Policy isn't risk management; what you need are actual controls.
Let’s say you’re buying a used car. What do you want to check on the car to make sure it’s safe? The lights? The windshield wipers? The tires? You’d want to check all these things. And then you’d check the documentation, like an accident report, and probably test drive it. But most importantly, you’d want to check the sticker on the top left of the windshield that says when the oil change is due, and never buy a car without that sticker.
Does that not make sense? Neither does saying “I won’t go to a larp without a Code of Conduct.” Because a Code of Conduct is the oil change sticker of larp.
Before we get into it: Sinking Ship Creations has a Code of Conduct. We’re not saying you shouldn’t have one, or that it hurts to have one. In fact, we think you should. However, a Code of Conduct is one of the least effective risk controls in larp.
This is because a Code of Conduct is, from a risk management perspective, just a policy letter. It says “we do this.” Which is great, but saying you do something is drastically different than doing it. Further, it’s not even a regulation (which is among the least effective risk controls). A regulation has a penalty for breaking a rule, and a method of enforcing that penalty. So if your policies don’t describe the consequences of disregarding the policy, and the system you’ll use to discover and penalize Code of Conduct violations, then it’s not even really an effective risk control.
Further, Code of Conducts only deal with something called malfeasance… malicious acts by people that cause hazardous situations. The bad actor will probably not read the Code of Conduct and decide to change their ways. You need controls to reduce the likelihood and severity of malfeasance, and these are usually designed into your larp. Probably the best way to protect against malfeasance is gatekeeping… it’s a dirty word in some circles, but when you see a larp with an application process, that’s what they’re doing. They’re creating a gate to screen for bad actors in order to reduce the likelihood of malfeasance. Now, compare the effectiveness of an application process to the effectiveness of a Code of Conduct, and you’ll see the point we’re trying to make.
Instead of risk control, the purpose of a Code of Conduct is really transparency. It’s an important part of the risk management process, because it allows the participant to make a risk-aware consent decision: they should be able to read the Code of Conduct and understand what will happen if there’s an act of malfeasance. As such, a Code of Conduct should be one of the last things developed in a risk management system, along with all other policy letters. Ideally, they should describe key parts the system used to reduce risk. A participant can review the Code of Conduct, get an idea about the risk controls in place, and decide, “do I want to play in this larp?”
You probably already do this, but instead of doing it consciously, you’re looking for unwritten indicators that you trust the process. That’s why a Code of Conduct became necessary for larps in the first place: they’re a sign that the designers at least have made a statement about malfeasance. Specific parts of the policy (such as an anti-harassment statement) speak to specific concerns important to participants. Most Codes of Conduct don’t actually reflect the effectiveness of a risk management system, as much as they do a designer’s commitment to safety… which is a vital first step.
There are great Codes of Conduct out there. The gold standard might be Big Bad Con’s Community Standards, which includes nine bullet point statements. Each statement consists of an expectation, and then an example of how to meet that expectation. These standards aren’t an example of regulation, but rather of training… it tells you what to do and then explains how to do it. As training is a more effective risk control than regulation, Big Bad Con’s Community Standards actually become a tool for reducing risk, instead of a statement about malfeasance.
That oil sticker is important: it’s a great reminder to change your oil, and missing an oil change is a surefire way to kill your engine. But you put the sticker on after you do an oil change as a reminder to continue doing your scheduled maintenance, not with the expectation that sticker is going to make the car safer in and of itself.