International Federation of Pharmaceutical Manufacturers & Associations Code applies globally, setting a baseline above which member national associations must operate. It covers promotional practices, patient organization support, clinical research interactions, and the disclosure of transfers of value to healthcare professionals. The IFPMA Code matters because it represents the industry's attempt to speak with one voice across vastly different regulatory environments — an exercise in establishing shared ethics where shared law does not exist.

EFPIA Code

Europe's pharmaceutical industry association operates a transparency code and a code on promotion. The disclosure requirements — public databases of payments to physicians and patient organizations — make ethics visible in a way that self-regulation alone cannot. This is an important architectural choice: when norms are made transparent, they become harder to violate quietly.

PhRMA Code on Interactions with Healthcare Professionals

The United States code emphasizes that interactions with HCPs must primarily benefit patients and enhance the practice of medicine. Its prohibition on gifts of no educational value — including branded merchandise — reflects an understanding that small gestures accumulate into relationships that bias prescription behavior. The norm here is not "no bribery" (that is law). The norm is "no relationship built on benefit rather than science."

What all four codes share: they go beyond what law requires. They exist because the industry recognized, over decades of scandal and reform, that law is a lagging indicator. By the time a practice is banned by statute, damage has already been done. Codes are the industry's attempt to move faster than law.

04Peer respect among competitors

One of the most underappreciated ethical norms in pharma operates between competitors. Companies compete fiercely for market share, pipeline talent, and regulatory advantage. Yet certain forms of mutual respect persist — and their erosion signals something deeper than a business problem.

Patent landscape courtesy

Patent disputes are common and often adversarial. But experienced IP professionals recognize an implicit norm: you do not design around a competitor's patent in ways that are technically legal but obviously violate the spirit of the protection. This is not law. It is a professional understanding that the patent system functions only if participants respect its purpose, not just its letter. Companies that routinely push this boundary find themselves regarded with wariness by partners, licensees, and regulators alike.

Co-marketing and co-promotion restraint

When two companies co-promote a product, or when a product approaches the boundary of another's indication, the norm is one of restraint. Aggressive expansion into overlapping clinical territory — even when legally permissible — damages working relationships that the industry depends on for future collaboration. A company that maximizes short-term competitive advantage at the expense of long-term industry trust is a company that no one wants to partner with.

Recall mutual aid

Perhaps the clearest example: when a company issues a significant safety recall, competitors have historically pulled back aggressive sales activity in the same category, at least temporarily. There is no rule requiring this. It is a norm of professional solidarity — an acknowledgment that when patient trust in a drug class is damaged, it damages everyone in that class. Companies that exploit a competitor's recall for immediate commercial gain are noted, remembered, and dealt with accordingly in future negotiations.

05Gray-zone judgment — by what standard?

The most difficult compliance situations are not the clear violations. Those are easy — you recognize them and stop. The hard situations are the ones where the rule is silent, the business pressure is real, and the path of least resistance is also the wrong path.

Experienced practitioners use several heuristics in these situations. None of them is a rule. All of them are ethics in practical form.

The front-page test

If this action were described accurately in a newspaper article tomorrow morning, would the company be comfortable? This is not a test about legality. It is a test about whether the action is defensible to a reasonable outside observer. Many actions that pass a legal review fail this test. Compliance is not the same as not getting caught.

The grandmother test

Could you explain this to a family member with no industry knowledge and have them regard it as obviously appropriate? If the explanation requires technical qualifications and careful framing to make the action look acceptable, the action probably isn't. This heuristic is particularly useful for cutting through rationalization.

The patient-centered question

Does this action serve patients, or does it serve the organization at patients' expense? This is not always easy to answer — organizational interests and patient interests usually align, because long-term business success requires patient trust. But in the short run, they can diverge. When they do, the patient-centered answer is the ethical one.

Industry common practice — and its limits

A fourth heuristic is industry common practice: "does everyone do this?" But this one comes with a warning. Common practice can be a valid reference point when it reflects accumulated professional wisdom. It becomes a rationalization when it is used to justify conduct that has simply never been examined. Drug industry history contains many examples of practices that "everyone did" — until they became the subject of a regulatory action or a damage lawsuit. "Everyone does it" is not an ethical defense. It is a description of a norm waiting to be challenged.

06Culture and ethics — the global firm challenge

Global pharmaceutical companies face a specific ethical tension that no policy document can fully resolve: the norms that feel natural in one national culture can feel aggressive, passive, or simply wrong in another.

Japan's professional culture places high value on indirect communication, hierarchical deference, and relationship maintenance over direct assertion. A Japanese medical affairs professional may feel it is inappropriate to correct a senior physician's misstatement about a drug, even if the misstatement could affect patient safety. The ethical norm — correct the record — is clear. The cultural norm — defer to seniority — pulls against it.

Western corporate cultures, particularly American ones, tend to value directness and individual accountability. A compliance officer trained in this mode may view a Japanese colleague's careful indirectness as evasion. The same behavior reads as professionalism in one context and as a problem in another.

Neither norm is wrong. Both create ethical risk when exported unchanged into a context that operates by different rules. The solution is not to pick one culture and impose it. The solution is to build explicit bridges: clear escalation paths, psychological safety for raising concerns, and leadership that genuinely invites disagreement from all directions.

Global companies that take this seriously invest in cross-cultural compliance training that goes beyond translation. They train managers to recognize that a compliant silence in Japan may be a different thing than a compliant silence in Germany. This is ethics as organizational design, not just personal virtue.

