My thoughts are that rather than keeping all of the information in a single string, a stored procedure would build a dataset that has either one row per code, or one field per code. In order to do one field per code, you would have to define up front the maximum number of possible codes to include in the report. To do one row per code would be a little trickier, but it would be easier to expand and report on.
-Dell