Category: Ethics and Conduct

Code of Ethics

Also known as: Ethics Code, Code of Ethical Conduct

Simply put

A code of ethics is a set of guiding principles that helps people conduct their professional activities with honesty and integrity. It typically sets out the values and standards of conduct expected of members of an organization or profession, supporting sound decision-making and building trust. Many professional bodies publish such codes to guide the conduct of their members.

Formal definition

A code of ethics is a formally articulated set of principles and standards of conduct that guide the professional behavior, integrity, and decision-making of individuals within an organization or profession. In practice, codes are generally principles-based instruments that express core values and expected conduct rather than exhaustive rules, and their binding force varies by context: a professional body's code (for example, those issued by associations for nurses, social workers, or computing professionals) may serve as an authoritative standard for its members, while an organization's internal code typically functions as a governance and compliance tool that articulates expected behavior and supports a broader ethics and compliance program. Ownership, enforcement mechanisms, and legal weight depend on the issuing body, sector, and jurisdiction, and a code of ethics is generally distinct from binding statutory or regulatory requirements. This entry is educational and not legal, audit, or compliance advice.

Why it matters

A code of ethics matters because it translates an organization's or profession's stated values into observable expectations for conduct, giving individuals a reference point for making sound decisions under pressure. By articulating principles such as honesty and integrity, a code can support consistent behavior, help build trust with clients, colleagues, and the public, and provide a shared standard against which conduct can be assessed. For professional bodies, a code often serves as an authoritative standard of practice for members; for organizations, it typically functions as a governance and compliance tool that anchors a broader ethics and compliance program.

The practical significance of a code depends heavily on who issues it and how it is used. A professional association's code, such as the NASW Code of Ethics for social workers, the American Nurses Association's Code of Ethics for Nurses, or the ACM's code for computing professionals, is generally designed to guide the professional conduct and decision-making of its members within that discipline. An internal organizational code, by contrast, generally articulates expected behavior and supports compliance efforts rather than standing as an external professional standard. Because ownership, enforcement mechanisms, and legal weight vary by issuing body, sector, and jurisdiction, the effect of a code in any given situation depends on its context.

It is important to recognize that a code of ethics is generally principles-based, expressing core values and expected conduct rather than an exhaustive set of rules, and it is typically distinct from binding statutory or regulatory requirements. A code's usefulness therefore rests less on the document itself than on how well it is embedded in decision-making, supported by governance structures, and reinforced over time.

Who it's relevant to

Chief Compliance and Ethics Officers

Compliance and ethics leaders generally own the organization's internal code as part of a broader ethics and compliance program, using it to articulate expected conduct and support consistent decision-making. Its practical effect depends on how well it is embedded in day-to-day activity and reinforced over time, rather than on the document alone.

Professionals Bound by an Association Code

Members of professions such as nursing, social work, and computing may be subject to a professional body's code, for example, the ANA Code of Ethics for Nurses, the NASW Code of Ethics, or the ACM code, which can serve as an authoritative standard of conduct within that discipline. Whether and how such a code binds an individual depends on the issuing body and the member's relationship to it.

Boards and Governance Professionals

Boards and governance functions generally have an interest in whether an organization has articulated its values and expected conduct and how those expectations are reinforced. A code can be a reference point for oversight of organizational culture, though the board's role is typically oversight rather than day-to-day administration, which usually sits with management.

General Counsel and Legal Advisers

Legal advisers may need to distinguish a code of ethics, generally a principles-based, non-binding statement of expected conduct, from the binding statutory and regulatory requirements that apply separately. A code's enforceability and legal weight depend on the issuing body, sector, and jurisdiction, and specific questions turn on the facts and applicable law.

Inside Code of Ethics

Statement of Values and Principles

A high-level articulation of the organization's core values, such as integrity, honesty, fairness, and respect, that sets the ethical tone and provides the interpretive foundation for more specific provisions. This component is typically principles-based rather than rules-based.

Standards of Conduct

More concrete expectations addressing recurring ethical issues, which commonly include conflicts of interest, gifts and hospitality, confidentiality, use of company assets, anti-bribery and corruption, fair dealing, and non-discrimination. The specific topics covered generally vary by sector, jurisdiction, and entity type.

Scope and Applicability

A statement identifying who is bound by the code, which may extend to directors, officers, employees, and in some cases third parties such as agents or suppliers. Whether a code is a voluntary internal standard or reflects an underlying legal requirement depends on the applicable law and listing rules.

Reporting and Escalation Mechanisms

Provisions describing how individuals may raise concerns or report suspected violations, often including whistleblower or speak-up channels and, in many jurisdictions, protections against retaliation. In some regimes certain reporting arrangements are legally required rather than voluntary.

Accountability and Enforcement Provisions

Language addressing the consequences of violations and the process for investigation and discipline. Management typically owns the operation of enforcement and monitoring, while the board or a designated committee generally retains oversight of the ethics program.

