Category: Ethics and Conduct

Code of Conduct

Also known as: Code of Business Conduct, Code of Ethics and Conduct

Simply put

A code of conduct is a formal document that sets out the standards of behavior an organization expects from its people, expressing its commitment to responsible and ethical practice. It broadly establishes expectations for how individuals should act and conveys the organization's values. It typically serves as a foundational reference point from which more detailed policies and procedures follow.

Formal definition

A code of conduct is an articulated statement of the values, standards, and responsibilities that govern an organization's conduct, generally establishing expectations for the behavior of directors, officers, employees, and sometimes third parties. It typically functions as a foundational compliance document from which more specific policies and procedures derive, and conveys the organization's commitment to responsible practice. In many organizations it forms part of the broader compliance framework, though its content, scope, and legal or regulatory status vary by jurisdiction, sector, and entity type; adoption may be voluntary or, for certain entities, expected under applicable listing rules or governance codes. This entry is educational and not legal, audit, or compliance advice.

Why it matters

A code of conduct is often the most visible expression of an organization's values and its commitment to responsible and ethical practice. It typically serves as the foundational reference point, sometimes described as the "house" from which more detailed policies and procedures follow, that broadly establishes expectations for how directors, officers, employees, and sometimes third parties should behave. Because it sits at the top of the policy hierarchy in many organizations, its clarity and credibility can shape the tone at the top and influence how seriously the rest of the compliance framework is taken.

For boards and senior management, the code is a means of articulating standards of behavior and conveying a commitment to integrity and accountability. It can help set consistent expectations across an organization and provide a common point of reference when questions of conduct arise. However, a code's practical value depends heavily on how it is embedded, communicated, and reinforced; a document that is adopted but not lived tends to offer limited protection.

The legal and regulatory status of a code varies considerably. In some cases adoption is voluntary, while for certain entities it may be expected under applicable listing rules or governance codes, and requirements differ by jurisdiction, sector, and entity type. Organizations should therefore treat the code as one element of a broader governance and compliance framework rather than a standalone solution, and confirm what is actually required in their specific circumstances.

Who it's relevant to

Boards and board committees

The board, often supported by a relevant committee, typically holds oversight responsibility for the organization's values and culture and may approve the code and review it periodically. As an oversight matter, the board is generally concerned with whether the code reflects the organization's values and whether management has systems to support it, rather than with day-to-day implementation.

Chief compliance officers and compliance functions

Compliance functions are frequently involved in drafting, maintaining, and communicating the code and in developing the more specific policies and procedures that derive from it. Because the code often serves as the foundational document within a broader compliance framework, its clarity affects the coherence of the policies beneath it.

General counsel and legal teams

Legal advisers help confirm whether a code is voluntary or expected under applicable listing rules or governance codes for a given entity, and assist in aligning its content with obligations that vary by jurisdiction, sector, and entity type. This entry is educational and does not substitute for such advice.

Management and employees

Management is typically responsible for embedding the code operationally and modeling the standards it sets, while employees are generally expected to understand and act consistently with it. Because the code broadly establishes expectations for behavior, it commonly serves as the reference point individuals consult when facing questions of conduct.

Internal audit and assurance functions

Assurance functions may assess whether processes supporting the code exist and are operating as intended. Such work generally focuses on the systems around the code rather than substituting for management's ownership of conduct standards.

Inside Code of Conduct

Statement of Values and Ethical Principles

A high-level articulation of the organization's core values and expected standards of behavior, typically framed in principles-based language that guides conduct rather than enumerating every specific rule.

Scope and Applicability

A description of who is covered, which may extend to directors, officers, employees, and in some cases contractors, agents, or third parties. Coverage generally varies by organization and jurisdiction and should be stated explicitly.

Conflict of Interest Provisions

Guidance on identifying, disclosing, and managing situations where personal interests may conflict with the organization's interests, including expectations around gifts, entertainment, and outside relationships.

Compliance with Law and Regulation

A general commitment to comply with applicable laws, regulations, and, where relevant, listing rules. The specific binding requirements referenced typically depend on the entity's jurisdiction, sector, and structure.

Reporting and Escalation Mechanisms

Descriptions of channels for raising concerns, such as whistleblowing or speak-up lines, along with non-retaliation commitments. Ownership of these channels generally sits with the compliance function or a designated body, not the board itself.

Consequences and Enforcement

A statement that violations may result in disciplinary or other consequences, clarifying that enforcement is an operational responsibility of management and human resources, subject to applicable law and internal policy.

Governance and Ownership

Clarification of accountability, typically with the board or a committee providing oversight of the code and its tone from the top, while management owns day-to-day implementation and monitoring.

Common questions

Answers to the questions practitioners most commonly ask about Code of Conduct.

Is a code of conduct the same thing as a code of ethics?

