Code of Conduct

A code of conduct is a formal document that sets out the specific rules, behaviours, and standards expected of employees, contractors, and stakeholders at an organisation.

Code of Conduct is a formal document specifying the rules, behaviours, and standards expected of all employees, covering harassment, conflicts of interest, confidentiality, anti-corruption, and consequences for violations.

Code of conduct vs code of ethics vs code of practice: the three-way distinction

These three terms are routinely conflated. Each has a distinct meaning and purpose.

Practical relationship: the code of ethics provides the values foundation; the code of conduct operationalises those values into rules; external codes of practice provide regulatory guidance the organisation must align with. Mature organisations maintain all three layers as a coherent stack.

Standard code of conduct structure

1. letter from leadership

CEO opens the document with a personal message about conduct expectations and leadership accountability. Sets the tone from the top.

2. purpose and scope

Who the code applies to (employees, contractors, board members, partners), when it applies, and the consequences of not following it.

3. workplace conduct

• Anti-discrimination and equal opportunity
• Anti-harassment (including sexual harassment, bullying, workplace violence)
• Diversity, equity, and inclusion expectations
• Reasonable accommodation and workplace safety

4. business integrity

• Anti-corruption and bribery (FCPA in US; UK Bribery Act)
• Gifts and entertainment thresholds
• Conflicts of interest and insider trading
• Fair competition and antitrust

5. information and resources

• Confidentiality and trade secrets
• Data privacy (GDPR, CCPA, sector-specific)
• Intellectual property
• Use of company property and records management

6. external communications and social media

• Social media use (personal and professional)
• Public statements and media contact
• Political activities and contributions

7. reporting and protection

• How to report concerns (hotline, manager, HR, ethics officer)
• Whistleblower protection commitments and non-retaliation policy
• Investigation process

8. consequences and enforcement

• Range of disciplinary actions for violations
• Process for investigation, discipline, escalation, and appeal

9. acknowledgment

Employee acknowledgment of receipt, reading, and commitment to follow the code. Typically signed annually.

Sarbanes-oxley section 406 (US public companies)

For US public companies, Sarbanes-Oxley Section 406 imposes specific code-related obligations:

• Disclosure obligation. Companies must disclose in annual reports whether they have a code of ethics applicable to the CEO, CFO, principal accounting officer, and similar functions.
• Substantive requirements. The code must promote honest and ethical conduct, accurate disclosures in SEC reporting, compliance with laws, internal reporting of violations, and accountability for adherence.
• Waiver disclosure. Any waivers granted to executives must be disclosed within 4 business days (Form 8-K).
• Stock exchange requirements. NYSE and NASDAQ listing rules require codes of business conduct applicable to all directors, officers, and employees.

Doj evaluation of corporate compliance programs

The DOJ’s ‘Evaluation of Corporate Compliance Programs’ guidance (updated 2024) asks three fundamental questions about codes of conduct:

1. Is the program well-designed? Does the code clearly articulate values, expected behaviours, and consequences? Is it accessible and informed by risk assessment?

1. Is the program adequately resourced and empowered? Are the compliance function and ethics officers appropriately resourced and independent?
2. Does the program work in practice? Are violations actually identified, investigated, and addressed? Is there evidence of fair and consistent enforcement?

A code of conduct that exists only as a document, without supporting training, reporting infrastructure, investigation capability, and enforcement track record, provides limited compliance protection.

Implementation playbook: 9 steps

1. Conduct a risk assessment. What conduct risks does the business actually face? Industry-specific, geography-specific, role-specific. The code should reflect these.

1. Involve stakeholders in drafting. Legal, HR, compliance, business leaders, employee representatives. A code drafted only by lawyers produces unusable documents.
2. Use plain language. Codes that read like legal documents fail to change behaviour.
3. Include examples and scenarios. ‘What would you do if…’ scenarios help employees apply the code to real situations.
4. Train employees substantively. Annual online training is the floor; role-specific training and scenario-based workshops are more effective.
5. Provide multiple reporting channels. Hotline, online tool, manager, HR, ethics officer. Multiple channels increase reporting rates substantially.
6. Investigate and discipline consistently. Consistent enforcement across all seniority levels is the credibility of the code.
7. Refresh regularly. Annual review minimum; faster when regulations change (EU AI Act effective August 2026, evolving data protection rules, social media developments).
8. Measure and report. Hotline volumes, investigation timelines, disciplinary outcomes, training completion. Board-level reporting demonstrates program effectiveness.

Common code of conduct failures

• Generic boilerplate. Cookie-cutter codes copy-pasted from templates produce no behaviour change; auditors and DOJ see through them.
• Inconsistent enforcement. Senior leaders exempted from rules applied to others. The fastest way to destroy code credibility.
• No reporting infrastructure. Code says ‘report concerns’ but no operational reporting channel; or channels exist but no investigation follows reports.
• Stale content. Code unchanged for 5+ years; does not address social media, AI, hybrid work, modern data protection. Loses currency.
• Code without training. Acknowledgement signature without substantive training; employees do not know what the code says or how to apply it.

See also Code of Ethics for the paired values document, Code of Practice for external statutory codes, and Best Practice Policy for HR policy framework.

Frequently asked questions