Governance and Oversight References

Cross-references clarifying which body approves and maintains the code and how it connects to the broader compliance program. Oversight of ethics and culture is commonly assigned to the board or a committee, distinct from management's operational responsibility for implementation.

Common questions

Answers to the questions practitioners most commonly ask about Code of Ethics.

Is a code of ethics the same thing as a code of conduct?

Although the terms are often used interchangeably, many organizations treat them as distinct. A code of ethics typically articulates the values and principles that guide expected behavior at a high level, while a code of conduct generally translates those principles into more specific rules, prohibitions, and required practices. Some entities combine both into a single document. The distinction is a matter of drafting convention rather than legal definition, and practice varies by organization, sector, and jurisdiction.

Does adopting a code of ethics by itself ensure ethical behavior or satisfy legal obligations?

No. A code is a written statement of expectations, not a control in itself. Its effectiveness generally depends on communication, training, leadership tone, monitoring, reporting channels, and consistent enforcement. In certain jurisdictions and for certain entity types, specific disclosure or adoption requirements may apply, for example, some listing rules and statutory regimes address codes for particular officers, but the existence of a code does not, on its own, demonstrate an effective ethics or compliance program. This entry is educational and not legal or compliance advice.

Who typically owns and approves the code of ethics within an organization?

Approval and oversight of the code generally sit with the board or a designated board committee, reflecting the board's oversight role, while management is typically responsible for drafting, implementing, communicating, and enforcing it day to day. The compliance function often coordinates administration and monitoring. Precise allocation depends on the entity's governance structure, applicable framework, and any relevant listing or statutory requirements.

How often should a code of ethics be reviewed and updated?

There is no single mandated interval under most frameworks. Organizations commonly review the code periodically and also in response to triggers such as changes in law or regulation, significant business or structural changes, emerging risks, or lessons from incidents and investigations. The appropriate cadence depends on the entity's risk profile, sector, jurisdiction, and any applicable requirements, and is ultimately a matter of professional judgment.

How can an organization assess whether its code of ethics is operating effectively?

Assessment generally distinguishes design from operating effectiveness. Design considerations include whether the code addresses relevant risks and is clearly communicated; operating effectiveness considers whether people understand it, whether training and attestations occur, whether reporting channels are used, and whether breaches are handled consistently. Assurance over these activities is typically provided by functions such as internal audit, separate from the management that operates the program. Specific methods depend on the organization's assurance model and resources.

What supporting elements are commonly needed to implement a code of ethics?

Implementation typically involves more than publishing the document. Common supporting elements include leadership messaging and tone from the top, training and periodic acknowledgment, accessible reporting or whistleblowing channels, procedures for investigating and remediating concerns, and mechanisms for consistent enforcement and disciplinary action. The specific combination varies by organization, applicable framework, and jurisdiction, and no single set of elements is universally required.

Common misconceptions

A code of ethics is a legally binding regulation that applies uniformly to all organizations.

A code of ethics is typically an internal, principles-based standard adopted voluntarily or in response to listing rules or sector expectations. While certain jurisdictions or listing regimes may require an entity to have a code or to disclose whether it has one, the content and enforceability generally vary by jurisdiction, sector, and entity type, and the code itself is not a statute.

Having a code of ethics is the same as having an effective ethics and compliance program.

A written code represents control design, not operating effectiveness. Whether the code functions as intended depends on communication, training, monitoring, reporting mechanisms, and enforcement over time. A document alone does not demonstrate that ethical standards are actually embedded or observed.

The board is responsible for administering and enforcing the code day to day.

Management generally owns the operational responsibilities of implementing, monitoring, and enforcing the code, while the board or a designated committee typically retains oversight of the ethics program and culture. Attributing the operational duties to the board conflates oversight with management responsibilities.

Best practices

Clarify explicitly which body approves the code and which functions are accountable for its implementation, monitoring, and enforcement, keeping board or committee oversight distinct from management's operational responsibilities.

Define the scope and applicability clearly, stating who is bound and whether any provisions reflect underlying legal requirements versus voluntary internal standards, given that obligations vary by jurisdiction, sector, and entity type.

Pair high-level values with concrete standards of conduct addressing recurring issues such as conflicts of interest, gifts, and confidentiality, so the code guides behavior rather than remaining purely aspirational.

Establish accessible reporting and escalation channels and, where applicable, retaliation protections, confirming these arrangements meet any legally required elements in the relevant jurisdictions.

Support the code with communication, training, and periodic monitoring so that its operating effectiveness can be assessed over time, rather than relying on the existence of the document as evidence of an effective program.

Review and update the code periodically to reflect changes in applicable law, listing rules, and the organization's risk profile, and seek qualified legal or compliance input on jurisdiction-specific requirements.