The two terms are often used interchangeably, but many organizations distinguish them. A code of ethics is typically framed at a higher level, articulating the values and ethical principles that guide the organization, while a code of conduct is generally more operational, translating those values into specific expectations for behavior and describing prohibited or required conduct. Some organizations combine them into a single document; others maintain both. There is no universal definition, and the distinction depends on how a given entity structures its documents. This is a matter of drafting convention rather than a legal requirement, and practices vary by jurisdiction, sector, and entity type.

Does simply having a code of conduct make an organization compliant or protect it from liability?

Generally, no. A code of conduct is a foundational element of many compliance programs, but its existence alone does not establish compliance or, by itself, insulate an organization from liability. In many jurisdictions and under various regulatory expectations, the relevant question is whether a compliance program is effective in practice, which typically depends on communication, training, monitoring, enforcement, and periodic review, not on the document alone. A code that is not embedded in day-to-day operations is sometimes described as a 'paper program.' How a code affects liability or regulatory treatment depends on facts, jurisdiction, and applicable law, and this entry is educational rather than legal advice.

Who is typically responsible for owning and maintaining the code of conduct?

Accountability generally sits with management, often the compliance function or general counsel, for drafting, maintaining, and operationalizing the code. The board or a relevant board committee typically exercises oversight, reviewing and, in many organizations, approving the code and monitoring the effectiveness of the program that supports it, rather than performing operational maintenance. The precise allocation of ownership and oversight varies by organizational structure, size, sector, and governance framework, so entities should confirm roles against their own charters and delegations.

How often should a code of conduct be reviewed and updated?

There is no single mandated frequency across jurisdictions. Many organizations review their code on a periodic basis, commonly on a defined cycle, and additionally when triggered by events such as changes in law or regulation, business or geographic expansion, significant incidents, or findings from monitoring and audit. The appropriate cadence depends on the organization's risk profile, sector, and applicable requirements. Documenting the review process and the rationale for changes is generally regarded as good practice, but specific expectations vary and should be checked against relevant rules and frameworks.

How can an organization tell whether its code of conduct is actually working?

Assessing effectiveness typically goes beyond confirming the code exists. Organizations commonly look at indicators such as employee awareness and understanding (often tested through training completion and comprehension), the volume and nature of reports through speak-up channels, consistency of enforcement, and results of monitoring, audits, and periodic reviews. It is useful to distinguish between whether controls and processes are well designed and whether they operate effectively in practice, these are separate questions. The choice of metrics and assurance approach depends on the organization's context and the judgment of its compliance, risk, and assurance functions.

How should a code of conduct relate to other policies and to third parties?

A code of conduct is generally a high-level document that sits above more detailed policies and procedures, which provide specific guidance in areas such as conflicts of interest, gifts and hospitality, anti-bribery, or data handling. Many organizations design the code to cross-reference these underlying policies rather than duplicate them. Regarding third parties, some organizations extend expectations to suppliers, agents, or business partners through a separate supplier or third-party code, or by contractual reference. Whether and how far to extend the code depends on the organization's risk exposure, applicable requirements, and its own judgment.

Common misconceptions

A code of conduct is a legally binding document that carries the force of law.

A code of conduct is generally an internal, principles-based governance instrument adopted voluntarily or in response to expectations under certain frameworks or listing rules. While it may reference binding legal obligations, the code itself is typically an organizational standard rather than a statute or regulation, and its status varies by jurisdiction and entity type.

Having a code of conduct means the organization has an effective compliance program.

A code documents expected behavior but is only one element. Its existence speaks to control design, not operating effectiveness. Whether the code actually shapes conduct depends on training, monitoring, enforcement, and culture, which are distinct activities generally owned by management and assurance functions.

The board is responsible for drafting and enforcing the code of conduct.

The board or a committee typically provides oversight and sets the tone from the top, but drafting, implementation, monitoring, and enforcement are generally operational responsibilities of management, compliance, and human resources. Attributing these operational duties to the board conflates oversight with execution.

Best practices

Clearly define the scope and applicability of the code, stating explicitly whether it covers directors, employees, contractors, and third parties, since coverage varies by organization.

Distinguish within the document between binding legal obligations and the organization's own voluntary standards of expected behavior, avoiding language that overstates legal reach.

Establish clear ownership by assigning oversight to the board or a designated committee while placing implementation, monitoring, and enforcement responsibilities with management and relevant functions.

Support the code with accessible reporting and escalation channels and a clearly stated non-retaliation commitment, and identify the function responsible for administering them.

Reinforce the code through periodic training, attestation, and communication so that it influences conduct in practice rather than existing only as a documented control.

Review and update the code periodically to reflect changes in the organization's risk profile, applicable requirements, and jurisdictional context, recognizing that appropriate content depends on the entity's specific facts and circumstances.