07The five-layer model

A useful framework for understanding how documents and ethics relate is to think in layers. Each layer has a different source of authority and a different failure mode.

The pyramid is deliberately inverted from a typical hierarchy diagram. The base — regulation — is the foundation that everything else rests on. But the structure's strength comes from the layers above, which do the work the base cannot.

Regulation sets the floor. Industry codes set a higher floor for members. SOPs translate codes and regulation into operational procedure. Ethics fills the gaps between all the above. Norms extend ethics into the professional community, creating social accountability for behavior that no document can reach.

The system breaks when layers are bypassed. A company that relies entirely on SOPs without building an ethical culture will find that employees comply in letter and violate in spirit. A culture that dismisses documents as bureaucracy will find that its genuinely good intentions are no defense against regulatory action. Both extremes fail. The five layers must work together.

08New norms in the AI era

The compliance landscape has always evolved in response to new technology. The AI era is producing a new category of ethical challenge: situations where the norms do not yet exist, the documents are still being drafted, and practitioners must make real decisions today.

Attribution and transparency

When an AI tool drafts a medical information document or a promotional piece, who is responsible for its accuracy? The current norm — still forming — is that the human who submits the document bears full accountability. AI assistance is not a defense. But this norm is under pressure from tools that are increasingly autonomous, from organizations that are cutting human review time under cost pressure, and from regulatory systems that have not yet fully caught up.

The emerging standard among responsible companies is explicit: any content that will be used in patient- or HCP-facing contexts must be reviewed by a qualified human, regardless of how it was generated. This is not yet law in most jurisdictions. It is a professional norm that serious practitioners hold because they understand the alternative.

Shared industry understanding on AI use

Industry associations are actively developing guidance on AI in pharma. IFPMA, EFPIA, and JPMA have each signaled that AI-generated content in promotional and medical contexts will be subject to the same ethical standards as human-generated content. The principle is consistency: the ethical standard applies to the output, not the method of production.

What does not yet exist is clarity on AI in drug discovery, clinical trial design, and pharmacovigilance. In these areas, norms are forming through professional discourse — conference presentations, journal discussions, regulatory consultations — rather than through formal documents. Practitioners in these areas are, right now, making ethical choices that will define the norms their successors inherit.

Data and patient privacy norms

AI systems in healthcare consume patient data at scale. Legal frameworks (GDPR, APPI, HIPAA) set floors. But the ethical questions go further: should a company use real-world patient data in a way that is technically permitted but that patients would find surprising? The norm here, articulated clearly by data ethics scholars and forming gradually in practice, is that permissible use and ethical use are not the same thing. The standard is not "could we?" but "would the patient, fully informed, find this reasonable?"

09Three challenges that remain unresolved

Acknowledging progress is important. So is acknowledging what remains genuinely hard.

The measurement problem

Documents can be counted, audited, and verified. Ethics cannot be measured the same way. A company can demonstrate that 100% of employees completed the annual compliance training. It cannot demonstrate that 100% of employees would make the right decision at 5 p.m. on a Friday when no one is watching and the business pressure is real. The metrics that are easy to collect are not the ones that matter most. Building meaningful proxies for ethical culture — employee survey data, speak-up rates, time-to-report on potential violations — is an active area of research, with no settled answer.

The global consistency problem

Large pharmaceutical companies operate across fifty or more countries, each with its own regulatory environment, cultural norms, and business context. Maintaining consistent ethical standards across that diversity is genuinely difficult. Not because local teams lack integrity, but because integrity itself looks different in different contexts. The companies that handle this best tend to have strong home-country ethical cultures that serve as reference points, combined with genuine respect for local variation rather than cultural imperialism. Getting that balance right is an ongoing leadership challenge, not a solved problem.

The short-term pressure problem

Ethical behavior in pharma often requires accepting short-term cost for long-term benefit: pulling a product that might still be safe but probably isn't, disclosing adverse event data that will hurt a drug's commercial prospects, declining a business opportunity that would benefit from a gray-zone interpretation of the rules. These decisions are easier when the company is financially healthy and the executive team has job security. They are harder under earnings pressure, product pipeline stress, or leadership transition. The ethical culture that functions well in good times is the one worth having. The test is whether it holds when the incentives are reversed.

10Connections to other chapters

Ethics and norms do not stand alone. They are the connective tissue between the other compliance topics covered in this series.

• Compliance 01 — Life-Related Industry: The five walls between pharma and patients (information, institution, economics, time, psychology) are precisely the terrain where ethics operates. Documents can acknowledge the walls; ethics determines whether they are exploited or respected.
• Compliance 02 — Social Trust: Social trust is the outcome that ethical behavior is building toward. Norms are its operational form — the practices that, when consistently followed, make trust credible.
• Ad Regulations: The JPMA Code and its global equivalents are, at their core, ethics documents that were formalized into codes. Understanding the ethical reasoning behind the rules makes those rules easier to apply correctly in situations the rules didn't anticipate.
• Ethics series: The ethics articles on this site examine foundational questions — patient rights, historical background, research ethics — that underlie the norms discussed here. The compliance series and the ethics series are two angles on the same terrain.
• Material Review: Review processes are where document-based compliance and ethical judgment meet in practice. A reviewer who understands only the checklist will miss violations that a reviewer who understands the underlying ethics will catch.